Users Guide

288 | 802.1x Authentication Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
In this scenario, the supplicant is configured for EAP-Transport Layer Security (TLS) or EAP-Protected EAP
(PEAP).
 EAP-TLS is used with smart card user authentication. A smart card holds a digital certificate which, with the
user-entered personal identification number (PIN), allows the user to be authenticated on the network. EAP-
TLS relies on digital certificates to verify the identities of both the client and server.
EAP-TLS requires that you import server and certification authority (CA) certificates onto the controller (see
“Configuring and Using Certificates with AAA FastConnect” on page294). The client certificate is verified
on the controller (the client certificate must be signed by a known CA) before the user name is checked on the
authentication server.
 EAP-PEAP uses TLS to create an encrypted tunnel. Within the tunnel, one of the following “inner EAP”
methods is used:
 EAP-Generic Token Card (GTC): Described in RFC 2284, this EAP method permits the transfer of
unencrypted usernames and passwords from client to server. The main uses for EAP-GTC are one-time
token cards such as SecureID and the use of an LDAP or RADIUS server as the user authentication server.
You can also enable caching of user credentials on the controller as a backup to an external authentication
server.
 EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAPv2): Described in
RFC 2759, this EAP method is widely supported by Microsoft clients. A RADIUS server must be used as
the backend authentication server.
If you are using the controller’s internal database for user authentication, you need to add the names and
passwords of the users to be authenticated. If you are using an LDAP server for user authentication, you need to
configure the LDAP server on the controller, and configure user IDs and passwords. If you are using a RADIUS
server for user authentication, you need to configure the RADIUS server on the controller.
Configuring 802.1x Authentication
On the controller, use the following steps to configure a wireless network that uses 802.1x authentication:
1. Configure the VLANs to which the authenticated users will be assigned. See Chapter 2, “Network
Parameters” on page59
2. Configure policies and roles. You can specify a default role for users who are successfully authenticated using
802.1x. You can also configure server derivation rules to assign a user role based on attributes returned by the
authentication server; server-derived user roles take precedence over default roles. For more information
about policies and roles, see Chapter 12, “Roles and Policies” on page321.
3. Configure the authentication server(s) and server group. The server can be an 802.1x RADIUS server or, if you
are using AAA FastConnect, a non-802.1x server or the controller’s internal database. If you are using EAP-
GTC within a PEAP tunnel, you can configure an LDAP or RADIUS server as the authentication server (see
Chapter 9, “Authentication Servers” ) If you are using EAP-TLS, you need to import server and CA
certificates on the controller (see “Configuring and Using Certificates with AAA FastConnect” on page294).
4. Configure the AAA profile.
 Select the 802.1x default user role.
 Select the server group you previously configured for the 802.1x authentication server group.
5. Configure the 802.1x authentication profile. See “Using the WebUI” on page307
NOTE: The Policy Enforcement Firewall Virtual Private Network (PEFV) module provides identity-based security for wired and
wireless users and must be installed on the controller. The stateful firewall allows user classification based on user identity, device
type, location and time of day and provides differentiated access for different classes of users. For information about obtaining and
installing licenses, see Chapter 34, “Software Licenses” on page 651.