The EAP types previously described transmit their credentials immediately.

EAP-TLS is quickly becoming the EAP type of choice when supporting BYOD in the enterprise. It is considered among the most secure EAP types, because password capture is not an option the endpoint must still have the private key. EAP-TLS has the benefit of being an open IETF standard, and it is considered “universally supported.” EAP-TLS uses X.509 certificates and provides the ability to support mutual authentication, where the client must trust the server’s certificate, and vice versa. This is similar to SSL and the way encryption is formed between your web browser and a secure website. EAP-TLS: Uses Transport Layer Security (TLS) to provide the secure identity transaction.Without this check box selected, MAB does not work. The check box for Detect EAP-MD5 as Host Lookup allows EAP-MD5 authentications to access the internal endpoints database. EAP-MD5 is common on some IP-Phones, and it is also possible that some switches send MAB requests within EAP-MD5. That means the server is validating the client, but the client does not authenticate the server (i.e., does not check to see if it should trust the server). However, EAP-MD5 does not have a mechanism for mutual authentication. The hash is sent to the server, where it is compared to a local hash to see if the credentials are accurate. EAP-MD5: Uses a Message Digest algorithm to hide the credentials in a HASH.As an interesting sidenote, 802.1X defines EAP over LAN: There are many different EAP types, each one has its own benefit and downside. EAP encapsulates the usernames, passwords, and certificates that a client is sending for purposes of authentication. Without this check box selected, MAB does not work.Įxtensible Authentication Protocol (EAP) TypesĮAP is an authentication framework providing for the transport and usage of identity credentials. The check box for Detect CHAP as Host Lookup allows CHAP authentications to access the internal endpoints database. CHAP is not often used with network access however, some vendors send MAB using CHAP instead of PAP. The username and password are encrypted using a challenge sent from the server. CHAP: Challenge Handshake Authentication Protocol.Without this check box selected, MAB would not work. The check box for Detect PAP as Host Lookup allows PAP authentications to access the internal endpoints database. We recommend you enable this for the MAB rule only and disable PAP for any authentication rules for real authentications. PAP is normally used with MAB, and some devices use PAP for Web authentications. The username is sent in the clear, and the password is optionally encrypted. PAP: Password Authentication Protocol.This section examines the most common authentication protocols seen in most environments, so you can create a more specific list of allowed protocols for your deployment.

User authentication policy