AWK-5222 User’s Manual
Other Console Configurations
3-24
You can check the current certificate status in
Current Status
if it is available.
Certificate issued to
: shows the certificate user.
Certificate issued by
: shows the certificate issuer.
Certificate expiration date
: indicates when the certificate gets invalid.
EAP-TTLS
It is usually much easier to re-use existing authentication systems, such as a Windows domain or
Active Directory, LDAP directory, or Kerberos realm, rather than creating a parallel authentication
system. As a result, TTLS (Tunneled TLS) and PEAP (Protected EAP) are used to support the use
of so-called “legacy authentication methods.”
TTLS and PEAP work in a similar way. First, they establish a TLS tunnel, like EAP-TLS, and
validate whether the network is trustworthy with digital certificates on the authentication server.
This step is run to establish a tunnel that protects the next step (or “inner” authentication) so it is
sometimes referred to as the “outer” authentication. Then the TLS tunnel is used to encrypt an
older authentication protocol that authenticates the user for the network.
As you can see, digital certificates are still needed for the outer authentication in a simplified form.
Only a small number of certificates are required, which can be generated by a small certificate
authority. Certificate reduction makes TTLS and PEAP much more popular than EAP-TLS.
The AWK-5222 provides some non-cryptographic EAP methods including
PAP
,
CHAP
,
MS-CHAP
, and
MS-CHAP-V2
. These EAP methods are not recommended for direct use on
wireless networks. However, they may be useful as inner authentication methods with TTLS or
PEAP.
Because the inner and outer authentications can use distinct user names in TTLS and PEAP, you
can use an anonymous user name for the outer authentication, while the true user name is shown
only through the encrypted channel. Remember, not all client software supports anonymous
altercation. Confirm this with the network administrator before you enable identity hiding in TTLS
and PEAP.
