Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide] Stateful and WISPr Authentication | 293
Chapter 11
Stateful and WISPr Authentication
ArubaOS supports stateful 802.1x authentication, stateful NTLM authentication and authentication for Wireless
Internet Service Provider roaming (WISPr). Stateful authentication differs from 802.1x authentication in that
the controller does not manage the authentication process directly, but monitors the authentication messages
between a user and an external authentication server, and then assigns a role to that user based upon the
information in those authentication messages. WISPr authentication allows clients to roam between hotspots
using different ISPs.
This chapter describes the following topics:
z “Stateful Authentication Overview” on page293
z “WISPr Authentication Overview” on page293
z “Important Points to Remember” on page294
z “Stateful 802.1x Authentication” on page294
z “Stateful NTLM Authentication” on page295
z “Configuring WISPr Authentication” on page296
Stateful Authentication Overview
ArubaOS supports two different types of stateful authentication, stateful 802.1x and stateful NTLM.
z Stateful 802.1x authentication: This feature allows the controller to learn the identity and role of a user
connected to a third-party AP, and is useful for authenticating users to networks with APs from multiple
vendors. When an 802.1x-capable access point sends a authentication request to a RADIUS server, the
controller inspects this request and the associated response to learn the authentication state of the user. It
then applies an identity-based user role through the Policy Enforcement Firewall.
z Stateful NTLM authentication: NT LAN Manager (NTLM) is a suite of Microsoft authentication and
session security protocols. You can use stateful NTLM authentication to configure a controller to monitor the
NTLM authentication messages between a client and a Windows authentication server. If the client
successfully authenticates via an NTLM authentication server, the controller can recognize that the client has
been authenticated and assign that client a specified user role.
The default Windows authentication method changed from the older NTLM protocol to the newer Kerberos
protocol, starting with Windows 2000. Therefore, stateful NTLM authentication is most useful for networks
with legacy, pre-Windows 2000 clients. Note also that unlike other types of authentication, all users
authenticated via stateful NTLM authentication must be assigned to the user role specified in the Stateful
NTLM Authentication profile. Dell’s stateful NTLM authentication does not support placing users in various
roles based upon group membership or other role-derivation attributes.
WISPr Authentication Overview
WISPr authentication allows a “smart client” to authenticate on the network when they roam between Wireless
Internet Service Providers, even if the wireless hotspot uses an ISP for which the client may not have an account.
If you are hotstpot operator using WISPr authentication, and a client that has an account with your ISP attempts
to access the Internet at your hotspot, then your ISP’s WISPr AAA server authenticates that client directly, and
allows the client access on the network.