Authentication Types for wireless devices

Authentication Types for wireless devices

1. Open Authentication to the Access Point

   • Open authentication allows any device to authenticate and then attempt to communicate with the access point. Using open authentication, any wireless device can authenticate with the access point, but the device can communicate only if its Wired Equivalent Privacy (WEP) keys match the access point's WEP keys.

2. Shared Key Authentication to the Access Point

   • During shared key authentication, the access point sends an unencrypted challenge text string to any device that is attempting to communicate with the access point. The device that is requesting authentication encrypts the challenge text and sends it back to the access point. If the challenge text is encrypted correctly, the access point allows the requesting device to authenticate.

3. EAP Authentication to the Network

   • This authentication type provides the highest level of security for your wireless network. By using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the access point helps a wireless client device and the RADIUS server to perform mutual authentication and derive a dynamic unicast WEP key.

4. MAC Address Authentication to the Network

   • The access point relays the wireless client device's MAC address to a RADIUS server on your network, and the server checks the address against a list of allowed MAC addresses. Because intruders can create counterfeit MAC addresses, MAC-based authentication is less secure than EAP authentication.

5. Combining MAC-Based, EAP, and Open Authentication

   • You can set up the access point to authenticate client devices that use a combination of MAC-based and EAP authentication. When you enable this feature, client devices that use 802.11 open authentication to associate to the access point first attempt MAC authentication. If MAC authentication succeeds, the client device joins the network.

6. describes the authentication types that are configured on the access point. Authentication types are tied to the Service Set Identifiers (SSIDs) that are configured for the access point.

7. Using CCKM for Authenticated Clients

   • Using Cisco Centralized Key Management (CCKM), authenticated client devices can roam from one access point to another without any perceptible delay during reassociation. An access point on your network provides Wireless Domain Services (WDS) and creates a cache of security credentials for CCKM-enabled client devices on the subnet.

8. Using WPA Key Management

   • Wi-Fi Protected Access (WPA) is a standards-based, interoperable security enhancement that strongly increases the level of data protection and access control for existing and future wireless LAN systems. It is derived from and will be forward-compatible with the upcoming IEEE 802.11i standard. WPA leverages TKIP (Temporal Key Integrity Protocol) for data protection and 802.1X for authenticated key management.

9. Configuring Authentication Types

   • This section describes how to configure authentication types. You attach configuration types to the Service Set Identifiers (SSIDs).
   • Configuring WPA Migration Mode
     • To set up an SSID for WPA migration mode, configure these settings: WPA optional •A cipher suite containing TKIP and 40-bit or 128-bit WEP •A static WEP key in key slot 2 or 3
   • Configuring MAC Authentication Caching
     • MAC-authenticated clients on your wireless LAN roam frequently, you can enable a MAC authentication cache on your access points. MAC authentication caching reduces overhead because the access point authenticates devices in its MAC address cache without sending the request to your authentication server. When a client device completes MAC authentication to your authentication server, the access point adds the client's MAC address to the cache.
   • Configuring Authentication Holdoffs, Timeouts, and Intervals
     • To configure holdoff times, reauthentication periods, and authentication timeouts for client devices that authenticate through your access point, follow these steps, beginning in privileged EXEC mode:
   • Applying an EAP Profile to an Uplink SSID
     • Enters the global configuration mode.
       • Enters interface configuration mode for the radio interface.
         • Assigns the uplink SSID to the radio interface.
           • EXIT