Wireless Security.pdf - PDF Archive

576 Chapter 21
environment. A primary advantage here is that if a device is stolen, the
certificates it uses can be immediately revoked. The next time it tries to
authenticate, the CRL will be checked and authentication will fail.
●
●
●
An authorization password. This is the shared-secret password you configured
for RADIUS client authentication on the IAS server. This password is used to
establish communication between the AP and the RADIUS server. Thus, it needs
to be protected by being long and complex. This password should be at least 22
characters long and use mixed case, numbers, letters, and other characters. You
might want to consider using a random string generation program to create this
password for you.
An IP address o f a primary and, if confi gured for fault tolerance, a secondary
RADIUS server. If the AP is in a DMZ, and the RADIUS server is behind a
firewall, this IP address can be the external IP address of the firewall.
A UDP port used for RADIUS authentication. The default port for RADIUS is
port 1645. However, you can change this port on the IAS server and the AP for
an additional degree of security.
Depending on your AP, you might have to go through additional configuration steps. For
example, you might have to enable the use of dynamic WEP keys. On the AP 500, this
configuration is automatically applied to the AP when you finish configuring the 802.1X
settings. Consult your AP’s documentation for specific information on configuring it for
802.1X authentication.
21.6.3.4 Configuring the Wireless Interface on Windows XP for
802.1X Authentication
If you have been following the preceding steps in the same order for configuring 802.1X
authentication, the final step is to configure the properties of the wireless interface in
Windows XP. You will have to ensure that the properties for EAP-TLS authentication and
dynamic WEP are configured. To do this, perform the following steps:
1. Obtain the Properties of the wireless interface and click the Authentication tab.
2. Ensure that the checkbox for Enable access control for IEEE 802.1X is checked
and that Smart Card or other Certifi cate is selected as the EAP type, as shown in
Figure 21.81 .
www.newnespress.com