Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-25
Introduction
ProCurve Wireless Edge Services xl Module
With its internal RADIUS server, the Wireless Edge Services xl Module can
also act as the authentication server.
802.1X relies on Extensible Authentication Protocol (EAP), which comes in
several varieties designed by various product developers. Although the
actual process varies according to the specific method, the basic process is
outlined below:
1. A wireless station associates to the WLAN.
2. The Wireless Edge Services xl Module receives the station’s traffic from
the RP. As soon as the association becomes active, the module places the
station in a shutdown status. The module issues an EAP challenge and
refuses all traffic except EAP messages from the station.
3. The station and the authentication server authenticate each other (the
exact process differs, depending on the EAP method they choose).
The Wireless Edge Services xl Module receives the EAP messages from
the wireless station (via the RP) and repackages them as RADIUS mes-
sages for the RADIUS server. Conversely, the module extracts EAP mes-
sages for the wireless station from RADIUS messages from the server.
4. If the user sends the correct credentials (which may take various forms,
including a digital certificate or a username and password), the RADIUS
server sends an authentication acknowledgement.
5. If you have configured the WLAN to use encryption, the authentication
process includes generating a per-session encryption key for WEP or a
pairwise (per-user) master key (PMK) for WPA. The authentication server
passes the key to the Wireless Edge Services xl Module.
Automatically generating secure encryption keys is one of the most vital
components of 802.1X for wireless networks. For more information about
encryption, see “Encryption Options for WLANs” on page 1-31.
6. If your network implements user-based controls—configured, for exam-
ple, through ProCurve IDM—the RADIUS server sends dynamic set-
tings—such as a VLAN assignment, ACLs, and rate limits—for the station.
Remember: if you are using the Wireless Edge Services xl Module’s internal
RADIUS server, the module acts as both the authenticator and the authenti-
cation server.
In short, 802.1X provides robust authentication as well as dynamic key man-
agement, and, if you want, support for dynamic, user-based settings.