Hi JK,

Thanks for the links.Very useful & I have rated Full.

BTW, I learned that EAP-FAST Manual PAC provision involves laborious tasks of manually creating and distribting PAC files to users.

Since my design is not to include PKI / Certificates and to use Username/Password I opted EAP-FAST initially.

Then, because of the drawbacks, Now I am planning to use PEAP-GTC which also have provision to avail Username/Password and no Certificate is involved. Is it correct? Without creating certificates will i be able to deploy PEAP-GTC provided I have ACS server & LDAP as external database

Please let me know if you have any opinion please

regards,

sairam

Hi Sairam:

Peap is a username/password based authentication but it does require atleast server side certificate, it could be self-signed certificate or any third party certificate.

PEAP-GTC is Cisco propritary, so its meant to work with Cisco products only. But, I also saw that we've an option for EAP-GTC on IBM utility.

In order to enable EAP_GTC, you can use either one of them:

Cisco350card

Cisco ACU utility

PEAP- Generic Token Card (PEAP-GTC)----FEW FACTS

=========================================

# Supports authentication using one-time passwords
     

# Supports NDS and LDAP
     

# Supports password change at expiration
     

# Is defined in a draft RFC
     

# Does not expose the logon user name in the EAP identity response
     

# Is not vulnerable to a dictionary attack
     

# Requires a server certificate and CA certificate, but does not require per-user certificates.

PEAP authentication:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/SCAuth.html#wp326152

HTH

Regards,

JK

Plz rate helpful posts-

Hi JK.

Thanks. I tested in the live environment today. I am using GTC using Intel Pro set utility. This option is available.

Moreover I disabled "Validate certificate" option and it is working even without server side certificate. only username password is sufficient to authenticate.

Your opinion is solicited. Expecting your valuable comments on this please

sairam    

Sairam:

Either you misunderstood or I wasn't clear in my last post...

When I say server side certificate that means, you need to install certificate atleast on the ACS to make this happen.

If it is working fine then you must have server cert installed on the ACS. If you wish, you can verify from the system configuration > ACs certificate page > Install certificate (Please notice the fields "Issued To" and Issued By")

Long story short, PEAP-GTC does use certificate but users will authenticate by providing their credentials.

Hope this helps.

Regards,

JK

Plz rate helpful posts-

Dear JK,

I am sorry If i havenot communicated this properly. However let me describe this now again

I have unchecked the checkbox "VALIDATE CERTIFICATE" in the client supplicant. Then I am able to use only username/password. In this scenario neither i have installed certificates on the client nor accepted certificate from the server.

It is working perfectly with only username/password authentication

any comments please

sairam

Hey Sai,

Thats okay...I understand that you have unchecked the option on the clients "validate server certificate" on Wireless Zero Configuration utiltiy by Windows and doing this client is not validating/accepting server identity.

We do this, If we donot want to install/accept certificate on client and we can authenticate by issuing username/password. However, we need certificate on the ACS (server certificate) just to enable peap. If we don't install this certificate on the ACS then you won't be able to select PEAP-GTC under system configuration > global authentication.

In nut shell, this is username/password based authentication.

Hope this helps...TC

Regards,

JK

Plz rate helpful posts-

Hi JK,

Its true. I have already created a self signed certificate in ACS Secure Engine

The reaso i went with PEAP is EAP-FAST with LDAP do not support automatic provisioning of PAC  in Phase I. Only Manual Provisioning is supported

Correct me if I am deviating from the concept

sairam