Setting up RADIUS for Management Users
Remote Authentication Dial-In User Service (RADIUS) is a client/server protocol that provides centralized security for users attempting to gain management access to a network. It serves as a backend database similar to local and TACACS+ and provides authentication and accounting services:
-
Authentication: The process of verifying users when they attempt to log into the controller.
Users must enter a valid username and password in order for the controller to authenticate users to the RADIUS server. If multiple databases are configured, you can specify the sequence in which the backend database must be tried.
Note
The management password for RADIUS server or controller, which is set for local authentication, is limited to 127 characters in length.
Note
Clients using Microsoft Windows 10 with default (zero-touch config) supplicant fail to connect to controller when there is no CA certificate to validate the server certificate. This is because the supplicant does not pop up a window to accept the server certificate and silently rejects the 802.1X authentication. Therefore, we recommend that you do either of the following:-
Manually install a third-party CA certificate on the AAA server, which the clients using Microsoft Windows 10 can trust.
-
Use any other supplicant, such as Cisco AnyConnect, which pops up a window to trust or not trust the server certificate. If you accept the trust certificate, then the client is authenticated.
-
-
Accounting: The process of recording user actions and changes.
Whenever a user successfully executes an action, the RADIUS accounting server logs the changed attributes, the user ID of the person who made the change, the remote host where the user is logged in, the date and time when the command was executed, the authorization level of the user, and a description of the action performed and the values provided. If the RADIUS accounting server becomes unreachable, users are able to continue their sessions uninterrupted.
RADIUS uses User Datagram Protocol (UDP) for its transport. It maintains a database and listens on UDP port 1812 for incoming authentication requests and UDP port 1813 for incoming accounting requests. The controller, which requires access control, acts as the client and requests AAA services from the server. The traffic between the controller and the server is encrypted by an algorithm defined in the protocol and a shared secret key configured on both devices.
You can configure multiple RADIUS accounting and authentication servers. For example, you may want to have one central RADIUS authentication server but several RADIUS accounting servers in different regions. If you configure multiple servers of the same type and the first one fails or becomes unreachable, the controller automatically tries the second one, then the third one if necessary, and so on.
When a management user is authenticated using a RADIUS server, only the PAP protocol is used. For web authentication users, PAP, MSCHAPv2 and MD5 security mechanisms are supported.
RADIUS Server Support
-
You can configure up to 32 RADIUS authentication and accounting servers.
-
If multiple RADIUS servers are configured for redundancy, the user database must be identical in all the servers for the backup to work properly.
-
One Time Passwords (OTPs) are supported on the controller using RADIUS. In this configuration, the controller acts as a transparent passthrough device. The controller forwards all client requests to the RADIUS server without inspecting the client behavior. When using OTP, the client must establish a single connection to the controller to function properly. The controller currently does not have any intelligence or checks to correct a client that is trying to establish multiple connections.
-
To create a read-only controller user on the RADIUS sever, you must set the service type to NAS prompt instead of Callback NAS prompt. If you set the service type to Callback NAS Prompt, the user authentication fails while setting it to NAS prompt gives the user read-only access to the controller.
Also, the Callback Administrative service type gives the user the lobby ambassador privileges to the controller.
-
If RADIUS servers are mapped per WLAN, then controller do not use RADIUS server from the global list on that WLAN.
-
To configure the RADIUS server:
-
Using Access Control Server (ACS): See the latest Cisco Secure Access Control System guide at https://www.cisco.com/c/en/us/support/security/secure-access-control-system/products-user-guide-list.html.
-
Using Identity Services Engine (ISE): See the Configuring External RADIUS Servers section in the Cisco Identity Services Engine Administrator Guide at https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html.
-
Primary and Fallback RADIUS Servers
The primary RADIUS server (the server with the lowest server index) is assumed to be the most preferable server for the controller. If the primary server becomes unresponsive, the controller switches to the next active backup server (the server with the next lowest server index). The controller continues to use this backup server, unless you configure the controller to fall back to the primary RADIUS server when it recovers and becomes responsive or to a more preferable server from the available backup servers.
Note |
Functionality change introduced in Release 8.5.140.0: When RADIUS aggressive failover for controller is disabled: Packet is retried for six times unless there is a termination from clients. The RADIUS server (both AUTH and ACCT) is marked unreachable after three timeout events (18 consecutive retries) from multiple clients (previously, from exactly three clients). When RADIUS aggressive failover for controller is enabled: Packet is retried for six times unless there is a termination from clients. The RADIUS server (both AUTH and ACCT) is marked unreachable after one timeout event (6 consecutive retries) from multiple clients (previously, from exactly one client). It means 18 consecutive retries per RADIUS server (both AUTH and ACCT) can be from multiple clients. Therefore, it is not always guaranteed that each packet will be retried for six times. |
RADIUS DNS
You can use a fully qualified domain name (FQDN) that enables you to change the IP address when needed, for example, for load balancing updates. A submenu, DNS, is added to the Security > AAA > RADIUS menu, which you can use to get RADIUS IP information from a DNS. The DNS query is disabled by default.
This section contains the following subsections:
Restrictions on Configuring RADIUS
-
You can configure the session timeout value for RADIUS server up to 65535 seconds. The controller does not support configuring session timeout value for RADIUS server higher than 65535 seconds.
-
The session timeout value configured on RADIUS server if set beyond 24 days, then the RADIUS session timeout value does not override the session timeout value configured locally over a WLAN.
-
A network address translation (NAT) scenario when IPSec is enabled on traffic between the controller and RADIUS server is not supported.
Configuring RADIUS Authentication (GUI)
Procedure
Step 1 |
Choose .This page lists any RADIUS servers that have already been configured.
|
||
Step 2 |
From the Auth Called Station ID Type drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message for network users. The following options are available:
|
||
Step 3 |
From the MAC Delimiter drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message for network users. The following options are available:
|
||
Step 4 |
Click Apply. Perform one of the following:
|
||
Step 5 |
If you are adding a new server, choose a number from the Server Index (Priority) drop-down list to specify the priority order of this server in relation to any other configured RADIUS servers providing the same service. |
||
Step 6 |
If you are adding a new server, enter the IP address of the RADIUS server in the Server IP Address text box.
|
||
Step 7 |
From the Shared Secret Format drop-down list, choose ASCII or Hex to specify the format of the shared secret key to be used between the controller and the RADIUS server. The default value is ASCII. |
||
Step 8 |
In the Shared Secret and Confirm Shared Secret text boxes, enter the shared secret key to be used for authentication between the controller and the server.
|
||
Step 9 |
If you are configuring a new RADIUS authentication server and want to enable AES key wrap, which makes the shared secret between the controller and the RADIUS server more secure, follow these steps:
|
||
Step 10 |
(Optional) Check the Apply Cisco ISE Default settings check box. Enabling Cisco ISE Default settings changes the following parameters:
The Layer 2 security is either WPA+WPA2 with 802.1X or None with MAC filtering. You can change these default settings if required. |
||
Step 11 |
If you are adding a new server, enter the RADIUS server’s UDP port number for the interface protocols in the Port Number text box. The valid range is 1 to 65535, and the default value is 1812 for authentication. |
||
Step 12 |
From the Server Status text box, choose Enabled to enable this RADIUS server or choose Disabled to disable it. The default value is enabled. |
||
Step 13 |
If you are configuring a new RADIUS authentication server, from the Support for CoA drop-down list, choose Enabled to enable change of authorization, which is an extension to the RADIUS protocol that allows dynamic changes to a user session, or choose Disabled to disable this feature. By default, this is set to Disabled state. Support for CoA includes support for disconnecting users and changing authorizations applicable to a user session and supports disconnect and change of authorization (CoA) messages. Disconnect messages cause a user session to be terminated immediately where CoA messages modify session authorization attributes such as data filters. |
||
Step 14 |
In the Server Timeout box, enter the number of seconds between retransmissions. The valid range is 2 to 30 seconds, and the default value is 2 seconds. Check the Key Wrap check box.
|
||
Step 15 |
Check the Network User check box to enable network user authentication, or uncheck it to disable this feature. The default value is unchecked. If you enable this feature, this entry is considered the RADIUS authentication server for network users. If you did not configure a RADIUS server entry on the WLAN, you must enable this option for network users. |
||
Step 16 |
If you are configuring a RADIUS authentication server, check the Management check box to enable management authentication, or uncheck the check box to disable this feature. The default value is checked. If you enable this feature, this entry is considered the RADIUS authentication server for management users, and authentication requests go to the RADIUS server. |
||
Step 17 |
Enter the Management Retransmit Timeout value, which denotes the network login retransmission timeout for the server. |
||
Step 18 |
If you want to use a tunnel gateway as AAA proxy, check the Tunnel Proxy check box. The gateway can function as a proxy RADIUS server as well as a tunnel gateway. |
||
Step 19 |
Check the PAC Provisioning check box to enable PAC for RADIUS authentication, or uncheck it to disable this feature. The default value is unchecked. If you enable this feature, the entry is considered by the RADIUS authentication server to provision PAC for users.
|
||
Step 20 |
Check the IPSec check box to enable the IP security mechanism, or uncheck the check box to disable this feature. The default value is unchecked.
|
||
Step 21 |
From the IPSec Profile Name drop-down list, choose the IPSec profile. You can create an IPSec profile by navigating to . For more information, see the "IPSec Profile" section in the "Controller Security" chapter. |
||
Step 22 |
Click Apply. |
||
Step 23 |
Click Save Configuration. |
||
Step 24 |
Repeat the previous steps if you want to configure any additional services on the same server or any additional RADIUS servers. |
Configuring RADIUS Accounting Servers (GUI)
Procedure
Step 1 |
Choose .This page lists any RADIUS servers that have already been configured.
|
||
Step 2 |
From the Acct Called Station ID Type drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message. The following options are available:
|
||
Step 3 |
From the MAC Delimiter drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message. The following options are available:
|
||
Step 4 |
Check the AP Events Accounting check box to enable sending of accounting requests to RADIUS server. If there are any network issues, the APs keep joining and disjoining from the controller. Enabling the AP Events Accounting option ensures that these events are monitored to help you detect the network issues. This option ensures that accounting requests are sent to the RADIUS server if the APs join or disjoin from the controller.
|
||
Step 5 |
Click Apply. Perform one of the following:
|
||
Step 6 |
If you are adding a new server, choose a number from the Server Index (Priority) drop-down list to specify the priority order of this server in relation to any other configured RADIUS servers providing the same service. |
||
Step 7 |
If you are adding a new server, enter the IP address of the RADIUS server in the Server IP Address text box.
|
||
Step 8 |
From the Shared Secret Format drop-down list, choose ASCII or Hex to specify the format of the shared secret key to be used between the controller and the RADIUS server. The default value is ASCII. |
||
Step 9 |
In the Shared Secret and Confirm Shared Secret text boxes, enter the shared secret key to be used for accounting between the controller and the server.
|
||
Step 10 |
If you are adding a new server, enter the RADIUS server’s UDP port number for the interface protocols in the Port Number text box. The valid range is 1 to 65535, and the default value is 1813 for accounting. |
||
Step 11 |
From the Server Status text box, choose Enabled to enable this RADIUS server or choose Disabled to disable it. The default value is enabled. |
||
Step 12 |
In the Server Timeout text box, enter the number of seconds between retransmissions. The valid range is 2 to 30 seconds, and the default value is 2 seconds. |
||
Step 13 |
Check the Network User check box to enable network user accounting, or uncheck it to disable this feature. The default value is unchecked. If you enable this feature, this entry is considered the RADIUS accounting server for network users. If you did not configure a RADIUS server entry on the WLAN, you must enable this option for network users. |
||
Step 14 |
Check the Management check box to enable management accounting, or uncheck the check box to disable this feature. The default value is checked. If you enable this feature, this entry is considered the RADIUS accounting server for management users, and accounting requests go to the RADIUS server. |
||
Step 15 |
If you want to use a tunnel gateway as AAA proxy, check the Tunnel Proxy check box. The gateway can function as a proxy RADIUS server as well as a tunnel gateway. |
||
Step 16 |
Check the PAC Provisioning check box to enable PAC for RADIUS accounting, or uncheck it to disable this feature. The default value is unchecked. If you enable this feature, the entry is considered by the RADIUS accounting server to provision PAC for users.
|
||
Step 17 |
Check the IPSec check box to enable the IP security mechanism, or uncheck the check box to disable this feature. The default value is unchecked.
|
||
Step 18 |
From the IPSec Profile Name drop-down list, choose the IPSec profile. You can create an IPSec profile by navigating to . For more information, see the "IPSec Profile" section in the "Controller Security" chapter. |
||
Step 19 |
Click Apply. |
||
Step 20 |
Click Save Configuration. |
||
Step 21 |
Repeat the previous steps if you want to configure any additional services on the same server or any additional RADIUS servers. |
Configuring RADIUS (CLI)
Procedure
RADIUS Authentication Attributes Sent by the Controller
The following tables identify the RADIUS authentication attributes sent between the controller and the RADIUS server in access-request and access-accept packets.
Attribute ID |
Description |
---|---|
1 | User-Name |
2 | Password |
3 | CHAP-Password |
4 | NAS-IP-Address |
5 | NAS-Port |
6 | Service-Type |
12 | Framed-MTU |
30 | Called-Station-ID (MAC address) |
31 | Calling-Station-ID (MAC address) |
32 | NAS-Identifier |
33 | Proxy-State |
60 | CHAP-Challenge |
61 | NAS-Port-Type |
79 | EAP-Message |
Attribute ID |
Description |
---|---|
1 | Cisco-LEAP-Session-Key |
2 | Cisco-Keywrap-Msg-Auth-Code |
3 | Cisco-Keywrap-NonCE |
4 | Cisco-Keywrap-Key |
5 | Cisco-URL-Redirect |
6 | Cisco-URL-Redirect-ACL |
Note |
These Cisco-specific attributes are not supported: Auth-Algo-Type and SSID. |
Attribute ID |
Description |
---|---|
6 | Service-Type. To specify read-only or read-write access to controllers through RADIUS authentication, you must set the Service-Type attribute (6) on the RADIUS server to Callback NAS Prompt for read-only access or to Administrative for read-write privileges. |
8 | Framed-IP-Address |
25 | Class |
26 | Vendor-Specific |
27 | Timeout |
29 | Termination-Action |
40 | Acct-Status-Type |
64 | Tunnel-Type |
79 | EAP-Message |
81 | Tunnel-Group-ID |
Note |
Message authentication is not supported. |
Attribute ID |
Description |
---|---|
11 | MS-CHAP-Challenge |
16 | MS-MPPE-Send-Key |
17 | MS-MPPE-Receive-Key |
25 | MS-MSCHAP2-Response |
26 | MS-MSCHAP2-Success |
Attribute ID |
Description |
||
---|---|---|---|
1 | VAP-ID | ||
3 | DSCP | ||
4 | 8021P-Type | ||
5 | VLAN-Interface-Name | ||
6 | ACL-Name | ||
7 | Data-Bandwidth-Average-Contract | ||
8 | Real-Time-Bandwidth-Average-Contract | ||
9 | Data-Bandwidth-Burst-Contract | ||
10 | Real-Time-Bandwidth-Burst-Contract | ||
11 | Guest-Role-Name
|
||
13 | Data-Bandwidth-Average-Contract-US | ||
14 | Real-Time-Bandwidth-Average-Contract-US | ||
15 | Data-Bandwidth-Burst-Contract-US | ||
16 | Real-Time-Bandwidth-Burst-Contract-US |
Authentication Attributes Honored in Access-Accept Packets (Airespace)
This section lists the RADIUS authentication Airespace attributes currently supported on the controller.
VAP ID
This attribute indicates the WLAN ID of the WLAN to which the client should belong. When the WLAN-ID attribute is present in the RADIUS Access Accept, the system applies the WLAN-ID (SSID) to the client station after it authenticates. The WLAN ID is sent by the controller in all instances of authentication except IPsec. In case of web authentication, if the controller receives a WLAN-ID attribute in the authentication response from the AAA server, and it does not match the ID of the WLAN, authentication is rejected. The 802.1X/MAC filtering is also rejected. The rejection, based on the response from the AAA server, is because of the SSID Cisco AVPair support. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| WLAN ID (VALUE) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 1
-
Vendor length – 4
-
Value – ID of the WLAN to which the client should belong.
QoS-Level
This attribute indicates the QoS level to be applied to the mobile client's traffic within the switching fabric, as well as over the air. This example shows a summary of the QoS-Level Attribute format. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| QoS Level |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 2
-
Vendor length – 4
-
Value – Three octets:
-
3 – Bronze (Background)
-
0 – Silver (Best Effort)
-
1 – Gold (Video)
-
2 – Platinum (Voice)
-
Differentiated Services Code Point (DSCP)
DSCP is a packet header code that can be used to provide differentiated services based on the QoS levels. This attribute defines the DSCP value to be applied to a client. When present in a RADIUS Access Accept, the DSCP value overrides the DSCP value specified in the WLAN profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DSCP (VALUE) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 3
-
Vendor length – 4
-
Value – DSCP value to be applied for the client.
802.1p Tag Type
802.1p VLAN tag received from the client, defining the access priority. This tag maps to the QoS Level for client-to-network packets. This attribute defines the 802.1p priority to be applied to the client. When present in a RADIUS Access Accept, the 802.1p value overrides the default specified in the WLAN profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 802.1p (VALUE) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 4
-
Vendor length – 3
-
Value – 802.1p priority to be applied to a client.
VLAN Interface Name
This attribute indicates the VLAN interface a client is to be associated to. A summary of the Interface-Name Attribute format is shown below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Interface Name...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – >7
-
Vendor-Id – 14179
-
Vendor type – 5
-
Vendor length – >0
-
Value – A string that includes the name of the interface the client is to be assigned to.
Note
This attribute only works when MAC filtering is enabled or if 802.1X or WPA is used as the security policy.
ACL-Name
This attribute indicates the ACL name to be applied to the client. A summary of the ACL-Name Attribute format is shown below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ACL Name...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – >7
-
Vendor-Id – 14179
-
Vendor type – 6
-
Vendor length – >0
-
Value – A string that includes the name of the ACL to use for the client
AAA Override for IPv6 ACLs
In order to support centralized access control through a centralized AAA server such as the Cisco Identity Services Engine (ISE) or ACS, the IPv6 ACL can be provisioned on a per-client basis using AAA Override attributes. In order to use this feature, the IPv6 ACL must be configured on the controller and the WLAN must be configured with the AAA Override feature enabled. The client will be de-authenticated if the ACL is not preconfigured on the controller. The actual named AAA attribute for an IPv6 ACL is Airespace-IPv6-ACL-Name, which is similar to the Airespace-ACL-Name attribute that is used for provisioning an IPv4-based ACL. The AAA attribute returned contents should be a string equal to the name of the IPv6 ACL as configured on the controller.
Data Bandwidth Average Contract
This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied for a client for non-realtime traffic such as TCP. This value is specific for downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Data Bandwidth Average Contract value overrides the Average Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data Bandwidth Average Contract...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 7
-
Vendor length – 4
-
Value – A value in kbps
Real Time Bandwidth Average Contract
This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied to a client for realtime traffic such as UDP. This value is specific for downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Real Time Bandwidth Average Contract value overrides the Average Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Real Time Bandwidth Average Contract...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 8
-
Vendor length – 4
-
Value – A value in kbps
Data Bandwidth Burst Contract
This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for non-realtime traffic such as TCP. This value is specific to downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Data Bandwidth Burst Contract value overrides the Burst Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data Bandwidth Burst Contract...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 9
-
Vendor length – 4
-
Value – A value in kbps
Real Time Bandwidth Burst Contract
This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for realtime traffic such as UDP. This value is specific to downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Real Time Bandwidth Burst Contract value overrides the Burst Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
Note |
If you try to implement Average Data Rate and Burst Data Rate as AAA override parameters to be pushed from a AAA server, both Average Data Rate and Burst Data Rate have to be sent from ISE. |
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Real Time Bandwidth Burst Contract...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 10
-
Vendor length – 4
-
Value – A value in kbps
Guest Role Name
This attribute provides the bandwidth contract values to be applied for an authenticating user. When present in a RADIUS Access Accept, the bandwidth contract values defined for the Guest Role overrides the bandwidth contract values (based on QOS value) specified for the WLAN. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| GuestRoleName ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 11
-
Vendor length – Variable based on the Guest Role Name length
-
Value – A string of alphanumeric characters
Data Bandwidth Average Contract Upstream
This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied to a client for non-realtime traffic such as TCP. This value is specific to upstream direction from wireless to wired. When present in a RADIUS Access Accept, the Data Bandwidth Average Contract value overrides the Average Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data Bandwidth Average Contract Upstream...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 13
-
Vendor length – 4
-
Value – A value in kbps
Real Time Bandwidth Average Contract Upstream
This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied to a client for realtime traffic such as UDP. This value is specific to upstream direction from wireless to wired. When present in a RADIUS Access Accept, the Real Time Bandwidth Average Contract value overrides the Average Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Real Time Bandwidth Average Contract Upstream...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 14
-
Vendor length – 4
-
Value – A value in kbps
Data Bandwidth Burst Contract Upstream
This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for non-realtime traffic such as TCP. This value is specific to upstream direction from wireless to wired. When present in a RADIUS Access Accept, the Data Bandwidth Burst Contract value overrides the Burst Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data Bandwidth Burst Contract Upstream...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 15
-
Vendor length – 4
-
Value – A value in kbps
Real Time Bandwidth Burst Contract Upstream
This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for realtime traffic such as UDP. This value is specific to upstream direction from wireless to wired. When present in a RADIUS Access Accept, the Real Time Bandwidth Burst Contract value overrides the Burst Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Real Time Bandwidth Burst Contract Upstream...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 16
-
Vendor length – 4
-
Value – A value in kbps
RADIUS Accounting Attributes
This table identifies the RADIUS accounting attributes for accounting requests sent from a controller to the RADIUS server.
Attribute ID |
Description |
---|---|
1 | User-Name |
4 | NAS-IP-Address |
5 | NAS-Port |
8 | Framed-IP-Address |
25 | Class |
30 | Called-Station-ID (MAC address) |
31 | Calling-Station-ID (MAC address) |
32 | NAS-Identifier |
40 | Accounting-Status-Type |
41 | Accounting-Delay-Time (Stop and interim messages only) |
42 | Accounting-Input-Octets (Stop and interim messages only) |
43 | Accounting-Output-Octets (Stop and interim messages only) |
44 | Accounting-Session-ID |
45 | Accounting-Authentic |
46 | Accounting-Session-Time (Stop and interim messages only) |
47 | Accounting-Input-Packets (Stop and interim messages only) |
48 | Accounting-Output-Packets (Stop and interim messages only) |
49 | Accounting-Terminate-Cause (Stop messages only) |
52 | Accounting-Input-Gigawords |
53 | Accounting-Output-Gigawords |
55 | Event-Timestamp |
64 | Tunnel-Type |
65 | Tunnel-Medium-Type |
81 | Tunnel-Group-ID |
IPv6-Framed-Prefix | |
190 | IPv6-Framed-Address |
This table lists the different values for the Accounting-Status-Type attribute (40).
Attribute ID |
Description |
||
---|---|---|---|
1 | Start | ||
2 | Stop | ||
3 | Interim-Update
|
||
7 | Accounting-On | ||
8 | Accounting-Off | ||
9-14 | Reserved for Tunneling Accounting | ||
15 | Reserved for Failed |
RADIUS VSA
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the network access server and the RADIUS server by using vendor specific attributes (VSA). VSA allow vendors to support their own extended attributes otherwise not suitable for general use. VSA are predefined in an XML file. You need to add the vendor specific attributes to the XML file and this XML file is downloaded to the controller. There is no configuration required on the controller to enable the support. The file contains the RADIUS attributes in a specific format as explained by the XML schema to specify the XML tags.
The XML file with the vendor specific attributes defined can be downloaded from a FTP server. The downloaded file is stored in the flash memory and retained across several reboot processes. The file is parsed upon successful download and each time when the controller boots up. The XML file can be uploaded to RADIUS server for authentication and accounting. Once controller parses these values, it stores the file in a separate data structures meant for vendor specific attributes storage. The controller uses these attributes value in authentication or accounting packets, or both based on specified usage format. If there are any errors in the file, the controller parsing fails, and the attributes are not applied. You should address the errors in the file or download the file from the FTP server again to the controller.
This section contains the following subsections:
Sample RADIUS AVP List XML File
You can use the sample RADIUS AVP list XML file for reference. The sample XML file contains only two attributes, one for authentication and the other for accounting. You can add more number of RADIUS attributes and value pairs but those attributes and value pairs should be appended in the format specified.
Note |
The maximum number of WLANs that is supported in an AVP download is 32. |
<?xml version="1.0" encoding="UTF-8"?>
<!--Sample XML file edited by User1-->
<radiusFile>
<avpList SSID_PROF="test" incAuth="true" incAcct="false">
<radiusAttributes>
<attributeName>Idle-Timeout</attributeName>
<vendorId>9</vendorId>
<attributeId>21</attributeId>
<valueType>INTEGER</valueType>
<attributeValue>100</attributeValue>
</radiusAttributes>
<radiusAttributes>
<attributeName>remote-name</attributeName>
<vendorId>9</vendorId>
<attributeId>26</attributeId>
<valueType>STRING</valueType>
<attributeValue>TEST</attributeValue>
</radiusAttributes>
</avpList>
<avpList SSID_PROF="test" incAcct="true">
<radiusAttributes>
<attributeName>Idle-Timeout</attributeName>
<vendorId>9</vendorId>
<attributeId>21</attributeId>
<valueType>INTEGER</valueType>
<attributeValue>100</attributeValue>
</radiusAttributes>
<radiusAttributes>
<attributeName>remote-name</attributeName>
<vendorId>9</vendorId>
<attributeId>26</attributeId>
<valueType>STRING</valueType>
<attributeValue>TEST</attributeValue>
</radiusAttributes>
</avpList>
</radiusFile>
Downloading RADIUS AVP List (GUI)
Procedure
Step 1 |
Choose Commands > Download File to open the Download File to Controller page. |
Step 2 |
From the File Type drop-down list, choose RADIUS AVP List. |
Step 3 |
From the Transfer Mode drop-down list, choose from the following options:
|
Step 4 |
In the IP Address text box, enter the IPv4 or IPv6 address of the server. |
Step 5 |
In the File Path text box, enter the directory path of the RADIUS AVP list. |
Step 6 |
In the File Name text box, enter the name of the RADIUS AVP list. |
Step 7 |
If you are using an FTP server, follow these steps:
|
Step 8 |
Click Download to download the RADIUS AVP list to the controller. A message appears indicating the status of the download. |
Step 9 |
Choose to open the Download RADIUS AVP List page. |
Step 10 |
From the WLAN SSID Profile name drop-down list, choose the WLAN SSID profile name. |
Step 11 |
Click the Auth AVP tab to view the RADIUS authentication attributes mapped to the AVP list. |
Step 12 |
Click the Acct AVP tab to view the RADIUS accounting attributes mapped to the AVP list. |
Uploading RADIUS AVP List (GUI)
Procedure
Step 1 |
Choose to open the Upload File from Controller page. |
Step 2 |
From the File Type drop-down list, choose RADIUS AVP List. |
Step 3 |
From the Transfer Mode drop-down list, choose from the following options:
|
Step 4 |
In the IP Address text box, enter the IPv4 or IPv6 address of the server. |
Step 5 |
In the File Path text box, enter the directory path of the RADIUS AVP list. |
Step 6 |
In the File Name text box, enter the name of the RADIUS AVP list. |
Step 7 |
If you are using an FTP server, follow these steps:
|
Step 8 |
Click Upload to upload the RADIUS AVP list from the controller. A message appears indicating the status of the upload. |
Uploading and Downloading RADIUS AVP List (CLI)
Procedure
Step 1 |
Log on to the controller CLI. |
Step 2 |
Download the RADIUS AVPs in the XML file format from the FTP server to the controller by entering this command: |
Step 3 |
Upload the XML file from the controller to the RADIUS server using the command: transfer upload datatype radius-avplist |
Step 4 |
Display VSA AVPs using the command: show radius avp-list ssid-profile-name |
Custom NAS-ID for RADIUS Accounting Using Downloadable RADIUS AVP
This feature addresses the need to have a configurable custom NAS-ID for custom accounting purposes on per WLAN basis. To download the XML file to the controller, you can use the FTP (server) method or use the transfer download method. This file is retained in the controller even after the reboot.
The custom AVP supersedes only the WLAN NAS-ID in the accounting messages. The priority of the other NAS-IDs is not affected.
Note |
|
Refer to RADIUS VSA section from the Controller Configuration guide to create the custom AVP file.
The following are the supported value type for NAS-ID (strictly uppercase):
-
SYSNAME
-
SYSIP
-
SYSMAC
-
APIP
-
APNAME
-
APMAC
-
APETHMAC
-
APGROUP
-
FLEXGROUP
-
SSID
-
APLOCATION
Note |
Software downgrade from the 8.6 to older version will not be supported for the new NAS-identifier AVP. If you decide to downgrade to an older version, perform the following steps:
|
Restrictions on Custom NAS-ID for RADIUS Accounting Using Downloadable RADIUS AVP
-
The custom NAS-ID string should contain minimum one value type and a maximum of three value type using ":" as the delimiter.
-
When a downloaded NAS-ID has multiple custom NAS-ID syntaxes for the same SSID profile, by default the latest syntax is used after overwriting the older one.
-
Maximum number of downloadable WLAN SSID profiles are 32.
-
The maximum supported length of the custom NAS-IDs that are derived from the syntax is 253.
This section contains the following subsections:
Configuring Custom NAS-ID AVP XML File
Procedure
Step 1 |
Edit the XML file using a notepad. |
||
Step 2 |
Update the SSID_PROF tag with the WLAN profile name you wish to apply the AVP to. |
||
Step 3 |
Update the following fields:
Example:
|
||
Step 4 |
Download the updated AVP XML file to the controller. |
||
Step 5 |
When the RADIUS download fails, use debug option debug radius avp-xml enable to know more about the error. |
Deleting a NAS-ID AVP (GUI)
Procedure
Step 1 |
Edit the AVP XML file using a text editor and delete the SSID_PROF name. |
||
Step 2 |
Download the updated NAS-ID AVP XML file to the controller. |
||
Step 3 |
Choose DOWNLOADED RADIUS AVP LIST page, the Acct tab displays an empty page. . On theThe NAS-ID AVP is successfully deleted.
|
Viewing Custom NAS-ID Enhancement Configuration (GUI)
Procedure
Step 1 |
Choose WLAN > Edit page. to open the |
||||||
Step 2 |
In the general tab, view the greyed out NAS-ID field to view the value type. Check if the format syntax for that file is downloaded and the string is displayed. Example:
|
||||||
Step 3 |
Choose DOWNLOADED RADIUS AVP LIST page. tab to open the |
||||||
Step 4 |
Select the Wlan SSID Profile Name from the drop-down list. The AVP details are displayed. |
Viewing Custom NAS-ID Enhancement (CLI)
Procedure
Per-WLAN RADIUS Source Support
The controller sources RADIUS traffic from the IP address of its management interface unless the configured RADIUS server exists on a VLAN accessible via one of the controller Dynamic interfaces. If a RADIUS server is reachable via a controller Dynamic interface, RADIUS requests to this specific RADIUS server will be sourced from the controller via the corresponding Dynamic interface.
By default, RADIUS packets sourced from the controller will set the NAS-IP-Address attribute to that of the management interface's IP Address, regardless of the packet's source IP Address (Management or Dynamic, depending on topology).
When you enable per-WLAN RADIUS source support (Radius Server Overwrite interface) the NAS-IP-Address attribute is overwritten by the controller to reflect the sourced interface. Also, RADIUS attributes are modified accordingly to match the identity. This feature virtualizes the controller on the per-WLAN RADIUS traffic, where each WLAN can have a separate layer 3 identity. This feature is useful in deployments that integrate with ACS Network Access Restrictions and Network Access Profiles.
To filter WLANs, use the callStationID that is set by RFC 3580 to be in the APMAC:SSID format. You can also extend the filtering on the authentication server to be on a per-WLAN source interface by using the NAS-IP-Address attribute.
You can combine per-WLAN RADIUS source support with the normal RADIUS traffic source and some WLANs that use the management interface and others using the per-WLAN dynamic interface as the address source.
This section contains the following subsections:
Prerequisites for Per-WLAN RADIUS Source Support
-
You must implement appropriate rule filtering on the new identity for the authentication server (RADIUS) because the controller sources traffic only from the selected interface.
Configuring Per-WLAN RADIUS Source Support (GUI)
Before you begin
Ensure that the WLAN is in disabled state. You can enable the WLAN after the configuration is done.
Procedure
Step 1 |
Choose WLANs to open the WLANs page. |
||
Step 2 |
Click the WLAN ID. |
||
Step 3 |
Click the Security tab, and then click the AAA Servers tab. |
||
Step 4 |
Check the RADIUS Server Overwrite interface check box to enable the per-WLAN RADIUS source support.
|
||
Step 5 |
From the Interface Priority drop-down list, select either AP Group or WLAN as the interface for RADIUS packet routing. |
||
Step 6 |
Ensure that the Interim Interval for RADIUS Server Accounting is within the valid range. |
||
Step 7 |
Save the configuration. |
Configuring Per-WLAN RADIUS Source Support (CLI)
Procedure
Step 1 |
Enter the config wlan disable wlan-id command to disable the WLAN. |
||
Step 2 |
Enter the following command to enable or disable the per-WLAN RADIUS source support: config wlan radius_server overwrite-interface {enable | disable} wlan-id
|
||
Step 3 |
Enable either an AP group's interface or a WLAN's interface for RADIUS packet routing by entering these commands:
|
||
Step 4 |
Enter the config wlan enable wlan-id command to enable the WLAN.
|
Monitoring the Status of Per-WLAN RADIUS Source Support (CLI)
To see if the feature is enabled or disabled, enter the following command:
show wlan wlan-id
ExampleThe following example shows that the per-WLAN RADIUS source support is enabled on WLAN 1.
show wlan 1
Information similar to the following is displayed:
WLAN Identifier.................................. 4
Profile Name..................................... example
Network Name (SSID).............................. example
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
...
Radius Servers
Authentication................................ Global Servers
Accounting.................................... Global Servers
Overwrite Sending Interface................... Enabled
Local EAP Authentication......................... Disabled
RADIUS Realm
When mobile clients associate to a WLAN, RADIUS realm is received as a part of EAP-AKA identity response request in the authentication request packet. The Network Access Identifier (NAI) format (EAP-AKA) for WLAN can be specified as 0<IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org. The realm in the NAI format is represented after the @ symbol, which is specified as wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org. If vendor specific attributes are added for MCC as 311 and MNC as 480 to 489, then the NAI format can be represented as: 0311480999999999@wlan.mnc480.mcc311.3gppnetwork.org.
For a mobile subscriber, the controller sends the authentication request to the AAA server only when the realm in the NAI format received from the device complies as per the given standards. Apart from authentication, accounting requests are also required to be sent to AAA server based on realm filtering.
In order to support realm filtering on the controller, you need to configure realm on the RADIUS. When a user is connected with a particular SSID, the user is authenticated and authorized using the NAI format received against the realm configured on the RADIUS server.
Realm Support on a WLAN
Each WLAN is configured to support NAI realms. Once the realm is enabled on a particular SSID, the lookup is done to match the realms received in the EAP identity response against the configured realms on the RADIUS server.
Realm Support on RADIUS Server
-
Realm Match for Authentication—In WPA2 dot1x with EAP methods (similar to EAP AKA), the username is received as part of EAP identity response. The realm is derived from the username and match with the realms configured in the RADIUS authentication server. If there is a match, then the authentication requests are forwarded to the RADIUS server. If there is a mismatch, then the client is deauthenticated.
-
Realm Match for Accounting—Username is received in access accept messages. When accounting messages are triggered, the realm is derived from the username and compared against the accounting realms configured on the RADIUS accounting server. If succeeded, accounting requests are forwarded to the RADIUS server. If there is a mismatch, the accounting requests are dropped. For example, if realm is configured as cisco on the controller, then the username is authenticated as xyz@cisco on the RADIUS server.
Note |
Even if the NAI realm is enabled on a WLAN and if there is no realm in the username, then the behavior is defaulted to no lookup, and the usual selection of the RADIUS server is followed. |
Note |
When the client uses fast re-authentication identity, the realm name is required from the authentication server in order for the controller to forward corresponding requests to the correct server. |
When EAP-AKA is used along with realm, fast reauthentication is supported when EAP server responds with AT_NEXT_REAUTH_ID attribute that has both the username portion and realm portion. Purpose of the realm is received controller picks up the right server for the subsequent fast reauthentication requests. For example, host APD server which supports EAP-AKA does not support realm portion. Therefore, the controller supports fast reauthentication only with those EAP servers which have this compatibility.
This section contains the following subsections:
Prerequisites for Configuring RADIUS Realm
RADIUS authentication or accounting server has to be disabled before adding realm and enabled after adding realm on the controller.
Restrictions for Configuring RADIUS Realm
-
You can configure a maximum of 17 RADIUS authentication and accounting servers to one controller.
-
The total number of realms that you can configure for one RADIUS authentication and accounting server is 30.
Configuring Realm on a WLAN (GUI)
Procedure
Step 1 |
Choose WLANs to open the WLANs page. |
Step 2 |
Click the ID number of the desired WLAN to open the WLANs > Edit page. |
Step 3 |
Choose the Advanced tab to open the WLANs > Edit (Advanced) page. |
Step 4 |
Select the RADIUS NAI-Realm check box to enable realm on the WLAN. |
Step 5 |
Click Apply to commit your changes. |
Step 6 |
Click Save Configuration to save your changes. |
Configuring Realm on a WLAN (CLI)
Procedure
Step 1 |
Enable or disable realm on a WLAN by entering this command: |
Step 2 |
View the realm configuration on a WLAN by entering this command: |
Configuring Realm on a RADIUS Authentication Server (GUI)
Procedure
Step 1 |
Choose to open RADIUS Authentication Servers > Edit page. |
Step 2 |
Click the Realm List link to open the Authentication Server Index page. |
Step 3 |
Enter the realm name in the Realm Name text box. |
Step 4 |
Click Add. |
Configuring Realm on a RADIUS Authentication Server (CLI)
Procedure
Step 1 |
Add realm to a RADIUS authentication server by entering this command: |
Step 2 |
Delete realm from a RADIUS authentication server by entering this command: |
Step 3 |
View RADIUS authentication server information by entering this command: |
Configuring Realm on a RADIUS Accounting Server (GUI)
Procedure
Step 1 |
Choose to open RADIUS Accounting Servers > Edit page. |
Step 2 |
Click the Realm List link to open the Accounting Server Index page. |
Step 3 |
Enter the realm name in the Realm Name text box. |
Step 4 |
Click Add. |
Configuring Realm on a RADIUS Accounting Server (CLI)
Procedure
Step 1 |
Add realm to a RADIUS accounting server by entering this command: |
Step 2 |
Delete realm from a RADIUS accounting server by entering this command: |
Step 3 |
View RADIUS accounting server information by entering this command: |
Disabling Accounting Servers per WLAN (GUI)
Note |
Disabling accounting servers disables all accounting operations and prevents the controller from falling back to the default RADIUS server for the WLAN. |
Procedure
Step 1 |
Choose WLANs to open the WLANs page. |
Step 2 |
Click the ID number of the WLAN to be modified. The WLANs > Edit page appears. |
Step 3 |
Choose the Security and AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page. |
Step 4 |
Unselect the Enabled check box for the Accounting Servers. |
Step 5 |
Click Apply to commit your changes. |
Step 6 |
Click Save Configuration to save your changes. |
User Login Policies
User Login Policies control the maximum number of concurrent netuser logins under one netuser name. The user name is case sensitive (CSCuu42548). Setting this to 0 means that there is no limit, and 8 is the maximum.
User Login Policies also control the logins under Layer 3 authentications and EAP. For EAP logins, the behavior of the maximum number of user logins is affected by the setting of the Max-Login Ignore Identity Response option. If you enable this, then the EAP identity response user name values are ignored for the purposes of enforcing a user name login limit.
Configuring User Login Policies (GUI)
Procedure
Step 1 |
Choose . |
Step 2 |
In the User Policies window, enter the maximum number of login sessions for a single user. The valid range is 0 to 8. The default value is 0. If you set this to 0, unlimited login sessions are permitted for a single user. |
Step 3 |
Save the configuration. |
Configuring User Login Policies (CLI)
Procedure
Step 1 |
Configure the maximum number of login sessions for a single user by entering this command: The valid range is 0 to 8. The default value is 0. If you set count to 0, unlimited login sessions are permitted for a single user. |
Step 2 |
Save the configuration by entering this command: |
AAA Override (Identity Networking)
In most wireless LAN systems, each WLAN has a static policy that applies to all clients associated with an SSID. Although powerful, this method has limitations because it requires clients to associate with different SSIDs to inherit different QoS and security policies.
However, the Cisco Wireless LAN solution supports identity networking, which allows the network to advertise a single SSID but allows specific users to inherit different QoS or security policies based on their user profiles. The specific policies that you can control using identity networking are as follows:
-
ACL—When the ACL attribute is present in the RADIUS Access Accept, the system applies the ACL name to the client station after it authenticates, which overrides any ACLs that are assigned to the interface.
-
VLAN—When a VLAN Interface-name or VLAN tag is present in a RADIUS Access Accept, the system places the client on a specific interface.
Note
The VLAN feature only supports MAC filtering, 802.1X, and WPA. The VLAN feature does not support web authentication or IPsec.
-
Tunnel Attributes.
Note
When any of the other RADIUS attributes (QoS-Level, ACL-Name, Interface-Name, or VLAN-Tag), which are described later in this section, are returned, the Tunnel Attributes must also be returned.
The operating system’s local MAC filter database has been extended to include the interface name, allowing local MAC filters to specify to which interface the client should be assigned. A separate RADIUS server can also be used, but the RADIUS server must be defined using the Security menus.
This section contains the following subsection:
RADIUS Attributes Used in Identity Networking
QoS-Level
This section explains the RADIUS attributes used in identity networking.
This attribute indicates the QoS level to be applied to the mobile client's traffic within the switching fabric, as well as over the air. This example shows a summary of the QoS-Level Attribute format. The text boxes are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| QoS Level |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
Type – 26 for Vendor-Specific
-
Length – 10
-
Vendor-Id – 14179
-
Vendor type – 2
-
Vendor length – 4
-
Value – Three octets:
-
3 – Bronze (Background)
-
0 – Silver (Best Effort)
-
1 – Gold (Video)
-
2 – Platinum (Voice)
-
ACL-Name
This attribute indicates the ACL name to be applied to the client. A summary of the ACL-Name Attribute format is shown below. The text boxes are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ACL Name...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – >7
-
Vendor-Id – 14179
-
Vendor type – 6
-
Vendor length – >0
-
Value – A string that includes the name of the ACL to use for the client
Interface Name
This attribute indicates the VLAN Interface a client is to be associated to. A summary of the Interface-Name Attribute format is shown below. The text boxes are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Vendor-Id
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Vendor-Id (cont.) | Vendor type | Vendor length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Interface Name...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
Type – 26 for Vendor-Specific
-
Length – >7
-
Vendor-Id – 14179
-
Vendor type – 5
-
Vendor length – >0
-
Value – A string that includes the name of the interface the client is to be assigned to.
Note
This Attribute only works when MAC filtering is enabled or if 802.1X or WPA is used as the security policy.
VLAN Tag
This attribute indicates the group ID for a particular tunneled session and is also known as the Tunnel-Private-Group-ID attribute.
This attribute might be included in the Access-Request packet if the tunnel initiator can predetermine the group resulting from a particular connection and should be included in the Access-Accept packet if this tunnel session is to be treated as belonging to a particular private group. Private groups may be used to associate a tunneled session with a particular group of users. For example, it may be used to facilitate routing of unregistered IP addresses through a particular interface. It should be included in Accounting-Request packets which contain Acct-Status-Type attributes with values of either Start or Stop and which pertain to a tunneled session.
A summary of the Tunnel-Private-Group-ID Attribute format is shown below. The text boxes are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Tag | String...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
Type – 81 for Tunnel-Private-Group-ID.
-
Length – >= 3
-
Tag – The Tag text box is one octet in length and is intended to provide a means of grouping attributes in the same packet which refer to the same tunnel. If the value of the Tag text box is greater than 0x00 and less than or equal to 0x1F, it should be interpreted as indicating which tunnel (of several alternatives) this attribute pertains. If the Tag text box is greater than 0x1F, it should be interpreted as the first byte of the following String text box.
-
String – This text box must be present. The group is represented by the String text box. There is no restriction on the format of group IDs.
Note
When any of the other RADIUS attributes (QoS-Level, ACL-Name, Interface-Name, or VLAN-Tag) are returned, the Tunnel Attributes must also be returned.
Tunnel Attributes
RFC 2868 defines RADIUS tunnel attributes used for authentication and authorization, and RFC2867 defines tunnel attributes used for accounting. Where the IEEE 802.1X authenticator supports tunneling, a compulsory tunnel may be set up for the Supplicant as a result of the authentication.
In particular, it may be desirable to allow a port to be placed into a particular VLAN, defined in IEEE 8021Q, based on the result of the authentication. This configuration can be used, for example, to allow a wireless host to remain on the same VLAN as it moves within a campus network.
The RADIUS server typically indicates the desired VLAN by including tunnel attributes within the Access-Accept. However, the IEEE 802.1X authenticator may also provide a hint as to the VLAN to be assigned to the Supplicant by including Tunnel attributes within the AccessRequest.
For use in VLAN assignment, the following tunnel attributes are used:
-
Tunnel-Type=VLAN (13)
-
Tunnel-Medium-Type=802
-
Tunnel-Private-Group-ID=VLANID
The VLAN ID is 12 bits, with a value between 1 and 4094, inclusive. Because the Tunnel-Private-Group-ID is of type String as defined in RFC 2868, for use with IEEE 802.1X, the VLANID integer value is encoded as a string.
When Tunnel attributes are sent, it is necessary to fill in the Tag text box. As noted in RFC 2868, section 3.1:
-
The Tag text box is one octet in length and is intended to provide a means of grouping attributes in the same packet that refer to the same tunnel. Valid values for this text box are 0x01 through 0x1F, inclusive. If the Tag text box is unused, it must be zero (0x00).
-
For use with Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, Tunnel-Private-Group-ID, Tunnel-Assignment-ID, Tunnel-Client-Auth-ID or Tunnel-Server-Auth-ID attributes (but not Tunnel-Type, Tunnel-Medium-Type, Tunnel-Password, or Tunnel-Preference), a tag text box of greater than 0x1F is interpreted as the first octet of the following text box.
-
Unless alternative tunnel types are provided, (e.g. for IEEE 802.1X authenticators that may support tunneling but not VLANs), it is only necessary for tunnel attributes to specify a single tunnel. As a result, where it is only desired to specify the VLANID, the tag text box should be set to zero (0x00) in all tunnel attributes. Where alternative tunnel types are to be provided, tag values between 0x01 and 0x1F should be chosen.
Configuring Network Access Identifier (CLI)
You can configure a network access server identifier (NAS-ID) on each WLAN profile, VLAN interface, or AP group. The NAS-ID is sent to the RADIUS server by the controller through an authentication request to classify users to different groups so that the RADIUS server can send a customized authentication response.
If you configure a NAS-ID for an AP group, this NAS-ID overrides the NAS-ID that is configured for a WLAN profile or the VLAN interface. If you configure a NAS-ID for a WLAN profile, this NAS-ID overrides the NAS-ID that is configured for the VLAN interface.
-
Configure a NAS-ID for a WLAN profile by entering this command:
config wlan nasid {nas-id-string | none} wlan-id
-
Configure a NAS-ID for a VLAN interface by entering this command:
config interface nasid {nas-id-string | none} interface-name
-
Configure a NAS-ID for an AP group by entering this command:
config wlan apgroup nasid {nas-id-string | none} apgroup-name
When the controller communicates with the RADIUS server, the NAS-ID attribute is replaced with the configured NAS-ID in an AP group, a WLAN, or a VLAN interface.
The NAS-ID that is configured on the controller for an AP group, a WLAN, or a VLAN interface is used for authentication. The configuration of NAS-ID is not propagated across controllers.
Note |
If WLAN interface is overridden at AP group then overridden interface NAS ID will be used. Since Interface NASID is given priority over WLAN NAS ID. |