Cloudpath

802.1X Supplicant Configuration

Name:

Supplicant Mode

Description:

Controls the behavior of the Windows supplicant, with regards to EAPOL-Start packets in particular.

Notes:

This setting is only available through the registry. By default, it does not exist. Editing the registry by hand is inherently dangerous. Use caution when updating values in the registry.

The key is located in 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global'
The key name is 'SupplicantMode' and the type is 'DWORD Value' (REG_DWORD).

For wired networks, this setting defaults to '3', which is not compliant with the 802.1X standard. In particular, it does not send EAPOL-Start packets as predictably, which can prevent authentication from occurring. It is strongly recommended to use the '3' value, which is compliant with the 802.1X standard.

Values:

0
  Disables 802.1X functionality.
1
  Never sends an EAPOL-Start packet.
2 (Default Windows Behavior)
  Automatically determines when to send EAPOL-Start packets.
3 (802.1X Standard Behavior)
  Sends an EAPOL-Start packet upon association to initiate the 802.1X authentication process. This is IEEE 802.1X compliant behavior.

Default Value:

Windows XP Wired: 2
Windows XP Wireless: 3
Windows Vista and greater: 3

Recommended Setting:

Cloudpath Help :

Cloudpath can detect the Supplicant Mode setting.

Supported settings include:

Compliant - Default. When selected, Windows will generate EAP-START packets based on the 802.1X standard. This is valid for wired and wireless LANs. This setting is recommended.

Cloudpath is able to auto remediate this setting.
By default, Windows XP will use 'Compliant' for wireless connections and 'Include Learning' for wired connections.
By default, Windows Vista and greater will use 'Compliant' for both wired and wireless connections.
It is recommended to use 'Compliant' for all connections.