Cloudpath

802.1X Supplicant Configuration

Name:

EAP Type

Description:

Controls the Extensible Authentication Protocol used by the 802.1X supplicant. The most common EAP types include PEAP, TLS, TTLS, LEAP, EAP-FAST and MD5-Challenge.

Notes:

MD5-Challenge is considered broken. LEAP is a Cisco protocol that is largely considered broken. TLS is the most secure but is also the most burdensome to deploy as it requires certificates on both client and server. PEAP and TTLS are the most commonly accepted compromises.

Each EAP type has its own additional properties that can be set by clicking the 'Properties' button.

Values:

MD5-Challenge
  Do not use this in a wireless environment. Avoid using it in a wired environment. It is considered broken.
Protected EAP (PEAP)
  PEAP is an EAP implementation that requires only a server certificate. Server certificate is used to establish an outer tunnel. In the outer tunnel, the client is given a temporary certificate. Then, an inner tunnel is established using both certificates similar to TLS. Within this inner tunnel, authentication occurs.
Smart Card or Other Certificate
  Known as TLS, this is the most secure but is the most burdensome to deploy. TLS requires certificates on both the client and the server to establish communication.
SecureW2 (TTLS)
  An open-source TTLS implementation for Windows. This is not a standard option and must be installed.

Default Value:

Smart Card or Other Certificate

Recommended Setting:

Most environments use PEAP or TTLS. Generally, if your user directory supports PEAP, use PEAP. Otherwise, use TTLS.

Cloudpath Help :

Cloudpath can detect the selected EAP type.

Supported settings include:

PEAP - Default. When selected, the EAP type is set to Protected EAP.

Smart card or other certificate (TLS) - When selected, the EAP type is set to TLS.

TTLS - When selected, the EAP type is set to TTLS.

Cloudpath is able to auto remediate this setting.
By default, Windows XP will set this to 'Smartcard or other certificate (TLS)' for new SSIDs.