New WLC Deployment, which Authentication to use

Question

Hi,
I am in the planning stages of deploying a wireless solution to my company. We have 2 WLC 4402 at our disposal plus 20 LWAPP AP's.
The requirements are to enable normal corp access for corporate employees using Windows XP and MAC's via 1 WLAN, and to enable guest access to 3rd party users using Mac;s, WinXP and Win2k using another WLAN.
We do not currently have a cetificate server.
We have an IAS Win2k Radius server
I want to avoid having to install any client software on the client pc's if possible.
So, which authentication method can I use that is the easiest to deploy, is secure, and is "fairly" future proof, i.e. I won't have to change all this in a years time.
Thanks
Lee

Answer 1

I recommend 802.1x and EAP-PEAP authentication.
There are many forms of EAP, but the two forms of EAP that are most appropriate for the majority of customers are PEAP (Protected EAP) and TTLS (Tunneled Transport Layer Security). Both forms of authentication do a good job of protecting passwords because the MSCHAPv2 password challenge session is protected inside an encrypted tunnel.
PEAP or TTLS is better than Cisco's LEAP mechanism which transmits the MSCHAPv2 session in the clear lending itself to offline password dictionary cracking.
PEAP generally refers to PEAP-EAP-MSCHAPv2 mode, which only requires a Server Side Digital Certificate and a Client Side Username/Password.
PEAP is supported in Microsoft IAS Radius.
TTLS is actually a little better in security than PEAP-EAP-MSCHAPv2 because it does not divulge the username in clear text, however it is not supported by Windows IAS or Cisco ACS, and Windows OS does not have a built in TTLS client built in.
In order to run EAP-PEAP (or TTLS mode), the RADIUS server MUST HAVE a server side x.509 digital certificate. This certificate should be purchased from a 3rd party Certificate Authority, don't use a Self-Signed Certificate on their RADIUS server. Self Signed Digital Certificates violate all best practice concepts for PKI, it might be ok for a LAB or Demo, but not a production environment.