Lantronix EMG 8500 EMG User Guide - Page 98

7: Networking The wireless client can connect to a WLAN network using WEP authentication (Open or Shared with 64 bit or 128 bit encryption), or WPA/WPA2 authentication (PSK or 802.1X/Enterprise with AES/CCMP or TKIP encryption). 802.1X is an enterprise class access protocol for protecting networks via authentication. There are three components to 802.1X authentication:  A supplicant, or client, which requires authentication (the EMG).  An authenticator, or access point, which acts as a proxy for the client, and restricts the client's communication with the authentication server.  An authentication server (usually RADIUS), which decides whether to accept the client's request for network access. Extensible Authentication Protocol (EAP) is used to pass the authentication information between the supplicant (the EMG) and the authentication server. The EAP type handles and defines the authentication. The access point acting as authenticator is only a proxy to allow the supplicant and the authentication server to communicate. The EMG supports the following EAP protocols:  LEAP: Lightweight Extensible Authentication Protocol (LEAP) uses dynamic WEP keys and mutual authentication with a modified version of MS-CHAP between the EMG and a RADIUS server.  EAP-TLS: uses TLS and Public key Infrastructure (PKI) to set up authentication with a RADIUS server. This method requires the use of a client-side certificate for communicating with the server.  EAP-TTLS: uses TTLS (Tunneled Transport Layer Security) and server-side certificates to set up authentication between the EMG and a RADIUS server. The actual authentication is, however, performed using passwords.  PEAP: Protected EAP uses server-side public key certificates to authenticate the EMG with a RADIUS server. PEAP authentication creates an encrypted TLS tunnel between the EMG and the server. The exchange of information is encrypted and stored in the tunnel ensuring the user credentials are kept secure.  FAST: Flexible Authentication via Secure Tunneling uses Protected Access Credential (PAC) for verifying clients on the network. Instead of using a certificate to achieve mutual authentication, FAST authenticates by means of a PAC (Protected Access Credential) stored on the EMG, which can be managed dynamically by the authentication server. The PAC can be provisioned (distributed one time) to the client either manually or automatically. Manual provisioning is delivery to the client via disk or a secured network distribution method. Automatic provisioning (used on the EMG) is an in-band distribution. This table summarizes the features of each EAP protocol: EAP Protocol TLS Feature Client-side yes certificate required Server-side yes certificate required WEP key yes management TTLS no yes yes PEAP no yes yes FAST no (PAC) LEAP no no (PAC) no yes yes EMG™ Edge Management Gateway User Guide 98