About The Peap Protocol - Cisco 2509 - Router - EN User Manual

Cisco Secure ACS Certificate Setup
EAP-TLS Limitations

About the PEAP Protocol

User Guide for Cisco Secure ACS for Windows Server
8-72
The Cisco Secure ACS implementation of EAP-TLS has the following
limitations:
• Server certificate format—Server and CA certificates must be in either
Base64-encoded X.509 format or DER-encoded binary X.509 format.
• LDAP attribute for binary comparison—If you configure
Cisco Secure ACS to perform binary comparison of user certificates, the user
certificate must be stored in Active Directory or an LDAP server, using a
binary format. Also, the attribute storing the certificate must be named
"usercertificate".
Windows server type—If you want to use Active Directory to authenticate
•
users with EAP-TLS, Cisco Secure ACS must be installed on a domain
controller rather than a member server.
The PEAP (Protected EAP) protocol is a client-server security architecture. PEAP
provides stronger security, greater extensibility, and support for one-time token
authentication. PEAP has been posted as an IETF Internet Draft by RSA, Cisco,
and Microsoft and is available at
http://www.ietf.org/internet-drafts/draft-josefsson-pppext-eap-tls-eap-02.txt.
PEAP operates with two phrases. The first phase—server
authentication—comprises a handshake and the establishment of and SSL tunnel.
User authentication occurs in the second phase using a new EAP type that is
protected by the SSL tunnel previously established.
PEAP uses TLS to authenticate the network infrastructure through the TLS
Handshake protocol, to protect user credentials in transit by means of the TLS
Record Protocol, and to generate cryptographic keying material using the
TLS-defined pseudo-random function (PRF) functionality. PEAP uses the same
encapsulation as EAP-TLS; however, whereas EAP-TLS ends after the TLS
Handshake Protocol is complete, PEAP continues, encapsulating another EAP
negotiation and authentication conversation within the TLS Record Protocol. This
encapsulation ensures the cryptographic protection of the second EAP
conversation. The authentication type negotiated during the second conversation
may be any valid (for example, "Generic Token Card (GTC)") EAP type. After
the second EAP conversation is complete, the EAP-Success (or EAP-Failure, as
Chapter 8 Establishing Cisco Secure ACS System Configuration
78-14696-01, Version 3.1