WPA authentication help

Question

Hi,
I am looking at impementing a small wireless network, but knowing the way things seems to work, it will most likely grow a lot in the near future.  The penny pinchers say that they want to go with a shared key scheme since they don't want to buy a radius server.  I think that this is not a great idea so I was hoping that I could get some help with my problem.
We will be using a 5508 WLC.  I believe that they can use local authentication (peap?).  If so, can wireless clients change their passwords?  Would they be able to do this on their wireless connection?  Also can an account be created on the 5508 that would allow a helpdesk employee to reset passwords?
If we do go out and buy a radius server (ACS most likely), I would like the ability for clients to change their passwords and to require them to be changed on a frequent basis.  Is this possible?  Can it be done though the wireless connection?
Thanks in advance for your help.

Answer 1

Hi,
The WLC can do peap authentication yes. However you don't have fancy password management features, so nothing the users can change.
There is the concept of "guest" accounts that "Lobbyambassadors" can create, so yes helpdesk people can manage WLC accounts.
However, the best is to have Active Directory managing your passwords. They are then using their windows domain credentials for the wireless.
With ACS, ACS can handle the authentication and using Active Directory as account databases. Then it allows end-users to change their passwords themselves when they expire.
Nicolas