User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 9 System Configuration: Authentication and Certificates
Provisioning Modes
Types of PACs
OL-14386-02
About Certification and EAP Protocols
Regardless of the master key TTL values that you define, a user will require PAC provisioning when the
user does not use EAP-FAST to access the network before the master key that generated the user’s PAC
has expired. For example, if the master key TTL is one week old and the retired master key TTL is one
week old, each EAP-FAST end-user client used by someone who goes on vacation for two weeks will
require PAC provisioning.
ACS supports out-of-band and in-band provisioning modes. The in-band provisioning mode operates
inside an Authenticated Diffie-Hellman Key Agreement Protocol (ADHP) tunnel before the peer
authenticates the ACS server.
Since an unauthenticated server is provisioned, it is not possible to use a plain text password; so only
MS-CHAP credentials can be used inside the tunnel. MS-CHAPv2 is used to prove the peer's identity
and receives a PAC for further authentication sessions. This method minimizes the risk of exposing the
user's credentials.
EAP-FAST has been enhanced to support an authenticated tunnel (using the server certificate) inside
which PAC provisioning occurs. The new cipher suites that are enhancements to EAP-FAST and
specifically the server certificate are used.
Since the server is authenticated as part of setting up the tunnel, weaker EAP methods, such EAP-GTC
can be used inside the tunnel to provide supplicant authentication.
At the end of a provisioning session that uses an authenticated tunnel, network access can be granted;
since the server and user have authenticated each other.
ACS supports the following EAP types inside the tunnel for provisioning:
EAP-GTC
EAP-MS-CHAPv2
EAP-TLS
Note By default, when using the EAP-GTC and EAP-MSCHAP inner methods, ACS allows up to
three additional authentication attempts inside the SSL tunnel if the initial authentication
attempt fails. After the fourth failed authentication attempt inside the SSL tunnel, ACS will
terminate the EAP conversation, resulting in a RADIUS Access-Reject.
ACS provisions supplicants with a PAC that contains a shared secret that is used in building a TLS tunnel
between the supplicant and ACS. ACS provisions supplicants with PAC that have a wider contextual use.
The following types of PACs are provisioned to ACS, as per server policies:
Tunnel (Shared Secret) PAC, user or machine—Distributed shared secret between the peer and
ACS that is used to establish a secure tunnel and convey the policy of what must and can occur in
the tunnel. The policy can include EAP methods, TLV exchanges, and identities that are allowed in
the tunnel. It is up to the server policy to include what's necessary in PAC to enforce the policy in
subsequent authentications that use the PAC. For example, in EAP-FAST Protocol Version 1, user
identity I-ID is included as the part of the server policy. It limits the inner EAP methods to be carried
only on the user identity that is provisioned. Other types of information can also be included, such
as which EAP method and which cipher suite is allowed, for example. If the server policy is not
User Guide for Cisco Secure Access Control Server 4.2
9-13