User Guide for Cisco Secure Access Control Server - Stewing Home

About Certification and EAP Protocols
PEAP Authentication
About the PEAP Protocol
9-6
The ACS host validates the client credentials as follows:
User Guide for Cisco Secure Access Control Server 4.2
Chapter 9 System Configuration: Authentication and Certificates
If the NAP agent sends a list of SoHs, the ACS sends the list to a Microsoft Network Policy Server
(NPS) by using the Cisco Host Credentials Authorization Protocol (HCAP). The NPS evaluates the
SoHs. The ACS then sends an appropriate network access profile to the network access device
(switch, router, VPN, and so on) to grant the authorized level of access to the client.
If the NAP agent sends a health certificate rather than a list of SoHs, then ACS validates the
certificate as the EAP-FAST session is established to determine the overall health state of the client.
The ACS then sends the appropriate network access profile to the network to grant the authorized
level of access to the client.
You can configure ACS to process access requests from NAP clients by setting up one or more network
access profiles that customize ACS to operate in the NAC/NAP environment. For details on how to
configure ACS to function in a NAC/NAP environment, refer to Chapter 9 of the Configuration Guide
for Cisco Secure ACS 4.2, “NAC/NAP Configuration Scenario.”
This section contains:
About the PEAP Protocol, page 9-6
PEAP and ACS, page 9-7
PEAP and the Unknown User Policy, page 9-8
Enabling PEAP Authentication, page 9-8
The PEAP protocol is a client-server security architecture that you use to encrypt EAP transactions;
thereby protecting the contents of EAP authentications.
PEAP authentications always involve two phases:
In phase1, the end-user client authenticates ACS. This action requires a server certificate and
authenticates ACS to the end-user client, ensuring that the user or machine credentials sent in phase
two are sent to a AAA server that has a certificate issued by a trusted CA. The first phase uses a TLS
handshake to establish an SSL tunnel between the end-user client and the AAA server.
Note Depending on the end-user client involved, the CA certificate for the CA that issued the ACS
server certificate is likely to be required in local storage for trusted root CAs on the end-user
client computer.
In the second phase, ACS authenticates the user or machine credentials by using an EAP
authentication protocol. The SSL tunnel that was created in phase1 protects the EAP authentication.
The authentication type that is negotiated during the second conversation may be any valid EAP
type, such as EAP-GTC (for Generic Token Card). Because PEAP can support any EAP
authentication protocol, individual combinations of PEAP and EAP protocols are denoted with the
EAP protocol in parentheses, such as PEAP (EAP-GTC). In phase two, PEAP supports the following
authentication protocols:
– EAP-MSCHAPv2
– EAP-GTC
OL-14386-02