Setting Up MAC-Based Authentication | Cisco Systems DL-2159-05

Chapter 8 Security Setup

Setting Up MAC-Based Authentication

Setting Up MAC-Based Authentication

MAC-based authentication allows only client devices with specified MAC addresses to associate and pass data through the access point. Client devices with MAC addresses not in a list of allowed MAC addresses are not allowed to associate with the access point.You can create a list of allowed MAC addresses in the access point management system or on a server used for MAC-based authentication, and you can enable MAC-based authentication on one or both of the access point radios.

This section provides instructions for:

•Enabling MAC-Based Authentication on the Access Point

•Authenticating Client Devices Using MAC Addresses or EAP

•Enabling MAC-Based Authentication in Cisco Secure ACS

Enabling MAC-Based Authentication on the Access Point

Follow these steps to set up and enable MAC-based authentication on the access point:

Step 1 Follow this link path to reach the Address Filters page:

a.On the Summary Status page, click Setup.

b.On the Setup page, click Address Filters under Associations. Figure 8-10shows the Address Filters page.

Figure 8-10 Address Filters Page

Cisco Aironet 1200 Series Access Point Software Configuration Guide

	OL-2159-05	8-21

Image 183

Cisco Systems DL-2159-05 manual Setting Up MAC-Based Authentication, Enabling MAC-Based Authentication on the Access Point

Contents

Text Part Number OL-2159-05 Corporate Headquarters Copyright 2001-2003, Cisco Systems, Inc All rights reserved Iii N T E N T S Navigating Using the Map Windows Native Vlan ID WEP Not Set on the Wireless Phone Vii Settings on the Authenticator Configuration Viii Event Notifications Setup Setting Up Administrator Authorization Snmp Setup Ssid Xii Audience and Scope OrganizationXiii Conventions Tip Means the following are useful tipsXiv Related Publications Obtaining DocumentationCisco.com Xvi Documentation CD-ROMOrdering Documentation Documentation Feedback Xvii Obtaining Technical AssistanceCisco TAC Website Opening a TAC Case TAC Case Priority Definitions Xviii Obtaining Additional Publications and Information A P T E R Overview Key Features Quality of Service Support Management OptionsRoaming Client Devices These documents are available on Cisco.com What is QoS?Limitations and Restrictions Related Documents Vlan Support What is a VLAN? Incorporating Wireless Devices into VLANs Vlan Example Level of Access Root Unit on a Wired LAN Network Configuration Examples Access Points as Root Units on a Wired LAN Repeater Unit that Extends Wireless Range Access Point as Repeater Central Unit in an All-Wireless Network Using the Management Interfaces Button/Link Description Using the Web-Browser InterfaceUsing the Web-Browser Interface for the First Time Using the Management Pages in the Web-Browser Interface Map Window with Network Ports Pages Expanded Navigating Using the Map Windows Preparing to Use a Terminal Emulator Using the Command-Line Interface Changing Settings with the CLI Connecting the Serial CableSetting Up the Terminal Emulator Function Description Selecting Pages and Settings Using Snmp Using a Telnet SessionApplying Changes to the Configuration Supported MIBs Radio Configuration and Basic Settings Express Setup Basic Settings MAC Address Entering Basic SettingsExpress Setup page contains the following settings System Name Default Gateway Configuration Server ProtocolDefault IP Address Default IP Subnet Mask Root-Unit Access Points Radio Network Optimization Optimize Radio Network For Security Setup Link Radio Configuration Snmp Admin. CommunityRadio Network Compatibility Ensure Compatibility With Entering Identity Information Settings on the AP Radio Identification Service Set ID Ssid Primary Port SettingsDefault IP Address Default IP Subnet Mask Entering Radio Hardware Information Leap Password Settings on the AP Radio Hardware AP Radio Hardware page contains the following settingsAllow Broadcast Ssid to Associate? Data Rates Enable World Mode Max. RTS Retries Transmit PowerFrag. Threshold RTS Threshold Default Radio Channel Search for Less-Congested Radio ChannelRestrict Searched Channels Receive Antenna and Transmit Antenna Entering Advanced Configuration Information AP Radio Advanced Page for Internal Radio Packet Forwarding Settings on the AP Radio AdvancedAP Radio Advanced pages contain the following settings Requested Status Ssid For Use By Infrastructure Stations Default Multicast Address FiltersMaximum Multicast Packets/Second Radio Cell Role Classify Workgroup Bridges as Network Infrastructure Use Aironet Extensions Ethernet Encapsulation Transform Quality of Service Setup LinkVlan Setup Link Require Use of Radio Firmware Broadcast WEP Key rotation interval sec Advanced Primary Ssid Setup LinkPreferred Access Points Temporal Key Integrity Protocol Radio Preamble Radio Modulation Non-Root Mobility Ethernet Configuration Entering Ethernet Hardware Information Settings on the Ethernet Identification Settings on the Ethernet Hardware Ethernet Hardware page contains the following settingsSpeed Loss of Backbone Connectivity # of Secs Loss of Backbone Connectivity ActionLoss of Backbone Connectivity Ssid Ethernet Advanced page contains the following settings Settings on the Ethernet Advanced Default Unicast and Multicast Address Filters Default Unicast Address Filter Always Unblock Ethernet When STP is DisabledOptimize Ethernet for OL-2159-05 Configuring VLANs Settings on the Vlan Setup Vlan setup page contains the following settingsEntering Vlan Information Vlan 802.1Q Tagging 802.1Q Encapsulation ModeMaximum Number of Enabled Vlan IDs Vlan Summary Status Link Vlan Name Vlan Security PolicySingle Vlan ID which allows Unencrypted packets Optionally allow Encrypted packets on the unencrypted Vlan TKIP/MIC Native Vlan ConfigurationBroadcast Domain Segmentation Parameter Deployment of Infrastructure and Non infrastructure Devices Primary and Secondary SSIDs Vlan ID RADIUS-Based Vlan Access Control Vlan Criteria for Deploying Wireless VLANs Wireless Vlan Deployment Example 5shows the wireless Vlan deployment scenario described above Creating the Native Vlan Using the Configuration ScreensObtaining and Recording Vlan ID and Setup Information Creating and Configuring VLANs on the Access Point Vlan Setup Vlan ID #1 Setup Creating the Full- and Part-Time VLANs Creating the Guest Vlan Creating the Maintenance Vlan Creating and Configuring the SSIDs AP Radio Internal Service Sets Configuring VLANs Wireless Vlan Deployment Example Enabling Vlan 802.1Q Tagging and Identifying the Native Vlan 11 AP Radio Service Sets Creating an Ssid for Infrastructure Devices Guidelines for Wireless Vlan Deployment OL-2159-05 Configuring Filters and QoS Protocol Filtering Filter Setup Enter a descriptive filter set name in the Set Name field Creating a Protocol Filter Filter Set Enabling a Protocol Filter Address Filters MAC Address Filtering Creating a MAC Address Filter AP Radio Advanced AP Radio Primary Ssid QoS Configuration Settings on the Quality of Service Setup Use Symbol ExtensionsGenerate Qbss Element Traffic Category Applying QoSBy Station Send Igmp General Query 10 Protocol Filters Setup 12 Vlan ID By Vlan By Filter 13 Filters Priority Setting By Dscp Value By CoS Value 17 Vlan Setup Wireless QoS Deployment Example 18 Vlan ID #xx WEP Not Set on the Wireless Phone WEP Set on the Wireless Phone 20 AP Radio Internal Service Sets 21 AP Radio Internal Service Sets OL-2159-05 Configuring Proxy Mobile IP Introduction to Mobility in IP Proxy Mobile IP Nomadic Approach Mobile ApproachMobile IP Explained Mobile IP Environment Mobile IP Traffic Pattern Proxy Mobile IP Explained Before Deploying Proxy Mobile IP Components of a Proxy Mobile IP Network Issues to Consider While Deploying Proxy Mobile IP Agent Discovery How Proxy Mobile IP Works Home Agent Subnet Mask Subnet Map Exchange Tunneling Registration Proxy Mobile IP Security Proxy Mobile IP Setup General Proxy Mobile IP Setup Authoritative AP n Authentication ServerSettings on the Proxy Mobile IP General Enable Proxy Mobile IP Settings on the Authenticator Configuration Local SA Bindings Settings on the Local SA Bindings Statistics Settings on the Proxy Mobile IP Statistics MN IP Addresses Authentication Failures for HAAuthentication Failures for FA Active AAP Configuring Proxy Mobile IP Settings on the Subnet Map TableView Subnet Map Table Configuring Proxy Mobile IP on Your Wired LAN 11 a Sample Network 13 AP Radio Internal Service Sets 15 Proxy Mobile IP General 17 Subnet Map Table 18 Authenticator Configuration 20 Network Configuration Screen for an Access Point Client 22 Passed Authentication Screen Configuring Other Settings Entering Time Server Settings Server Setup Settings on the Time Server Setup Entering Boot Server Settings Settings on the Boot Server SetupBoot Server Setup page contains the following settings Dhcp Multiple-Offer Timeout sec Configuration Server ProtocolUse Previous Configuration Server Settings Bootp Server Timeout sec Option Definition Dhcp Requested Lease Duration minDhcp Minimum Lease Duration min Dhcp Client Identifier Type Dhcp Class Identifier Settings on the Web Server SetupWeb Server Setup page contains the following settings Dhcp Client Identifier Value Http Port Default Help Root URLDefault Web Root URL Allow Non-Console Browsing Domain Name System Entering Name Server SettingsSettings on the Name Server Setup Default Domain Domain Name Servers Entering FTP SettingsSettings on the FTP Setup FTP Setup page contains the following settings Routing Setup Entering Routing Settings New Network Route SettingsRouting Setup page contains the following settings Association Table Display Setup Installed Network Routes listAssociation Table Filters Configuring Other Settings Association Table Display Setup Settings on the Association Table Filters Stations to ShowFields to Show Primary Sort Association Table AdvancedPackets To/From Station Bytes To/From Station Association Table Advanced Settings on the Association Table Advanced Maximum Number of Forwarding Table Entries Rogue AP Alert Timeout minutesHandle Station Alerts as Severity Level Maximum number of bytes stored per Station Alert packet Default Activity Timeout seconds Per Device Class Event Notification SetupEvent Display Setup Settings on the Event Display Setup Severity Level Description How should time generally be displayed?How should Event Elapsed non-wall-clock Time be displayed? Severity Level at which to display events Event Handling Setup 10 The Event Handling Setup Maximum number of bytes stored per Alert packet Settings on the Event Handling SetupDisposition of Events Handle Station Events as Severity Level Event Notifications Setup Clear Alert StatisticsPurge Trace Buffer Snmp Trap Community Settings on the Event Notifications SetupShould Notify-Disposition Events generate Snmp Traps? Snmp Trap Destination Ieee Snmp Traps Should Generate the Following Notifications Should Syslog Messages use the Cisco Emblem Format?Syslog Destination Address Syslog Facility Number Security Setup Encrypting Radio Signals with WEP Security OverviewLevels of Security Network Authentication Types Additional WEP Security Features Sequence for EAP Authentication Wired LAN Client Sequence for Open Authentication Combining MAC-Based, EAP, and Open Authentication Protecting the Access Point Configuration with User Manager Setting Up WEP Transmit? Key Contents Key Access Point Associated Device Not set Snmp Variable WEP Full WEP Off Enabling Additional WEP Security FeaturesUsing Snmp to Set Up WEP Enabling Message Integrity Check MIC AP Radio Advanced Page for Internal Radio Enabling Temporal Key Integrity Protocol Tkip Enabling Broadcast WEP Key Rotation Setting Up Open or Shared Key Authentication Enabling EAP on the Access Point Setting Up EAP Authentication Firmware Version Draft 802.1x-2001 Access Point EAP Settings for Various Client Configurations Enabling EAP in Cisco Secure ACS Click Add New Access Server Setting a Session-Based WEP Key Timeout Setting Up a Repeater Access Point As a Leap Client AP Radio Identification Page for Internal Radio Enabling MAC-Based Authentication on the Access Point Setting Up MAC-Based Authentication 11 Authenticator Configuration Security Setup Setting Up MAC-Based Authentication 12 AP Radio Advanced Authenticating Client Devices Using MAC Addresses or EAP Enabling MAC-Based Authentication in Cisco Secure ACS Summary of Settings for Authentication Types Authentication Types Required SettingsLeap EAP-TLS, EAP-MD5 Attribute ID Description Radius Attributes Sent by the Access Point VSA attribute Nas-location Vlan-id Auth-algo-type Acct-Delay-TimeAcct-Session-Id Acct-Authentic Acct-Terminate-Cause Setting Up Backup Authentication Servers Setting Up Administrator Authorization Creating a List of Authorized Management System Users 14 Security Setup 16 User Management Window Click Apply. You are returned to the User Information Setting up Centralized Administrator AuthenticationClick User Information. The User Information page appears Click Add New User. The User Management window appears 18 Authenticator Configuration System Flow Notes Authorization Parameters Network Management Using the Association Table Setting the Display OptionsBrowsing to Network Devices Station Using Station Pages Station Identification and Status Information on Station Pages Rate, Signal, and Status Information To Station InformationFrom Station Information Performing Pings and Link Tests Hops and Timing InformationPerforming a Ping Click Link Test Performing a Link Test Using the Network Map Window Deauthenticating and Disassociating Client DevicesClearing and Updating Statistics Using Cisco Discovery Protocol MIB for CDP Settings on the CDP Setup Port Assignments Assigning Network Ports Settings on the Port Assignments Enabling Wireless Network Accounting Accounting Setup Settings on the Accounting Setup Attribute Definition Accounting Attributes Radiusipadr OL-2159-05 10-1 Managing Firmware and Configurations 10-2 Full Update of the Firmware ComponentsUpdating Firmware Updating with the Browser from a Local Drive 10-3 Selective Update of the Firmware Components 10-4 Updating from a File Server 10-5 Update All Firmware From File Server 10-6 Update Firmware From File Server 10-7 Retrieving Firmware and Web Page Files 10-8 Distributing Firmware 10-9 Distributing a Configuration 10-10 Limiting Distributions 10-11 Downloading the Current Configuration 10-12 Uploading a ConfigurationUploading from a Local Drive Uploading from a File Server 10-13 Resetting the Configuration 10-14 Restarting the Access Point 11-1 Management System Setup Snmp Setup Settings on the Snmp Setup11-2 Using the Database Query Settings on the Database Query11-3 Console and Telnet Setup Changing Settings with the Database Query11-4 Settings on the Console/Telnet Using Secure Shell11-5 11-6 12-1 Special Configurations 12-2 Setting Up a Repeater Access Point 12-3 12-4 12-5 Using Hot Standby Mode 12-6 12-7 12-8 13-1 Sections in this chapter include 13-2 Using Diagnostic PagesNetwork Diagnostics Selections on the Network Diagnostics 13-3 Radio Diagnostics Tests Vlan Summary Status SSIDs Int, Mod13-4 13-5 Network Ports Identifying Information and Status Data Received13-6 Data Transmitted Ethernet Port13-7 Configuration Information Receive Statistics13-8 AP Radio Transmit Statistics13-9 AP Radio Port 13-10 13-11 13-12 Display Options Display Settings Event Log13-13 13-14 Log HeadingsSaving the Log Event Log Summary Using Command-Line Diagnostics Command Information Displayed13-15 13-16 Entering Diagnostic Commands Diagnostic Command Results Eapdiag1on13-17 Eapdiag2on Vxdiagarpshow13-18 13-19 13-20 Vxdiagcheckstack 13-21 Vxdiaghostshow 13-22 Vxdiagi 13-23 Vxdiagipstatshow 13-24 Vxdiagmemshow 13-25 Vxdiagmuxshow 13-26 Vxdiagrouteshow 13-27 Vxdiagtcpstatshow 13-28 Reserving Access Point Memory for a Packet Trace Log FileTracing Packets Vxdiagudpstatshow 13-29 Tracing Packets for Specific Devices 13-30 Tracing Packets for Ethernet and Radio PortsViewing Packet Trace Data Packets Stored in a Log File Checking the Top Panel Indicators Packets Displayed on the CLI13-31 13-32 Message Ethernet Status Radio Meaning Type Indicator 13-33 Finding an Access Point by Blinking the Top Panel Indicators 13-34 Checking Basic SettingsEAP Authentication Requires Matching 802.1x Protocol Drafts WEP Keys 13-35 Firmware Version Draft 13-36 Resetting to the Default Configuration 13-37 13-38 Channels, Power Levels, and Antenna Gains Channels Ieee 802.11aRegulatory Domains Ieee 802.11b Maximum Power Levels and Antenna Gains Americas -A 100 Eirp maximum 13.5 Emea -E MW Eirp maximum Maximum Power Level mWRegulatory Domain Antenna Gain dBi Maximum Power Level mW Regulatory Domain With 6-dBi Antenna Gain Regulatory Domain Antenna Gain dBi Maximum Power Level mW OL-2159-05 Protocol Filter Lists ISO Designator Protocol Smtp UDP XNS-IDP ISO-TP4 ISO-CNLP CnlpVines SVP POP2 TftpHttp Tsap RIP CmotBGP IRC Radius CVSRFE Event Log Messages With a timestamp, messages look like this example Default FormatMessage Formats Cisco Emblem Format Logalert LoginfoSyslog Severity Emblem Severity Logemerg Reason Message DescriptionsPossible Cause or Severity Event Description Mnemonic Recommended Action Host Device Newaddr SrchostIfDescr Srchost to port ifDescr Desthost length pktLen Reqlen bytes IfDescr error= errornum Packet from srchost to desthostDesthost on port ifDescr From srchost to desthost on port IfDescr error=erronumFor procedure on port ifDescr Srchost to desthost on port Srchost on port ifDescr Version Srchost to desthost of unknownDesthost Prtrarpip SysrebootRebootinf Admin Port device Status PktLen IfDescr errno=errno Ethercon ENC WEPUnenc Xidexp Media port Frame Frame bytes Unit Username FailedUsername Port devName unit Hstndbyeth 1XVERHstndbyen Assoclost Nulses InstkeyAcctcon Amngrreq Open NorbufNosbuf Noaserv VlanID IfIndex Awcmib IfIndex MIB Taskstarted NomibdkeyBadsize Taskfailed SsidIdx Statuses and Reasons Appendix C Event Log Messages Statuses and Reasons OL-2159-05 IN-1 Numerics Dtim CDP MIBDhcp CLI IN-3 Ethernet Locate unit by flashing LEDs Radio trafficIN-4 IN-5 Pspf SSH VlanIN-6 IN-7 Warm restart IN-8