Cisco Systems 0L-11350-01 Guidelines for Local Authenticators, Configuration Overview, Configuring the Local Authenticator Access Point

9-3
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-11350-01
Chapter9 Configuring an Access Point as a Local Authenticator
Configuring a Local Authenticator
Guidelines for Local Authenticators
Follow these guidelines when configuring an access point as a local authenticator:
•Use an access point that does not serve a large number of client devices. When the access point acts
as an authenticator, performance might degrade for associated client devices.
•Secure the access point physically to protect its configuration.
Configuration Overview
You complete four major steps when you set up a local authenticator:
1. On the local authenticator, create a list of access points authorized to use the authenticator to
authenticate client devices. Each access point that uses the local authenticator is a network access
server (NAS).
Note If your local authenticator access point also serves client devices, you must enter the local
authenticator access point as a NAS. When a client associates to the local authenticator
access point, the access point uses itself to authenticate the client.
2. On the local authenticator, create user groups and configure parameters to be applied to each group
(optional).
3. On the local authenticator, create a list of up to 50 LEAP users, EAP-FAST users, or MAC addresses
that the local authenticator is authorized to authenticate.
Note You do not have to specify which type of authentication that you want the local authenticator
to perform. It automatically performs LEAP, EAP-FAST, or MAC-address authentication for
the users in its user database.
4. On the access points that use the local authenticator, enter the local authenticator as a RADIUS
server.
Note If your local authenticator access point also serves client devices, you must enter the local
authenticator as a RADIUS server in the local authenticator’s configuration. When a client
associates to the local authenticator access point, the access point uses itself to authenticate
the client.
Configuring the Local Authenticator Access Point
Beginning in Privileged Exec mode, follow these steps to configure the access point as a local
authenticator:
Command Purpose
Step1 configure terminal Enter global configuration mode.
Step2 aaa new-model Enable AAA.