EAP-TLS with just an Aruba Instant AP?

In this video, I will show you how to configure EAP-TLS for WLAN clients with just the Instant Access Point, so without external RADIUS servers. Basic steps are uploading the certificate to be used by the AP and the root CA for your clients, configure these certificates to be used and create your WPA2-Enterprise network using the Internal authentication server.

[@danbarrett231]

What platform does the cert need to be download as form the CA? For example, Apache, one of the various Microsoft IIS, Tomcat, Other, etc?

[@sureshhkumar955]

How authorization will happen ? If we have multiple users, We will have multiple client cert based on there names, so how authorization will happen ?

[@hermanrobers]

It's recommended to use an external RADIUS server, for example ClearPass to have full control. Doing EAP-TLS on the AP itself is only for corner cases where you can't have a RADIUS server. With this setup, any certificate issued by the TrustedCA will be accepted and authenticated. While I have not tried, you may be successful in the access rules (kzbin.info/www/bejne/aX7KaaNsp7R_nqM) if you switch that to role-based you can create role-assignment based on the username sent. Again, with an external RADIUS server you will have much better control and visibility.

[@brentvdx]

This is EAP-TTLS on the client side, but called EAP-TLS on the instant Ap?