Cisco Cisco Aironet 350 Wireless Bridge 기술 매뉴얼
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
Overview of Local RADIUS Server Feature
Usually an external RADIUS Server is used to authenticate users. In some cases, this is not a feasible solution.
In these situations, an access point can be made to act as a RADIUS Server. Here, users are authenticated
against the local database configured in the access point. This is called a Local RADIUS Server feature. You
can also make other access points in the network use the Local RADIUS Server feature on an access point.
For more information on this, refer to Configuring Other Access Points to Use the Local Authenticator.
In these situations, an access point can be made to act as a RADIUS Server. Here, users are authenticated
against the local database configured in the access point. This is called a Local RADIUS Server feature. You
can also make other access points in the network use the Local RADIUS Server feature on an access point.
For more information on this, refer to Configuring Other Access Points to Use the Local Authenticator.
Configure
The configuration describes how to configure LEAP and Local Radius Server Feature on an access point. The
Local RADIUS Server feature was introduced in Cisco IOS Software Release 12.2(11)JA. Refer to LEAP
Authentication with RADIUS Server for background information on how to configure LEAP with an external
RADIUS Server.
Local RADIUS Server feature was introduced in Cisco IOS Software Release 12.2(11)JA. Refer to LEAP
Authentication with RADIUS Server for background information on how to configure LEAP with an external
RADIUS Server.
As with most password−based authentication algorithms, Cisco LEAP is vulnerable to dictionary attacks. This
is not a new attack or new vulnerability of Cisco LEAP. You must create a strong password policy to mitigate
dictionary attacks, that would include strong passwords and frequent new passwords. Refer to Dictionary
Attack on Cisco LEAP for more information about dictionary attacks and how to prevent them.
is not a new attack or new vulnerability of Cisco LEAP. You must create a strong password policy to mitigate
dictionary attacks, that would include strong passwords and frequent new passwords. Refer to Dictionary
Attack on Cisco LEAP for more information about dictionary attacks and how to prevent them.
This document assumes this configuration for both CLI and GUI:
The IP address of the access point is 10.77.244.194.
1.
The SSID used is cisco, which is mapped to VLAN 1.
2.
The usernames are user1 and user2, which are mapped to the group Testuser.
3.
CLI Configuration
Access Point
ap#show running−config
Building configuration...
.
.
.
aaa new−model
!−−− This command reinitializes the authentication,
!−−− authorization and accounting functions.
!
!
aaa group server radius rad_eap
server 10.77.244.194 auth−port 1812 acct−port 1813
!−−− A server group for RADIUS is created called "rad_eap"
!−−− that uses the server at 10.77.244.194 on ports 1812 and 1813.
.
.
.
aaa authentication login eap_methods group rad_eap