Moxa AWK-6222-EU-T [42/101] Eap tls

AWK-6222 User’s Manual Other Console Configurations

3-24

EAP-TLS

TLS is the standards-based successor to the Secure Socket Layer (SSL). It can establish a trusted

communication channel over a distrusted network. TLS provides mutual authentication through

certificate exchange. EAP-TLS is also secure to use. You are required to submit a digital certificate

to the authentication server for validation, but the authentication server must also supply a

certificate.

You can use WLAN 1/2 Æ WLAN Certificate Settings to import your WLAN certificate and

enable EAP-TLS on the client end.

You can check the current certificate status in Current Status if it is available.

Certificate issued to: shows the certificate user.

Certificate issued by: shows the certificate issuer.

Certificate expiration date: indicates when the certificate becomes invalid.

EAP-TTLS

It is usually much easier to re-use existing authentication systems, such as a Windows domain or

Active Directory, LDAP directory, or Kerberos realm, rather than create a parallel authentication

system. As a result, TTLS (Tunneled TLS) and PEAP (Protected EAP) are used to support the use

of so-called “legacy authentication methods.”

TTLS and PEAP work in a similar way. First, they establish a TLS tunnel, like EAP-TLS, and

validate whether the network is trustworthy with digital certificates on the authentication server.

This step is run to establish a tunnel that protects the next step (or “inner” authentication) so it is

sometimes referred to as the “outer” authentication. Then the TLS tunnel is used to encrypt an

older authentication protocol that authenticates the user for the network.

As you can see, digital certificates are still needed for the outer authentication in a simplified form.

Only a small number of certificates are required, which can be generated by a small certificate

authority. Certificate reduction makes TTLS and PEAP much more popular than EAP-TLS.

The AWK-6222 provides some non-cryptographic EAP methods including PAP, CHAP,

MS-CHAP, and MS-CHAP-V2. These EAP methods are not recommended for direct use on

wireless networks. However, they may be useful as inner authentication methods with TTLS or

PEAP.