User's Manual

Advanced Configuration
BreezeMAX Wi² and BreezeACCESS Wi² System Manual 53
4.2.5 Authentication
Wireless clients can be authenticated for network access by checking their MAC
address against the local database configured on the AP, or by using a database
configured on a central RADIUS server. Alternatively, authentication can be
implemented using the IEEE 802.1X network access control protocol.
A client’s MAC address provides relatively weak user authentication, since MAC
addresses can be easily captured and used by another station to break into the
network. Using 802.1X provides more robust user authentication using user
names and passwords or digital certificates. You can configure the access point to
use both MAC address and 802.1X authentication, with client station MAC
authentication occurring prior to IEEE 802.1X authentication. However, it is
better to choose one or the other, as appropriate.
Take note of the following points before configuring MAC address or 802.1X
authentication:
 Use MAC address authentication for a small network with a limited number of
users. MAC addresses can be manually configured on the AP itself without the
need to set up a RADIUS server, but managing a large number of MAC
addresses across many APs is very cumbersome. A RADIUS server can be used
to centrally manage a larger database of user MAC addresses.
 Use IEEE 802.1X authentication for networks with a larger number of users
and where security is the most important issue. When using 802.1X
authentication, a RADIUS server is required in the wired network to centrally
manage the credentials of the wireless clients. It also provides a mechanism
for enhanced network security using dynamic encryption key rotation or WiFi
Protected Access (WPA).
 The AP can also operate in a 802.1X supplicant mode. This enables the AP
itself to be authenticated with a RADIUS server using a configured MD5 user
name and password. This prevents rogue APs from gaining access to the
network.
NOTE
If you configure RADIUS MAC authentication together with 802.1X, RADIUS MAC address
authentication is performed prior to 802.1X authentication. If RADIUS MAC authentication
succeeds, then 802.1X authentication is performed. If RADIUS MAC authentication fails, 802.1X
authentication is not performed.