EAP-FAST uses a PAC key to protect the user credentials that are exchanged. All EAP-FAST authenticators are
identified by an authority identity (A-ID). The local authenticator sends its A-ID to an authenticating client, and
the client checks its database for a matching A-ID. If the client does not recognize the A-ID, it requests a new
PAC.
NOTE
: If the provisioned Protected Access Credential (PAC) is valid, the WiFi connection utility does not prompt
the user for acceptance of the PAC. If the PAC is invalid, the WiFi connection utility fails the provisioning
automatically. A status message is displayed in the
Wireless Event Viewer
that an administrator can review on the
user's computer.
1. Leave unchecked
Disable EAP-FAST Enhancements (CCXv4)
.
2.
Allow authenticated provisioning
and
Allow unauthenticated provisioning
are both checked.
3.
Default Server
: None selected is the default. Click
Select Server
to select a PAC from the default PAC
authority server. The Protected Access Credentials selection page opens.
NOTE
: Server groups are only listed if you have installed an
Administrator Package
that contains EAP-
FAST Authority ID (A-ID) Group settings.
PAC distribution can also be completed manually (out-of-band). Manual provisioning lets you create a
PAC for a user on an ACS server and then import it into a user's computer. A PAC file can be protected
with a password, which the user needs to enter during a PAC import.
4. To import a PAC:
1. Click
Import
to import a PAC from the PAC server.
2. Click
Open
.
3. Enter the PAC password (optional).
4. Click
OK
to close this page. The selected PAC is used for this wireless profile.
5. Click
Next
.
6. If this is not a Pre-logon/Common profile, then click
Next
and jump to
Step 3 of 3: EAP-FAST Server
.
7. If this is a Pre-logon/Common profile, or if you are not using the Administrator Tool to create this profile,
proceed to the next step.
Step 2 of 3: EAP-FAST Additional Information
1. Authentication Protocol: Select MS-CHAP-V2 or GTC
2. User Credentials: Select Use Windows Logon or Use the following.
3. If you selected
Use the following
, then enter the User Name, Domain, Password, and Confirm Password.
4. Enter the Roaming Identity: %DOMAIN%\%USERNAME
5. Click Next.
Step 3 of 3: EAP-FAST Server
1. Click
Validate Server Certificate
if desired and select the Certificate Issuer from the drop down menu. The
default selection is Any Trusted CA.
2. If desired, click
Specify Server or Certificate Name
and enter the name. Then click
Server Name must
match the specified entry exactly
or
Domain name must end with the specified entry
. The server
name can include all characters, including special characters.
3. Click
OK
.
Back to Top
Back to Contents
Trademarks and Disclaimers
Intel® PROSet/Wireless WiFi Connection Utility User's Guide
