User's Manual

Configuration
17
For enterprise deployment, WPA requires a RADIUS
authentication server to be configured on the wired network. The
802.1x client and RADIUS server should use an appropriate EAP
type - such as EAP-TLS (Transport Layer Security), EAP-TTLS
(Tunneled TLS), or PEAP (Protected EAP) - for strongest
authentication. Working together, these protocols provide “mutual
authentication” between a client, the access point, and a RADIUS
server that prevents unauthorized users from joining your
network, and also prevents users from accidentally joining a
rogue network. Only when a RADIUS server has authenticated a
user’s credentials will encryption keys be sent to the access point
and client.
Note: To implement WPA on wireless clients requires a
WPA-enabled network card driver and 802.1x client software
that supports the EAP authentication type that you want to use.
Windows XP provides native WPA support, other systems
require additional software. Note that Microsoft now has an
802.1x authentication client for Windows 2000 that you can
download from their web site.