Cisco Cisco Access Registrar 4.2 Spécifications télécharger pdf (Page 207)

100

101

5-23

Cisco Wireless LAN Controller Configuration Guide

OL-13826-01

Chapter 5 Configuring Security Solutions

Configuring Local EAP

For example, information similar to the following appears for the show ldap summary command:

LDAP Servers

Idx Host IP addr Port Enabled

--- --------------- ----- -------

1 10.10.10.10 389 Yes

Information similar to the following appears for the show ldap statistics command:

LDAP Servers

Server 1........................ 10.10.10.10 389

5. To make sure the controller can reach the LDAP server, enter this command:

ping server_ip_address

6. To save your changes, enter this command:

save config

7. To enable or disable debugging for LDAP, enter this command:

debug aaa ldap {enable | disable}

Configuring Local EAP

Local EAP is an authentication method that allows users and wireless clients to be authenticated locally.

It is designed for use in remote offices that want to maintain connectivity to wireless clients when the

backend system becomes disrupted or the external authentication server goes down. When you enable

local EAP, the controller serves as the authentication server and the local user database, thereby

removing dependence on an external authentication server. Local EAP retrieves user credentials from

the local user database or the LDAP backend database to authenticate users. Local EAP supports LEAP,

EAP-FAST, EAP-TLS, PEAPv0/MSCHAPv2, and PEAPv1/GTC authentication between the controller

and wireless clients.

Note The LDAP backend database supports these local EAP methods: EAP-TLS, EAP-FAST/GTC, and

PEAPv1/GTC. LEAP, EAP-FAST/MSCHAPv2, and PEAPv0/MSCHAPv2 are also supported but only

if the LDAP server is set up to return a clear-text password. For example, Microsoft Active Directory is

not supported because it does not return a clear-text password. If the LDAP server cannot be configured

to return a clear-text password, LEAP, EAP-FAST/MSCHAPv2, and PEAPv0/MSCHAPv2 are not

supported.

Note If any RADIUS servers are configured on the controller, the controller tries to authenticate the wireless

clients using the RADIUS servers first. Local EAP is attempted only if no RADIUS servers are found,

either because the RADIUS servers timed out or no RADIUS servers were configured. If four RADIUS

servers are configured, the controller attempts to authenticate the client with the first RADIUS server,

then the second RADIUS server, and then local EAP. If the client attempts to then reauthenticate

manually, the controller tries the third RADIUS server, then the fourth RADIUS server, and then local

EAP. If you never want the controller to try to authenticate clients using an external RADIUS server,

enter these CLI commands in this order:

config wlan disable wlan_id

config wlan radius_server auth disable wlan_id

config wlan enable wlan_id

1 2 ... 202 203 204 205 206 207 208 209 210 211 212 ... 635 636

Commentaires sur ces manuels

Pas de commentaire

Cisco Cisco Access Registrar 4.2 Spécifications Page 207

Commentaires sur ces manuels