Hello all, i'am using here a Fortigate 60E with some Fortiaps 433F. The Fortgate is linked with LDAP and Radiusserver. WLAN Entperprise WPA2 and WPA3 works with this auth methods: TTLS + PAPTTLS + GTCPEAP + GTC I have tried to find reasonable info's as to what the difference is, but have not found it. So my question is: "What is the difference between the methods, what should I use?". Thanks a lotBest Regards :)

Visitor III

Solved

Difference between WLAN auth methods

6 replies
3425 views

Hello all,

i'am using here a Fortigate 60E with some Fortiaps 433F. The Fortgate is linked with LDAP and Radiusserver. WLAN Entperprise WPA2 and WPA3 works with this auth methods:

TTLS + PAP
TTLS + GTC
PEAP + GTC

I have tried to find reasonable info's as to what the difference is, but have not found it. So my question is: "What is the difference between the methods, what should I use?".

Thanks a lot

Best Regards :)

ebilcariAnswer

Staff

Basically yes, RADIUS server is always recommended, FortiAuthenticator for example can offers a scalable solution. You can aim for the most secure one EAP-TLS (user certificate based).

Anyway even if you are using EAP-TTLS/PAP (that is passing the traffic in clear text in inner tunnel) this is still secure because the information is exchanged via the EAP tunnel that encrypts the traffic with TLS. You have to configure manually the supplicant on end devices and be careful to select only the trusted domain and CA to avoid any "honey pot" scenario.

Emirjon

Jean-Philippe_P

Staff & Editor

Hello fireon,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Jean-Philippe - Fortinet Community Team

ebilcari

Staff

The authentication methods you mentioned are used as part of EAP protocol that is an open standard protocol. Some information can be found here: https://docs.fortinet.com/document/fortiauthenticator/6.5.2/administration-guide/125951/extensible-authentication-protocol

There are three participants in this communication: Supplicant (end host) <-> Authenticator (FGT) <-> Auth. Server (RADIUS server).

The role of the authenticator (FGT/FAP) is just to translate the requests from EAPoL to RADIUS without worrying too much about the method used. Most of the related configurations are done in the Supplicant and the RADIUS server.

The methods have pros and cons, PEAP/MSCHAPv2 is more popular in windows hosts and EAP-TLS is the most secure, some of them are deprecated.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Limitations-when-using-WPA2-Enterprise-WiFi-with/ta-p/240585

Emirjon

fireonAuthor

Visitor III

I understand, and thanks for the link. So of course it is also client dependent what this understands. Thought it always had also still effect how well and how fast a device can log on.

In principle, if I understand correctly, logging in directly via Fortigate is not the best idea, since everything has to be transmitted in plain text. But that also means it doesn't matter which of my 3 methods I use. Right?

https://deepdoc.at

ebilcariAnswer

Staff

Basically yes, RADIUS server is always recommended, FortiAuthenticator for example can offers a scalable solution. You can aim for the most secure one EAP-TLS (user certificate based).

Anyway even if you are using EAP-TTLS/PAP (that is passing the traffic in clear text in inner tunnel) this is still secure because the information is exchanged via the EAP tunnel that encrypts the traffic with TLS. You have to configure manually the supplicant on end devices and be careful to select only the trusted domain and CA to avoid any "honey pot" scenario.

Emirjon

fireonAuthor

Visitor III

Change to Radius an it works perfectly.

https://deepdoc.at

ebilcari

Staff

I'm glad to hear that, thank you for your feedback.

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO