New Intel Wireless Pro set let bypass PEAP user authentication

Unanswered Question
Apr 4th, 2007
User Badges:


I have a critical situation. We use PEAP/MSCHAPv2 for client and user authentication. Wireless users and clients will be authenticated by the ACS by asking a ADS usergroup membership. Valid users and clients have access to LAN ressources protected by the wlan controller. If the wireless client use the WZC and the logged on user is not a member of the user group he will not be authenticated and have no access through the wlan controller. But if the wireless client can use the actual "Intel Wireless Pro Set" and the user is not a member of the ADS group the ACS drop the user authentication request. But some seconds later the user will have nevertheless access to internal resources.

In this case I think the user authentication request will not right handled by the ACS so authenticated client will have access through the wlan controller and a not ACS authenticated user will have access to lan ressources by his local cached user credentials.

Is there a possible security leak or have I a configuration problem?

Best regards

Olaf Bachmann

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
irisrios Wed, 04/11/2007 - 05:55
User Badges:
  • Silver, 250 points or more

It could be configuration issue.

check wheather PEAP "Fast Reconect" disabled on ACS side.

obachmann Wed, 04/11/2007 - 06:23
User Badges:

Hi irisrios.

PEAP "Fast Reconect" is disabled on ACS side.

But in the meantime we made some tests with cisco ACS and nortel wlan controller. If the wlan client use a wireless profile, generated with the Intel Proset (!! full installation incl. andmin tools and pre-logon authentication!!) then a user who is not a member of the wlan user group have access to lan resources.


This Discussion