The figure below describes the PAC's construction. A PAC consists of the PAC-Opaque, PAC Key, and PAC-Info fields. The PAC-Info field contains the A-ID. Figure 2: PAC's Process Flow PAC Provisioning In Secure RADIUS, the PAC key is provisioned into each device during authentication to derive the shared secret. Since the RADIUS ACS does not store the PAC key for each device, the clients must also send an additional RADIUS attribute containing the PAC-Opaque field, which is a variable length field that can only be interpreted by the server to recover the required information and validate the peer’s identity and authentication.
For example, the PAC-Opaque field may include the PAC key and the PAC’s peer identity. The PAC-Opaque field format and contents are specific to the PAC server on which it is issued. The RADIUS server obtains the PAC Key from the PAC-Opaque field and derives the shared secret the same way clients do. Secure RADIUS only modifies the way shared secret is derived and not its usage. EAP-FAST Phase 0 is used to automatically provision a client with a PAC. Deploying Devices in High Availability Setup Perform the following steps when deploying devices in an HA setup: Cisco TrustSec Overview PAC Provisioning Cisco TrustSec Overview 6