Which EAP Type to choose for 802.1x Wireless Policy?

Question

Hi everyone,
i have a question about recommendation for EAP Type in a wireless policy:
Which configuration is more secure/recommendet?
a)
Authentication Type: PEAP
EAP Type: EAP-MSCHAP v2
b)
Authentication Type: EAP
EAP Type: Certificate
We have a working configuration with a) and could Change to b).
Thanks,
Andy

Answer 1

Hi,
Project a uses PEAP cooperate with EAP(EAP-MSCHAP v2) is more security/recommended.
PEAP is a new member of the family of EAP protocols. To enhance both the EAP protocols and network security, PEAP provides:
1. Protection for the EAP method negotiation that occurs between client and server through a TLS channel. This helps prevent an attacker from injecting packets between the client and the network access server (NAS) to cause the negotiation of a less secure
EAP method. The encrypted TLS channel also helps prevent denial of service attacks against the IAS server.
2. Support for the fragmentation and reassembly of messages, allowing the use of EAP types that do not provide this.
3. Wireless clients with the ability to authenticate the IAS or RADIUS server. Because the server also authenticates the client, mutual authentication occurs.
4. Protection against the deployment of an unauthorized wireless access point (WAP) when the EAP client authenticates the certificate provided by the IAS server. In addition, the TLS master secret created by the PEAP authenticator and client is not shared
with the access point. Because of this, the access point cannot decrypt the messages protected by PEAP.
5. PEAP fast reconnect, which reduces the delay in time between an authentication request by a client and the response by the IAS or RADIUS server, and allows wireless clients to move between access points without repeated requests for authentication.
This reduces resource requirements for both client and server.
You can choose between two EAP types for use with PEAP: EAP-MS-CHAPv2 or EAP-TLS. EAP-MS-CHAPv2 uses credentials (user name and password) for user authentication. EAP-TLS uses either certificates installed in the client computer certificate store or a smart
card for user and client computer authentication. Comparatively, the second one is more security because public Key certificates provide a much stronger authentication method than those that use password-based credentials.
Best Regards,           
Eve Wang