Cisco Systems OL-6415-04 manual Configuring MAC Authentication Caching

Chapter 6 Configuring Authentication Types

Configure Authentication Types

	Command	Purpose
Step 6
	broadcast-key [ vlan vlan-id]	Use the broadcast key rotation command to configure
	{ change seconds }	additional updates of the WPA group key.
	[ membership-termination ]
	[ capability-change ]
Step 7
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

This example shows how to configure a pre-shared key for clients using WPA and static WEP, with group key update options:

ap# configure terminal

ap(config)# interface dot11radio 0

ap(config-if)# ssid batman

ap(config-ssid)#wpa-psk ascii batmobile65

ap(config-ssid)# exit ap(config-if)# exit

ap(config)# broadcast-key vlan 87 membership-termination capability-change

Configuring MAC Authentication Caching

If MAC-authenticated clients on your wireless LAN roam frequently, you can enable a MAC authentication cache on your access points. MAC authentication caching reduces overhead because the access point authenticates devices in its MAC-address cache without sending the request to your authentication server. When a client device completes MAC authentication to your authentication server, the access point adds the client’s MAC address to the cache.

Beginning in privileged EXEC mode, follow these steps to enable MAC authentication caching:

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	dot11 aaa authentication	Enable MAC authentication caching on the access point.
	mac-authen filter-cache [timeout	Use the timeout option to configure a timeout value for MAC
	seconds]
		addresses in the cache. Enter a value from 30 to 65555 seconds.
		The default value is 1800 (30 minutes). When you enter a
		timeout value, MAC-authentication caching is enabled
		automatically.
Step 3
	exit	Return to privileged EXEC mode.
Step 4
	show dot11 aaa authentication	Show entries in the MAC-authentication cache. Include client
	mac-authen filter-cache [address]	MAC addresses to show entries for specific clients.
Step 5
	clear dot11 aaa authentication	Clear all entries in the cache. Include client MAC addresses to
	mac-authen filter-cache [address]	clear specific clients from the cache.
Step 6
	end	Return to privileged EXEC mode.
Step 7
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

Cisco Wireless ISR and HWIC Access Point Configuration Guide

6-14 OL-6415-04