Concept Guide

l Personal—Personal is also called Pre-Shared Key (PSK). In this type, a unique key is shared with each client
in the network. Users have to use this key to securely log in to the network. The key remains the same until
it is changed by authorized personnel. You can also configure key change intervals .
l Enterprise—Enterprise is more secure than WPA Personal. In this type, every client automatically receives a
unique encryption key after securely logging on to the network. This key is automatically updated at regular
intervals. WPA uses TKIP and WPA2 uses the AES algorithm.
Recommended Authentication and Encryption Combinations
The following table summarizes the recommendations for authentication and encryption combinations for the
Wi-Fi networks.
Network Type Authentication Encryption
Employee 802.1X AES
Guest Network Captive portal None
Voice Network or
Handheld devices
802.1X or PSK as supported
by the device
AES if possible, TKIP or WEP if
necessary (combine with security
settings assigned for a user role).
Table 36: Recommended Authentication and Encryption Combinations
Configuring Authentication Survivability
The authentication survivability feature supports a survivable authentication framework against the remote
link failure when working with the external authentication servers. When enabled, this feature allows the W-
IAPs to authenticate the previously connected clients against the cached credentials if the connection to the
authentication server is temporarily lost.
Instant supports the following EAP standards for authentication survivability:
l EAP-PEAP: The Protected Extensible Authentication Protocol also known as Protected EAP or PEAP is a
protocol that encapsulates EAP within a potentially encrypted and authenticated Transport Layer Security
(TLS) tunnel. The EAP-PEAP supports the MSCHAPv2 and GTC methods.
l EAP-TLS: EAP-Transport Layer Security (EAP-TLS) is an IETF open standard that uses the Transport Layer
Security (TLS) protocol.
When the authentication survivability feature is enabled, the following authentication process is used:
1. The client associates to a W-IAP and authenticates to the external authentication server. The external
authentication server can be either CPPM(for EAP-PEAP)or RADIUSserver (EAP-TLS).
2. Upon successful authentication, the associated W-IAP caches the authentication credentials of the
connected users for the configured duration. The cache expiry duration for authentication survivability can
be set within the range of 1-99 hours, with 24 hours being the default cache timeout duration.
3. If the client roams or tries to reconnect to the W-IAP and the remote link fails due to the unavailability of the
authentication server, the W-IAP uses the cached credentials in the internal authentication server to
authenticate the user. However, if the user tries to reconnect after the cache expiry, the authentication fails.
4. When the authentication server is available and if the client tries to reconnect, the W-IAP detects the
availability of server and allows the client to authenticate to the server. Upon successful authentication, the
W-IAP cache details are refreshed.
Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide Authentication and User Management | 174