7920 EAP verification/configuration

[paulcian_2]

I just setup a 7920 phone and Laptop to use Network EAP to a Radius server. From the 7920 documention it states that I should set WEP Encryption to NONE and broadcast key rotation to ENABLE.

As soon as set WEP Encryption to NONE the wireless laptop can no longer associate. The laptop is also set up to use EAP with dynamic WEP keys. The Wireless cars is a Cisco 340 client.

Thanks in advance.

My questions are:

1)How do I verify if the 7920 is using Dynamic keys as implied?

2) Why does the wireless Laptop require the WEP be set to mandatory?

3) Does setting the WEP to Mandatory somehow open the 7920 to security risks?

Documentation Link:

http://www.cisco.com/en/US/partner/products/sw/voicesw/ps556/products_configuration_example09186a00801a90d3.shtml#task3-1

[michaelgillespie]

If using LEAP, then WEP is dynamic. Will get a new set of keys after roam or re-authentication. You could sniff to see the EAP msgs.

Do not need to enter WEP keys into the client as they will be provided dynamically.

EAP requires mandatory WEP and must be configured so in the AP. EAP will not work w/ WEP disabled.

WEP mandatory means you will either use static or dynamic WEP. Dynamic WEP being the most secure.

Also that is a typo in that doc. Will see it gets corrected. Should say click on WEP encryption and set to "mandatory".

Also a good doc to reference is the 7920 Design Guide @ http://www.cisco.com/en/US/products/hw/phones/ps379/products_white_paper0900aecd800f6d97.shtml, which also has an IOS AP sample config.

[paulcian_2]

I do not have WEP keys defined so being that the documentation had a typo it appears everything is working fine.

Two additional questions: If we are setting the phone up with a static username and password can someone pick this up through a sniffer? Second, can the phone be locked so that you cannot even view the network config?

Thanks again in advance you have been a great help

[michaelgillespie · Accepted solution]

Yes only need wep mandatory defined.

Can see the username in the EAP packets, but not password.

Blocking of the network config, will be in a future firmware image (2.0).

[paulcian_2]

Thanks again for your help.