Filter
Top Products
9-5
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Chapter 9 Configuring an Access Point as a Local Authenticator
Configuring a Local Authenticator
This example shows how to set up a local authenticator used by three access points with three user groups
and several users:
AP# configure terminal
AP(config)# radius-server local
AP(config-radsrv)# nas 10.91.6.159 key 110337
AP(config-radsrv)# nas 10.91.6.162 key 110337
AP(config-radsrv)# nas 10.91.6.181 key 110337
AP(config-radsrv)# group clerks
AP(config-radsrv-group)# vlan 87
AP(config-radsrv-group)# ssid batman
AP(config-radsrv-group)# ssid robin
AP(config-radsrv-group)# reauthentication time 1800
AP(config-radsrv-group)# block count 2 time 600
AP(config-radsrv-group)# group cashiers
AP(config-radsrv-group)# vlan 97
AP(config-radsrv-group)# ssid deer
AP(config-radsrv-group)# ssid antelope
AP(config-radsrv-group)# ssid elk
AP(config-radsrv-group)# reauthentication time 1800
AP(config-radsrv-group)# block count 2 time 600
AP(config-radsrv-group)# group managers
AP(config-radsrv-group)# vlan 77
AP(config-radsrv-group)# ssid mouse
AP(config-radsrv-group)# ssid chipmunk
AP(config-radsrv-group)# reauthentication time 1800
AP(config-radsrv-group)# block count 2 time 600
AP(config-radsrv-group)# exit
AP(config-radsrv)# user jsmith password twain74 group clerks
AP(config-radsrv)# user stpatrick password snake100 group clerks
AP(config-radsrv)# user nick password uptown group clerks
AP(config-radsrv)# user 00095125d02b password 00095125d02b group clerks mac-auth-only
Step 11
user username
{ password | nthash } password
[ group group-name ]
[mac-auth-only]
Enter the LEAP and EAP-FAST users allowed to authenticate
using the local authenticator. You must enter a username and
password for each user. If you only know the NT value of the
password, which you can often find in the authentication server
database, you can enter the NT hash as a string of hexadecimal
digits.
To add a client device for MAC-based authentication, enter the
client’s MAC address as both the username and password. Enter
12 hexadecimal digits without a dot or dash between the numbers
as the username and the password. For example, for the MAC
address 0009.5125.d02b, enter 00095125d02b as both the
username and the password.
To limit the user to MAC authentication only, enter
mac-auth-only.
To add the user to a user group, enter the group name. If you do
not specify a group, the user is not assigned to a specific VLAN
and is never forced to reauthenticate.
Step 12
end Return to privileged EXEC mode.
Step 13
copy running-config
startup-config
(Optional) Save your entries in the configuration file.
Command Purpose