POLICIES – RADIUS (tab)

Select the protocol group from the drop-down list.

Possible values:

• Default. Use the setting of the parent policy.
• Any. Any RADIUS protocol suggested by the client, whether for wireless or non-wireless, may be used.

• Secure. Enable all of the following EAP or PEAP protocols::

  • EAP-TTLSv0
  • PEAPv0
  • PEAPv1

• Custom. Select one or more of the following protocols:

  • EAP-TTLSv0
  • PEAP v0
  • PEAP v1
  • PAP
  • CHAP
  • MSCHAP
  • MSCHAP2

If you enable EAP-TTLSv0, OneSpan Authentication Server will always propose it as the first option for the outer authentication method during protocol negotiation with the RADIUS client. Some RADIUS clients, which do not support EAP-TTLSv0, may interpret this as a negotiation failure and terminate the authentication request. If you experience this issue, you can circumvent it by disabling all RADIUS protocols except the ones that are explicitly supported by the RADIUS client.

The length of time a machine may be connected before a fast-reconnect is required (in seconds).

Two RADIUS return attributes are returned to the WAP with an Access-Accept:

• Session-Timeout (value: Wireless Session Lifetime)
• Terminate-Action (value: RADIUS-Request)

The used WAP may not support these attributes, and may use its own configured defaults.

Default value: 3600 (1 hour)

The length of time allowed before a full authentication, including the user supplying an OTP, is required (in seconds).

Possible values: 3600–2147483647

Default value: 86400.

The maximum number of fast reconnects (fast re-authentication) allowed between full OTP authentications, including the user supplying an OTP.

Possible values:

• Default. Use the setting of the parent policy.
• Limited. Enter a maximum value in the box below.
• Unlimited. Allow unlimited fast reconnects within the TLS session lifetime.

Default value: 48

If roaming wireless connections will be in use, the Maximum Fast Reconnect Count setting should be set higher than if static wireless connections are used. If you set this value to 0, you effectively disable fast reconnect.