Solved: 7921 PEAP and Microsoft IAS

aciscolook · ‎02-05-2008

I just set up a 7921 to authenticate using PEAP, a WLC 4402 as a Radius Client to a Microsoft IAS. The phone authenticated but I hadn't even installed a Trusted Root Certificate on the phone to validate the MS IAS server's machine certificate. Does 7921 PEAP not require server validation by default? IF so, how can I enable this important security feature?

migilles · ‎02-05-2008

7921 PEAP implementation does not validate the authentication server cert.

We may look into this for the future.

View solution in original post

migilles · ‎02-05-2008

7921 PEAP implementation doesn't require and doesn't allow local client certificate to be installed.

aciscolook · ‎02-05-2008

I know that PEAP doesn't require client certificate. I meant my radius server's machine certificate is from a Windows domain issued by a windows Certificate Authority. I never installed the Trusted Root Authority cetificate into the 7921 phone so how can it validate the radius server's certificate unless it doesn't validate by default. If this is the case how can I force the 7921 client to validate server's certificate?

migilles · ‎02-05-2008

7921 PEAP implementation does not validate the authentication server cert.

We may look into this for the future.

aciscolook · ‎02-05-2008

Thanks again for the information.

Michel.thebeau · ‎08-06-2008

Hi,

I was wondering if this response about PEAP not validating the server cert is still valid today?

Thanks,

Michel

migilles · ‎08-06-2008

Yes in 1.1(1) firmware it does not have the capability to use a client certificate to validate the server identity, but this will be in the next release 1.2(1) that is coming out shortly.

migilles · ‎08-13-2008

Release 1.2(1) for the 7921G was posted on CCO yesterday.

1.2(1) Software

http://tools.cisco.com/support/downloads/go/Model.x?mdfid=280808676&mdfLevel=Model&treeName=Voice%20and%20Unified%20Communications&modelName=Cisco%20Unified%20Wireless%20IP%20Phone%207921G&treeMdfId=278875240

1.2(1) Release Notes

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7921g/firmware/1_2_1/english/release/notes/7921_12.html