133
Copyright © 2004-2005, Vivato, Inc.
Configuring WPA with RADIUS Security on a Client
Wi-Fi Protected Access
(WPA) with
Remote Authentication Dial-In User Service
(RADIUS) is a Wi-Fi Alli-
ance subset of IEEE 802.11i, which includes
Temporal Key Integrity Protocol
(TKIP), and
Counter mode/
CBC-MAC Protocol
IEEE. This mode requires the use of a RADIUS server to authenticate users, and con-
figuration of user accounts on the AP/Bridge.
When you configure WPA with RADIUS security mode on the AP/Bridge, you have a choice of whether to
use the Built-in Authentication Server or an external RADIUS server that you provide.
The Vivato Wi-Fi AP/Bridge Built-in Authentication Server supports Protected
Extensible Authentication
Protocol
(EAP) known as "EAP/PEAP" and
Microsoft Challenge Handshake Authentication Protocol
Version 2
(MSCHAP V2), which provides authentication for point-to-point protocol (PPP) connections
between a Windows-based computer and network devices such as AP/Bridges.
So, if you configure the network (AP/Bridge) to use security mode and choose the Built-in Authentication
server, you must configure client stations to use WPA with RADIUS and EAP/PEAP.
If you configure the network (AP/Bridge) to use this security mode with an external RADIUS server, you
must configure the client stations to use WPA with RADIUS and whichever security protocol your
RADIUS server is configured to use.
WPA with RADIUS Client Using EAP/PEAP
The Built-In Authentication Server on the Vivato Wi-Fi AP/Bridge uses Protected
Extensible Authentication
Protocol
(EAP) known as "EAP/PEAP".
•
If you are using the Built-in Authentication server with "WPA with RADIUS" security mode on the Vivato
Wi-Fi AP/Bridge, then you will need to set up wireless clients to use PEAP.
•
Additionally, you may have an external RADIUS server that uses EAP/PEAP. If so, you will need to (1)
add the Vivato Wi-Fi AP/Bridge to the list of RADIUS server clients, and (2) configure your "WPA with
RADIUS" wireless clients to use PEAP.
Note
The following example assumes you are using the Built-in Authentication server that comes
with the Vivato Wi-Fi AP/Bridge. If you are setting up EAP/PEAP on a client of an VA4200
that is using an external RADIUS server, the client configuration process will differ somewhat
from this example especially with regard to certificate validation.
