EAP Types in Windows

EAP Types in Windows

The following EAP types are included with Microsoft Windows XP (Service Pack 1 [SP1] and later), Windows Server 2003, and the Windows 2000 family with Microsoft 802.1X Authentication Client:

• EAP-MD5 CHAP

• EAP-TLS

• Protected EAP (PEAP)

NOTE
Windows XP (prior to SP1) includes only the EAP-MD5 CHAP and EAP-TLS EAP types.

EAP types on the wireless client are configured from the Authentication tab for a network adapter (in Windows XP and Windows 2000 with Microsoft 802.1X Authentication Client) and for a wireless network (in Windows XP SP1 and later and Windows Server 2003). In each case, a single EAP type is selected for authentication.

EAP types on the Internet Authentication Service (IAS) server are configured from the Authentication tab in the profile properties of a remote access policy. For Windows 2000 IAS, a specific EAP type is selected from the Authentication tab, as shown in Figure 5-1.

Figure 5-1. Authentication tab for Windows 2000 IAS.

For Windows Server 2003 IAS, you can select more than one EAP type and determine the order of negotiation. The Select EAP Providers dialog box is shown in Figure 5-2, in which EAP types are referred to as EAP providers.

Figure 5-2. Select EAP Providers dialog box for Windows Server 2003 IAS.

From the Select EAP Providers dialog box, you can add or remove supported EAP types, configure their properties, and specify the order of their negotiation. You can access this dialog box by clicking the EAP Methods button on the Authentication tab in the profile properties of a remote access policy. The default EAP provider is configured based on options you select in the New Remote Access Policy Wizard.