Implementing Support for Secure 802.1x Technologies

Windows Server 2003 has the capability to implement 802.1x port-level security. This security capability is comprised of several components and each of them needs to be configured to pass the appropriate information to the others. All of the components in this process need to be 802.1x-compliant.

802.1x is the IEEE standard that defines port-based network access control. It also defines the method for passing the Extensible Authentication Protocol (EAP) messages. There are three parts of a Windows Server 2003 “based 802.1x-compliant system:

• Supplicant. User or client that wants to be authenticated (Windows XP SP1 or later)

• Authenticator. Access point that is 802.1x-compliant (be sure to check with the manufacturer's documentation prior to choosing your equipment)

• Authentication Server. Microsoft IAS Server (RADIUS) registered with Active Directory

RFC 2716

Microsoft introduced a Request for Comment (RFC) in 1999 called RFC 2716. This document describes EAP-TLS. Transport Level Security (TLS) provides for mutual authentication, encrypted negotiation, and key exchange between two end points. Combined, the two technologies are referred to as EAP-TLS.