The PEAP authentication process is as follows:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client verifies the RADIUS server’s certificate.
4. The RADIUS server authenticates the client using MS-CHAP or other means,
such as an OTP.
5. The RADIUS server and the client agree on the WEP key.
6. A secure tunnel is established between the client and the server.
An organization can use Windows logins and passwords if it has not issued certificates
to every station. RADIUS servers that support EAP-TTLS and PEAP can check LAN
access requests with Windows domain controllers, Active Directories, and other
existing user databases.
PEAP Version 0 and Version 1
There are two versions of PEAP:
• PEAP Version 0 (also known as Microsoft PEAP)
• PEAP Version 1 (also known as Cisco PEAP)
Each version supports a different method of client authentication through its TLS
tunnel. Version 0 authenticates clients using MS-CHAP Version 2. This limits user
databases to those supporting MS-CHAP Version 2, such as Active Directory.
1 2
3
4
5
6
Client
Access Point Switch
RADIUS Server
IEEE 802.1X Authentication 75
Version 1 (Cisco PEAP) authenticates clients using OTPs and logon passwords, which
allow OTP support from vendors and logon password databases in addition to
Microsoft databases.
In addition, Version 1 enables users to hide name identities until the TLS tunnel is
created. This ensures that usernames are not broadcast during the authentication phase.
IT Certification CCIE,CCNP,CCIP,CCNA,CCSP,Cisco Network Optimization and Security Tips
Cisco Wireless EAP
Cisco Wireless EAP
The Cisco proprietary take on EAP is known as Cisco Wireless EAP.
NOTE: Cisco Wireless EAP is also known as Lightweight EAP (LEAP). However, some users
interpreted “lightweight” with a negative connotation, so Cisco opted to call it Cisco
Wireless EAP instead.
Cisco Wireless EAP provides username and password-based authentication between a
wireless client and AP, via an authentication server.
Cisco Wireless EAP server and client derive a session key, so that future frames can be
encrypted with a key different than keys used by other sessions, thus providing stronger
security. In addition, new keys are generated each time the client roams to a new AP.
Dynamic keys, a feature in all EAP implementations, address an enormous
vulnerability inherent with static encryption keys. Static keys are shared among all
stations on the WLAN. If an attacker can crack the static shared key, he can eavesdrop
on all WLAN traffic. Dynamic session keys make it more difficult for the attacker
because there is less traffic to analyze, and consequently, it reduces the potential for
finding a flaw. In addition, if the attacker is able to crack the key, the session might
already be over.
When using Cisco Wireless EAP, dynamic per-user, per-session WEP keys are
generated each time the user authenticates to the WLAN. You can strengthen security
even further by requiring WEP key timeouts, which forces re-authentication
This
generates a new WEP key, even for existing sessions. Figure 4-3 shows the Cisco
Wireless EAP process.
The Cisco Wireless EAP authentication process is as follows:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client provides login credentials to the RADIUS server.
4. The RADIUS server and the client authenticate each other.
5. The RADIUS server and the client derive a session key.
6. Secure communications are established between the client and the server.
The Cisco proprietary take on EAP is known as Cisco Wireless EAP.
NOTE: Cisco Wireless EAP is also known as Lightweight EAP (LEAP). However, some users
interpreted “lightweight” with a negative connotation, so Cisco opted to call it Cisco
Wireless EAP instead.
Cisco Wireless EAP provides username and password-based authentication between a
wireless client and AP, via an authentication server.
Cisco Wireless EAP server and client derive a session key, so that future frames can be
encrypted with a key different than keys used by other sessions, thus providing stronger
security. In addition, new keys are generated each time the client roams to a new AP.
Dynamic keys, a feature in all EAP implementations, address an enormous
vulnerability inherent with static encryption keys. Static keys are shared among all
stations on the WLAN. If an attacker can crack the static shared key, he can eavesdrop
on all WLAN traffic. Dynamic session keys make it more difficult for the attacker
because there is less traffic to analyze, and consequently, it reduces the potential for
finding a flaw. In addition, if the attacker is able to crack the key, the session might
already be over.
When using Cisco Wireless EAP, dynamic per-user, per-session WEP keys are
generated each time the user authenticates to the WLAN. You can strengthen security
even further by requiring WEP key timeouts, which forces re-authentication
This
generates a new WEP key, even for existing sessions. Figure 4-3 shows the Cisco
Wireless EAP process.
The Cisco Wireless EAP authentication process is as follows:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client provides login credentials to the RADIUS server.
4. The RADIUS server and the client authenticate each other.
5. The RADIUS server and the client derive a session key.
6. Secure communications are established between the client and the server.
EAP-TLS
EAP-TLS
EAP with Transport Layer Security (EAP-TLS) requires that both the station and
RADIUS server authenticate themselves using public key cryptography, such as smart
cards or digital certificates.
This conversation is secured with an encrypted TLS tunnel. That is, only the
authentication is encrypted. After that is complete, then WEP, WPA, or WPA2 provide
user data encryption. Although this makes EAP-TLS resistant to decryption dictionary
and man-in-the-middle (MitM) attacks, the station’s identity (and the name bound to
the certificate) can still be culled by attackers.
Because EAP-TLS is standard on Microsoft Windows XP, Windows 2000, and
Windows Server 2003, it is popular in Windows-based environments. Figure 4-2 shows
EAP-TLS in action.
The EAP-TLS authentication process is as follows:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client authenticates the server with a certificate.
4. The RADIUS server authenticates the client with a certificate.
5. The RADIUS server and the client agree on a WEP key.
6. A secure tunnel is established between the client and the server.
Client 1 2
3
4
5
6
Access Point Switch
RADIUS Server
72 IEEE 802.1X Authentication
The downside to this method is that issuing digital certificates to each station is time
consuming, and most organizations prefer to use usernames and passwords for
wireless authentication. Protected EAP (PEAP), which is discussed later in this
chapter, is a good substitute for EAP-TLS.
EAP with Transport Layer Security (EAP-TLS) requires that both the station and
RADIUS server authenticate themselves using public key cryptography, such as smart
cards or digital certificates.
This conversation is secured with an encrypted TLS tunnel. That is, only the
authentication is encrypted. After that is complete, then WEP, WPA, or WPA2 provide
user data encryption. Although this makes EAP-TLS resistant to decryption dictionary
and man-in-the-middle (MitM) attacks, the station’s identity (and the name bound to
the certificate) can still be culled by attackers.
Because EAP-TLS is standard on Microsoft Windows XP, Windows 2000, and
Windows Server 2003, it is popular in Windows-based environments. Figure 4-2 shows
EAP-TLS in action.
The EAP-TLS authentication process is as follows:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client authenticates the server with a certificate.
4. The RADIUS server authenticates the client with a certificate.
5. The RADIUS server and the client agree on a WEP key.
6. A secure tunnel is established between the client and the server.
Client 1 2
3
4
5
6
Access Point Switch
RADIUS Server
72 IEEE 802.1X Authentication
The downside to this method is that issuing digital certificates to each station is time
consuming, and most organizations prefer to use usernames and passwords for
wireless authentication. Protected EAP (PEAP), which is discussed later in this
chapter, is a good substitute for EAP-TLS.
Extensible Authentication Protocol
Extensible Authentication Protocol
The EAP is a framework that supports multiple methods of authentication. In essence,
EAP manages the authentication, but the variant of EAP used dictates how clients are
authenticated. Some authentication methods include:
• Token cards
• Kerberos
• Public key authentication
• Certificates
• Smart cards
• One-time passwords (OTP)
Several variations on EAP are possible. Depending on your organization’s need, it
allows different types of authentication.
As Figure 4-1 shows, EAP authentication is a multistep process:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client provides login information.
4. A Remote Authentication Dial-In User Service (RADIUS) server and client
authenticate each other.
5. A RADIUS server and client agree on a WEP key.
6. Authentication is completed.
This is the basic framework of how EAP works. However, individual authentication
methods can make the process slightly different.
The EAP is a framework that supports multiple methods of authentication. In essence,
EAP manages the authentication, but the variant of EAP used dictates how clients are
authenticated. Some authentication methods include:
• Token cards
• Kerberos
• Public key authentication
• Certificates
• Smart cards
• One-time passwords (OTP)
Several variations on EAP are possible. Depending on your organization’s need, it
allows different types of authentication.
As Figure 4-1 shows, EAP authentication is a multistep process:
1. The client associates with the AP.
2. The AP blocks the client from accessing the network.
3. The client provides login information.
4. A Remote Authentication Dial-In User Service (RADIUS) server and client
authenticate each other.
5. A RADIUS server and client agree on a WEP key.
6. Authentication is completed.
This is the basic framework of how EAP works. However, individual authentication
methods can make the process slightly different.
802.1X Protocols
802.1X Protocols
802.1X can be thought of as a control inside your Ethernet switches and APs. The
control starts in the OFF position. It considers 802.1X requests and if it decides to grant
access, the control moves to the ON position. After a period of time, the station times
out or disconnects, moving the control back to the OFF position.
Although the credibility of WEP has taken a beating, it’s not totally out of the WLAN
security game. WEP is a necessary part of an 802.1X deployment. WEP, used in
conjunction with 802.1X, is far more secure than when it is used in static deployments.
An even more robust security mechanism, Wi-Fi Protected Access (WPA), is discussed
later in this chapter.
There are several protocols used with the 802.1X standard for LAN Port Access
Control. Within the 802.1X framework, a LAN station is not allowed to pass traffic
through an Ethernet device or WLAN AP until it has successfully authenticated itself.
After it has been authenticated, the client can pass traffic on the LAN.
There are 43 protocols that work within the framework of 802.1X authentication. Some
of the popular protocols you are likely to see in Cisco wireless networking include a
variety of Extensible Authentication Protocol (EAP) authentication frameworks. These
are covered in the sections that follow.
802.1X can be thought of as a control inside your Ethernet switches and APs. The
control starts in the OFF position. It considers 802.1X requests and if it decides to grant
access, the control moves to the ON position. After a period of time, the station times
out or disconnects, moving the control back to the OFF position.
Although the credibility of WEP has taken a beating, it’s not totally out of the WLAN
security game. WEP is a necessary part of an 802.1X deployment. WEP, used in
conjunction with 802.1X, is far more secure than when it is used in static deployments.
An even more robust security mechanism, Wi-Fi Protected Access (WPA), is discussed
later in this chapter.
There are several protocols used with the 802.1X standard for LAN Port Access
Control. Within the 802.1X framework, a LAN station is not allowed to pass traffic
through an Ethernet device or WLAN AP until it has successfully authenticated itself.
After it has been authenticated, the client can pass traffic on the LAN.
There are 43 protocols that work within the framework of 802.1X authentication. Some
of the popular protocols you are likely to see in Cisco wireless networking include a
variety of Extensible Authentication Protocol (EAP) authentication frameworks. These
are covered in the sections that follow.
Subscribe to:
Posts (Atom)