Table Of Contents

Configuring Authentication Types

Understanding Authentication Types

Open Authentication to the Bridge

Shared Key Authentication to the Bridge

EAP Authentication to the Network

Configuring Authentication Types

Default Authentication Settings

Assigning Authentication Types to an SSID

Configuring Authentication Holdoffs, Timeouts, and Intervals

Setting Up a Non-Root Bridge as a LEAP Client

Matching Authentication Types on Root and Non-Root Bridges

Configuring Authentication Types

---

This chapter describes how to configure authentication types on the bridge. This chapter contains these sections:

•Understanding Authentication Types

•Configuring Authentication Types

•Matching Authentication Types on Root and Non-Root Bridges

Understanding Authentication Types

This section describes the authentication types that you can configure on the bridge. The authentication types are tied to the SSID that you configure on the bridge.

Before bridges can communicate, they must authenticate to each other using open or shared-key authentication. For maximum security, bridges should also authenticate to your network using EAP authentication, an authentication type that relies on an authentication server on your network.

The bridge uses four authentication mechanisms or types and can use more than one at the same time. These sections explain each authentication type:

•Open Authentication to the Bridge

•Shared Key Authentication to the Bridge

•EAP Authentication to the Network

Open Authentication to the Bridge

Open authentication allows any 1400 series bridge to authenticate and then attempt to communicate with another 1400 series bridge. Using open authentication, a non-root bridge can authenticate to a root bridge, but the non-root bridge can communicate only if its WEP keys match the root bridge's. A bridge that is not using WEP does not attempt to authenticate with a bridge that is using WEP. Open authentication does not rely on a RADIUS server on your network.

Figure 10-1 shows the authentication sequence between a non-root bridge trying to authenticate and a root bridge using open authentication. In this example, the device's WEP key does not match the bridge's key, so it can authenticate but not pass data.

Figure 10-1 Sequence for Open Authentication

Shared Key Authentication to the Bridge

Cisco provides shared key authentication to comply with the IEEE 802.11b standard. However, because of shared key's security flaws, we recommend that you avoid using it.

During shared key authentication, the root bridge sends an unencrypted challenge text string to other bridges attempting to communicate with the root bridge. The bridge requesting authentication encrypts the challenge text and sends it back to the root bridge. If the challenge text is encrypted correctly, the root bridge allows the requesting device to authenticate. Both the unencrypted challenge and the encrypted challenge can be monitored, however, which leaves the root bridge open to attack from an intruder who calculates the WEP key by comparing the unencrypted and encrypted text strings. Because of this weakness, shared key authentication can be less secure than open authentication. Like open authentication, shared key authentication does not rely on a RADIUS server on your network.

Figure 10-2 shows the authentication sequence between a device trying to authenticate and an bridge using shared key authentication. In this example the device's WEP key matches the bridge's key, so it can authenticate and communicate.

Figure 10-2 Sequence for Shared Key Authentication

EAP Authentication to the Network

This authentication type provides the highest level of security for your wireless network. By using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the root bridge helps another bridge and the RADIUS server to perform mutual authentication and derive a dynamic unicast WEP key. The RADIUS server sends the WEP key to the root bridge, which uses it for all unicast data signals that it sends to or receives from the non-root bridge. The root bridge also encrypts its broadcast WEP key (entered in the bridge's WEP key slot 1) with the non-root bridge's unicast key and sends it to the non-root bridge.

When you enable EAP on your bridges, authentication to the network occurs in the sequence shown in Figure 10-3:

Figure 10-3 Sequence for EAP Authentication

In Steps 1 through 9 in Figure 10-3, a non-root bridge and a RADIUS server on the wired LAN use 802.1x and EAP to perform a mutual authentication through the root bridge. The RADIUS server sends an authentication challenge to the non-root bridge. The non-root bridge uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server. Using information from its user database, the RADIUS server creates its own response and compares that to the response from the non-root bridge. When the RADIUS server authenticates the non-root bridge, the process repeats in reverse, and the non-root bridge authenticates the RADIUS server.

When mutual authentication is complete, the RADIUS server and the non-root bridge determine a WEP key that is unique to the non-root bridge and provides the non-root bridge with the appropriate level of network access, thereby approximating the level of security in a wired switched segment to an individual desktop. The non-root bridge loads this key and prepares to use it for the logon session.

During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over the wired LAN to the root bridge. The root bridge encrypts its broadcast key with the session key and sends the encrypted broadcast key to the non-root bridge, which uses the session key to decrypt it. The non-root bridge and the root bridge activate WEP and use the session and broadcast WEP keys for all communications during the remainder of the session.

There is more than one type of EAP authentication, but the bridge behaves the same way for each type: it relays authentication messages from the wireless client device to the RADIUS server and from the RADIUS server to the wireless client device. See the "Assigning Authentication Types to an SSID" section for instructions on setting up EAP on the bridge.

---

Note If you use EAP authentication, you can select open or shared key authentication, but you don't have to. EAP authentication controls authentication both to your bridge and to your network.

---

Configuring Authentication Types

This section describes how to configure authentication types. You attach configuration types to the bridge's SSID. See Chapter 7 "Configuring SSIDs," for details on setting up the bridge SSID. This section contains these topics:

•Default Authentication Settings

•Assigning Authentication Types to an SSID

•Configuring Authentication Holdoffs, Timeouts, and Intervals

Default Authentication Settings

The default SSID on the bridge is autoinstall. Table 10-1 shows the default authentication settings for the default SSID:

Table 10-1 Default Authentication Configuration

Feature	Default Setting
SSID	autoinstall
Guest Mode SSID	autoinstall (The bridge broadcasts this SSID in its beacon and allows bridges with no SSID to associate.)
Authentication types assigned to tsunami	open

Assigning Authentication Types to an SSID

Beginning in privileged EXEC mode, follow these steps to configure authentication types for SSIDs:

	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	interface dot11radio 0	Enter interface configuration mode for the radio interface.
Step 3	ssid ssid-string	Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive. Note Do not include spaces in SSIDs.
Step 4	authentication open [eap list-name]	(Optional) Set the authentication type to open for this SSID. Open authentication allows any bridge to authenticate and then attempt to communicate with the bridge. •(Optional) Set the SSID's authentication type to open with EAP authentication. The bridge forces all other bridges to perform EAP authentication before they are allowed to join the network. For list-name, specify the authentication method list. Note A bridge configured for EAP authentication forces all bridges that associate to perform EAP authentication. Bridges that do not use EAP cannot communicate with the bridge.
Step 5	authentication shared [eap list-name]	(Optional) Set the authentication type for the SSID to shared key. Note Because of shared key's security flaws, Cisco recommends that you avoid using it. •(Optional) Set the SSID's authentication type to shared key with EAP authentication. For list-name, specify the authentication method list.
Step 6	authentication network-eap list-name	(Optional) Set the authentication type for the SSID to Network-EAP. Using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the bridge helps a non-root bridge and the RADIUS server to perform mutual authentication and derive a dynamic unicast WEP key. However, the bridge does not force all non-root bridges to perform EAP authentication.
Step 7	end	Return to privileged EXEC mode.
Step 8	copy running-config startup-config	(Optional) Save your entries in the configuration file.

Use the no form of the SSID commands to disable the SSID or to disable SSID features.

This example sets the authentication type for the SSID bridgeman to open with EAP authentication. Bridges using the bridgeman SSID attempt EAP authentication using a server named adam.

bridge# configure terminal

bridge(config)# configure interface dot11radio 0

bridge(config-if)# ssid bridgeman

bridge(config-ssid)# authentication open eap adam

bridge(config-ssid)# end

The configuration on non-root bridges associated to this bridge would also contain these commands:

bridge(config)# configure interface dot11radio 0

bridge(config-if)# ssid bridgeman

bridge(config-ssid)# authentication client username bridge7 password catch22

This example sets the authentication type for the SSID bridget to network-EAP with a static WEP key. 
EAP-enabled bridges using the bridget SSID attempt EAP authentication using a server named eve, 
and bridges using static WEP rely on the static WEP key. 

bridge# configure terminal

bridge(config)# configure interface dot11radio 0

bridge(config-if)# encryption key 2 size 128 12345678901234567890123456 

bridge(config-if)# ssid bridget

bridge(config-ssid)# authentication network-eap eve

bridge(config-ssid)# end

The configuration on non-root bridges associated to this bridge would also contain these commands:

bridge(config)# configure interface dot11radio 0

bridge(config-if)# ssid bridget

bridge(config-ssid)# authentication client username bridge11 password 99bottles

Configuring Authentication Holdoffs, Timeouts, and Intervals

Beginning in privileged EXEC mode, follow these steps to configure holdoff times, reauthentication periods, and authentication timeouts for non-root bridges authenticating through your root bridge:

	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	dot11 holdoff-time seconds	Enter the number of seconds a non-root bridge must wait before it can reattempt to authenticate following a failed authentication. Enter a value from 1 to 65555 seconds.
Step 3	interface dot11radio 0	Enter interface configuration mode for the radio interface.
Step 4	dot1x client-timeout seconds	Enter the number of seconds the bridge should wait for a reply from a non-root bridge attempting to authenticate before the authentication fails. Enter a value from 1 to 65555 seconds.
Step 5	dot1x reauth-period seconds [server]	Enter the interval in seconds that the bridge waits before forcing an authenticated non-root bridge to reauthenticate. •(Optional) Enter the server keyword to configure the bridge to use the rauthentication period specified by the authentication server. If you use this option, configure your authentication server with RADIUS attribute 27, Session-Timeout. This attribute sets the maximum number of seconds of service to be provided to the non-root bridge before termination of the session or prompt. The server sends this attribute to the root bridge when a non-root bridge performs EAP authentication.
Step 6	end	Return to privileged EXEC mode.
Step 7	copy running-config startup-config	(Optional) Save your entries in the configuration file.

Use the no form of these commands to reset the values to default settings.

Setting Up a Non-Root Bridge as a LEAP Client

You can set up a non-root bridge to authenticate to your network like other wireless client devices. After you provide a network username and password for the non-root bridge, it authenticates to your network using LEAP, Cisco's wireless authentication method, and receives and uses dynamic WEP keys.

Setting up a non-root bridge as a LEAP client requires three major steps:

1. Create an authentication username and password for the non-root bridge on your authentication server.

2. Configure LEAP authentication on the root bridge to which the non-root bridge associates.

3. Configure the non-root bridge to act as a LEAP client.

Beginning in Privileged Exec mode, follow these instructions to set up the non-root bridge as a LEAP client:

	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	interface dot11radio 0	Enter interface configuration mode for the radio interface.
Step 3	ssid ssid-string	Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case-sensitive.
Step 4	authentication client username username password password	Configure the username and password that the non-root bridge uses when it performs LEAP authentication. This username and password must match the username and password that you set up for the non-root bridge on the authentication server.
Step 5	authentication network-eap list-name	Set the authentication type for the SSID to Network-EAP.
Step 6	end	Return to privileged EXEC mode.
Step 7	copy running-config startup-config	(Optional) Save your entries in the configuration file.

This example sets a LEAP username and password for the SSID bridgeman, and configures Network-EAP as the authentication type for the SSID on the non-root bridge:

bridge# configure terminal

bridge(config)# configure interface dot11radio 0

bridge(config-if)# ssid bridgeman

bridge(config-ssid)# authentication client username bugsy password run4yerlife

bridge(config-ssid)# authentication network-eap romeo

bridge(config-ssid)# end

Matching Authentication Types on Root and Non-Root Bridges

To use the authentication types described in this section, the root bridge authentication settings must match the settings on the non-root bridges that associate to the root bridge.

Table 10-2 lists the settings required for each authentication type on the root and non-root bridges.

Table 10-2 Client and Bridge Security Settings 

Security Feature	Non-Root Bridge Setting	Root Bridge Setting
Static WEP with open authentication	Set up and enable WEP	Set up and enable WEP and enable Open Authentication
Static WEP with shared key authentication	Set up and enable WEP and enable Shared Key Authentication	Set up and enable WEP and enable Shared Key Authentication
LEAP authentication	Set up and enable WEP and Network-EAP authentication and configure a LEAP username and password	Set up and enable WEP and enable network-EAP authentication