Cisco Systems CB21AG manual Configuring the Client Adapter Setting Security Parameters

Page 82

Chapter 5 Configuring the Client Adapter

Setting Security Parameters

The client adapter uses the username, password, and PAC to perform mutual authentication with the RADIUS server through the access point. The username and password need to be re-entered each time the client adapter is inserted or the Windows device is rebooted unless you configure your adapter to use saved EAP-FAST credentials.

PACs are created by Cisco Secure ACS and are identified by an ID. The user obtains his or her own copy of the PAC from the server, and the ID links the PAC to the profile created in ADU. When manual PAC provisioning is enabled, the PAC is manually copied from the server and imported onto the client device. The following rules govern PAC storage:

–PACs are stored as encrypted data files in either the global or private store on the user’s computer.

•Global PACs can be accessed and used by any user at any logon stage. They are available before or during logon or after the user is logged off if the profile is not configured with the No Network Connection Unless User Is Logged In option.

•Private PACs can be accessed and used only by the user who provisioned them or the system administrator.

Note Global PACs are stored on C:\Document and Settings\All Users\Application

Data\Cisco\cscostore, and private PACs are stored on C:\Document and Settings\user\

Application Data\Cisco\cscostore.

–If automatic PAC provisioning is enabled and it occurs after the user is logged on, the PAC is stored in the private store of the currently logged-on user. Otherwise, the PAC is stored in the global store.

–PAC files can be added or overwritten using the import feature.

–PAC files can be removed using the delete feature. They are also deleted when you uninstall the client adapter software.

EAP-FAST authentication is designed to support the following user databases over a wireless LAN:

–Cisco Secure ACS internal user database

–Cisco Secure ACS ODBC user database

–Windows NT/2000/2003 domain user database

–LDAP user database

LDAP user databases (such as NDS) support only manual PAC provisioning while the other three user databases support both automatic and manual PAC provisioning.

•EAP-TLS—This authentication type uses a dynamic session-based WEP key derived from the client adapter and RADIUS server to encrypt data. It uses a client certificate for authentication.

RADIUS servers that support EAP-TLS include Cisco Secure ACS release 3.0 or later and Cisco Access Registrar release 1.8 or later.

Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide

5-16

OL-4211-03

 

 

Page 81 Page 83
Image 82
Page 81 Page 83
Contents Corporate Headquarters Customer Order Number Text Part Number OL-4211-03Copyright 2005 Cisco Systems, Inc All rights reserved N T E N T S IiiAssembling the Antenna Overview Pop-Up Menu Help Exit Select Profile ViiAntenna Installation Warning B-3 ViiiWPA OL-4211-03 Preface Following topics are covered in this sectionOrganization AudiencePurpose XiiConventions XiiiXiv Cisco.com Related PublicationsObtaining Documentation Documentation DVDDocumentation Feedback Cisco Product Security OverviewOrdering Documentation XviCisco Technical Support Website Reporting Security Problems in Cisco ProductsObtaining Technical Assistance An emergency, you can also reach Psirt by telephone 877 408Definitions of Service Request Severity Submitting a Service RequestXviii Obtaining Additional Publications and Information XixOL-4211-03 Product Overview Client Adapter Model Number Description Introduction to the Client AdaptersTerminology AIR-CB21AGRadio Antenna Hardware ComponentsRadio LEDsDriver Software ComponentsClient Utilities Network Configurations Using Client Adapters Ad Hoc Wireless LANAccess Point Root Unit Wired LAN Preparing for Installation FCC Safety Compliance Statement Safety informationSafety Guidelines Package Contents Unpacking the Client AdapterSystem Requirements For Infrastructure Devices Site RequirementsFor Client Devices OL-4211-03 Installing the Client Adapter Inserting a Client Adapter Inserting a PC-Cardbus CardChanging the Bracket Inserting a PCI CardBracket screws Inserting the Card Assembling the Antenna Inserting a PCI Card into a PCMounting the Antenna Inserting the Antenna into Its BaseBottom of Antenna Base Mounting the Antenna Installing the Client Adapter Software Preparing Setup Window Click Next. The Setup Type window appears see Figure Cisco Aironet Installation Program Window10 Setup Type Window 11 Install Cisco Aironet Site Survey Utility Window 12 Choose Destination Location Window 13 Select Program Folder Window 14 Important Please Read! Window Feature 15 Choose Configuration Tool WindowSecurity Static WEP Yes Leap or EAP-FAST authenticationWith dynamic WEP EAP-TLS or Peap authentication Yes ReceiveClick Properties Installing a Microsoft Hot Fix for Group Policy Delay Page OL-4211-03 Using the Profile Manager Overview of Profile Manager Opening Profile ManagerSSID2 Field DescriptionSSID1 SSID3Creating a New Profile Available Infrastructure and Ad Hoc Networks WindowSNR Profile Management General Window Including a Profile in Auto Profile Selection Auto Profile Selection Management WindowOL-4211-03 Selecting the Active Profile Editing a Profile Modifying a ProfileImporting and Exporting Profiles Deleting a ProfileImporting a Profile Exporting a ProfileExport Profile Window Configuring the Client Adapter Overview Parameter Category NumberSetting General Parameters Parameter Description Client adapter to roam to that network without having to be ReconfiguredAuto profile selection or configured for use in an ad hoc Auto profile selectionSetting Advanced Parameters Profile Management Advanced WindowRadio Band Transmit Power Level Profile Management Advanced Parameters Network Type Description Parameter Description Parameter Description Default Open Setting Security Parameters Preferred Access Points WindowOverview of Security Features Profile Management Security WindowStatic WEP Keys EAP with Dynamic WEP KeysConfiguring the Client Adapter Setting Security Parameters LEAP, EAP-FAST, EAP-TLS, Peap EAP-GTC, or Peap EAP-MSCHAP V2,WPA and WPA2 Cckm Fast Secure RoamingReporting Access Points that Fail Leap Authentication Security Feature Client Setting Access Point Setting Synchronizing Security FeaturesAdditional WEP Key Security Features SsidWPA Security Feature Client Setting Access Point Setting WPA/WPA2/CCKM LEAP, EAP-FAST, EAP-TLSOr later, choose a cipher suite that is MICPeap EAP-MSCHAP Enabling Static WEPTkip Interval to any value other thanConfiguring the Client Adapter Setting Security Parameters Enabling WPA/WPA2 Passphrase Define WPA/WPA2 Pre-Shared Key WindowEnabling Leap Leap Settings Window Configuring the Client Adapter Setting Security Parameters Configuring the Client Adapter Setting Security Parameters Enabling EAP-FAST EAP-FAST Settings Window Configuring the Client Adapter Setting Security Parameters Click Select More Select EAP-FAST PAC Window 10 Import EAP-FAST PAC File Window Configuring the Client Adapter Setting Security Parameters Deleting a Manually Provisioned PAC File Enabling EAP-TLS or Peap Enabling EAP-TLS 12 Define Certificate WindowConfiguring the Client Adapter Setting Security Parameters Enabling Peap EAP-GTC 13 Define Peap EAP-GTC Configuration Window 14 Configuration Settings Window Configuring the Client Adapter Setting Security Parameters 15 Define Peap EAP-MSCHAP V2 Configuration Window Enabling Peap EAP-MSCHAP16 Configuration Settings Window Configuring the Client Adapter Setting Security Parameters Configuring the Client Adapter Setting Security Parameters Configuring the Client Adapter Setting Security Parameters Disabling Static WEP, WPA/WPA2 Passphrase, or EAP Enabling Wi-Fi MultimediaEnabling the QoS Packet Scheduler on Windows 17 Wireless Cisco Connection Properties Window 18 Select Network Component Type Window Enabling the QoS Packet Scheduler on Windows XP Click Control Panel Double-clickNetwork ConnectionsSetting Roaming Parameters in the Windows Control Panel Follow these steps to access the roaming parametersWireless Mode Using EAP Authentication Using Leap or EAP-FAST Leap or EAP-FAST Authentication Status WindowAfter Profile Activation or Card Insertion Stage ExplanationAfter a Reboot or Logon After Your EAP-FAST Password ExpiresUsing Leap or EAP-FAST with an Automatically Prompted Login Enter Wireless Network Password Window After Your EAP-FAST Password Expires Using Leap or EAP-FAST with a Manually Prompted Login After Profile ActivationAfter a Reboot, Logon, or Card Insertion Action Drop-Down Menu After Your EAP-FAST Password Expires Using Leap or EAP-FAST with a Saved Username and Password Using EAP-TLS 10 Please Change Password WindowWindows NT or 2000 Domain Databases or Ldap Databases Only Using Peap EAP-GTCOTP Databases Only Using Peap EAP-MSCHAP Restarting the Authentication ProcessOL-4211-03 Viewing Status and Statistics Status Statistics Overview of ADU Status and Statistics ToolsTool NumberDisplays the signal strength Signal-to-noise ratio as a percentageViewing the Current Status of Your Client Adapter 3interprets each element of the Current Status windowStatus Description Status Description Details on these server-based authentication types 4interprets each element of the Advanced Status windowMichael MIC is enabled and is being used with WPA and Tkip None MIC is disabledMIC is enabled and is being used with MMHWMM Status Description Status Description Cisco Aironet Desktop Utility Diagnostics Window Viewing Statistics for Your Client AdapterStatistic Description Advanced Statistics Window6interprets each element of the Advanced Statistics window Ckip MIC OK Integrity check MIC value when Ckip was being usedPoint OL-4211-03 Using the Aironet System Tray Utility Astu Astu Icon Infrastructure mode or another client in ad hoc modeOverview of Astu Icon DescriptionTool Tip Window Status Element DescriptionConnection Status Description Help This option enables you to access the online helpPop-Up Menu Following sections describe each Astu pop-up menu optionOpen Aironet Desktop Utility TroubleshootingExit PreferencesEnable/Disable Radio Reauthenticate Manual LoginSelect Profile Show Connection Status Connection Status WindowConnection Status Window Elements Ssid OL-4211-03 Routine Procedures Removing a PC-Cardbus Card Removing a Client AdapterRemoving a PCI Card Client Adapter Software Procedures Upgrading the Client Adapter SoftwarePrevious Installation Detected Window Choose Update the previous installation and click Next Uninstalling the Client Adapter Software Choose Uninstall the previous installation and click NextOpening ADU ADU ProceduresExiting ADU Finding the Version of ADU Viewing Client Adapter InformationRefer to for instructions on using Astu Astu ProceduresAccessing Online Help Enabling or Disabling Your Client Adapter’s RadioOL-4211-03 Troubleshooting 10-1Status LED green Activity LED amber Condition Accessing the Latest Troubleshooting InformationInterpreting the Indicator LEDs 10-2Troubleshooting Information Number Troubleshooting the Client AdapterUsing the Troubleshooting Utility Diagnosing Your Client Adapter’s OperationTroubleshooting Utility Window 10-4Troubleshooting Utility Window with Test Results 10-5Troubleshooting Utility Window Detailed Report 10-6Saving the Detailed Report to a Text File 10-7Disabling the Microsoft 802.1X Supplicant Windows 2000 Only Client Adapter Recognition Problems10-8 Resolving Resource Conflicts in Windows Reboot your computerResolving Resource Conflicts 10-9Resolving Resource Conflicts in Windows XP Problems Associating to an Access Point10-10 Parameters Missing from Profile Management Windows Problems Connecting to the NetworkPrioritizing Network Connections 10-11Error Messages 10-1210-13 10-14 10-15 10-16 10-17 10-18 10-19 10-20 10-21 10-22 10-23 10-24 Technical Specifications ESD Physical SpecificationsRadio Specifications KV human body modelAppendix a Technical Specifications DBm @ 24 Mbps Receiver sensitivity 802.11aDBm @ 6, 9, 12, and 18 Mbps DBm @ 36 MbpsIndoor typical Outdoor typical Power Specifications Safety and Regulatory Compliance SpecificationsTranslated Safety Warnings Explosive Device Proximity Warning Antenna Installation Warning Appendix B Translated Safety Warnings Appendix B Translated Safety Warnings Appendix B Translated Safety Warnings Declarations of Conformity and Regulatory Information Models AIR-CB21AG-A-K9, AIR-PI21AG-A-K9 USADepartment of Communications Canada Canadian Compliance StatementOL-4211-03 Cisco Aironet CB21AG Wireless LAN Client Adapter Declaration of Conformity StatementCisco Aironet PI21AG Wireless LAN Client Adapter Japanese Translation Declaration of Conformity for RF ExposureEnglish Translation English Translation 5-GHz Client AdaptersChinese Translation Communication ACTGHz Client Adapters This equipment is limited for indoor useOL-4211-03 Channels, Power Levels, and Antenna Gains Ieee 802.11a ChannelsRegulatory Domains Ieee 802.11b/g Data Rate Maximum Power Levels and Antenna GainsIeee 802.11b With 1-dBi Antenna GainIeee 802.11g Mbps 31.6OL-4211-03 P E N D I X E Overview EAP with Dynamic WEP Keys WPA Configuring the Client Adapter Configuring the Client Adapter Page Configuring the Client Adapter Page Enabling EAP-TLS Authentication For EAP type, choose Smart Card or other Certificate Configuring the Client Adapter Enabling Peap Authentication Figure E-6 Protected EAP Properties Window Figure E-7 EAP MSCHAPv2 Properties Window Figure E-8 Peap Properties Window Figure E-9 Generic Token Card Properties Window Associating to an Access Point Using Windows XP Figure E-10 Wireless Network Connection Status WindowPerforming a Site Survey Guidelines Additional InformationOpening the Site Survey Utility Selecting the Client AdapterUsing the Associated AP Status Tab Specifying Display UnitsViewing the Access Point’s Status Table F-1 Site Survey Utility Associated AP Status Description Using the AP Scan List Tab Viewing the AP Scan List Figure F-5 Site Survey Utility AP Scan ListRssi CCX Pausing the AP Scan ListValue 1, 2, 3, or Viewing AP Details Access point’s wireless networkDetailed Information Parameter Description Rssi Generating an AP Scan Log File Figure F-7 Site Survey Utility Log FileFinding the Version of the Site Survey Utility Accessing Online HelpUninstalling the Site Survey Utility Exiting the Site Survey UtilityPage Standard Wireless network composed of stations without access pointsStations Set of characters that contains both letters and numbersGL-2 Setting must be within the range of 64 to 2312 bytes GL-3Ethernet 802.3 and wireless LAN 802.11 specifications GL-4GL-5 GL-6 802.1X for authenticated key management Computing device with an installed client adapterProtection and 802.1X for authenticated key management GL-7GL-8 Selecting in ADU Authentication Mode parameterIN-1 Selecting the active profile Pausing ViewingADU IN-2CAM AstuIN-3 FCC C-2 ADU Windows XPData encryption ADU Site survey utility IN-4IN-5 ACK CTS CRCFCC RTSIN-7 Status With Leap Modify button Disabling EnablingMMH MIC IN-8IN-9 IN-10 IN-11 IN-12 Setting Viewing ADU Regulatory compliance Safety Spread spectrumIN-13 With test results Third-party tool, enabling in Install WizardInitial window IN-14Security features IN-15IN-16
Related manuals
Manual 34 pages 15 Kb Manual 22 pages 28.37 Kb Manual 170 pages 950 b Manual 22 pages 55.14 Kb
Top Page Image Contents