Users Guide

258 | 802.1x Authentication Dell PowerConnect ArubaOS 5.0 | User Guide
Reauthentication Select the Reauthentication checkbox to force the client to do a 802.1x reauthentication after the
expiration of the default timer for reauthentication. (The default value of the timer is 24 hours.) If
the user fails to reauthenticate with valid credentials, the state of the user is cleared. If
derivation rules are used to classify 802.1x-authenticated users, then the reauthentication timer
per role overrides this setting.
This option is disabled by default.
Opportunistic Key Caching By default, the 802.1x authentication profile enables a cached pairwise master key (PMK) derived
via a client and an associated AP and used when the client roams to a new AP. This allows
clients faster roaming without a full 802.1x authentication. Uncheck this option to disable this
feature.
NOTE: Make sure that the wireless client (the 802.1x supplicant) supports this feature. If the
client does not support this feature, the client will attempt to renegotiate the key whenever it
roams to a new AP. As a result, the key cached on the controller can be out of sync with the key
used by the client.
Validate PMKID If opp-key-caching is enabled, this option instructs the controller to check the pairwise master
key (PMK) ID sent by the client. When this option is enabled, the client must send a PMKID in the
associate or reassociate frame to indicate that it supports OKC; otherwise, full 802.1x
authentication takes place. (This feature is optional and is disabled by default, since most clients
that support OKC do not send the PMKID in their association request.)
Use Session Key Select the Use Session Key option to use the RADIUS session key as the unicast WEP key. This
option is disabled by default.
Use Static Key Select the Use Static Key option to use a static key as the unicast/multicast WEP key. This option
is disabled by default.
xSec MTU Set the maximum transmission unit (MTU) for frames using the xSec protocol. The range of
allowed values is 1024-1500 bytes, and 1300 bytes
Termination Select the Termination checkbox to allow 802.1x authentication to terminate on the
controller. This option is disabled by default.
Termination EAP-Type If termination is enabled, click either EAP-PEAP or EAP-TLS to select a Extensible Authentication
Protocol (EAP) method.
Termination Inner EAP-Type If you are using EAP-PEAP as the EAP method, specify one of the following
inner EAP types:
z eap-gtc: Described in RFC 2284, this EAP method permits the transfer of unencrypted
z usernames and passwords from client to server. The main uses for EAP-GTC are one-time
token cards such as SecureID and the use of LDAP or RADIUS as the user authentication
server. You can also enable caching of user credentials on the controller as a backup to an
external authentication server.
z eap-mschapv2: Described in RFC 2759, this EAP method is widely supported by Microsoft
clients.
Token Caching If you select EAP-GTC as the inner EAP method, you can select the Token Caching checkbox to
enable the controller to cache the username and password of each authenticated user. The
controller continues to reauthenticate users with the remote authentication server, however, if
the authentication server is not available, the controller will inspect its cached credentials to
reauthenticate users.
This option is disabled by default.
Token Caching Period If you select EAP-GTC as the inner EAP method, you can specify the timeout period, in hours, for
the cached information. The default value is 24 hours.
CA-Certificate Click the CA-Certificate drop-down list and select a certificate for client authentication. The CA
certificate needs to be loaded in the controller before it will appear on this list.
Server-Certificate Click the Server-Certificate drop-down list and select a server certificate the controller will use
to authenticate itself to the client.
Table 52 802.1x Authentication Profile Basic WebUI Parameters (Continued)
Parameter Description