13-4
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Chapter13 Configuring RADIUS and TACACS+ Servers
Configuring and Enabling RADIUS
A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep
accounts on a user. You can use method lists to designate one or more security protocols to be used, thus
ensuring a backup system if the initial method fails. The software uses the first method listed to
authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software
selects the next method in the list. This process continues until there is successful communication with
a listed method or the method list is exhausted.
You should have access to and should configure a RADIUS server before configuring RADIUS features
on your access point.
This section contains this configuration information:
•Default RADIUS Configuration, page13-4
•Identifying the RADIUS Server Host, page13-4 (required)
•Configuring RADIUS Login Authentication, page13-7 (required)
•Defining AAA Server Groups, page 13-9 (optional)
•Configuring RADIUS Authorization for User Privileged Access and Network Services, page13-11
(optional)
•Configuring Packet of Disconnect, page13-12 (optional)
•Starting RADIUS Accounting m, page13-13 (optional)
•Selecting the CSID Format, page 13-14 (optional)
•Configuring Settings for All RADIUS Servers, page13-15 (optional)
•Configuring the Access Point to Use Vendor-Specific RADIUS Attributes, page 13-16 (optional)
•Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication, page 13-17
(optional)
•Configuring WISPr RADIUS Attributes, page13-18 (optional)
Note The RADIUS server CLI commands are disabled until you enter the aaa new-model command.
Default RADIUS Configuration
RADIUS and AAA are disabled by default.
To prevent a lapse in security, you cannot configure RADIUS through a network management
application. When enabled, RADIUS can authenticate users accessing the access point through the CLI.
Identifying the RADIUS Server Host
Access point-to-RADIUS-server communication involves several components:
•Host name or IP address
•Authentication destination port
•Accounting destination port
•Key string
•Timeout period
•Retransmission value