Wireless Security

[Zohaib Khan]

Hi All,

I want a solution to scure my wireless Network any suggestion. Enabling WPA2 is not much scure anyone with little effort can break it I need most scure solution to protect Wireless LAN and please mention how much suggested solution is scure.

I am going for 802.1x but dont know how much scure it is

[Sandeep Choudhary]

HI Zohaib,

1. WPA2 with AES is the very secure way to protect WLAN.(Its very hard to brake this).- If u r using Pre shared key

2. You can use AAA method(Supplicant, Authenticator, Auth. server) - If u r using RADIUS server

EAP-TLS : both side u need certificate(Client and server side)

Regards

[Zohaib Khan]

Thanks Sandeep for yor response. I am going for cisco secure ACS can any one guide me about that, its will good choice for security

[Sandeep Choudhary]

Hi ,
I don't know what exactly ur requirements are. But still I will suggest u to check cisco ISE.

ISE is a policy management and control platform for wired/ wireless and VPN. It support guest access, BYOD and secure access.

Please check this and make ur decision accordingly.

Regards
Don't forget to rate helpful post.

Sent from Cisco Technical Support iPhone App

[rizaldiiii]

Hi, as i know, hacker can break EAP-TLS, they can decrypt the certificate then spoof network.

i've ever read hackin9 magazine, in the magazine, they explain how to break the certificate.. i forgot the volume of magazine

i think you can use second option, use the AAA method (radius server) more secure than PSK

[Jeff Van Houten]

How about eap-tls for authentication under wpa2 encryption. Then the only thing to connect to would be a VPN device forcing users to establish a connection using a different out-of-band authentication mechanism (phone factor??). I could go on all day but my fingers are tired.

Sent from Cisco Technical Support iPad App

[Abha Jha]

Hi,

If you have a radius server then its better to go for EAP-TLS or EAP-TTLS but do remember you will be needing certificate authentication for this.

But this is highly secure than any Pre shared KEY authentication.

[George Stefanick]

Eap-TLS is the highest standard of authentication and when used with aes encryption is most secure. It involves the use of a PKI with client and server side certificates.

Eap-TTLS is really no different than Eap-PEAP. The difference between them is that TTLS allows for more internal protocols ..

Sent from Cisco Technical Support iPad App

[Scott Fella · Accepted solution]

Any 802.1x is better than preshared key. Like George explained, if you have a PKI infrastructure, then EAP-TLS is the way to go. All 802.1x requires the use of a radius server and if your a Microsoft shop, then depending on the version of server you bring up, you can use Microsoft IAS or NPS as a radius server. For Cisco, you can use ACS for radius or if you want more features like profiling, you can look into Cisco's ISE. Many of these tie into active directory so if you don't have a PKI infrastructure, you can still use 802.1x with PEAP or even machine authentication if your devices are all joined to your domain.

Depending in what you choose, you should be able to search the web and find many various examples of how to setup the 802.1x you choose.

Sent from Cisco Technical Support iPhone App