A campus WLAN now requires EAP-TLS. A laptop has a working certificate profile and an older PEAP profile, and it keeps offering PEAP. A laptop that is set to the certificate profile joins. What should the other laptops change?
Select an answer to reveal the explanation.
Short Explanation
The laptop is introducing itself with the old method because that profile is still first in line. Your WLAN wants the certificate. Select the EAP-TLS profile, because a shorter lease will not reorder the profiles.
Full Explanation
A supplicant offers the profile it is set to use. These laptops still prefer PEAP, and the WLAN now requires EAP-TLS, so the offer fails. A laptop that is set to the certificate profile joins. The other laptops need that EAP-TLS profile selected. Hiding the SSID does not convert PEAP into EAP-TLS. DHCP does not delete an authentication profile when the lease renews. The data rate does not make a PEAP offer valid on an EAP-TLS WLAN. The method is in the profile, not in the PHY rate. The laptop has both a PEAP profile and an EAP-TLS profile and prefers PEAP. The WLAN now requires EAP-TLS. Select the TLS profile. Check one live client after the change and do not retune the rest of the floor until that client matches the result you expected. Exam caveat: the certificate profile still needs a certificate in the store that profile uses. Selecting EAP-TLS on a laptop with no certificate fails for a different reason. Operational check: select the certificate profile on a failing laptop and confirm the controller sees EAP-TLS instead of PEAP.