5-13
Cisco Wireless LAN Controller Configuration Guide
OL-17037-01
Chapter 5 Configuring Security Solutions
Configuring RADIUS
• config radius acct ipsec authentication {hmac-md5 | hmac-sha1} index—Configures the
authentication protocol to be used for IP security.
• config radius acct ipsec encryption {3des | aes | des | none} index—Configures the IP security
encryption mechanism.
• config radius acct ipsec ike dh-group {group-1 | group-2 | group-5} index—Configures the IKE
Diffie Hellman group.
• config radius acct ipsec ike lifetime interval index—Configures the timeout interval for the
session.
• config radius acct ipsec ike phase1{aggressive | main} index—Configures the Internet Key
Exchange (IKE) protocol.
• config radius acct {enable | disable} index—Enables or disables a RADIUS accounting server.
• config radius acct delete index—Deletes a previously added RADIUS accounting server.
Step 4 To configure the RADIUS server fallback behavior, enter this command:
config radius fallback-test mode {off | passive | active} where
• Off disables RADIUS server fallback.
• Passive causes the controller to revert to a server with a lower priority from the available backup
servers without using extraneous probe messages. The controller simply ignores all inactive servers
for a time period and retries later when a RADIUS message needs to be sent.
• Active causes the controller to revert to a server with a lower priority from the available backup
servers by using RADIUS probe messages to proactively determine whether a server that has been
marked inactive is back online. The controller simply ignores all inactive servers for all active
RADIUS requests. Once the primary server receives a response from the recovered ACS server, the
active fallback RADIUS server no longer sends probe messages to the server requesting the active
probe authentication.
Step 5 If you enabled Active mode in Step 4, enter these commands to configure additional fallback parameters:
• config radius fallback-test username username—Specifies the name to be sent in the inactive
server probes. You can enter up to 16 alphanumeric characters for the username parameter.
• config radius fallback-test interval interval—Specifies the probe interval value (in seconds).
Step 6 To save your changes, enter this command:
save config
Step 7 To configure the order of authentication when multiple databases are configured, enter this command:
config aaa auth mgmt AAA_server_type AAA_server_type
where AAA_server_type is local, radius, or tacacs.
To see the current management authentication server order, enter this command:
show aaa auth
Information similar to the following appears:
Management authentication server order:
1......................................... local
2...................................... radius
Step 8 Use these commands to see RADIUS statistics:
• show radius summary—Shows a summary of RADIUS servers and statistics.
• show radius auth statistics—Shows the RADIUS authentication server statistics.
To Next Page
Loading...
Need help?
General
