82 CHAPTER 3: CONFIGURING A WX SWITCH FOR BASIC SERVICE
WX1200# display aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead State
-------------------------------------------------------------------
svr1 10.10.70.20 1812 1813 5 3 0 UP
svr2 10.10.70.40 1812 1813 5 3 0 UP
Server groups
grp1 (load-balanced): svr1 svr2
set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1
Configuring EAP
Offload with Server
Authentication
You can configure a WX switch to perform all EAP processing locally and
use RADIUS servers for authentication and authorization. To configure an
WX switch to perform EAP processing locally and use RADIUS servers for
MS-CHAP-V2:
1 Install server certificates on the WX switch. You can install certificates
assigned by a CA or generate self-signed certificate on the switch.
(See “Installing a Server Certificate for Network Users” on page 52,
“Generating a Self-Signed Certificate for Network Users” on page 53,
and “Installing a Certificate Assigned by a Certificate Authority for
Network Users” on page 53.)
2 Configure the RADIUS servers and add them to server group. You must
configure a server group even if you have only one server.
(See “Configuring RADIUS Servers for Pass-Through Authentication” on
page 79.)
3 Set the 802.1X authentication protocol to PEAP-MS-CHAP-V2. With this
protocol setting, a WX switch performs EAP locally and uses a RADIUS
server to complete the process by performing authentication and
authorization with MS-CHAP-V2.
(See “Configuring the Authentication Protocol for Offload
Authentication” on page 83.)
Figure 11 shows an example of offload user authentication.
To Next Page
Loading...
