802.1x, eDirectory, and RADIUS

Question

Hello all:
I hope that I am posting on the correct forum.
We currently have a Cisco ACS 3.3 which we have configured to use
eDirectory as an external LDAP directory. We are currently able to set
up access to our routers and switches via TACACs and successfully
authenticate via user names and passwords stored in eDirectory, so we
know that the LDAP access is working. eDirectory version is 8.7.3.4. OS
is Netware 6.5 sp 3.
We are now embarking on setting up wireless authentication utilizing
the AEGIS client from Meetinghouse as our supplicant. We have been
successful in authenticating to our test wireless AP (Cisco 1200) with
a user setup in an access group on the ACS using the ACS as a RADIUS
server. We are authenticating via LEAP. However, we have not been able
to authenticate using eDirectory usernames and passwords. Upon
reviewing various posts I have seen info about adding RADIUS attributes
to eDirectory to use the FreeRADIUS server. Is this necessary with the
ACS device? Do we need to change our protocol to EAP-TTLS as is
suggested in other posts or do we need to set up simple passwords? What
security considerations do we want to take into account?
If anyone has successfully implemented this configuration, please feel
free to contact me directly. We want to leverage eDirectory and our
client's experience with this platform to make wireless security as
seemless and secure as possible. This is a school district and we want
to be able to limit our user access via login names that they enter on
any machine in the district rather than via machine certificates. That
way if we want to deny a student access for disciplinary reasons, we
can implement it very easily.
I would greatly appreciate any assistance that can be provided!!!!!!
Donna Moyer

Answer 1

Heiti
I sent you an email regarding our situation. Have you received it yet
and if so have you had a chance to respond to the wireless
authentication questions.
Thanks
heiti@boras_nospam_.se wrote:
> Nope....the easiest way to do it, is to use eDirectory for authentication
> only and let the acs server do the other stuff.
>
> I quess that the only time when you need to to so is when you are
> connecting to netware RADIUS via PAP over EAP-TTLS tunnel.
> You can do that with freeRadius but not with ciso ACS.
> And the only clients supporting that are Intel Proset, Aegis and Odyssey
> but not the Ciscos or Microsofts supplicators.
>
>
> Whitch metod to use depends on what environment you have;
> In a school environment(or a environment where computers are shared among
> many users) and Novell Client installed, you should use PEAP (PEAPv1;GTC)
> instead of EAP-FAST and use the pre-logon stuff on the supplicator.
> And use a static user in the profile configuration(and you event dont need
> to have the user credentials in edirectory), istead of prompting the
> password and username all the time.
> (Because you are needing the IP-address before the novell Client tries to
> logon.)
> That should give, in a user point of view, a Single Sing On functionality.
>
> In a opposite environment where there is a single profile(user) on each
> computer you can use EAP-FAST(with manual PAC provisioning) or PEAP with
> eDirectory (or LDAP) as the autehticator database, and prompt for Username
> and password eatch time.
>
>
> The ultimate method would be a Novell Client supporing EAP and a Novell
> RADIUS server supporting EAP-FAST/EAP-TTLS or PEAP.
> That should ease upp everyting a bit and give a clean environment and
> Single Sing On functionality =)
>
>
> PS. PEAP gives the advantage against EAP-TLS that PEAP doesnt need a
> client certificate only a server certificate.
>
>
> Method Database Certificate
> -------------------------------------------------
> EAP-FAST LDAP/NDS/Etc. No, only PAC
> PEAPv0(MSChap) AD Server
> PEAPv1(Gtc) LDAP/NDS/Etc. Server
> EAP-TLS LDAP/NDS/Etc. Client, Server
> EAP-TTLS NW RADIUS(PAP) No
> LEAP AD No
>
>
> feel free to ask more!
>
> best regards,
> Heiti Ernits
> Network Technician
> Adk-Data
> Bors Stad