What EAP supported on XP?

[c.ong]

Hi,

I am designing a wireless LAN for customer. It is an end to end Cisco solutions. With CSACS acts as the authentication server. They have a mixture of wireless client such as Cisco and others. For Cisco client, they will be using LEAP / EAP- Fast protocol. The OS on other type of clients is XP. What EAP protocl is suitable for the client with XP? By default, XP uses EAP-MD5, am I right? Can CSACS supports EAP-MD5?

If they are looking at PEAP, what additional equipment or requirements I should propose?

Thanks.

Delon

[verdann]

XP does have support for EAP-MD5, but I'd highly recommend not using it, its worthless as a stand-alone wireless authentication protocol, and won't allow you to use rekeying.

If you want to use PEAP, XP already has full PEAP-MSCHAP support, you won't need any further 3rd party client software. ACS can authenticate back to an AD user database as well if you wish. Any additional equipment requirements would depend on against what user database you want to authenticate your clients, either an LDAP/radius specific user accounts db or an existing active directory user account structure.

If your XP clients are using cisco (or CCX compatible cards) then just use cisco's ACU on XP to do EAP-FAST as you would your other cisco clients. If you don't have control over the client's wireless cards then you will have to consider PEAP and other methods, I don't think any 3rd party vendors (such as Funk or Meetinghouse) do EAP-FAST just yet.

[c.ong]

Hi,

With reference to your recommendation,

do I need to get a digital certificate or a CA server for PEAP to run?

I have no experience on XP. Is it tedious to setup PEAP-MSCHAP?

Thanks.

Regards,

Delon

[ingservis]

I agree with verdann...

...as far as I remember on XP you have an option of using EAP-SIM, EAP-TLS with or without MSCHAPv2....

...you can use EAP-MD5 but is not good and you have to implement different supplicant, but it works I have tested it, not with ACS with some other Radius against MySQL user database.

...We have had similar projects with variety of clients with hardware from other vendors, EAP-MSCHAPv2 has turned out as a good solution.

Hope this helps