101
6.0 Summit Radio
6.1.2.6
EAP Credentials
The 802.1X authentication types PEAP, EAP-TTLS, and EAP-TLS rely
upon information in digital certificates that are created by a certificate
authority, or CA. To enable a client device to validate (or authenticate)
the server used for PEAP, EAP-TTLS, or EAP-TLS authentication, you
must provision a root CA certificate and distribute it to that client. You
can store the CA certificate in a device’s Microsoft certificate store or in
a directory with a path that you specify as the value for Certs Path on the
SCU Global window. If you don’t specify a Certs Path value, then SCU
uses for the Certs Path value the path to the certs directory that is off
the SCU folder. For EAP-TLS you also must generate a user certificate for
each client; that user certificate must be stored in the Microsoft certificate
store on the client.
Instead of using digital certificates, EAP-FAST relies upon strong shared-
secret keys that are unique to users. These secrets are called protected
EAP-Type
User
Password
CA Cert
Validate
Server
User MS Store
Others
LEAP
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
EAP-FAST
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
• PAC Filename (up to
32 characters)
• PAC Password (up to
32 characters)
PEAP-MSCHAP
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
Filename (up to 32 char-
acters)
See Note on CA Cert Field
See Note on Validate
Server Checkbox
See Note on Use
MS store Checkbox
PEAP-TGC
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
Filename (up to 32 char-
acters)
See Note on CA Cert Field
See Note on Validate
Server Checkbox
See Note on Use
MS store Checkbox
PEAP-TLS
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
Filename (up to 32 char-
acters)
See Note on CA Cert Field
See Note on Validate
Server Checkbox
See Note on Use
MS store Checkbox
EAP-TTLS
Username or Domain/
Username (up to 64
characters)
Password (up to 32
characters)
Filename (up to 32 char-
acters)
See Note on CA Cert Field
See Note on Validate
Server Checkbox
See Note on Use
MS store Checkbox
EAP-TLS
Username or Domain/
Username (up to 64
characters)
Filename (up to 32 char-
acters)
See Note on CA Cert Field
See Note on Validate
Server Checkbox
See Note on Use
MS store Checkbox
User Cert
See Note on User Cert
access credentials (PACs) and can be created automatically or manually.
With automatic or in-band provisioning, the PAC is created and distrib-
uted to the client device in one operation. With manual or out-of-band
provisioning, the PAC is created in one step and then must be distributed
to the client device separately. SCU supports PACs created automatically
or manually. When you create a PAC manually, you must load it to the
directory identified by the Certs Path global setting. Be sure that the PAC
file does not have read-only permissions set, or SCU will not be able to
use the PAC.
There are no default values for credentials. If the credentials are not speci-
fied in the profile then, when the radio tries to associate using that profile,
Summit software will display a dialog box that prompts the user to enter
the credentials. Summit software will populate the dialog box with the
username and password supplied for the previous EAP authentication.
Note on CA Cert Field:
This is the filename of the root certificate authority
digital certificate. Leave this blank if the
Use MS Store
checkbox is checked.
Note on Validate Server Checkbox:
Check this if using a CA certificate
to validate an authentication server. When this is checked, a certificate filename
must be entered in the CA Cert field or check the Use MS store checkbox.
Note:
Summit strongly recommends the use of server validation with PEAP-
GTC.
Note on Use MS Store Checkbox:
Check this if the Microsoft certificate
store should be used for a CA certificate. This is applicable only when Validate
Server is checked.
Note on User Cert:
Tap the “...” button to select a user (or station) certificate
from the Microsoft certificate store. Do not enter a filename; the user certificate
must reside in the Microsoft certificate store. When browsing for a certificate, the
pop-up box displays Issued By and Issued To.
Of the seven EAP types supported by SCU, all but EAP-FAST and LEAP rely
upon information in digital certificates that are created by a certificate authority
(CA). To enable a station device to authenticate the server, provide a root CA
certificate and distribute it to that station. The CA certificate can be stored in
Notes for EAP Credentials
a unit’s Microsoft certificate store or in a specified directory (see Certs Path for
additional information regarding a specified directory).
Note:
For EAP-TLS, the user must also generate a user certificate for each
station. The user certificate must be stored in the Microsoft certificate
store on the station.
EAP-FAST relies upon strong shared-secret keys that are unique to users (rath-
er than digital certificates). These keys are called protected access credentials
(PACs) and can be created automatically or manually. With automatic or in-
band provisioning, the PAC is created and distributed to the station device in
one operation. With manual or out-of-band provisioning, the PAC is created in
one step and must then be distributed to the station device separately.
SCU supports PACs created automatically or manually. When the user creates a
PAC manually, it must be loaded into the directory identified by the Certs Path
global setting. Be sure that the PAC file does not have read-only permissions set,
or SCU will not be able to use the PAC.
Note:
If the user enters a PAC filename in the SCU field, manual provisioning is
used. If the user omits the PAC filename, automatic provisioning is used.