Setting Up 802.1x Authentication for a Wireless AP

802.1x is an authentication standard for wired and wireless LANs. The 802.1x standard can be used to authenticate access points to the LAN to which they are connected. 802.1x support provides security for network deployments where access points are placed in public spaces.

To successfully set up 802.1x authentication of a Wireless AP, the AP must be configured for 802.1x authentication before the AP is connected to a 802.1x enabled switch port.

Caution

If the switch port to which the AP is connected is not 802.1x enabled, the 802.1x authentication does not take effect.

802.1x authentication credentials can be updated at any time, whether or not the AP is connected with an active session. If the AP is connected, the new credentials are sent immediately. If the AP is not connected, the new credentials are delivered the next time the AP connects to the controller.

There are two main aspects to the 802.1x feature:

• Credential management — The controller and the AP are responsible for the requesting, creating, deleting, or invalidating the credentials used in the authentication process.
• Authentication — The AP is responsible for the actual execution of the EAP-TLS or PEAP protocol.

802.1x authentication can be configured on a per-AP basis. For example, 802.1x authentication can be applied to specific APs individually or with a multi-edit function.

The 802.1x authentication supports two authentication methods:

• PEAP (Protected Extensible Authentication Protocol)
  • Is the recommended 802.1x authentication method
  • Requires minimal configuration effort and provides equal authentication protection to EAP-TLS
  • Uses user ID and passwords for authentication of access points
• EAP-TLS
  • Requires more configuration effort
  • Requires the use of a third-party Certificate Authentication application
  • Uses certificates for authentication of access points
  • The controller can operate in either proxy mode or pass through mode.
    • Proxy mode — The controller generates the public and private key pair used in the certificate.
    • Pass through mode — The certificate and private key are created by the third-party Certificate Authentication application.
      

      Note

      Although a wireless AP can support using both PEAP and EAP-TLS credentials simultaneously, it is not recommended to do so. Instead, it is recommended that you use only one type of authentication and that you install the credentials for only that type of authentication on the wireless AP.