Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems DL-2159-05 Radius Attributes Sent by the Access Point, Attribute ID Description

Models: DL-2159-05

1 332

Download 332 pages 33.19 Kb

Page 191

Chapter 8 Security Setup

RADIUS Attributes Sent by the Access Point

RADIUS Attributes Sent by the Access Point

Tables 8-6 through 8-10 identify the attributes sent by an access point to a client in access-request, access-accept, and accounting-request packets.

Table 8-6 Attributes Sent in Access-Request Packets

Attribute ID		Description

1		User-Name

4		NAS-IP-Address

5		NAS-Port

6		Service-Type

12		Framed-MTU

30		Called-Station-ID (MAC address)

31		Calling-Station-ID (MAC address)

32		NAS-Identifier

61		NAS-Port-Type

79		EAP-Message1
80		Message-Authenticator1
VSA (attribute 26)		SSID

1.	RFC2869
Table 8-7 Attributes Honored in Access-Accept Packets

Attribute ID		Description

27		Session-Timeout

64		Tunnel-Type1
65		Tunnel-Medium-Type1
79		EAP-Message (for 802.1x authentication)

80		Message-Authenticator (for 802.1x authentication)

81		Tunnel-Private-Group-ID1
VSA (attribute 26)		LEAP session-key

VSA (attribute 26)		SSID

1.	RFC2868

Cisco Aironet 1200 Series Access Point Software Configuration Guide

	OL-2159-05	8-29

Image 191

Cisco Systems DL-2159-05 manual Radius Attributes Sent by the Access Point, Attribute ID Description

Contents

Text Part Number OL-2159-05 Corporate HeadquartersCopyright 2001-2003, Cisco Systems, Inc All rights reserved Iii N T E N T SNavigating Using the Map Windows Native Vlan ID WEP Not Set on the Wireless Phone Vii Settings on the Authenticator ConfigurationViii Event Notifications SetupSetting Up Administrator Authorization Snmp Setup Ssid Xii Xiii Audience and ScopeOrganization Xiv ConventionsTip Means the following are useful tips Cisco.com Related PublicationsObtaining Documentation Xvi Documentation CD-ROMOrdering Documentation Documentation FeedbackXvii Obtaining Technical AssistanceCisco TAC Website Opening a TAC Case TAC Case Priority DefinitionsXviii Obtaining Additional Publications and InformationA P T E R OverviewKey Features Roaming Client Devices Quality of Service SupportManagement Options These documents are available on Cisco.com What is QoS?Limitations and Restrictions Related DocumentsVlan Support What is a VLAN?Incorporating Wireless Devices into VLANs Vlan Example Level of AccessRoot Unit on a Wired LAN Network Configuration ExamplesAccess Points as Root Units on a Wired LAN Repeater Unit that Extends Wireless RangeAccess Point as Repeater Central Unit in an All-Wireless NetworkUsing the Management Interfaces Button/Link Description Using the Web-Browser InterfaceUsing the Web-Browser Interface for the First Time Using the Management Pages in the Web-Browser InterfaceMap Window with Network Ports Pages Expanded Navigating Using the Map WindowsPreparing to Use a Terminal Emulator Using the Command-Line InterfaceSetting Up the Terminal Emulator Changing Settings with the CLIConnecting the Serial Cable Function Description Selecting Pages and SettingsApplying Changes to the Configuration Using SnmpUsing a Telnet Session Supported MIBs Radio Configuration and Basic Settings Express Setup Basic SettingsMAC Address Entering Basic SettingsExpress Setup page contains the following settings System NameDefault Gateway Configuration Server ProtocolDefault IP Address Default IP Subnet MaskRoot-Unit Access Points Radio Network Optimization Optimize Radio Network For Security Setup LinkRadio Network Compatibility Ensure Compatibility With Radio ConfigurationSnmp Admin. Community Entering Identity Information Settings on the AP Radio IdentificationService Set ID Ssid Primary Port SettingsDefault IP Address Default IP Subnet MaskEntering Radio Hardware Information Leap PasswordAllow Broadcast Ssid to Associate? Settings on the AP Radio HardwareAP Radio Hardware page contains the following settings Data Rates Enable World ModeMax. RTS Retries Transmit PowerFrag. Threshold RTS ThresholdRestrict Searched Channels Default Radio ChannelSearch for Less-Congested Radio Channel Receive Antenna and Transmit Antenna Entering Advanced Configuration InformationAP Radio Advanced Page for Internal Radio Packet Forwarding Settings on the AP Radio AdvancedAP Radio Advanced pages contain the following settings Requested StatusSsid For Use By Infrastructure Stations Default Multicast Address FiltersMaximum Multicast Packets/Second Radio Cell RoleClassify Workgroup Bridges as Network Infrastructure Use Aironet ExtensionsEthernet Encapsulation Transform Quality of Service Setup LinkVlan Setup Link Require Use of Radio FirmwareBroadcast WEP Key rotation interval sec Advanced Primary Ssid Setup LinkPreferred Access Points Temporal Key Integrity ProtocolRadio Preamble Radio ModulationNon-Root Mobility Ethernet ConfigurationEntering Ethernet Hardware Information Settings on the Ethernet IdentificationSpeed Settings on the Ethernet HardwareEthernet Hardware page contains the following settings Loss of Backbone Connectivity Ssid Loss of Backbone Connectivity # of SecsLoss of Backbone Connectivity Action Ethernet Advanced page contains the following settings Settings on the Ethernet AdvancedDefault Unicast and Multicast Address Filters Optimize Ethernet for Default Unicast Address FilterAlways Unblock Ethernet When STP is Disabled OL-2159-05 Configuring VLANs Entering Vlan Information Settings on the Vlan SetupVlan setup page contains the following settings Vlan 802.1Q Tagging 802.1Q Encapsulation ModeMaximum Number of Enabled Vlan IDs Vlan Summary Status LinkVlan Name Vlan Security PolicySingle Vlan ID which allows Unencrypted packets Optionally allow Encrypted packets on the unencrypted VlanTKIP/MIC Native Vlan ConfigurationBroadcast Domain Segmentation ParameterDeployment of Infrastructure and Non infrastructure Devices Primary and Secondary SSIDsVlan ID RADIUS-Based Vlan Access ControlVlan Criteria for Deploying Wireless VLANsWireless Vlan Deployment Example 5shows the wireless Vlan deployment scenario described above Creating the Native Vlan Using the Configuration ScreensObtaining and Recording Vlan ID and Setup Information Creating and Configuring VLANs on the Access PointVlan Setup Vlan ID #1 Setup Creating the Full- and Part-Time VLANs Creating the Guest Vlan Creating the Maintenance VlanCreating and Configuring the SSIDs AP Radio Internal Service Sets Configuring VLANs Wireless Vlan Deployment Example Enabling Vlan 802.1Q Tagging and Identifying the Native Vlan 11 AP Radio Service Sets Creating an Ssid for Infrastructure Devices Guidelines for Wireless Vlan DeploymentOL-2159-05 Configuring Filters and QoS Protocol Filtering Filter SetupEnter a descriptive filter set name in the Set Name field Creating a Protocol FilterFilter Set Enabling a Protocol Filter Address Filters MAC Address FilteringCreating a MAC Address Filter AP Radio Advanced AP Radio Primary Ssid QoS Configuration Generate Qbss Element Settings on the Quality of Service SetupUse Symbol Extensions Traffic Category Applying QoSBy Station Send Igmp General Query10 Protocol Filters Setup 12 Vlan ID By VlanBy Filter 13 Filters Priority SettingBy Dscp Value By CoS Value17 Vlan Setup Wireless QoS Deployment Example18 Vlan ID #xx WEP Not Set on the Wireless Phone WEP Set on the Wireless Phone20 AP Radio Internal Service Sets 21 AP Radio Internal Service Sets OL-2159-05 Configuring Proxy Mobile IP Introduction to Mobility in IP Proxy Mobile IPMobile IP Explained Nomadic ApproachMobile Approach Mobile IP Environment Mobile IP Traffic Pattern Proxy Mobile IP ExplainedBefore Deploying Proxy Mobile IP Components of a Proxy Mobile IP Network Issues to Consider While Deploying Proxy Mobile IPAgent Discovery How Proxy Mobile IP WorksHome Agent Subnet Mask Subnet Map ExchangeTunneling RegistrationProxy Mobile IP Security Proxy Mobile IP SetupGeneral Proxy Mobile IP SetupAuthoritative AP n Authentication ServerSettings on the Proxy Mobile IP General Enable Proxy Mobile IPSettings on the Authenticator Configuration Local SA Bindings Settings on the Local SA BindingsStatistics Settings on the Proxy Mobile IP StatisticsMN IP Addresses Authentication Failures for HAAuthentication Failures for FA Active AAPView Subnet Map Table Configuring Proxy Mobile IPSettings on the Subnet Map Table Configuring Proxy Mobile IP on Your Wired LAN 11 a Sample Network 13 AP Radio Internal Service Sets 15 Proxy Mobile IP General 17 Subnet Map Table 18 Authenticator Configuration 20 Network Configuration Screen for an Access Point Client 22 Passed Authentication Screen Configuring Other Settings Entering Time Server Settings Server SetupSettings on the Time Server Setup Boot Server Setup page contains the following settings Entering Boot Server SettingsSettings on the Boot Server Setup Dhcp Multiple-Offer Timeout sec Configuration Server ProtocolUse Previous Configuration Server Settings Bootp Server Timeout secOption Definition Dhcp Requested Lease Duration minDhcp Minimum Lease Duration min Dhcp Client Identifier TypeDhcp Class Identifier Settings on the Web Server SetupWeb Server Setup page contains the following settings Dhcp Client Identifier ValueHttp Port Default Help Root URLDefault Web Root URL Allow Non-Console BrowsingDomain Name System Entering Name Server SettingsSettings on the Name Server Setup Default DomainDomain Name Servers Entering FTP SettingsSettings on the FTP Setup FTP Setup page contains the following settingsRouting Setup Routing Setup page contains the following settings Entering Routing SettingsNew Network Route Settings Association Table Filters Association Table Display SetupInstalled Network Routes list Configuring Other Settings Association Table Display Setup Fields to Show Settings on the Association Table FiltersStations to Show Primary Sort Association Table AdvancedPackets To/From Station Bytes To/From StationAssociation Table Advanced Settings on the Association Table AdvancedMaximum Number of Forwarding Table Entries Rogue AP Alert Timeout minutesHandle Station Alerts as Severity Level Maximum number of bytes stored per Station Alert packetDefault Activity Timeout seconds Per Device Class Event Notification SetupEvent Display Setup Settings on the Event Display SetupSeverity Level Description How should time generally be displayed?How should Event Elapsed non-wall-clock Time be displayed? Severity Level at which to display eventsEvent Handling Setup 10 The Event Handling Setup Maximum number of bytes stored per Alert packet Settings on the Event Handling SetupDisposition of Events Handle Station Events as Severity LevelPurge Trace Buffer Event Notifications SetupClear Alert Statistics Snmp Trap Community Settings on the Event Notifications SetupShould Notify-Disposition Events generate Snmp Traps? Snmp Trap DestinationIeee Snmp Traps Should Generate the Following Notifications Should Syslog Messages use the Cisco Emblem Format?Syslog Destination Address Syslog Facility NumberSecurity Setup Levels of Security Encrypting Radio Signals with WEPSecurity Overview Network Authentication Types Additional WEP Security FeaturesSequence for EAP Authentication Wired LAN Client Sequence for Open Authentication Combining MAC-Based, EAP, and Open AuthenticationProtecting the Access Point Configuration with User Manager Setting Up WEPTransmit? Key Contents Key Access Point Associated DeviceNot set Snmp Variable WEP Full WEP Off Enabling Additional WEP Security FeaturesUsing Snmp to Set Up WEP Enabling Message Integrity Check MICAP Radio Advanced Page for Internal Radio Enabling Temporal Key Integrity Protocol Tkip Enabling Broadcast WEP Key Rotation Setting Up Open or Shared Key Authentication Enabling EAP on the Access Point Setting Up EAP AuthenticationFirmware Version Draft 802.1x-2001 Access Point EAP Settings for Various Client Configurations Enabling EAP in Cisco Secure ACS Click Add New Access ServerSetting a Session-Based WEP Key Timeout Setting Up a Repeater Access Point As a Leap ClientAP Radio Identification Page for Internal Radio Enabling MAC-Based Authentication on the Access Point Setting Up MAC-Based Authentication11 Authenticator Configuration Security Setup Setting Up MAC-Based Authentication 12 AP Radio Advanced Authenticating Client Devices Using MAC Addresses or EAP Enabling MAC-Based Authentication in Cisco Secure ACS Leap Summary of Settings for Authentication TypesAuthentication Types Required Settings EAP-TLS, EAP-MD5 Attribute ID Description Radius Attributes Sent by the Access PointVSA attribute Nas-location Vlan-id Auth-algo-type Acct-Delay-TimeAcct-Session-Id Acct-AuthenticAcct-Terminate-Cause Setting Up Backup Authentication ServersSetting Up Administrator Authorization Creating a List of Authorized Management System Users 14 Security Setup16 User Management Window Click Apply. You are returned to the User Information Setting up Centralized Administrator AuthenticationClick User Information. The User Information page appears Click Add New User. The User Management window appears18 Authenticator Configuration System Flow Notes Authorization Parameters Network Management Browsing to Network Devices Using the Association TableSetting the Display Options Station Using Station PagesStation Identification and Status Information on Station PagesFrom Station Information Rate, Signal, and Status InformationTo Station Information Performing a Ping Performing Pings and Link TestsHops and Timing Information Click Link Test Performing a Link TestClearing and Updating Statistics Using the Network Map WindowDeauthenticating and Disassociating Client Devices Using Cisco Discovery Protocol MIB for CDP Settings on the CDP SetupPort Assignments Assigning Network PortsSettings on the Port Assignments Enabling Wireless Network AccountingAccounting Setup Settings on the Accounting SetupAttribute Definition Accounting AttributesRadiusipadr OL-2159-05 10-1 Managing Firmware and Configurations10-2 Full Update of the Firmware ComponentsUpdating Firmware Updating with the Browser from a Local Drive10-3 Selective Update of the Firmware Components10-4 Updating from a File Server10-5 Update All Firmware From File Server10-6 Update Firmware From File Server10-7 Retrieving Firmware and Web Page Files10-8 Distributing Firmware10-9 Distributing a Configuration10-10 Limiting Distributions10-11 Downloading the Current Configuration10-12 Uploading a ConfigurationUploading from a Local Drive Uploading from a File Server10-13 Resetting the Configuration10-14 Restarting the Access Point11-1 Management System Setup11-2 Snmp SetupSettings on the Snmp Setup 11-3 Using the Database QuerySettings on the Database Query 11-4 Console and Telnet SetupChanging Settings with the Database Query 11-5 Settings on the Console/TelnetUsing Secure Shell 11-6 12-1 Special Configurations12-2 Setting Up a Repeater Access Point12-3 12-4 12-5 Using Hot Standby Mode12-6 12-7 12-8 13-1 Sections in this chapter include13-2 Using Diagnostic PagesNetwork Diagnostics Selections on the Network Diagnostics13-3 Radio Diagnostics Tests13-4 Vlan Summary StatusSSIDs Int, Mod 13-5 Network Ports13-6 Identifying Information and StatusData Received 13-7 Data TransmittedEthernet Port 13-8 Configuration InformationReceive Statistics 13-9 AP RadioTransmit Statistics AP Radio Port 13-1013-11 13-12 Display Options13-13 Display SettingsEvent Log 13-14 Log HeadingsSaving the Log Event Log Summary13-15 Using Command-Line DiagnosticsCommand Information Displayed 13-16 Entering Diagnostic Commands13-17 Diagnostic Command ResultsEapdiag1on 13-18 Eapdiag2onVxdiagarpshow 13-19 13-20 Vxdiagcheckstack13-21 Vxdiaghostshow13-22 Vxdiagi13-23 Vxdiagipstatshow13-24 Vxdiagmemshow13-25 Vxdiagmuxshow13-26 Vxdiagrouteshow13-27 Vxdiagtcpstatshow13-28 Reserving Access Point Memory for a Packet Trace Log FileTracing Packets Vxdiagudpstatshow13-29 Tracing Packets for Specific Devices13-30 Tracing Packets for Ethernet and Radio PortsViewing Packet Trace Data Packets Stored in a Log File13-31 Checking the Top Panel IndicatorsPackets Displayed on the CLI 13-32 Message Ethernet Status Radio Meaning Type Indicator13-33 Finding an Access Point by Blinking the Top Panel Indicators13-34 Checking Basic SettingsEAP Authentication Requires Matching 802.1x Protocol Drafts WEP Keys13-35 Firmware Version Draft13-36 Resetting to the Default Configuration13-37 13-38 Channels, Power Levels, and Antenna Gains Regulatory Domains ChannelsIeee 802.11a Ieee 802.11b Maximum Power Levels and Antenna GainsAmericas -A 100 Eirp maximum 13.5 Emea -E MW Eirp maximum Maximum Power Level mWRegulatory Domain Antenna Gain dBi Maximum Power Level mW Regulatory Domain With 6-dBi Antenna GainRegulatory Domain Antenna Gain dBi Maximum Power Level mW OL-2159-05 Protocol Filter Lists ISO Designator ProtocolSmtp UDP XNS-IDP ISO-TP4 ISO-CNLP CnlpVines SVPPOP2 TftpHttp TsapRIP CmotBGP IRCRFE RadiusCVS Event Log Messages With a timestamp, messages look like this example Default FormatMessage Formats Cisco Emblem FormatLogalert LoginfoSyslog Severity Emblem Severity LogemergReason Message DescriptionsPossible Cause or Severity Event Description Mnemonic Recommended ActionHost DeviceIfDescr NewaddrSrchost Srchost to port ifDescr Desthost length pktLenReqlen bytes Desthost on port ifDescr IfDescr error= errornumPacket from srchost to desthost From srchost to desthost on port IfDescr error=erronumFor procedure on port ifDescr Srchost to desthost on portSrchost on port ifDescr Desthost VersionSrchost to desthost of unknown Prtrarpip SysrebootRebootinf AdminPort device Status PktLen IfDescr errno=errnoEthercon ENC WEPUnenc XidexpMedia port Frame Frame bytesUnit Username FailedUsername Port devName unitHstndbyeth 1XVERHstndbyen AssoclostNulses InstkeyAcctcon AmngrreqOpen NorbufNosbuf NoaservVlanID IfIndex Awcmib IfIndex MIBTaskstarted NomibdkeyBadsize TaskfailedSsidIdx Statuses and Reasons Appendix C Event Log Messages Statuses and Reasons OL-2159-05 IN-1 NumericsDtim CDP MIBDhcp CLIIN-3 IN-4 Ethernet Locate unit by flashing LEDsRadio traffic IN-5 PspfIN-6 SSHVlan IN-7 Warm restartIN-8