Avez-vous un compte?
Ce document décrit une configuration d'échantillon d'un Point d'accès articulé autour d'un logiciel de Cisco IOS® (AP) pour l'authentification de Protocole EAP (Extensible Authentication Protocol) des utilisateurs de sans fil contre une base de données accédée à par un serveur de RADIUS.
AP jette un pont sur les paquets Sans fil du client dans les paquets de câble destinés au serveur d'authentification et vice versa. Puisqu'AP joue ce rôle passif dans l'EAP, cette configuration est utilisée avec pratiquement toutes les méthodes d'EAP. Ces méthodes incluent, mais ne sont pas limitées à, EAP léger (LEAP), EAP protégé (PEAP) - version 2 de la Microsoft Challenge Handshake Authentication Protocol (MSCHAP), PEAP-Generic Token Card (GTC), EAP-Flexible Authentication via Secure Tunneling (JEÛNEZ), EAP-Transport Layer Security (TLS), et EAP-Tunneled TLS (TTL). Vous devez configurer convenablement le serveur d'authentification pour chacune de ces méthodes d'EAP.
Ce document décrit comment configurer AP et le serveur de RADIUS, qui est un Cisco Secure Access Control Server (ACS) 5.3 dans cette configuration d'échantillon.
Cisco vous recommande de prendre connaissance des rubriques suivantes :
Les informations contenues dans ce document sont basées sur les versions de matériel et de logiciel suivantes :
Cet exemple de configuration suppose qu'il y a seulement un VLAN dans le réseau.
Les informations contenues dans ce document ont été créées à partir des périphériques d'un environnement de laboratoire spécifique. Tous les périphériques utilisés dans ce document ont démarré avec une configuration effacée (par défaut). Si votre réseau est opérationnel, assurez-vous que vous comprenez l'effet potentiel de toute commande.
Ce document utilise cette configuration pour le GUI et le CLI :
Cette procédure décrit comment définir le serveur d'authentification et établir des relations avec elle.
Si vous envoyez des utilisateurs à un serveur RADIUS externe, AP doit être un client d'Authentification, autorisation et comptabilité (AAA) pour ce serveur RADIUS externe. Cette procédure décrit comment configurer l'ACS.
Cette procédure décrit comment configurer l'Identifiant SSID (Service Set Identifier) sur AP.
C'est la même configuration faite dans le CLI :
show run
Building configuration...
Current configuration : 2511 bytes
!
! Last configuration change at 01:17:48 UTC Mon Mar 1 1993
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
!
logging rate-limit console 9
enable secret 5 $1$1u04$jr7DG0DC5KZ6bVaSYUhck0
!
aaa new-model
!
!
aaa group server radius rad_eap
server 10.106.55.91
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
!
!
!
!
!
aaa session-id common
ip cef
!
ip dhcp pool test
!
!
!
dot11 syslog
!
dot11 ssid radius
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa version 2
guest-mode
!
!
crypto pki token default removal timeout 0
!
!
username Cisco password 7 0802455D0A16
!
!
bridge irb
!
!
!
interface Dot11Radio0
no ip address
!
encryption mode ciphers aes-ccm
!
ssid radius
!
antenna gain 0
stbc
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
no ip address
!
encryption mode ciphers aes-ccm
!
ssid radius
!
antenna gain 0
dfs band 3 block
stbc
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface BVI1
ip address 10.105.136.11 255.255.255.128
!
ip default-gateway 10.105.136.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip route 0.0.0.0 0.0.0.0 10.105.136.1
ip radius source-interface BVI1
!
radius-server attribute 32 include-in-access-req format %h
radius-server host 10.106.55.91 key 7 00271A1507545A545C606C
radius-server vsa send accounting
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
transport input all
!
end
Référez-vous à cette section pour vous assurer du bon fonctionnement de votre configuration.
Connectez le client ; après l'authentification réussie, c'est le résumé de configuration qui paraît dans le GUI AP :
Dans le CLI, sélectionnez la commande de show dot11 associations afin de confirmer la configuration :
ap#show dot11 associations
802.11 Client Stations on Dot11Radio0:
SSID [radius] :
MAC Address IP address Device Name Parent State
f8db.7f75.7804 10.105.136.116 unknown - self EAP-Assoc
Vous pouvez également présenter le show radius server-group toute la commande afin d'afficher une liste de tous les servers-group configurés de RADIUS sur AP.
Cette procédure décrit comment dépanner votre configuration.
Invalid message authenticator in EAP request
radius-server host x.x.x.x auth-port x acct-port x key <shared_secret>
Employez ces commandes de débogage afin d'étudier et afficher les négociations parmi des périphériques :
Cette commande affiche des divisions importantes (ou des états) de la négociation entre le client et le serveur d'authentification. C'est un exemple de sortie d'une authentification réussie :
ap#debug dot11 aaa authenticator state-machine
state machine debugging is on
ap#
*Mar 1 01:38:34.919: dot11_auth_dot1x_send_id_req_to_client: Sending identity
request to f8db.7f75.7804
*Mar 1 01:38:34.919: dot11_auth_dot1x_send_id_req_to_client: Client
f8db.7f75.7804 timer started for 30 seconds
*Mar 1 01:38:35.431: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.431: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:35.431: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:35.435: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.435: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:35.435: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:35.443: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.443: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:35.443: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:35.447: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.447: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:35.447: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
-------------------Lines Omitted for simplicity-------------------
*Mar 1 01:38:36.663: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:36.663: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:36.663: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:36.667: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:36.667: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:36.667: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:36.671: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_PASS) for f8db.7f75.7804
*Mar 1 01:38:36.671: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:36.671: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:36.719: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]
Cette commande affiche les négociations de RADIUS entre le serveur et le client, qui pont par AP. C'est un exemple de sortie d'une authentification réussie :
ap#debug radius authentication
*Mar 1 01:50:50.635: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.635: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: service-type [345] 4 1
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: interface [222] 3
*Mar 1 01:50:50.635: RADIUS: 32 [ 2]
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IPv6:
*Mar 1 01:50:50.635: RADIUS/ENCODE(000001F6): acct_session_id: 491
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.635: RADIUS(000001F6): sending
*Mar 1 01:50:50.635: RADIUS(000001F6): Send Access-Request to 10.106.55.91:1645
id 1645/73, len 140
*Mar 1 01:50:50.635: RADIUS: authenticator 0F 74 18 0E F3 08 ED 51 -
8B EA F7 31 AC C9 CA 6B
*Mar 1 01:50:50.635: RADIUS: User-Name [1] 8 "radius"
*Mar 1 01:50:50.635: RADIUS: Framed-MTU [12] 6 1400
*Mar 1 01:50:50.635: RADIUS: Called-Station-Id [30] 26 "1C-E6-C7-E1-D8-90:
radius"
*Mar 1 01:50:50.635: RADIUS: Calling-Station-Id [31] 16 "f8db.7f75.7804"
*Mar 1 01:50:50.635: RADIUS: Service-Type [6] 6 Login [1]
*Mar 1 01:50:50.635: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.635: RADIUS: E3 E1 50 F8 2B 22 26 84 C1 F1 76 28 79 70 5F 78
[ P+"&v(yp_x]
*Mar 1 01:50:50.635: RADIUS: EAP-Message [79] 13
*Mar 1 01:50:50.635: RADIUS: 02 01 00 0B 01 72 61 64 69 75 73
[ radius]
*Mar 1 01:50:50.635: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:50.635: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:50.635: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:50.635: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:50.635: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:50.635: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:50.635: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:50.639: RADIUS: Received from id 1645/73 10.106.55.91:1645, Access
-Challenge, len 94
*Mar 1 01:50:50.639: RADIUS: authenticator 5E A4 A7 B9 01 CC F4 20 -
2E D0 2A 1A A4 58 05 9E
*Mar 1 01:50:50.639: RADIUS: State [24] 32
*Mar 1 01:50:50.639: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.639: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.639: RADIUS: EAP-Message [79] 24
*Mar 1 01:50:50.639: RADIUS: 01 DC 00 16 11 01 00 08 00 CB 2A 0A 74 B3 77 AF
72 61 64 69 75 73 [ *twradius]
*Mar 1 01:50:50.639: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.643: RADIUS: CC 44 D5 FE FC 86 BC 2D B0 89 61 69 4F 34 D1 FF
[ D-aiO4]
*Mar 1 01:50:50.643: RADIUS(000001F6): Received from id 1645/73
*Mar 1 01:50:50.643: RADIUS/DECODE: EAP-Message fragments, 22, total 22 bytes
*Mar 1 01:50:50.647: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.647: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: service-type [345] 4
1
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: interface [222] 3
*Mar 1 01:50:50.647: RADIUS: 32 [ 2]
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IPv6:
*Mar 1 01:50:50.647: RADIUS/ENCODE(000001F6): acct_session_id: 491
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.647: RADIUS(000001F6): sending
*Mar 1 01:50:50.647: RADIUS(000001F6): Send Access-Request to 10.106.55.91:1645
id 1645/74, len 167
*Mar 1 01:50:50.647: RADIUS: authenticator C6 54 54 B8 58 7E ED 60 - F8 E0 2E
05 B0 87 3B 76
*Mar 1 01:50:50.647: RADIUS: User-Name [1] 8 "radius"
*Mar 1 01:50:50.647: RADIUS: Framed-MTU [12] 6 1400
*Mar 1 01:50:50.647: RADIUS: Called-Station-Id [30] 26 "1C-E6-C7-E1-D8-90:
radius"
*Mar 1 01:50:50.647: RADIUS: Calling-Station-Id [31] 16 "f8db.7f75.7804"
*Mar 1 01:50:50.647: RADIUS: Service-Type [6] 6 Login
[1]
*Mar 1 01:50:50.647: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.647: RADIUS: FE 15 7B DB 49 FE 27 C5 BC E2 FE 83 B9 25 8C 1F
[ {I'?]
*Mar 1 01:50:50.647: RADIUS: EAP-Message [79] 8
*Mar 1 01:50:50.647: RADIUS: 02 DC 00 06 03 19
*Mar 1 01:50:50.647: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:50.647: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:50.647: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:50.647: RADIUS: State [24] 32
*Mar 1 01:50:50.647: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.647: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.647: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:50.647: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:50.647: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:50.647: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:50.647: RADIUS: Received from id 1645/74 10.106.55.91:1645, Access
-Challenge, len 78
*Mar 1 01:50:50.647: RADIUS: authenticator 0E 81 99 9E EE 39 50 FB - 6E 6D 93
8C 8E 29 94 EC
*Mar 1 01:50:50.647: RADIUS: State [24] 32
*Mar 1 01:50:50.651: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.651: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.651: RADIUS: EAP-Message [79] 8
*Mar 1 01:50:50.651: RADIUS: 01 DD 00 06 19 21 [ !]
*Mar 1 01:50:50.651: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.651: RADIUS: A8 54 00 89 1F 2A 01 52 FE FA D2 58 2F E5 F2 86
[ T*RX/]
*Mar 1 01:50:50.651: RADIUS(000001F6): Received from id 1645/74
*Mar 1 01:50:50.651: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes
*Mar 1 01:50:50.655: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.655: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: service-type [345] 4
1
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: interface [222] 3
-------------------Lines Omitted for simplicity-------------------
11 [ l2^w$qM{60]
*Mar 1 01:50:51.115: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:51.115: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:51.115: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:51.115: RADIUS: State [24] 32
*Mar 1 01:50:51.115: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:51.115: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:51.115: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:51.115: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:51.115: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:51.115: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:51.115: RADIUS: Received from id 1645/80 10.106.55.91:1645, Access
-Challenge, len 115
*Mar 1 01:50:51.115: RADIUS: authenticator 74 CF 0F 34 1F 1B C1 CF -
E9 27 79 D5 F8 9C 5C 50
*Mar 1 01:50:51.467: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]
Cette commande affiche les négociations d'AAA pour l'authentification entre le périphérique de client et le serveur d'authentification.
ap#debug aaa authentication
AAA Authentication debugging is on
ap#term mon
ap#
*Mar 1 01:55:52.335: AAA/BIND(000001F9): Bind i/f
*Mar 1 01:55:52.859: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.867: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.875: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.895: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.219: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.379: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.395: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.807: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.879: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.939: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]