Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-27
Introduction
ProCurve Wireless Edge Services xl Module
After users authenticate, the Wireless Edge Services xl Module can control
users’ network access with dynamic ACLs stored in the external RADIUS
server’s database (perhaps configured with software such as ProCurve IDM).
You can also control the VLAN associated with Web-Auth with manual ACLs.
The Wireless Edge Services xl Module grants users that fail to authenticate
the same guest status that it grants unauthenticated users. If you want, you
can add IP addresses to the approved list to provide limited resources to such
users. For example, you could allow unauthenticated guests to access a Web
page with information about your organization and other courtesy services.
Web-Auth is popular for wireless networks with many anonymous users who
may or may not have client software that supports 802.1X. This form of
authentication grants companies a degree of control over users’ access while
presenting users with an intuitive and easily navigable login interface. How-
ever, Web-Auth is not as secure as 802.1X.
You can add either WEP or WPA/WPA2 encryption to a WLAN that uses Web-
Auth. Users must then know the encryption key in order to connect to the
network and even reach the login page.
MAC Authentication. The Wireless Edge Services xl Module can also con-
trol which wireless stations connect to a WLAN according to their MAC, or
hardware-based, addresses. This option is best suited for small networks and
for devices without user interfaces.
The module supports two types of MAC authentication: RADIUS and local.
RADIUS MAC Authentication. If you enable MAC authentication on a
WLAN, the Wireless Edge Services xl Module sends a request, which includes
a station’s MAC address as both the username and password, to a RADIUS
server. (See Figure 1-11.) The RADIUS request can be in the following formats:
■ Password Authentication Protocol (PAP)
■ Challenge Handshake Authentication Protocol (CHAP)
For information about configuring RADIUS MAC authentication, see
Chapter 4: Wireless Local Area Networks (WLANs).