10-3
Cisco Aironet 1100 Series Access Point Installation and Configuration Guide
OL-2851-01
Chapter 10 Configuring Authentication Types
Understanding Authentication Types
access point allows the requesting device to authenticate. Both the unencrypted challenge and the
encrypted challenge can be monitored, however, which leaves the access point open to attack from an
intruder who calculates the WEP key by comparing the unencrypted and encrypted text strings. Because
of this weakness, shared key authentication can be less secure than open authentication. Like open
authentication, shared key authentication does not rely on a RADIUS server on your network.
Figure 10-2
shows the authentication sequence between a device trying to authenticate and an access
point using shared key authentication. In this example the device’s WEP key matches the access point’s
key, so it can authenticate and communicate.
Figure 10-2 Sequence for Shared Key Authentication
EAP Authentication to the Network
This authentication type provides the highest level of security for your wireless network. By using the
Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the
access point helps a wireless client device and the RADIUS server to perform mutual authentication and
derive a dynamic unicast WEP key. The RADIUS server sends the WEP key to the access point, which
uses it for all unicast data signals that it sends to or receives from the client. The access point also
encrypts its broadcast WEP key (entered in the access point’s WEP key slot 1) with the client’s unicast
key and sends it to the client.
When you enable EAP on your access points and client devices, authentication to the network occurs in
the steps shown in
Figure 10-3
:
Access point
or bridge
with WEP key = 123
Client device
with WEP key = 123
1. Authentication request
2. Unencrypted challenge
3. Encrypted challenge response
4. Authentication response
54584