802.1x, Encryption and Authentication - EAP-FAST

Extensible Authentication Protocol - Flexible Authentication via Secure Tunnelling (EAP-FAST) developed by Cisco, submitted to IETF.

+ LEAP uses strong passwords, but LEAP-FAST supports single sign-on for Windows
+ Doesn't use certificates
+ Supported on Windows
+ Full support for 802.1x, AES, 802.11i and TKIP
+ Supports WPA/2 authenticated key management on Win2k/XP
+ Supports roaming and centralised key management CCKM using Wireless Domain Services
+ Supports password expiration/change

PHASE0 (provision PAC) - client dynamically provisioned a Protected Access Credential (PAC) via a secure tunnel
PHASE1 (establish secure tunnel) - Client and AAA server such as ACS authenticate each other and establish secure tunnel
PHASE2 (client authentication) - Client sends it's credentials to the radius server, the radius server authenticates and establishes a client authorisation policy.

A wireless client can only transmit EAP until authenticated by AAA, client sends EAP over LAN (EAPOL) start frame to the AP, the AP sends a request/identify to the client. The client sends it's network identifier NAI to the AP, which the AP sends to the radius server.

The client and server perform mutual authentication (phase 1/2) and the RADIUS server sends a session key to the AP in a success packet. The client/server then negotiate a session key, the client and AP use the key during the session. When the session completes an EAPOL logoff packet is sent to the AP.