PEAP work without a ... ??

[alahmadi_sami]

Hi all,

I have ACS configured to authenticate wireless users using “Cisco PEAP” with server certificate and the data base from Active Directory.

The problem I’m facing is the users can be authenticated without installing the server certificate.

Is it normal?? Or Is there an option in the ACS to reject any authentication request from any user who doesn’t have the certificate installed in his wireless device??

please respond ASAP guys.

thaknks alot

[scottmac]

PEAP only uses a certificate on the ACS side of the connection.

EAP-TLS requires the use of certificates on both Server and Client.

Windows clients, if I'm recalling correctly, have a checkbox in the wireless configuration for whether or not you want the client to verify the server's certificate

Good Luck

Scott

.

[alahmadi_sami]

thanks for your reply scott,

but is there a way to force the windows client to install the certificate, otherwise he can't login?

i wanna do this to ensure the client is talking to the right ACS server and encrypt his data.

[BERNHARD FIEGLMUELLER]

then you have to make it over the AD policy i think, but its the same with the ssl web sites you can trust the ca or you can set the browser to trust everything.

regards bernhard

[gtwhaley]

Hi,

PEAP uses a server side certificate, not client. If client certificates are what you desire you may need to look at EAP-TLS or another method. Hope this helps.

g

[alahmadi_sami]

Thanks guys for your support and help,

I know PEAP is a server side certificate, what i want to know is:

Is it possible to reject any authentication request from any client who doesn’t install the server certificate? If Yes, ... How??

I hope it is clear now guys :)

Waiting for your reply

[alahmadi_sami]

any update guys?

[scottmac]

With PEAP, no. Not without an additional component that would check for a client-side cert and reject the authorization.

PEAP does not use or check client side certificates.

Good Luck

Scott