PEAP weakness ???

[g.rodegari]

Hello,

I'm using PEAP to authenticate my Microsoft WiFi clients.

If I well understood, with PEAP I've a TLS session between my clients and CiscoSecure, for secure, private, user authentication.

After the successful authentication, however, the communication between AcessPoint and WiFi Clients

use WEP protocol for confidentiality... then, if someone sniff this, could intercept and decrypt the communication....

I mean: with PEAP the authentication is mostly secure and verified but someone could anyway intercept my post-authentication data... the embedded insecurity of WEP still remains.

Is it correct?

The workaround could be use WPA intested of WEP?

But... I think that with Windows XP, WPA is not still supported... I'm right?

Thank you,

G.

[raphaelrobertson]

WPA is supported in XP, SP2 has it included, SP1 needs a rollup package installed.

WEP is used with PEAP, TKIP is used with WPA.

[g.rodegari]

Thank you,

I' just trying PEAP with TKIP, I think that PEAP also works well with WPA.

My AP configuration is this:

interface Dot11Radio0

no ip address

no ip route-cache

!

encryption vlan 1 mode ciphers tkip

!

ssid spalmen

vlan 1

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa

guest-mode

!

On XP Client side:

- encryption: WPA with TKIP

- authentication: PEAP with Certificate

Thanks,

G.