AWK-5232
Web Console Configuration
3-17
EAP Protocol
Setting
Description
Factory Default
TLS
Specifies Transport Layer Security protocol
TLS
TTLS
Specifies Tunneled Transport Layer Security
PEAP
Specifies Protected Extensible Authentication Protocol, or
Protected EAP
Before choosing the EAP protocol for your WPA/WPA2-Enterpise settings on the client end, please contact the
network administrator to make sure the system supports the protocol on the AP end. Detailed information on
these three popular EAP protocols is presented in the following sections:
EAP-TLS
TLS is the standards-based successor to the Secure Socket Layer (SSL). It can establish a trusted
communication channel over a distrusted network. TLS provides mutual authentication through certificate
exchange. EAP-TLS is also secure to use. You are required to submit a digital certificate to the authentication
server for validation, but the authentication server must also supply a certificate.
You can use WLAN 1/2
WLAN Certificate Settings to import your WLAN certificate and enable EAP-TLS
on the client end.
You can check the current certificate status in Current Status if it is available.
Certificate issued to: shows the certificate user.
Certificate issued by: shows the certificate issuer.
Certificate expiration date: indicates when the certificate gets invalid.
EAP-TTLS
It is usually much easier to re-use existing authentication systems, such as a Windows domain or Active
Directory, LDAP directory, or Kerberos realm, rather than creating a parallel authentication system. As a result,
TTLS (Tunneled TLS) and PEAP (Protected EAP) are used to support the use of so-called “legacy authentication
methods.”
TTLS and PEAP work in a similar way. First, they establish a TLS tunnel, like EAP-TLS, and validate whether the
network is trustworthy with digital certificates on the authentication server. This step is run to establish a
tunnel that protects the next step (or “inner” authentication) so it is sometimes referred to as the “outer”
authentication. Then the TLS tunnel is used to encrypt an older authentication protocol that authenticates the
user for the network.
As you can see, digital certificates are still needed for the outer authentication in a simplified form. Only a small
number of certificates are required, which can be generated by a small certificate authority. Certificate
reduction makes TTLS and PEAP much more popular than EAP-TLS.