Table Of Contents
Guest User Design Requirements
Considerations for Implementation
Designing the Network Architecture
Wireless Guest Traffic Flow with Clean Access Server
Configuring Catalyst 6500 Switches and WLSM
Configuring the Catalyst 6500 Wireless LAN Service Module
Configuring Cisco Aironet Access Points
Configuring Cisco Clean Access Server and Manager
Cisco Clean Access Server and Cisco Catalyst 6500 Series Wireless LAN Services Module Integration Guide
This document describes how to integrate the Cisco Clean Access (CCA) solution with the Cisco Catalyst 6500 Series Wireless LAN Services Module (WLSM) to provide public and guest Internet access management features and functionality for wired and wireless networks.
CCA Overview
The Cisco Catalyst 6500 series WLSM is part of the Catalyst 6500 series of multilayer switches. It operates as a Wireless Domain Service (WDS) device supporting Cisco Aironet access points deployed in autonomous mode.
Cisco Clean Access is a Network Admission Control (NAC) appliance solution that automatically detects, isolates, and cleans infected or vulnerable devices which are attempting to access the network. It identifies whether machines are compliant with security policies and repairs vulnerabilities before permitting access to the network.
In 2003, Cisco introduced NAC as a way for networks to make compliance with security policies a prerequisite for network access. Today, customers can choose to deploy NAC functionality in two ways:
•
through an industry-collaborative framework that leverages solutions of other vendors.
•
The CCA solution consists of three components:
•
•
•
CCA with WLSM
CCA provides authentication, posture assessment, and remediation services when Layer 2 adjacency (such as MAC address visibility) is available. These services occur because a connection through a local switch, a connection through a trunked interface using 802.1Q, or a tunneled Layer 2 via L2TPv3 is achieved.
With Layer 3 multi-hop clients on WLSM, the CCA product provides authentication and accounting services. An example of this implementation is for guest users (such as a visitor or a trainee in a training lab). CCA provides the following key features when deployed with WLSM for guest authentication and accounting services:
•
•
•
•
•
•
•
Guest User Design Requirements
All guest wireless traffic coming into the Cat6500 from the tunnel interface is forced to go through the CAS before going anywhere else. Use VPN Routing and Forwarding (VRF) to establish a completely separate routing table where a default route points to the CAS untrusted interface.
After the guest users are authenticated either locally or using an external server (RADIUS, LDAP, Kerberos) by the CAS/CAM, the user traffic passes through the CAS to reach the outside network. Optionally, you can also set the user timeout session, bandwidth, and access control management.
Considerations for Implementation
The following design guidelines should be considered before implementation:
•
•
•
•
•
•
•
•
•
•
•
Designing the Network Architecture
Figure 1 shows a typical network architecture.
Figure 1 Network Architecture
System Requirements
The design requires the following equipment:
•
•
•
•
•
•
The following software versions are required:
•
•
•
•
Wireless Guest Traffic Flow
The following process is followed in a wireless guest traffic flow.
1.
2.
3.
4.
5.
Adding Clean Access Servers
The following section explains how to add clean access servers. The clean access solution has three deployment methods in the in-band solution.
1.
2.
3.
In the WLSM solution, the Real-IP gateway deployment method is used, and the CAS server acts as a DHCP relay.
Wireless Guest Traffic Flow with Clean Access Server
The guest traffic is forwarded to the clean access server by the following process.
1.
2.
3.
4.
5.
6.
The reverse path is followed for the returning traffic.
Configuring Catalyst 6500 Switches and WLSM
The following example code shows how to configure Catalyst 6500 switches and wireless LAN service modules.
sup720#sh runBuilding configuration...Current configuration : 8511 bytes!version 12.2service timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice counters max age 10!hostname sup720!boot system flash sup-bootflash:s72033-jk9sv-mz.122-18.SXD3.bin!wlan module 3 allowed-vlan 20vtp mode transparentip subnet-zero!!no ip domain-lookupip dhcp excluded-address 172.16.10.1 172.16.10.20!ip dhcp pool mobilenetwork 172.16.10.0 255.255.255.0option 150 ip 10.1.21.5default-router 172.16.10.1dns-server 171.70.168.183!ip dhcp snoopingip vrf guest#1rd 1:100!vlan 9-14,16-18,20-21,50,80,90,100,105,110-113,115,120,200,210!interface Loopback1description source_of_tunnel_1ip address 10.100.10.10 255.255.255.0!interface Loopback4ip address 10.100.40.10 255.255.255.0!!Create the mGRE tunnel interface for the "guest" Mobility Group. All data to and from wireless guest SSID will be sent/received over this interface. This interface is placed in the VRF "guest#1".!interface Tunnel1description Guest tunnelip vrf forwarding guest#1ip address 172.16.10.1 255.255.255.0no ip redirectstunnel source Loopback1tunnel mode gre multipointmobility network-id 1mobility trust!!interface FastEthernet4/44description connection to Cat3750no ip addressswitchportswitchport access vlan 21switchport mode access!interface FastEthernet4/45description connection to ACS for WLSM setupno ip addressswitchportswitchport mode access!interface Vlan1ip address 10.1.1.1 255.255.255.0!interface Vlan18ip vrf forwarding guest#1ip address 172.18.10.1 255.255.255.0!interface Vlan20description to_WLSMip address 10.10.10.1 255.255.255.0!interface Vlan21description to_Cat3750ip address 10.1.21.1 255.255.255.0!router eigrp 100redistribute connectedredistribute staticnetwork 10.0.0.0network 172.16.0.0auto-summary!ip classless!The routing needed for each VRF. In this example we have used static routes but you can enable a routing protocol in each VRF using the command "address-family" in router configuration mode.!ip route vrf guest#1 0.0.0.0 0.0.0.0 172.18.10.2no ip http server!!line con 0exec-timeout 15 15line vty 0 4password ciscono login!!endConfiguring the Catalyst 6500 Wireless LAN Service Module
The following code example shows how to configure Catalyst 6500 wireless LAN service modules.
wlsm#sh runBuilding configuration...Current configuration : 1948 bytes!version 12.3no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname wlsm-isg!enable password cisco!username cisco password 0 ciscospd headroom 512clock timezone EST -5aaa new-model!!aaa group server radius rad-peapserver 10.1.1.11 auth-port 1645 acct-port 1646!aaa group server radius rad-leapserver 10.1.1.12 auth-port 1645 acct-port 1646!aaa authentication login my-vty-list enableaaa authentication login wlccp-infra group radiusaaa session-id commonip subnet-zeroip tftp source-interface Ethernet0/0.20no ip domain lookup!!wlan vlan 20ipaddr 10.10.10.2 255.255.255.0gateway 10.10.10.1admin!!no crypto isakmp enable!ip classlessip route 0.0.0.0 0.0.0.0 10.10.10.1ip http serverno ip http secure-server!radius-server host 10.1.1.11 auth-port 1645 acct-port 1646radius-server key ciscoradius-server vsa send accounting!wlccp authentication-server infrastructure wlccp-infrawlccp authentication-server client any wlccp-infra!line con 0transport preferred alltransport output allline 1 3no exectransport preferred alltransport input alltransport output allflowcontrol softwareline vty 0 4password ciscologin authentication my-vty-listtransport preferred alltransport input alltransport output all!endConfiguring Cisco Aironet Access Points
The following example code shows how to configure Cisco 1200 access points.
AP-1#sh runBuilding configuration...Current configuration : 4407 bytes!version 12.2no service padservice timestamps debug datetime msecservice timestamps log datetime msecservice password-encryption!hostname AP-1!logging queue-limit 100enable secret 5 $1$NrNO$SHIs9OPkW2S9hGYDUWB/X0enable password 7 02050D480809!username Cisco password 7 02250D480809ip subnet-zerono ip domain lookup!dot11 phonedot11 arp-cache!bridge irb!!interface Dot11Radio0no ip addressno ip route-cache!ssid Guestvlan 11authentication openguest-modemobility network-id 1!ssid Maintenancevlan 14authentication openmobility network-id 4!speed basic-11.0 12.0 18.0 24.0 36.0 48.0rts threshold 2312power local cck 50power local ofdm 30power client 100no preamble-shortchannel 2412station-role rootno dot11 extension aironetl2-filter bridge-group-acl!interface Dot11Radio0.10encapsulation dot1Q 10 nativeno ip route-cachebridge-group 1bridge-group 1 subscriber-loop-controlbridge-group 1 block-unknown-sourceno bridge-group 1 source-learningno bridge-group 1 unicast-floodingbridge-group 1 spanning-disabled!interface Dot11Radio0.11encapsulation dot1Q 11service-policy input voiceservice-policy output voiceno ip route-cachebridge-group 11bridge-group 11 subscriber-loop-controlbridge-group 11 block-unknown-sourceno bridge-group 11 source-learningno bridge-group 11 unicast-floodingbridge-group 11 spanning-disabled!interface Dot11Radio0.14encapsulation dot1Q 14service-policy input dataservice-policy output datano ip route-cachebridge-group 14bridge-group 14 subscriber-loop-controlbridge-group 14 block-unknown-sourceno bridge-group 14 source-learningno bridge-group 14 unicast-floodingbridge-group 14 spanning-disabled!interface FastEthernet0no ip addressno ip route-cacheduplex autospeed auto!interface FastEthernet0.10encapsulation dot1Q 10 nativeno ip route-cachebridge-group 1no bridge-group 1 source-learningbridge-group 1 spanning-disabled!interface FastEthernet0.11encapsulation dot1Q 11no ip route-cachebridge-group 11no bridge-group 11 source-learningbridge-group 11 spanning-disabled!interface FastEthernet0.14encapsulation dot1Q 14no ip route-cachebridge-group 14no bridge-group 14 source-learningbridge-group 14 spanning-disabled!interface BVI1ip address 10.1.12.2 255.255.255.0no ip route-cache!ip http serverip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eagip radius source-interface BVI1bridge 1 route ip!!wlccp ap username test password 7 01100F175804wlccp ap wds ip address 10.10.10.2!line con 0line vty 0 4login localline vty 5 15login!endAP-1#Configuring Cisco Clean Access Server and Manager
After you have configured the network to route all guest traffic to the CAS, you can authenticate the guest users using the CAS. The configuration is performed with the CAM. You configure the user management locally on the CAM. For CAS configuration, you must connect to the server by clicking Manage on the Clean Access Servers window (see Figure 2) and follow the steps below.
Figure 2 Clean Access Servers > Manage
Step 1
Figure 3 Real IP Gateway
Step 2
Step 3
Step 4
Figure 4 User Roles
Step 5
Figure 5 Guest Role
Step 6
Figure 6 Assigning Different Roles
Step 7
Figure 7 Creating the Guest Portal
Step 8
Figure 8 Managed Subnet
Step 9
Step 10
Guest
