WPA-Enterprise secures larger wireless LANs by authenticating each user or device through individual credentials instead of one shared pre-shared key. It uses IEEE 802.1X and the Extensible Authentication Protocol (EAP). section 20.2 section 20.5
The authentication exchange uses three roles and two transport relationships:
- Supplicant: the wireless client requesting network access. section 20.2.2
- Authenticator: normally the access point; in a split-MAC design, the WLC performs this role. section 20.2.2
- Authentication server: usually a RADIUS server that verifies the client’s credentials. section 20.2.2
- EAPoL carries EAP messages between the supplicant and authenticator, while RADIUS relays them between the authenticator and authentication server. section 20.2.2
The client first performs Open System Authentication and associates with the access point, but association alone does not permit network communication. The client must then complete 802.1X/EAP authentication. In a split-MAC architecture, CAPWAP tunnels the client’s EAP messages from the AP to the WLC. section 20.2.2
WLC initial setup
A WLC initial-configuration wizard asks whether to configure a RADIUS server: “Configure a RADIUS Server now? [YES][no]: no”. RADIUS configuration is necessary when WPA-Enterprise uses 802.1X/EAP; accepting “no” therefore avoids configuring that authentication infrastructure during the wizard. section 21.1.2
Figure 20.6 The 802.1X/EAP protocol stack. 802.1X defines EAPoL, which allows EAP messages to be transported over Ethernet or 802.11 LANs.
The protocol-stack figure maps EAP authentication onto 802.1X and EAPoL transport over Ethernet or 802.11 LANs. section 20.2.2
