Enterprise APs at the water utility authenticate users via RADIUS, but the AP-to-AAA shared secret remains the vendor default. What is wrong with that authentication design?
Select an answer to reveal the explanation.
Short Explanation
802.1X can be picture-perfect and still trip over a default RADIUS secret—that’s the AP’s handshake with AAA. Change it, protect it. AES on the air doesn’t forgive a factory secret on the wire to RADIUS.
Full Explanation
Enterprise authentication design includes securing communication between the NAS (AP/controller) and the RADIUS server. A default shared secret allows unauthorized RADIUS clients or message forgery risks and leaves AAA trust incomplete even if air encryption is strong. Unique, protected secrets (and preferably RadSec where used) are part of a complete design; EAP-TLS does not remove the need to authenticate the RADIUS client relationship.