User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 9 System Configuration: Authentication and Certificates
Enabling EAP-FAST
OL-14386-02
About Certification and EAP Protocols
Disabled—When you do not check the EAP-FAST master server check box, ACS continues to
operate as an EAP-FAST master server until the first time it receives replicated EAP-FAST
components from the primary ACS. When Actual EAP-FAST server status displays the text Slave,
ACS uses the EAP-FAST settings, Authority ID, and master keys that it receives from a primary
ACS during replication; rather than using the master keys that it generates and its unique Authority
ID.
Note When you uncheck the EAP-FAST master server check box, the Actual EAP-FAST server
status remains Master until ACS receives replicated EAP-FAST components and then the
Actual EAP-FAST server status changes to Slave. Until Actual EAP-FAST server status
changes to Slave, ACS acts as a master EAP-FAST server by using master keys that it
generates, its unique Authority ID, and the EAP-FAST settings that are configured in its web
interface.
Disabling the EAP-FAST master server setting eliminates the need for providing a different PAC
from the primary and secondary ACSs. This elimination occurs because the primary and secondary
ACSs send the end-user client the same Authority ID at the beginning of the EAP-FAST transaction;
therefore, the end-user client uses the same PAC in its response to either ACS. Also, a PAC that one
ACS generated for a user in a replication scheme where the EAP-FAST master server setting is
disabled is accepted by all other ACSs in the same replication scheme.
For more information about replication, see ACS Internal Database Replication, page 8-1.
This section explains the procedures to configure ACS to support EAP-FAST authentication.
Note You must configure the end-user clients to support EAP-FAST. This procedure is specific to configuring
ACS only.
Before You Begin
The steps in this procedure are a suggested order only. Enabling EAP-FAST at your site may require
recursion of these steps or performing these steps in a different order. For example, in this procedure,
determining how you want to support PAC provisioning comes after configuring a user database to
support EAP-FAST; however, choosing automatic PAC provisioning places different limits on user
database support.
To enable ACS to perform EAP-FAST authentication:
Step 1 Configure a user database that supports EAP-FAST authentication. To determine which user databases
support EAP-FAST authentication, see Authentication Protocol-Database Compatibility, page 1-8. For
user database configuration, see Chapter 12, “User Databases.”
Note User database support differs for EAP-FAST phase zero and phase two.
ACS supports use of the Unknown User Policy and group mapping with EAP-FAST, as well as password
aging with Windows external user databases.
User Guide for Cisco Secure Access Control Server 4.2
9-19