To enable WPA with the Aegis server, we had to include the EAP module (PEAP) in the authentication, authorization and accounting policy and configure the EAP module's authentication type (MS-CHAPv2).
Like most RADIUS servers, Aegis can enforce access control with check attributes, which specify that a client can access the WLAN through certain APs. The server uses the reply attributes to give user-specific parameters to the AP. These attributes, such as inactivity time-out and session time-out, work only if the AP device supports them. In our tests, Proxim's AP-600 worked well with the WPA-based Aegis setup.
To ensure that the client devices could access the secure WPA infrastructure, we included the CA issuing the server certificate in the trusted-root CA store of the client. So when the client authenticated, the server's identity was verified first and then the client's identity, with PAP, CHAP or MS-CHAPv2.
We also ran Funk's Odyssey RADIUS server to enable a PDA. You provision it much the same way as the Aegis RADIUS server, except in how you define your EAP type and point to server certificates. In the Odyssey server, all EAP modules are included by default and only need to be enabled. Odyssey's management interface defines a single server certificate for TLS, TTLS and PEAP, whereas Aegis lets you define multiple certificates through its console.
We set up a secure channel through a tunneled encryption mechanism using EAP's TTLS, and configured our Pocket PC PDA using the Odyssey Client for Pocket PC configuration manager. The Odyssey server can authenticate users only against an NT domain or Active Directory, so the user profile requires that you use the domain name with the user name.