EasyManua.ls Logo

Cisco ISR User Manual

Cisco ISR
188 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #85 background imageLoading...
Page #85 background image
5-9
Cisco Wireless ISR and HWIC Access Point Configuration Guide
OL-6415-04
Chapter 5 Configuring Encryption Types
Configure Encryption Types
TKIP
AES
TKIP+AES
WEP 40-bit
WEP 128-bit
Universal client configuration
!
dot11 ssid test10
authentication open
authentication key-management wpa
wpa-psk ascii 7 11584B5643475D5B5C737B
!
!
interface Dot11Radio0/1/0
ip address dhcp
!
encryption mode ciphers aes-ccm
!
ssid test10
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role non-root
!
End
The access point is configured with AES+TKIP WPA-PSK encryption. The universal client will display
the following system message when there is a mismatch in the encryption types during association
between the AP and the universal client:
%DOT11-4-CANT_ASSOC: Interface Dot11Radio0/1/0, cannot associate: WPAIE invalid multicast
suite exp=0x0050F204 act=0x0050F202
In this example, the universal client would have the multicast suite of 0x0050F204 (for TKIP) but instead
received the multicast suite of 0x0050F202 (for AES+ TKIP). Here are the different scenarios:
If the universal client is configured for AES WPAv2 (encryption mode ciphers aes-ccm), the access
point must be configured for AES WPAv2. The universal client will associate with AES encryption.
If the universal client is configured for TKIP (encryption mode ciphers tkip) The access point must
be configured for either 1. TKIP WPA or 2. TKIP+AES. The universal client will associate with
TKIP encryption.
If the universal client is configured for AES+TKIP (encryption mode ciphers tkip aes) The access
point must be configured for TKIP+AES. The universal client will associate with AES encryption.
If the access point is configured for AES WPAv2 WPAv2 (encryption mode ciphers aes-ccm), and
the universal client is configured with TKIP+AES (encryption mode ciphers aes-ccm tkip), you will
get a system message stating the multicast suite was not found.
%DOT11-4-CANT_ASSOC: Interface Dot11Radio0/1/0, cannot associate: WPAIE not found and
required

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco ISR and is the answer not in the manual?

Cisco ISR Specifications

General IconGeneral
BrandCisco
ModelISR
CategoryWireless Access Point
LanguageEnglish

Summary

Chapter 2 Configuring Radio Settings

Configuring Network or Fallback Role

Explains how to configure the wireless device's radio network role and fallback role when the Ethernet port is disabled or disconnected.

Universal Client Mode

Describes Universal Client Mode, where a radio acts as a wireless client, detailing its features and limitations for specific Cisco routers.

Configuring Universal Client Mode

Provides detailed CLI steps to configure Universal Client Mode by setting the radio interface station-role to non-root on Cisco ISR series routers.

Configuring Radio Data Rates

Explains how to choose data rates for wireless transmission, detailing states like Basic, Enabled, and Disabled for optimizing range or throughput.

Configuring Radio Transmit Power

Guides on configuring transmit power based on radio type and regulatory domain, referencing hardware installation guides for details.

Configuring Radio Channel Settings

Explains how to assign static channel settings for access points for consistent performance, discussing 2.4-GHz and 5-GHz channel usage.

Chapter 3 Configuring Multiple SSIDs

Understanding Multiple SSIDs

Defines SSIDs as unique identifiers for wireless networks and explains how to configure up to 16 SSIDs with different settings per SSID.

Configuring Multiple SSIDs

Contains configuration information for multiple SSIDs, including creating SSIDs globally and using RADIUS to restrict them.

Creating an SSID Globally

Provides CLI steps to create an SSID globally in Cisco IOS Releases 12.4 and later, allowing assignment to specific radio interfaces.

Using a RADIUS Server to Restrict SSIDs

Explains how to prevent unauthorized SSID use by creating an authorized SSID list on a RADIUS server for client authentication.

Configuring Multiple Basic SSIDs

Explains support for multiple basic SSIDs (BSSIDs) for 802.11a/g radios, allowing unique DTIM settings and broadcasting multiple SSIDs.

Chapter 4 Configuring an Access Point as a Local Authenticator

Understand Local Authentication

Explains local authentication for wireless LANs without RADIUS servers or as a backup, allowing up to 50 client authentications per second.

Configure a Local Authenticator

Provides instructions for setting up an access point as a local authenticator, covering guidelines, overview, and configuration steps.

Configuring the Local Authenticator Access Point

Details the initial CLI steps to configure an access point as a local authenticator, starting with enabling AAA and then configuring RADIUS server settings.

Configuring Other Access Points to Use the Local Authenticator

Explains how to add the local authenticator to the server list on other access points, emphasizing the order of server entries and RADIUS port requirements.

Configuring EAP-FAST Settings

Discusses customizing EAP-FAST settings like credential timeout, authority ID, and server keys to match network requirements.

Chapter 5 Configuring Encryption Types

Understand Encryption Types

Describes how encryption types like WEP, AES-CCMP, and TKIP protect wireless LAN traffic and recommends full encryption.

Configure Encryption Types

Covers configuring encryption types such as WEP, AES-CCM, TKIP, and broadcast key rotation for wireless LAN security.

Creating Cipher Suites

Guides on creating cipher suites, which are sets of encryption and integrity algorithms, to enable WPA and protect radio communication.

Chapter 6 Configuring Authentication Types

Understand Authentication Types

Describes authentication types configurable on access points, tied to SSIDs, and mentions Open, Shared Key, MAC Address, and EAP authentication.

Configure Authentication Types

Details how to configure authentication types and attach them to SSIDs, including assigning types to an SSID and configuring holdoffs.

Assigning Authentication Types to an SSID

Provides steps to configure authentication types for SSIDs, including open, shared key, MAC address, EAP, and WPA key management.

EAP Authentication to Network

Details EAP Authentication as the highest security level, using RADIUS to perform mutual authentication and derive dynamic WEP keys.

Using WPA Key Management

Explains Wi-Fi Protected Access (WPA) for data protection and 802.1X for key management, detailing WPA and WPA-PSK types.

Matching Access Point and Client Device Authentication Types

Emphasizes matching access point and client adapter security settings for successful authentication, referencing relevant guides and tables.

Chapter 7 Configuring RADIUS Servers

Configuring and Enabling RADIUS

Describes enabling and configuring RADIUS for detailed accounting and administrative control over authentication and authorization processes.

Understanding RADIUS

Defines RADIUS as a distributed client/server system for network security and lists environments where it is suitable and not suitable.

RADIUS Operation

Explains the sequence of events when a wireless user attempts to log in and authenticate via a RADIUS server, including EAP authentication steps.

Configuring RADIUS

Guides on configuring RADIUS support by identifying RADIUS server hosts and defining method lists for authentication, authorization, and accounting.

Identifying the RADIUS Server Host

Details the components of access point-to-RADIUS server communication and how to identify RADIUS servers by hostname, IP address, and ports.

Configuring RADIUS Login Authentication

Explains how to configure AAA authentication by defining named method lists and applying them to interfaces, ensuring user authentication sequence.

Defining AAA Server Groups

Guides on configuring AAA server groups to group existing server hosts for authentication, allowing subsets for specific services.

Configuring RADIUS Authorization for User Privileged Access and Network Services

Describes using AAA authorization to restrict user network access, specifically for privileged EXEC mode, based on user profiles.

Starting RADIUS Accounting

Explains how to enable AAA accounting to track user activity and resource consumption, reporting it to the RADIUS server.

Configuring Settings for All RADIUS Servers

Guides on configuring global communication settings for all RADIUS servers, including key, retransmit, timeout, and deadtime values.

Chapter 8 Configuring VLANs

Configuring VLANs

Provides instructions on configuring VLANs on the access point to operate with VLANs on the wired LAN, including assigning SSIDs and authentication settings.

Incorporating Wireless Devices into VLANs

Explains how to connect wireless devices to VLANs by configuring SSIDs to recognize specific VLAN IDs, enabling flexible network segmentation.

Configuring a VLAN

Details the three-step process to configure VLANs on an access point: enable VLANs, assign SSIDs to VLANs, and assign authentication settings.

Using a RADIUS Server to Assign Users to VLANs

Explains how a RADIUS server can assign users or groups to specific VLANs upon authentication, mapping clients based on attributes like Tunnel Type and Tunnel Private Group ID.

Chapter 9 Configuring QoS

Understanding QoS for Wireless LANs

Explains Quality of Service (QoS) for wireless LANs, focusing on prioritizing traffic and improving network performance and bandwidth utilization.

Configuring QoS

Guides on configuring QoS on access points to provide preferential treatment to certain traffic, improving network predictability and bandwidth allocation.

Related product manuals