Local Extensible Authentication Protocol

Local EAP

Local EAP is a controller feature that

  • makes the controller act as both authenticator and authentication server

  • allows 802.1x authentication on WPA Enterprise wireless clients without the use of any RADIUS server, and

  • refers to the EAP authentication server activity and not necessarily tied to the user credentials validation that can be delegated to an external LDAP database.

Feature scenarios

Local EAP is designed to allow administrators to use Enterprise-grade 802.1x authentication for a limited number of users in situations and branches where an external dedicated RADIUS server may not be available. It can also work as an emergency backup in case the RADIUS server is not available.

You can implement Local EAP either with users local to the controller or use an external LDAP database to store the user credentials.

Restrictions for local EAP

Consider these restrictions when implementing local EAP on wireless controllers.

  • It is not possible to configure AAA attributes, such as per-user ACL or per-user session timeout using local EAP.

  • Local EAP only allows user database either locally on the controller or on an external LDAP database.

  • Local EAP supports TLS 1.2 as of 17.1 and later software release.

  • Local EAP uses the trustpoint of your choice on the controller. You will either need to install a publicly trusted certificate on the controller or import it on the clients for the EAP session to be trusted by the client.

  • Local EAP supports EAP-FAST, EAP-TLS, and PEAP as EAP authentication methods.


    Note

    PEAP-mschapv2 does not work when using certain external LDAP databases that only support clear text passwords.

  • When FIPS mode is enabled on the controller, the password for local EAP users must be configured with an encryption higher than type six, otherwise the users fail to authenticate. To ensure successful authentication, configure the password using the command algorithm-type sha256 secret <password> .

Configure local EAP profile (CLI)

Create and configure a local EAP profile to support authentication methods for wireless clients.
EAP profiles define authentication methods and security parameters for wireless network access. This configuration establishes a local EAP profile with PEAP method and PKI trustpoint for secure client authentication.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create an EAP profile.

Example:

Device(config)# eap profile profile-name

Example:

Device(config)# eap profile mylocapeap

Step 3

Configure the PEAP method on the profile.

Example:

Device(config-eap-profile)# method peap

Step 4

Configure the PKI trustpoint on the profile.

Example:

Device(config-eap-profile)# pki-trustpoint trustpoint-name

Example:

Device(config-eap-profile)# pki-trustpoint admincert
The local EAP profile is configured with PEAP authentication method and associated PKI trustpoint, ready for use in wireless network authentication.

Configure local EAP profile (GUI)

Configure a local EAP profile to enable secure authentication for wireless clients using various EAP methods.

Use this procedure to create a local EAP profile through the graphical user interface when you need to provide secure wireless authentication capabilities.

Procedure

Step 1

Choose Configuration > Security > Local EAP.

Step 2

Click Add.

Step 3

In the Create Local EAP Profiles page, enter a profile name.

Note

 

It is not advised to use LEAP EAP method due to its weak security. You can use any of these EAP methods to configure a trustpoint:

  • EAP-FAST

  • EAP-TLS

  • PEAP

Clients do not trust the default controller certificate, so you need to deactivate the server certificate validation on the client side or install a certificate trustpoint on the controller.

Step 4

Click Apply to Device.

The local EAP profile is successfully created and applied to the device, enabling secure authentication for wireless clients.

Configure AAA authentication (GUI)

This task enables you to set up authentication, authorization, and accounting (AAA) authentication methods using the graphical user interface to control network access and security.

AAA authentication is a security framework that controls access to network resources. You can configure different authentication methods such as local authentication or external authentication servers to validate user credentials before granting network access.

Procedure

Step 1

Choose Configuration > Security > AAA, and navigate to the AAA Method List > Authentication tabs.

Step 2

Click Add.

Step 3

Choose dot1x as the Type and local as the Group Type.

Step 4

Click Apply to Device.

The AAA authentication method is configured and applied to the device. The system will now use the specified authentication method (dot1x with local group type) to validate user access requests.

Configure AAA authorization method (GUI)

Configure AAA authorization methods to control access permissions for network and credential-download operations.

AAA authorization methods define how the system determines what actions authenticated users are permitted to perform. This configuration is essential for maintaining network security and access control.

Procedure

Step 1

Navigate to Authorization sub-tab.

Step 2

Create a new method for credential-download type and point it to local.

Note

 

Perform the same for network authorization type.

AAA authorization methods are configured for both credential-download and network authorization types, pointing to local authentication.

Configure AAA authorization method (CLI)

Configure AAA authorization method to establish authentication and authorization policies for network access control using CLI commands.

Use this procedure when you need to set up AAA authorization method through the command line interface to control network access and credential management.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a AAA authentication model.

Example:

Device(config)# aaa new-model

Step 3

Configure the default local RADIUS server.

Example:

Device(config)# aaa authentication dot1x default local

Step 4

Configure default database to download credentials from local server.

Example:

Device(config)# aaa authorization credential-download default local

Step 5

Configure the local authentication method list.

Example:

Device(config)# aaa local authentication default authorization default

Step 6

Configure authorization for network services.

Example:

Device(config)# aaa authorization network default local

AAA authorization method is configured with local authentication and authorization for dot1x, credential download, and network services.

Configure local advanced methods (GUI)

Configure local advanced authentication and authorization methods to control access to network resources using the graphical user interface.

Local advanced methods provide enhanced security controls for authentication and authorization in AAA configurations. Use this procedure when you need to set default local authentication and authorization methods through the GUI.

Procedure

Step 1

In the Configuration > Security > AAA window, perform the following:

  1. Navigate to AAA Advanced tab.

  2. From the Local Authentication drop-down list, choose a default local authentication.

  3. From the Local Authorization drop-down list, choose a default local authorization.

Step 2

Click Apply.

The local advanced authentication and authorization methods are configured and applied to the AAA settings.

Configure WLAN (GUI)

Configure a WLAN profile to enable wireless network access for clients.

WLAN configuration allows you to define wireless network parameters including SSID, radio policy, and authentication settings.

Procedure

Step 1

Choose Configuration > Tags & Profiles > WLANs.

Step 2

In the WLANs window, click the name of the WLAN or click Add to create a new one.

Step 3

In the Add/Edit WLAN window that is displayed, click the General tab to configure the following parameters.

  • In the Profile Name field, enter or edit the name of the profile.

  • In the SSID field, enter or edit the SSID name.

    The SSID name can be alphanumeric, and up to 32 characters in length.

  • In the WLAN ID field, enter or edit the ID number. The valid range is between 1 and 512.

  • From the Radio Policy drop-down list, choose the 802.11 radio band.

  • Using the Broadcast SSID toggle button, change the status to either Enabled or Disabled.

  • Using the Status toggle button, change the status to either Enabled or Disabled.

Step 4

In the AAA tab, you can configure the following:

  1. Choose an authentication list from the drop-down.

  2. Check the Local EAP Authentication check box to enable local EAP authentication on the WLAN. Also, choose the required EAP Profile Name from the drop-down list.

Step 5

Click Save & Apply to Device.

The WLAN is configured and applied to the device. The wireless network is now available for client connections with the specified settings.

Configure WLAN (CLI)

Configure a WLAN using CLI commands to establish wireless network connectivity with dot1x security authentication.

Use this procedure when you need to set up a wireless LAN with security authentication through the command line interface.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Enter the WLAN configuration sub-mode.

Example:

Device(config)# wlan wlan-name wlan-id ssid-name
Device(config)# wlan localpeapssid 1 localpeapssid

wlan-name : Is the name of the configured WLAN.

wlan-id : Is the wireless LAN identifier. The range is 1 to 512.

ssid-name : Is the SSID name which can contain 32 alphanumeric characters.

Note

 

If you have already configured this command, enter wlan wlan-name command.

Step 3

Enable security authentication list for dot1x security. The configuration is similar for all dot1x security WLANs.

Example:

Device(config-wlan)# security dot1x authentication-list auth-list-name
Device(config-wlan)# security dot1x authentication-list default

Step 4

Set EAP Profile on an WLAN.

Example:

Device(config-wlan)# local-auth profile-name
Device(config-wlan)# local-auth mylocaleap

profile name : Is the EAP profile on an WLAN.

The WLAN is configured with dot1x security authentication and the specified EAP profile.

Create a user account (CLI)

This task creates a new user account with specified parameters including username, password, creation time, description, and user type.

Use this procedure when you need to create a user account through the command-line interface. This method allows you to specify detailed account parameters during the creation process.

Before you begin

Follow these steps to create a user account using CLI commands:

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a user account.

Example:

Device(config)# user-name user-name
Device(config)# user-name 1xuser

Step 3

Set the creation time of the user account.

Example:

Device(config)# creation-time time
Device(config)# creation-time 1572730075

Step 4

Add a user-defined description to the new user account.

Example:

Device(config)# description user-name
Device(config)# description 1xuser

Step 5

Create a password for the user account.

Example:

Device(config)# password 0 password
Device(config)# password 0 Cisco123

Step 6

Specify the type of user account.

Example:

Device(config)# type network-user description user-name
Device(config)# type network-user description 1xuser

The user account is created with the specified username, password, creation time, description, and user type. The account is now available for use on the device.

Attach a policy profile to a WLAN interface (GUI)

This task allows you to attach a policy profile to a WLAN interface to control network access and security policies for wireless connections.

Policy profiles define access control rules and security settings for WLAN interfaces. Attaching a policy profile to a WLAN interface ensures that wireless clients connecting through that interface are subject to the defined policies.

Procedure

Step 1

Choose Configuration > Tags & Profiles > Tags.

Step 2

On the Manage Tags page, click Policy tab.

Step 3

Click Add to view the Add Policy Tag window.

Step 4

Enter a name and description for the policy tag.

Step 5

Click Add to map the WLAN and policy.

Step 6

Choose the WLAN profile to map with the appropriate policy profile, and click the tick icon.

Step 7

Click Save & Apply to Device.

The policy profile is attached to the WLAN interface. The configuration is saved and applied to the device, ensuring that the policy rules are enforced for clients connecting through the specified WLAN interface.

Deploy policy tag to access points (GUI)

Deploy policy tags to access points to apply specific wireless policies and configurations to designated access points in your network.

Use this procedure when you need to assign policy tags to access points through the graphical user interface. Policy tags allow you to apply consistent configurations across multiple access points.

Procedure

Step 1

Choose Configuration > Wireless > Access Points.

Step 2

On the All Access Points page, click the access point you want to configure.

Make sure that the tags assigned are the ones you configured.

Step 3

Click Apply.

The policy tag is successfully deployed to the selected access point, and the wireless policies associated with the tag are applied to that access point.