Security

What is the reasoning behind OnBoard by default using PEAP without Fast Reconnect?

Onboard should default to EAP-TLS, not PEAP.

Yes, the wizard creates a service with the first Auth Type as EAP-TLS with OCSP.  The second is PEAP without fast reconnect enabled.

 

Why PEAP without fast reconnect rather than with?

Fast connect is a security hole considered by most security teams. So the decision was made to default with it disabled. 

Interesting.  Do you by chance have any examples of this documented anywhere?  My Google fu is failing me on this subject.

 

My understanding of the fast reconnect feature is that it is there to provide quicker authentication when roaming from NAD to NAD when properly configured against the same NAS.  If the environment is all Aruba mobility controllers, does fast reconnect even provide a benefit?

11r is the suitable secure replacement.

Are you having issues in your deployment without fast reconnect?

No, just trying to understand why CPPM creates the service the way it does.  The documentation and associated comments on this subject appears to be nil.

 

It's not a ClearPass feature so you likely won't find any documentation on it. You can find a complete explanation of PEAP and related features on TechNet.

Also keep in mind that the Onboard service generated by the wizard is designed for single SSID onboard so PEAP would only be used for the first authentication so Fast Connect would never be used anyway.

Yes, I know that PEAP is Microsoft but that wasn't the documentation I was referring to.  I'm just trying to find something on why CPPM wizards set some of the options like they do.

 

PEAP would be first authentication for devices destined for OnBoard but the customer might not be interested in buying OnBoard licenses for every device they have on the network.