D-Link DWL-2210AP Router Manual PDF (Setup & Configuration Guide)

Page 146 / 193 Scroll up to view Page 141 - 145

146

Appendix A: Conﬁguring Security Settings on Wireless Clients

If you conﬁgured the D-Link DWL-2210AP to use WPA with RADIUS security mode

and to use either the Built-in Authentication Server or an external RADIUS server that

uses EAP/PEAP . . .

First set up user accounts on the access point (Cluster > User Management). . . .

. . . then conﬁgure WPA security with PEAP authentication on each client as follows.

Page 147 / 193

147

Appendix A: Conﬁguring Security Settings on Wireless Clients

Choose

either TKIP

or AES for

the Data

Encryption

mode

Choose Protected EAP (PEAP)

Disable (click to uncheck)

“Validate server certiﬁcate”

Choose “secured

password (EAP-

MSCHAP v2)”

. . . then click

“Conﬁgure”

Choose WPA

. . . then, click

“Properties”

Disable (click to uncheck) option to

automatically use Windows logon

name and password

Page 148 / 193

148

Appendix A: Conﬁguring Security Settings on Wireless Clients

2. Conﬁgure this setting on the Authentication tab.

3. Click

Properties

to bring up the Protected EAP Properties dialog and conﬁgure the

following settings.

4. Click

Conﬁgure

to bring up the EAP MSCHAP v2 Properties dialog.

On this dialog, disable (click to uncheck) the option to “Automatically use my Windows

login name . . .etc. so that upon login you will be prompted for user name and

password.

Click

OK

on all dialogs (starting with the EAP MSCHAP v2 Properties dialog) to close

and save your changes.

Logging on to the Wireless Network with a WPA PEAP Client

“WPA with RADIUS” PEAP clients should now be able to associate with the access

point. Client users will be prompted for a user name and password to authenticate

with the network.

1. Conﬁgure the following settings on the Association and Authentication tabs on the

Network Properties dialog.

Association Tab

Network Authentication

WPA

Data Encryption

TKIP or AES depending on how this option is conﬁgured

on the access point.

Note:

When the Cipher Suite on the access point is set

to “Both”, then TKIP clients with a valid TKIP key and

AES clients with a valid CCMP (AES) key can associate

with the access point. For more information, see

Administrators Guide and Online Help on the access

point.

Authentication Tab

EAP Type

Choose “Protected EAP (PEAP)”

Protected EAP Properties Dialog

Validate Server Certiﬁcate

Disable this option (click to uncheck the box).

Note:

This example assumes you are using the Built-in

Authentication server on the AP. If you are setting up

EAP/PEAP on a client of an AP that is using an external

RADIUS server, you might certiﬁcate validation and

choose a certiﬁcate, depending on your infrastructure.

Select Authentication Method

Choose “Secured password (EAP-MSCHAP v2)”

Page 149 / 193

149

WPA with RADIUS Client Using EAP-TLS Certiﬁcate

Extensible Authentication Protocol

(EAP)

Transport Layer Security

(TLS), or EAP-TLS,

is an authentication protocol that supports the use of smart cards and certiﬁcates. You

have the option of using EAP-TLS with both WPA with RADIUS and IEEE 802.1x modes

if you have an external RADIUS server on the network to support it.

Appendix A: Conﬁguring Security Settings on Wireless Clients

To use this type of security, you must do the following:

1. Add the D-Link DWL-2210AP to the list of RADIUS server clients. (See

“Conﬁguring an External RADIUS Server to Recognize the D-Link DWL-2210AP” in

this manual.)

2. Conﬁgure the D-Link DWL-2210AP to use your RADIUS server (by providing

the RADIUS server IP address as part of the “WPA with RADIUS” security mode

settings).

3. Conﬁgure wireless clients to use WPA security and “Smart Card or other

Certiﬁcate” as described in this section.

4. Obtain a certiﬁcate for this client as described in “Obtaining a TLS-EAP Certiﬁcate

for a Client” in this manual.

If you conﬁgured the D-Link DWL-2210AP to use WPA with RADIUS security mode

with an external RADIUS server . . .

If you want to use IEEE 802.1x mode with EAP-TLS certiﬁcates for authentication and

authorization of clients, you must have an external RADIUS server and a

Public Key Authority

Infrastructure

(PKI), including a

Certiﬁcate Authority

(CA), server conﬁgured on your network.

It is beyond the scope of this document to describe these conﬁguration of the RADIUS server,

PKI, and CA server. Consult the documentation for those products.

Some good starting points available on the Web for the Microsoft Windows PKI software are:

“How to Install/Uninstall a Public Key Certiﬁcate Authority for Windows 2000”

at

http://support.microsoft.com/default.aspx?scid=kb;EN-US;231881

and How to Conﬁgure a

Certiﬁcate Server at

http://support.microsoft.com/default.aspx?scid=kb;en-us;318710#3

.

. . . then conﬁgure

WPA security

with certiﬁcate

authentication on

each client as shown

on the following page.

Page 150 / 193

150

Appendix A: Conﬁguring Security Settings on Wireless Clients

Choose WPA

Choose either TKIP

or AES for the Data

Encryption mode

Choose Smart Card

or other certiﬁcate and

enable “Authenticate as

computer when info is

available”

Then click

“Properties”

Enable (click to

check) “Validate

server certiﬁcate”

Select (check) the name of

the certiﬁcate on this client

(downloaded from RADIUS

server in a prerequisite

procedure)

Rate

Popular D-Link Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share