User manual
Security
TPG User Manual 65
Configuring EAP-TTLS
Benefits and
Purpose
EAP-TTLS (Tunneled Transport Layer Security) validates the identity
of devices or users before they gain access to network resources. You
can configure the TPG for the EAP-TTLS network authentication.
This makes sure that the TPG gets access to protected networks.
Mode of Operation
EAP-TTLS consists of two phases:
• In phase 1, a TLS-encrypted channel between the TPG and the
RADIUS server will be established. Only the RADIUS server
authenticates itself using a certificate that was signed by a CA.
This process is also referred to as 'outer authentication'.
• In phase 2, an additional authentication method is used for the
communication within the TLS channel. EAP-defined methods and
older methods (CHAP, PAP, MS-CHAP und MS-CHAPv2) are
supported. This process is also referred to as 'inner authentication'.
The advantage of this procedure is that only the RADIUS server
needs a certificate. Therefore no PKI is needed. Moreover, TTLS
supports most authentication protocols.
Requirements
; The TPG is defined as user (with user name and password) on a
RADIUS server.
Proceed as follows:
1. Start the TPG Control Center.
2. Select SECURITY – Authentication.
3. Select TTLS from the Authentication method list.
4. Enter the user name and the password that are used for the
configuration of the TPG on the RADIUS server.
5. Select the settings intended to secure the communication in the
TLS channel.
6. To make the connection more secure, you can also install the
root certificate of the RADIUS server on the TPG (Ö60).
7. Click Save & Restart to confirm.
ª The settings are saved.