EAP-FAST 1, IN-2 | Cisco Systems OL-6415-04 instruction

19

15

15

Index

commands
accounting		3
antenna 22
authentication client				3
beacon dtim-period				27
beacon period			27
bridge-group			25
broadcast-key			14
countermeasure tkip hold-time 16
dot11 aaa mac-authen filter-cache						14
dot11 extension aironet					23
dot11 holdoff-time				15
dot11 interface-number carrier busy						29
dot1x client-timeout				15
dot1x reauth-period				15
encapsulation dot1q				6
encryption		4
fragment-threshold				28
guest-mode			4
infrastructure-client				25
infrastructure-ssid				4
interface dot11radio				1, 2
packet retries			27
payload-encapsulation					24
power client			14
rts retries		27
rts threshold			27
show dot11 associations					5
slot-time-short 28
speed	11
ssid	3, 9, 5
switchport protected				26
vlan	4, 5
world-mode			21
wpa-psk		13
commands station role				3
Complementary Code Keying (CCK)
See CCK

countermeasure tkip hold-time command 16

CSID format, selecting 13

D

Data Beacon Rate		26
data rate setting		10
data retries	27
default configuration
RADIUS	4
delivery traffic indication message (DTIM)				26
DFS 19
diversity	22
documentation
Cisco 1800 series routers			13
Cisco 800 series routers			13
Cisco High-Speed WAN Interface Card				12
Cisco IOS software 13
dot11 aaa mac-authen filter-cache command				14
dot11 extension aironet command 23
dot11 holdoff-time commands 15

dot11 interface-number carrier busy command 29 dot1x client-timeout command

dot1x reauth-period command DTIM 26

Dynamic Frequency Selection

E

EAP authentication, overview	4
EAP-FAST 1, 2
EAP-FAST authentication 16
EAP-MD5 authentication
setting on client and access point		18
EAP-SIM authentication
setting on client and access point		18
EAP-TLS authentication
setting on client and access point		17
encapsulation dot1q command	6
encapsulation method 24

Cisco Wireless ISR and HWIC Access Point Configuration Guide

	IN-2	OL-6415-04

Image 176

Cisco Systems OL-6415-04 manual EAP-FAST 1, IN-2

Contents

Corporate Headquarters Text Part Number 0L-6415-04Page N T E N T S Ssid Configuration Methods Supported by Cisco IOS Releases Creating Cipher Suites Protocol Filters Local Authenticator Messages Contents Cisco Wireless Router and Hwic Configuration Guide Preface AudiencePurpose Preface provides information on the following topics Organization Conventions Preface Conventions Related Publications Cisco Product Document Title Obtaining Documentation Cisco.com Ordering Documentation Documentation FeedbackProduct Documentation DVD Reporting Security Problems in Cisco Products Cisco Product Security Overview Cisco Technical Support & Documentation Website Submitting a Service RequestObtaining Technical Assistance Definitions of Service Request Severity Obtaining Additional Publications and Information Preface Obtaining Additional Publications and Information Wireless Device Management Overview Network Configuration Example Root Unit on a Wired LAN Features Overview Features Overview Overview Cisco Wireless Router and Hwic Configuration Guide Configuring Radio Settings Command Purpose Enabling the Radio InterfaceRoles in Radio Network Cisco Role in Radio Network Eries ISRs Configuring Network or Fallback Role Following is a sample of a Root Bridge Configuration Bridge Features Not SupportedSample Bridging Configuration Following is a sample of Non-Root Bridge Configuration Interface Dot11Radio0/1/0 no ip address Universal Client Mode Configuring Universal Client Mode Virtual interface to aid NAT translation Following configuration is supported on NATNAT Network Address Translation No service password-encryption Hostname C1803WUC Configuring Radio Data Rates Configuring Radio Settings Configuring Radio Data Rates Throughput ofdm default Speed11.0 2.0 5.5 basic-1.0 2.0 5.5 6.0 9.0 Configuring Radio Transmit Power End Return to privileged Exec modeDBm 100 125 150 200 250 Limiting the Power Level for Associated Client Devices Power local5 6 7 10 13 15 17 Maximum Configuring Radio Channel Settings Power client20 30 50 100 maximum 10 20 30 50 Maximum Regulatory Domains Center ChannelIdentifier MHz 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 2472 2484 Channel DFS Automatically Enabled on Some 5-GHz Radio Channels GHz Channels on Which DFS is Automatically Enabled Enabling and Disabling World Mode Confirming that DFS is EnabledThis example shows how to unblock all frequencies for DFS Blocking Channels from DFS Selection Enabling and Disabling Short Radio Preambles Configuring Transmit and Receive Antennas Antenna receiveDiversity left right Antenna transmit No dot11 extension aironet Disabling and Enabling Access Point ExtensionsDisable Access Point extensions Snap or 802.1h dot1h, the default setting Payload-encapsulationSet the encapsulation transformation method to RFC1042 Snap dot1h Bridge-group group port-protected Configure terminal Enter global configuration modeEnable Pspf Configuring Beacon Period and Dtim Configuring Protected Ports Configuring RTS Threshold and Retries Configuring Maximum Data RetriesRts threshold value Rts retries value Configuring Fragmentation Threshold Bytes for the 2.4-GHz radio. Enter a setting from 256 toEnabling Short Slot Time for 802.11g Radios Fragment-threshold value Performing a Carrier Busy Test OL-6415-04 Configuring Multiple SSIDs Vlan Ssid Configuration Methods Supported by Cisco IOS ReleasesUnderstanding Multiple SSIDs Configuring Multiple SSIDs Creating an Ssid Globally Command Purpose Using Spaces in SSIDs Using a Radius Server to Restrict SSIDsViewing SSIDs Configured Globally Guidelines for Using Multiple BSSIDs Configuring Multiple Basic SSIDsRequirements for Configuring Multiple BSSIDs CLI Configuration Example Displaying Configured BSSIDsEnabling Mbssid and Ssidl at the same time Information-element ssidl Sample Configuration for Enabling Mbssid and Ssidl Use the no form of the command to disable Ssidl IEsBelow is a sample configuration for enabling Mbssid Below is a sample configuration for enabling Ssidl Interface Dot11Radio0/0/0 no ip address OL-6415-04 Configuring an Access Point as a Local Authenticator Understand Local Authentication Configure a Local Authenticator Guidelines for Local Authenticators Configuration OverviewConfiguring the Local Authenticator Access Point Aaa new-model Enable AAA Reauthentication time seconds Radius-server localVlan vlan Ssid ssid Password nthash password Mac-auth-only This example shows how to set up EAP-FAST authentication End Routerconfig# aaa new-model Configuring EAP-FAST Settings Configuring PAC Settings Possible PAC Failures Caused by Access Point Clock Configuring an Authority IDConfiguring Server Keys Limiting the Local Authenticator to One Authentication Type Viewing Local Authenticator StatisticsThis example shows local authenticator statistics Unblocking Locked Usernames Using Debug Messages Configuring Encryption Types Understand Encryption Types, Configure Encryption Types, Understand Encryption Types Configure Encryption Types Creating WEP Keys Security Configuration WEP Key Restriction WEP Key RestrictionsEncryption Key Creating Cipher Suites Example WEP Key SetupAccess Point Associated Device Slot Transmit? Key Contents Cipher Suites Compatible with WPA WPA Enabling and Disabling Broadcast Key RotationCompatible Cipher Suites Security Type in Universal Client Mode Security WEP 40-bit WEP 128-bit Universal client configurationTkip AES TKIP+AES Debugging Caveats WEP OL-6415-04 Configuring Authentication Types Understand Authentication Types Open Authentication to Access Point Shared Key Authentication to Access Point Traffic from client EAP Authentication to Network Sequence for EAP Authentication MAC Address Authentication to the Network Combining MAC-Based, EAP, and Open Authentication Using WPA Key Management 5shows the WPA key management process WPA-PSK Mode Windows XP Yes Software and Firmware Requirements for WPA and WPA-TKIPThird Party Host Supplicant Protocol Required? Systems Configure Authentication Types Assigning Authentication Types to an Ssid Authentication open Optional Set the authentication type to open for this SsidMac-address list-name alternate Optional eap list-name Authentication shared Authentication network-eapAuthentication key-management Mac-address list-name Configuring WPA Migration Mode Configuring Additional WPA Settings Wpa-psk hex ascii 0 Configuring MAC Authentication Caching Dot1x client-timeout seconds Dot11 holdoff-time secondsDot1x reauth-period seconds Server Tkip clients on that interface for the holdtime period Security Feature Client Setting Access Point SettingDetects two MIC failures within 60 seconds, it blocks all WPA-PSK Security Feature Client Setting Access Point Setting Configuring Radius Servers Configuring and Enabling Radius Understanding Radius Radius Operation Configuring Radius Default Radius Configuration Identifying the Radius Server Host Acct-port port-number timeout Port for authentication requests.Optional For acct-portRadius-server timeout command is used Radius-server host hostname Configuring Radius Login Authentication Show running-config Verify your entries Aaa authentication login default Login authentication defaultAuthentication login command Include-in-access-req format %h Defining AAA Server Groups Port for authentication requests Port for accounting requestsAaa group server radius group-name Define the AAA server-group with a group name Radius Starting Radius Accounting Option MAC Address Example Configuring Settings for All Radius ServersSelecting the Csid Format Show running-config Verify your settings Radius-server host hostname ip-address non-standard AuthenticationRadius-server vsa send accounting Configuring WISPr Radius Attributes Radius-server key string Displaying the Radius Configuration Snmp-server location location Radius Attributes Sent by the Access Point Attribute ID Description VLAN-ID Acct-Terminate-Cause VSA attribute NAS-Location Disc-Cause-Ext Configuring VLANs Understanding VLANs LAN and Vlan Segmentation with Wireless Devices Related Documents Configuring VLANs Incorporating Wireless Devices into VLANs Configuring a Vlan Interface dot11radio 0.x Encapsulation dot1q vlan-id Using a Radius Server to Assign Users to VLANs Guidelines for Using Vlan NamesAssigning Names to VLANs Creating a Vlan Name Viewing VLANs Configured on the Access Point Vlan Configuration Example Ssid Vlan ID Configuring Vlan Vlan 1 Interfaces Vlan 2 Interfaces Vlan 3 Interfaces Configuring VLANs Vlan Configuration Example OL-6415-04 Configuring QoS Understanding QoS for Wireless LANs, Configuring QoS, Impact of QoS on a Wireless LAN Understanding QoS for Wireless LANsQoS for Wireless LANs Versus QoS on Wired LANs Precedence of QoS Settings Upstream and Downstream Traffic Flow Using Wi-Fi Multimedia Mode Configuring QoS Configuration GuidelinesAdjusting Radio Access Categories Fixed Slot Time Sample Configuration Using the CLI Disabling Igmp Snooping Helper Channel Settings Ieee 802.11b 2.4-GHz BandCenter Frequency Americas Japan Ieee 802.11g 2.4-GHz Band Ieee 802.11a 5-GHz BandCenter Regulatory Domains Americas -A Emea -E Japan -J Frequency Frequency North America OL-6415-04 Protocol Filters Protocol Icmp IgmpTCP EGP PUP Chaos ISO Designator Tsap POP2POP3 IMAP2 RIP RPCUucp CVS IEEE802dot11-MIB Supported MIBsMIB List Using FTP to Access the MIB Files RFC1213-MIB RFC1398-MIB SNMPv2-MIB SNMPv2-SMI SNMPv2-TC Error and Event Messages How to Read System MessagesThis appendix lists the CLI error and event messages Level Description Explanation a station associated to an access point Explanation a station disassociated from an access pointMessage Traceback Reports Association Management Messages Subsystem Messages Recommended Action None Explanation The device has begun its DFS scanning process Recommended Action None Error Message DOT11-4-RMINCAPABLE Interface interface Recommended Action Reload the system Error Message DOT11-4-CANTASSOC Cannot associate characters Recommended Action None Recommended Action Local Authenticator Messages Network with wireless stations Wireless network composed of stations without Access PointsAccess Point Operating in the 2.4-GHz band Hoc mode GL-2 LAN 802.11 specifications Wired Ethernet networkAn antenna that radiates its signal in a spherical pattern Corresponding IP addresses Transmission at 6, 9, 12, 18, 24, 36, 48, and 54 Mbps Transmission at 2 Mbps While maintaining an unbroken connection to the LAN That of a cable 802.1X for authenticated key management Wireless MultiMediaComputing device with an installed client adapter EAP AES-CCMP EAP-FAST 1 IN-2 FTP Leap Qbss Names, Vlan Network-EAPOfdm Guest mode Multiple SSIDs Support Using spaces Local authentication Names Ssid 4 Vlan command 4Regulatory Domains Radius RFC World-mode command WPA migration mode Wpa-psk command IN-7 IN-8 IN-9 IN-10 IN-11 IN-12 IN-13 IN-14