Filter
Top Products
B-19
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Appendix B Authentication in ACS 5.3
EAP-FAST
EAP-FAST is a client-server security architecture that encrypts EAP transactions with a TLS tunnel.
While similar to PEAP in this respect, it differs significantly in that EAP-FAST tunnel establishment is
based on strong secrets that are unique to users.
These secrets are called Protected Access Credentials (PACs), which ACS generates by using a master
key known only to ACS. Because handshakes based on shared secrets are intrinsically faster than
handshakes based on PKI, EAP-FAST is the fastest of the advanced EAP protocols (including EAP-TLS
and PEAP) that establish a TLS connection to encrypt the traffic between the supplicant and ACS. No
certificate management is required to implement EAP-FAST.
EAP-FAST occurs in three phases:
• Phase zero—Unique to EAP-FAST, phase zero is a tunnel-secured means of providing an
EAP-FAST end-user client with a PAC for the user requesting network access. (See Automatic
In-Band PAC Provisioning, page B-23.)
Providing a PAC to the end-user client is the sole purpose of phase zero. The tunnel is established
based on an anonymous Diffie-Hellman key exchange for Anonymous In-band provisioning.
Authenticated In-band provisioning uses other cipher suites.
If EAP-MSCHAPv2 or EAP-GTC authentication succeeds, ACS provides the user with a PAC. To
determine which databases support EAP-FAST phase zero, see Authentication Protocol and Identity
Store Compatibility, page B-35.
Note Phase zero is optional and PACs can be manually provided to end-user clients. (See Manual
PAC Provisioning, page B-24.)
The Allow Anonymous In-Band PAC provisioning option provides an end-user client with a PAC by
using EAP-FAST phase zero. If this check box is checked, ACS establishes a secured connection
with the end-user client for the purpose of providing the client with a new PAC.
This option allows an anonymous TLS handshake between the end-user client and ACS
(EAP-MSCHAPv2 and EAP-GTC are used as inner methods.)
The Allow Authenticated In-Band PAC provisioning option provisions an end-user client with a PAC
by using EAP-FAST phase zero with TLS server-side authentication. This option requires that you
install a server certificate.
In general, phase zero of EAP-FAST does not authorize network access. However, if you choose the
Accept Client on Authenticated Provisioning option, ACS sends a RADIUS Access-Accept
(containing an EAP Success) at the end of a successful phase zero PAC provisioning, and the client
is not forced to reauthenticate again.
This option can be enabled only when the Allow Authenticated In-Band PAC Provisioning option is
also enabled.
• Phase one—In phase one, ACS and the end-user client establish a TLS tunnel based on the PAC that
the end-user client presents. This phase requires that the end-user client has been provided a PAC
for the user who is attempting to gain network access and that the PAC is not expired. The means by
which PAC provisioning has occurred is irrelevant; you can use automatic or manual provisioning.
• Phase two—In phase two, ACS authenticates the user’s credentials from within the protected TLS
tunnel that was constructed in phase one, using EAP-MSCHAPv2 or EAP-GTC as the inner EAP
method. To determine which databases support EAP-FAST phase two, see Authentication Protocol
and Identity Store Compatibility, page B-35.
Phase one and phase two are subsequent parts of the same EAP-FAST conversation.