6.3Authentication, cryptography, and PKI

Authentication, controlling "who may connect to the network," and cryptography/PKI, preventing impersonation and tampering, are the foundations of network security. A network specialist must be able to judge, for each wired LAN port or wireless access point, which authentication method (which type of 802.1X/EAP) fits the requirements, such as the operational burden of certificate management or compatibility with an existing password infrastructure.

6.3.1RADIUS and EAP

• RADIUS is a protocol that centralizes authentication, authorization, and accounting (AAA) on a single server. Instead of maintaining a separate user database at every access point, VPN device, or switch port, devices query the RADIUS server, giving centralized user management.
• EAP (Extensible Authentication Protocol) is a framework that allows the actual authentication method to be swapped in. EAP-TLS performs mutual certificate-based authentication using both a client certificate and a server certificate—the strongest option, but with a high cost of distributing and managing certificates to every client. PEAP uses a certificate only on the server side to establish a TLS tunnel, inside which the client performs lightweight authentication such as ID/password, achieving reasonable strength while keeping certificate-management costs down.