Specifications

Chapter 2 An Overview of the Voice Over IP Wireless Network
Components of the VoIP Wireless Network
2-20
Cisco Unified Wireless IP Phone 7921G Administration Guide for Cisco Unified CallManager Release 4.1, 4.2, 5.0
OL-10802-02
• EAP-FAST Authentication—This client server security architecture encrypts
EAP transactions within a Transport Level Security (TLS) tunnel between the
access point and the Remote Authentication Dial-in User Service (RADIUS)
server such as the Cisco
Access Control Server (ACS).
The TLS tunnel uses Protected Access Credentials (PACs) for authentication
between the client (phone) and the RADIUS server. The server sends an
Authority ID (AID) to the client (phone), which in turn selects the appropriate
PAC. The client (phone) returns a PAC-Opaque to the RADIUS server. The
server decrypts the PAC with its master-key. Both end points now have the
PAC key and a TLS tunnel is created. EAP-FAST supports automatic PAC
provisioning, but you must enable it on the RADIUS server.
Note In the Cisco ACS, by default, the PAC expires in one week. If the phone
has an expired PAC, authentication with the RADIUS server takes longer
while the phone gets a new PAC.
To avoid these PAC provisioning delays, set the PAC expiration period to
90 days or longer on the ACS or RADIUS server.
Authenticated Key Management
The following authentication schemes use the RADIUS server to manage
authentication keys:
• Wi-Fi Protected Access (WPA)—Uses information on a RADIUS server to
derive unique pair-wise keys for authentication. Because these keys are
generated at the centralized RADIUS server, WPA provides more security
than WPA pre-shared keys that are stored on the access point and phone.
• Cisco Centralized Key Management (CCKM)—Uses information on a
RADIUS server and a wireless domain server (WDS) to manage and
authenticate keys. The WDS creates a cache of security credentials for
CCKM-enabled client devices for fast and secure reauthentication.
With WPA and CCKM, encryption keys are not entered on the phone, but are
automatically derived between the access point and phone. But the EAP
username and password that are used for authentication must be entered on
each phone.