0

We are planning to setup WPA2 Enterprise in our Office. We have Ubiquity APs, a Unifi Controller and want to use Windows Credentials for authentication. We want to use a Linux Radius server (freeradius3) as authenticator.

I was reading RFC 3579 to prepare myself with a little theory before we implement anything. All in all its pretty clear. However, I was wondering how the Client (or peer/supplicant) credentials (sent from client via AP to the radius server) are encrypted. From reading the RFC I couldn't really figure out how this part works. The RFC states:

To address the security vulnerabilities of RADIUS/EAP, implementations of this specification SHOULD support IPsec [RFC2401] along with IKE [RFC2409] for key management.

Does that mean we have to set up IPsec in order to get the setup working in a secure manner?

Improve this question
3
  • 2
    PEAP uses TLS for encryption and should be much easier to set up.
    – Zac67 ♦
    Nov 11, 2021 at 17:51
  • You are referring to Protected EAP with TLS certifcates. Yes, probably this is easier than IPSec. Do you know which Server Node would be in charge of establishing the TLS connection. Would it be the authenticator (aka RADIUS Server) or the authentication server (aka Domain Controller).
    – Teosch
    Nov 12, 2021 at 10:14
  • 1
    EAP or PEAP are used within RADIUS, so the certificate needs to be set up on the RADIUS server. There's also RFC 6614 for RADIUS over TCP/TLS, but you need to check what your gear supports.
    – Zac67 ♦
    Nov 12, 2021 at 11:40

1 Answer 1

Reset to default
2

Does that mean we have to set up IPsec in order to get the setup working in a secure manner?

Short answer:

No, for all the most common EAP methods used for wireless authentication.

RFC 3579 does not specify the EAP method, so it takes a general strategy for protecting data.

In practice, the EAP methods commonly used for wireless, PEAP, EAP-TLS, and EAP-TTLS, all encrypt data between the client (supplicant) and the RADIUS server (authenticator). So IPsec is not needed to protect the data.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.