![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
-
Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.
LEAP and IAS server?
- Thread starter Cadsworth
- Start date
Why do you want to use LEAP? Even Cisco admits it is a broken protocol because it is vulnerable to dictionary attacks.
If you want to go to the extra security that uses the domain security provided by IAS you should look at WPA + AES or AES + TKIP
If you want to go to the extra security that uses the domain security provided by IAS you should look at WPA + AES or AES + TKIP
Or WEP..
Actualy we are using a very very beta load of the 7920 firmware that works with eap-fast. The firmware is a bit of a mess at this stage, and not open to the public I think. The utility that you use to update firmware and push the settings to the phone, doesent even see all the settings. You have to put the user password in with the utility, but some of the setting changes need to be made on the phone itself.
There are other phones that support 802.11x are you stuck with the Cisco phones?
Also what are your plans for key passing? Username and password, or sharred key?
Actualy we are using a very very beta load of the 7920 firmware that works with eap-fast. The firmware is a bit of a mess at this stage, and not open to the public I think. The utility that you use to update firmware and push the settings to the phone, doesent even see all the settings. You have to put the user password in with the utility, but some of the setting changes need to be made on the phone itself.
There are other phones that support 802.11x are you stuck with the Cisco phones?
Also what are your plans for key passing? Username and password, or sharred key?
Cadsworth said:7920 wireless phones need to use LEAP
Oh. Now it makes sense.
moetop said:
Dangit, this puts my plan on hold. I have been putting together a plan to convert my companies 21 locations from 128 bit WEP to EAP-Fast. We don't have any 7920 phones yet but we plan to get some in the future.
Thanks for letting us know about your problems.
"Or WEP.."
Yeah I just didn't want to go this route, was hoping not to have to set it up this way, probably will have to though.
"Also what are your plans for key passing? Username and password, or sharred key?"
In the past we were using username/password.
"Thanks for letting us know about your problems."
We just switched our Cisco Radius server over to ias and for the most part it went really well, except for the phones and a couple of Cisco 350 cards on win2k laptops.
Yeah I just didn't want to go this route, was hoping not to have to set it up this way, probably will have to though.
"Also what are your plans for key passing? Username and password, or sharred key?"
In the past we were using username/password.
"Thanks for letting us know about your problems."
We just switched our Cisco Radius server over to ias and for the most part it went really well, except for the phones and a couple of Cisco 350 cards on win2k laptops.
Ahh yes there is a command you need in your AP config for the 350 cards to work. You actualy need to add LEAP to one of the authentication lines, but it weird, because it actualy doesent use LEAP it still uses EAP-fast.. I got an explanation from TAC why it was needed, but I cant remember off hand.. If I remember I'll post the line tomorrow.
If you have a corporate policy on password changes (i.e. 90 day change) using the same username as they use for NT auth can cause a large pain in the ass. If this is the case and you have a policy that 3 bad authentications lock you out you can run into a large problem, because everyone forgets that they have their password on the phone. This type of catch 22 go's for Handhelds Windows devices as well. People never remember to change the password on the device and then lock themselvs out.
I have been realy dissapointed in Cisco and the mess that they have with Wireless. I'm glad they bought Airspace and seem to be going in that direction. They post a giant warning about LEAP and then leave their Wireless phones in the lurch with WEP as the only alternative.
Although people say WEP is easy to crack You need to generate 500 to 1 mill worth of a specefic type of packet to get enough data to start the crack process, and that takes a while.
If it were me I wouldent buy a Cisco wireless phone right now. I need to see if I can find the list of phones that support 802.11x. I keep wanting to try my pocket PC with SIP client and bluetooth headset, but our current version of Cisco Call manager doesent support Client SIP. I have tested it with my Asterisk server from the local Panera bread and was impressed, but that was with no wireless security overhead.. Not like when at work using the Odessey client for EAp-fast and all it's overhead on the little pocket pc.
If you have a corporate policy on password changes (i.e. 90 day change) using the same username as they use for NT auth can cause a large pain in the ass. If this is the case and you have a policy that 3 bad authentications lock you out you can run into a large problem, because everyone forgets that they have their password on the phone. This type of catch 22 go's for Handhelds Windows devices as well. People never remember to change the password on the device and then lock themselvs out.
I have been realy dissapointed in Cisco and the mess that they have with Wireless. I'm glad they bought Airspace and seem to be going in that direction. They post a giant warning about LEAP and then leave their Wireless phones in the lurch with WEP as the only alternative.
Although people say WEP is easy to crack You need to generate 500 to 1 mill worth of a specefic type of packet to get enough data to start the crack process, and that takes a while.
If it were me I wouldent buy a Cisco wireless phone right now. I need to see if I can find the list of phones that support 802.11x. I keep wanting to try my pocket PC with SIP client and bluetooth headset, but our current version of Cisco Call manager doesent support Client SIP. I have tested it with my Asterisk server from the local Panera bread and was impressed, but that was with no wireless security overhead.. Not like when at work using the Odessey client for EAp-fast and all it's overhead on the little pocket pc.
Here is the line we needed to add.. Keep in mind we are using a WDS type of setup, so we have a promary and backup WDS AP in each network..
wlccp authentication-server client leap method_WLCCP_RAD_EAP
Here is the explanation.
"So you're looking for why a second wlccp authentication-server group had to be added with the keyword "leap" in order for the PCM3xx/MPIxxx clients to pass authentication.
It starts back at the SSID level on the AP. Per our "EAP Authentication with RADIUS Server" document's "Network EAP or Open Authentication with EAP" topic at
http://www.cisco.com/en/US/products...s_configuration_example09186a00801bd035.shtml
the PCM/MPI cards signal their intentions of doing EAP differently than the CB21AG and non-Cisco cards do. This distinction in handling at the SSID level on the AP has to be accounted for at the WDS level, too, which explains the need for one group that covers both "eap" and "leap"."
And to the point of the Topic of this post there is a third party application that allows LEAP.. I mentioned it before. It's the funk odyssey client.
wlccp authentication-server client leap method_WLCCP_RAD_EAP
Here is the explanation.
"So you're looking for why a second wlccp authentication-server group had to be added with the keyword "leap" in order for the PCM3xx/MPIxxx clients to pass authentication.
It starts back at the SSID level on the AP. Per our "EAP Authentication with RADIUS Server" document's "Network EAP or Open Authentication with EAP" topic at
http://www.cisco.com/en/US/products...s_configuration_example09186a00801bd035.shtml
the PCM/MPI cards signal their intentions of doing EAP differently than the CB21AG and non-Cisco cards do. This distinction in handling at the SSID level on the AP has to be accounted for at the WDS level, too, which explains the need for one group that covers both "eap" and "leap"."
And to the point of the Topic of this post there is a third party application that allows LEAP.. I mentioned it before. It's the funk odyssey client.