Cisco Systems OL-7426-03 Configuring Identity Networking for Operating System, Radius Attributes

Configuring Identity Networking for Operating System

This document explains the Identity Networking feature of Operating System, how it is configured and the expected behavior for various security policies.

In previous Operating System releases, each WLAN had a static policy that would be applied to all mobile clients associated with the SSID. Although very powerful, this method has limitations since it requires clients to associate with different SSIDs to inherit different QoS and security policies.

The current Operating System supports Identity Networking, which allows the network to advertise a single SSID, yet allows for specific users to inherit different QoS or security policies based on their user profiles. The specific policies that may be overridden include:

•Quality of Service. When present in a RADIUS Access Accept, the QoS-Level value overrides the QoS value specified in the WLAN profile.

•ACL. When the ACL attribute is present in the RADIUS Access Accept, the system applies the ACL-Name to the client station after authentication occurs. This overrides any ACLs that are assigned to the interface.

•VLAN. When a VLAN Interface-Name or VLAN-Tag is present in a RADIUS Access Accept, the system places the client on a specific interface.

Note: This feature is ONLY available with MAC Filtering, 802.1X and WPA. This feature DOES NOT WORK with Web Auth or IPSec.

•Tunnel Attributes.

Note: When any of the other RADIUS attributes in this section are returned, the Tunnel Attributes must also be returned.

In order for this feature to be enabled, on a per WLAN basis, the Enable AAA Override configuration flag must be enabled.

The Operating System’s local MAC Filter database has been extended to include the interface name, allowing local MAC filters to specify to which interface the client should be assigned. A separate RADIUS server can also be used, but the RADIUS server must be defined using the Security menus.

The following sections explain the RADIUS attributes.

RADIUS Attributes

QoS-Level

This attribute indicates the Quality of Service level to be applied to the mobile client's traffic within the switching fabric, as well as over the air. A summary of the QoS-Level Attribute format is shown below. The fields are transmitted from left to right.

0123

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type Length Vendor-Id

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Vendor-Id (cont.) Vendor type Vendor length

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

QoS Level

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

5/26/05	Configuring Identity Networking for Operating System
OL-7426-03