802.1X and EAP

Another common security issue that you have to deal with in wireless environments is managing unauthorized access. In wireless networks there are no physical boundaries, so attackers can gain access from outside the physical security perimeter. They can introduce rogue APs or soft APs on laptops or handheld devices that can breach security policies. Because wireless signals are not easily controlled or contained, this could create security issues for the network.

MAC address security can be used to allow only certain devices to associate with the access points, but this cannot prevent MAC address spoofing techniques. An effective solution would involve MAC address filtering but this is not very scalable when dealing with a large number of wireless clients. The most efficient solution to this problem is using 802.1X port-based authentication. This is an authentication standard for both wired and wireless LANs that allows individual users and devices to authenticate using the Extensible Authentication Protocol (EAP) and an authentication server (RADIUS or TACACS+).

Figure 29.2 – 802.1X Functionality

Referencing Figure 29.2 above, 802.1X works by authenticating the user before receiving access to the network and this involves three components:

• Supplicant (client)
• Authenticator (access point or switch)
• Authentication server (RADIUS or TACACS+)

The client workstation can run client software known as a supplicant, which can be a Windows client or a third-party client software supplicant. The client software requests access to different services and it uses EAP to communicate with the access point (or LAN switch), which is the authenticator. The authenticator will then verify the client information against an authentication server (e.g., RADIUS).

EAP has five different security types:

• EAP-TLS
• PEAP
• EAP-TTLS
• LEAP
• EAP-FAST

EAP-Transport Layer Security (EAP-TLS) is a commonly used EAP method in wireless environments that requires a certificate to be installed on both the supplicant and the authentication server. The key pairs must first be generated and then signed by a local or remote CA server. The key communication process used by EAP-TLS is similar to SSL encryption, in that the user’s certificate is sent through an encrypted tunnel. EAP-TLS is one of the most secure authentication methods but it is also very expensive and difficult to implement.

Protected Extensible Authentication Protocol (PEAP) requires only a server-side certificate that will be used to create the encrypted tunnel. The authentication process takes place inside that tunnel. PEAP was jointly developed by Cisco, Microsoft, and RSA so it is heavily used in Microsoft Windows environments. PEAP uses the Microsoft Challenge Handshake Authentication Protocol (MS-CHAPv2) or Generic Token Card (GTC) to authenticate the user inside the encrypted tunnel.

EAP-Tunneled Transport Layer Security (EAP-TTLS) is a lot like PEAP, as it uses a TLS tunnel to protect the less secure authentication mechanisms. This might include protocols like PAP (Password Authentication Protocol), CHAP, MS-CHAPv2, or EAP MD5. EAP-TTLS is not widely used in enterprise networks but it can be found mainly in legacy environments that contain older authentication systems (e.g., Windows NT).

Lightweight EAP (LEAP) was created by Cisco as a proprietary solution for their equipment and systems. It is still supported by a variety of operating systems, like Windows and Linux, but it is no longer considered secure because a series of vulnerabilities that affect it was identified.

EAP-Flexible Authentication via Secure Tunneling (EAP-FAST) is also a Cisco-developed EAP type that was aimed to address the weaknesses in its LEAP protocol. When using EAP-FAST, server certificates are optional so it offers a lower cost implementation than a full-blown PEAP or EAP-TTLS. EAP-FAST uses a Protected Access Credential (PAC) technique to establish the TLS tunnel for the protection of the credential tunnel. PAC is basically a strong shared secret key that is unique for every client.