After authentication is successfully completed between the wireless client and NPS, the TLS session is negotiated between the client and NPS. After the IEEE 802.11-based association is successfully established between the client and the access point, the TLS session is negotiated with the AP. An IEEE 802.11-based association provides an open system or shared key authentication before a secure association is created between the client and the access point. The wireless client associates with the AP. The PEAP authentication process consists of two main phases. PEAP does not specify an authentication method, but provides additional security for other Extensible Authentication Protocols (EAPs), such as EAP-MS-CHAP v2, that can operate through the TLS-encrypted channel provided by PEAP. PEAP uses Transport Level Security (TLS) to create an encrypted channel between an authenticated PEAP client, such as a wireless laptop, and a PEAP authenticator, such as Microsoft NPS or any RADIUS server. This document provides a sample configuration for the Protected Extensible Authentication Protocol (PEAP) with Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 2 authentication in a Cisco Unified Wireless network with the Microsoft Network Policy Server (NPS) as the RADIUS server. Refer to the Cisco Technical Tips Conventions for more information on document conventions. If your network is live, ensure that you understand the potential impact of any command. All of the devices used in this document started with a cleared (default) configuration. The information in this document was created from the devices in a specific lab environment. Windows 2008 Enterprise Server with NPS, Certificate Authority (CA), dynamic host control protocol (DHCP), and Domain Name System (DNS) services installed.Cisco Aironet 3602 Access Point (AP) with Lightweight Access Point Protocol (LWAPP).
The information in this document is based on these software and hardware versions: Microsoft Windows 2008 installation and configuration guides can be found on Microsoft Tech Net. The Cisco Technical Assistance Center (TAC) does not support Microsoft Windows server configuration. If you have trouble with the configuration, contact Microsoft for help. The Microsoft Windows server configuration presented in this document has been tested in the lab and found to work as expected.
Note: This document is intended to give the readers an example on the configuration required on a Microsoft server for PEAP-MS-CHAP authentication.
0 kommentar(er)
