Solved: Recommend security method for CB21AG clients

N3t W0rK3r · ‎02-23-2005

I am looking for recommendations of the strongest/most secure encryption and authenication method to use to secure clients that are using CB21AG client adapters and ADU software.

EAP-TLS is not an option as we currently do not have PKI in place. EAP-FAST is preferred, but not supported yet with curent client software. What's the next best method?

I have a WLSE and ACS server along with AP1210s at my disposal. Client laptops are predominantly XPsp1.

Thanks, in advance, for your suggestions.

John Rumball

jorumball@hrsrh.on.ca

gdedrick · ‎02-23-2005

WPA with PEAP would be the most secure but LEAP would be the easiest - just use strong passwords. EAP-FAST should be supported in the next release of the ADU, v1.3, I believe. That would be the easiest and most secure for all Cisco clients. Turn off WZC service.

View solution in original post

michaelr · ‎03-14-2005

The problem with LEAP (besides the vulnerability with passwords) is that it requires Cisco's version of TKIP and MIC to be secure. The CB21 doesn't appear to support them. If it doesn't I would strongly recommend against "raw" WEP (which is what you are left with when you turn off Cisco's TKIP and MIC). Use WPA PEAP.

View solution in original post

gdedrick · ‎02-23-2005

WPA with PEAP would be the most secure but LEAP would be the easiest - just use strong passwords. EAP-FAST should be supported in the next release of the ADU, v1.3, I believe. That would be the easiest and most secure for all Cisco clients. Turn off WZC service.

michaelr · ‎03-14-2005

The problem with LEAP (besides the vulnerability with passwords) is that it requires Cisco's version of TKIP and MIC to be secure. The CB21 doesn't appear to support them. If it doesn't I would strongly recommend against "raw" WEP (which is what you are left with when you turn off Cisco's TKIP and MIC). Use WPA PEAP.