이 문서에서는 RADIUS 서버에서 액세스하는 데이터베이스에 대해 무선 사용자의 EAP(Extensible Authentication Protocol) 인증을 위한 Cisco IOS® 소프트웨어 기반 액세스 포인트(AP)의 샘플 컨피그레이션에 대해 설명합니다.
AP는 클라이언트의 무선 패킷을 인증 서버로 향하는 유선 패킷으로 브리징하고 그 반대의 경우도 마찬가지입니다.AP는 EAP에서 이 패시브 역할을 하므로 이 컨피그레이션은 거의 모든 EAP 방법과 함께 사용됩니다.이러한 방법에는 LEAP(Light EAP), PEAP(Protected EAP)-MSCHAP(Microsoft Challenge Handshake Authentication Protocol) 버전 2, PEAP-GTC(Generic Token Card), FAST(Secure Tunneling)를 통한 EAP-Flexible Authentication, TLS(EAP-Tunneled TLS)가 포함되며 이에 국한되지 않습니다. 이러한 각 EAP 방법에 대해 인증 서버를 적절히 구성해야 합니다.
이 문서에서는 이 샘플 컨피그레이션에서 Cisco ACS(Secure Access Control Server) 5.3인 AP 및 RADIUS 서버를 구성하는 방법에 대해 설명합니다.
다음 주제에 대한 지식을 보유하고 있으면 유용합니다.
이 문서의 정보는 다음 소프트웨어 및 하드웨어 버전을 기반으로 합니다.
이 컨피그레이션 예에서는 네트워크에 VLAN이 하나만 있다고 가정합니다.
이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다.이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다.현재 네트워크가 작동 중인 경우, 모든 명령어의 잠재적인 영향을 미리 숙지하시기 바랍니다.
이 문서에서는 GUI와 CLI에 모두 이 컨피그레이션을 사용합니다.
이 절차에서는 인증 서버를 정의하고 인증 서버와 관계를 설정하는 방법에 대해 설명합니다.
사용자를 외부 RADIUS 서버로 보내는 경우 AP는 이 외부 RADIUS 서버에 대한 AAA(Authentication, Authorization, and Accounting) 클라이언트여야 합니다.이 절차에서는 ACS를 구성하는 방법을 설명합니다.
이 절차에서는 AP에서 SSID(Service Set Identifier)를 구성하는 방법을 설명합니다.
이는 CLI 내에서 수행되는 것과 동일한 컨피그레이션입니다.
show run
Building configuration...
Current configuration : 2511 bytes
!
! Last configuration change at 01:17:48 UTC Mon Mar 1 1993
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
!
logging rate-limit console 9
enable secret 5 $1$1u04$jr7DG0DC5KZ6bVaSYUhck0
!
aaa new-model
!
!
aaa group server radius rad_eap
server 10.106.55.91
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
!
!
!
!
!
aaa session-id common
ip cef
!
ip dhcp pool test
!
!
!
dot11 syslog
!
dot11 ssid radius
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa version 2
guest-mode
!
!
crypto pki token default removal timeout 0
!
!
username Cisco password 7 0802455D0A16
!
!
bridge irb
!
!
!
interface Dot11Radio0
no ip address
!
encryption mode ciphers aes-ccm
!
ssid radius
!
antenna gain 0
stbc
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
no ip address
!
encryption mode ciphers aes-ccm
!
ssid radius
!
antenna gain 0
dfs band 3 block
stbc
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface BVI1
ip address 10.105.136.11 255.255.255.128
!
ip default-gateway 10.105.136.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip route 0.0.0.0 0.0.0.0 10.105.136.1
ip radius source-interface BVI1
!
radius-server attribute 32 include-in-access-req format %h
radius-server host 10.106.55.91 key 7 00271A1507545A545C606C
radius-server vsa send accounting
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
transport input all
!
end
이 섹션을 사용하여 컨피그레이션이 제대로 작동하는지 확인합니다.
클라이언트를 연결합니다.성공적인 인증 후 AP GUI에 표시되는 컨피그레이션 요약입니다.
CLI에서 show dot11 associations 명령을 입력하여 컨피그레이션을 확인합니다.
ap#show dot11 associations
802.11 Client Stations on Dot11Radio0:
SSID [radius] :
MAC Address IP address Device Name Parent State
f8db.7f75.7804 10.105.136.116 unknown - self EAP-Assoc
AP에 구성된 모든 RADIUS 서버 그룹 목록을 표시하려면 show radius server-group all 명령을 입력할 수도 있습니다.
이 절차에서는 컨피그레이션을 트러블슈팅하는 방법에 대해 설명합니다.
Invalid message authenticator in EAP request
radius-server host x.x.x.x auth-port x acct-port x key
디바이스 간의 협상을 조사하고 표시하려면 다음 debug 명령을 사용합니다.
이 명령은 클라이언트와 인증 서버 간의 주요 협상 부서(또는 상태)를 표시합니다.다음은 성공적인 인증 출력의 예입니다.
ap#debug dot11 aaa authenticator state-machine
state machine debugging is on
ap#
*Mar 1 01:38:34.919: dot11_auth_dot1x_send_id_req_to_client: Sending identity
request to f8db.7f75.7804
*Mar 1 01:38:34.919: dot11_auth_dot1x_send_id_req_to_client: Client
f8db.7f75.7804 timer started for 30 seconds
*Mar 1 01:38:35.431: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.431: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:35.431: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:35.435: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.435: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:35.435: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:35.443: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.443: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:35.443: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:35.447: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:35.447: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:35.447: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
-------------------Lines Omitted for simplicity-------------------
*Mar 1 01:38:36.663: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_REPLY) for f8db.7f75.7804
*Mar 1 01:38:36.663: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:36.663: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:36.667: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,
CLIENT_REPLY) for f8db.7f75.7804
*Mar 1 01:38:36.667: dot11_auth_dot1x_send_response_to_server: Sending client
f8db.7f75.7804 data to server
*Mar 1 01:38:36.667: dot11_auth_dot1x_send_response_to_server: Started timer
server_timeout 60 seconds
*Mar 1 01:38:36.671: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,
SERVER_PASS) for f8db.7f75.7804
*Mar 1 01:38:36.671: dot11_auth_dot1x_send_response_to_client: Forwarding server
message to client f8db.7f75.7804
*Mar 1 01:38:36.671: dot11_auth_dot1x_send_response_to_client: Started timer
client_timeout 30 seconds
*Mar 1 01:38:36.719: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]
이 명령은 서버와 클라이언트 간의 RADIUS 협상을 표시합니다. 두 협상 모두 AP에 의해 브리지됩니다.다음은 성공적인 인증 출력의 예입니다.
ap#debug radius authentication
*Mar 1 01:50:50.635: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.635: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: service-type [345] 4 1
*Mar 1 01:50:50.635: RADIUS: AAA Unsupported Attr: interface [222] 3
*Mar 1 01:50:50.635: RADIUS: 32 [ 2]
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IPv6:
*Mar 1 01:50:50.635: RADIUS/ENCODE(000001F6): acct_session_id: 491
*Mar 1 01:50:50.635: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.635: RADIUS(000001F6): sending
*Mar 1 01:50:50.635: RADIUS(000001F6): Send Access-Request to 10.106.55.91:1645
id 1645/73, len 140
*Mar 1 01:50:50.635: RADIUS: authenticator 0F 74 18 0E F3 08 ED 51 -
8B EA F7 31 AC C9 CA 6B
*Mar 1 01:50:50.635: RADIUS: User-Name [1] 8 "radius"
*Mar 1 01:50:50.635: RADIUS: Framed-MTU [12] 6 1400
*Mar 1 01:50:50.635: RADIUS: Called-Station-Id [30] 26 "1C-E6-C7-E1-D8-90:
radius"
*Mar 1 01:50:50.635: RADIUS: Calling-Station-Id [31] 16 "f8db.7f75.7804"
*Mar 1 01:50:50.635: RADIUS: Service-Type [6] 6 Login [1]
*Mar 1 01:50:50.635: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.635: RADIUS: E3 E1 50 F8 2B 22 26 84 C1 F1 76 28 79 70 5F 78
[ P+"&v(yp_x]
*Mar 1 01:50:50.635: RADIUS: EAP-Message [79] 13
*Mar 1 01:50:50.635: RADIUS: 02 01 00 0B 01 72 61 64 69 75 73
[ radius]
*Mar 1 01:50:50.635: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:50.635: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:50.635: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:50.635: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:50.635: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:50.635: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:50.635: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:50.639: RADIUS: Received from id 1645/73 10.106.55.91:1645, Access
-Challenge, len 94
*Mar 1 01:50:50.639: RADIUS: authenticator 5E A4 A7 B9 01 CC F4 20 -
2E D0 2A 1A A4 58 05 9E
*Mar 1 01:50:50.639: RADIUS: State [24] 32
*Mar 1 01:50:50.639: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.639: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.639: RADIUS: EAP-Message [79] 24
*Mar 1 01:50:50.639: RADIUS: 01 DC 00 16 11 01 00 08 00 CB 2A 0A 74 B3 77 AF
72 61 64 69 75 73 [ *twradius]
*Mar 1 01:50:50.639: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.643: RADIUS: CC 44 D5 FE FC 86 BC 2D B0 89 61 69 4F 34 D1 FF
[ D-aiO4]
*Mar 1 01:50:50.643: RADIUS(000001F6): Received from id 1645/73
*Mar 1 01:50:50.643: RADIUS/DECODE: EAP-Message fragments, 22, total 22 bytes
*Mar 1 01:50:50.647: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.647: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: service-type [345] 4
1
*Mar 1 01:50:50.647: RADIUS: AAA Unsupported Attr: interface [222] 3
*Mar 1 01:50:50.647: RADIUS: 32 [ 2]
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IPv6:
*Mar 1 01:50:50.647: RADIUS/ENCODE(000001F6): acct_session_id: 491
*Mar 1 01:50:50.647: RADIUS(000001F6): Config NAS IP: 10.105.136.11
*Mar 1 01:50:50.647: RADIUS(000001F6): sending
*Mar 1 01:50:50.647: RADIUS(000001F6): Send Access-Request to 10.106.55.91:1645
id 1645/74, len 167
*Mar 1 01:50:50.647: RADIUS: authenticator C6 54 54 B8 58 7E ED 60 - F8 E0 2E
05 B0 87 3B 76
*Mar 1 01:50:50.647: RADIUS: User-Name [1] 8 "radius"
*Mar 1 01:50:50.647: RADIUS: Framed-MTU [12] 6 1400
*Mar 1 01:50:50.647: RADIUS: Called-Station-Id [30] 26 "1C-E6-C7-E1-D8-90:
radius"
*Mar 1 01:50:50.647: RADIUS: Calling-Station-Id [31] 16 "f8db.7f75.7804"
*Mar 1 01:50:50.647: RADIUS: Service-Type [6] 6 Login
[1]
*Mar 1 01:50:50.647: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.647: RADIUS: FE 15 7B DB 49 FE 27 C5 BC E2 FE 83 B9 25 8C 1F
[ {I'?]
*Mar 1 01:50:50.647: RADIUS: EAP-Message [79] 8
*Mar 1 01:50:50.647: RADIUS: 02 DC 00 06 03 19
*Mar 1 01:50:50.647: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:50.647: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:50.647: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:50.647: RADIUS: State [24] 32
*Mar 1 01:50:50.647: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.647: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.647: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:50.647: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:50.647: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:50.647: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:50.647: RADIUS: Received from id 1645/74 10.106.55.91:1645, Access
-Challenge, len 78
*Mar 1 01:50:50.647: RADIUS: authenticator 0E 81 99 9E EE 39 50 FB - 6E 6D 93
8C 8E 29 94 EC
*Mar 1 01:50:50.647: RADIUS: State [24] 32
*Mar 1 01:50:50.651: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:50.651: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:50.651: RADIUS: EAP-Message [79] 8
*Mar 1 01:50:50.651: RADIUS: 01 DD 00 06 19 21 [ !]
*Mar 1 01:50:50.651: RADIUS: Message-Authenticato[80] 18
*Mar 1 01:50:50.651: RADIUS: A8 54 00 89 1F 2A 01 52 FE FA D2 58 2F E5 F2 86
[ T*RX/]
*Mar 1 01:50:50.651: RADIUS(000001F6): Received from id 1645/74
*Mar 1 01:50:50.651: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes
*Mar 1 01:50:50.655: RADIUS/ENCODE(000001F6):Orig. component type = DOT11
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: ssid [347] 6
*Mar 1 01:50:50.655: RADIUS: 72 61 64 69 [ radi]
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: service-type [345] 4
1
*Mar 1 01:50:50.655: RADIUS: AAA Unsupported Attr: interface [222] 3
-------------------Lines Omitted for simplicity-------------------
11 [ l2^w$qM{60]
*Mar 1 01:50:51.115: RADIUS: NAS-Port-Type [61] 6 802.11 wireless
[19]
*Mar 1 01:50:51.115: RADIUS: NAS-Port [5] 6 282
*Mar 1 01:50:51.115: RADIUS: NAS-Port-Id [87] 5 "282"
*Mar 1 01:50:51.115: RADIUS: State [24] 32
*Mar 1 01:50:51.115: RADIUS: 32 37 53 65 73 73 69 6F 6E 49 44 3D 61 63 73 35
[27SessionID=acs5]
*Mar 1 01:50:51.115: RADIUS: 31 2F 31 36 35 34 38 39 35 31 31 2F 39 3B [ 1
/165489511/9;]
*Mar 1 01:50:51.115: RADIUS: NAS-IP-Address [4] 6 10.105.136.11
*Mar 1 01:50:51.115: RADIUS: Nas-Identifier [32] 4 "ap"
*Mar 1 01:50:51.115: RADIUS(000001F6): Sending a IPv4 Radius Packet
*Mar 1 01:50:51.115: RADIUS(000001F6): Started 5 sec timeout
*Mar 1 01:50:51.115: RADIUS: Received from id 1645/80 10.106.55.91:1645, Access
-Challenge, len 115
*Mar 1 01:50:51.115: RADIUS: authenticator 74 CF 0F 34 1F 1B C1 CF -
E9 27 79 D5 F8 9C 5C 50
*Mar 1 01:50:51.467: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]
이 명령은 클라이언트 디바이스와 인증 서버 간의 인증을 위한 AAA 협상을 표시합니다.
ap#debug aaa authentication
AAA Authentication debugging is on
ap#term mon
ap#
*Mar 1 01:55:52.335: AAA/BIND(000001F9): Bind i/f
*Mar 1 01:55:52.859: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.867: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.875: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:52.895: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.219: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.379: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.395: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.807: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.879: AAA/AUTHEN/PPP (000001F9): Pick method list 'eap_methods'
*Mar 1 01:55:53.939: %DOT11-6-ASSOC: Interface Dot11Radio0, Station
f8db.7f75.7804 Associated KEY_MGMT[WPAv2]