Cisco EAP FAST - without PACs

[ainmainmcisco]

My group is implementing EAP FAST without PACs.  (We are using PKI)

I am trying to document the details of this setup.

I know that EAP-FAST can be used without PAC files, falling back to normal TLS.

What I cannot find is a good discussion of the EAP FAST process (phases) when there are no PACs used.

There are several sites that talk about the EAP FAST phases in detail, but they all seem to be talking about using PACs.

Can anyone direct me, or illuminate me?

Thanks.

Paul

[Saurav Lodh]

When using the controller's local RADIUS server for EAP-FAST authentications, authentication may fail if your client already has a PAC for the controller you are authenticating to.When the client does not have a PAC, EAP-FAST auto provisioning will ask you to accept a PAC from the local RADIUS server, authentication will then pass.