We are planning to setup WPA2 Enterprise in our Office. We have Ubiquity APs, a Unifi Controller and want to use Windows Credentials for authentication. We want to use a Linux Radius server (freeradius3) as authenticator.
I was reading RFC 3579 to prepare myself with a little theory before we implement anything. All in all its pretty clear. However, I was wondering how the Client (or peer/supplicant) credentials (sent from client via AP to the radius server) are encrypted. From reading the RFC I couldn't really figure out how this part works. The RFC states:
To address the security vulnerabilities of RADIUS/EAP, implementations of this specification SHOULD support IPsec [RFC2401] along with IKE [RFC2409] for key management.
Does that mean we have to set up IPsec in order to get the setup working in a secure manner?