Nortel Networks 2300 manual Enabling PEAP-MS-CHAP-V2 Offload

474Configuring AAA for Network Users

Enabling PEAP-MS-CHAP-V2 Offload

The following example illustrates how to enable PEAP-MS-CHAP-V2 offload. In this example, all EAP processing is offloaded from the RADIUS server, but MS-CHAP-V2 authentication and authorization are done through a RADIUS server. The MS-CHAP-V2 lookup matches users against the user list on a RADIUS server. Because the WSS switch requires a certificate for authentication, a self-signed certificate is shown in this example.

1Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type the following command:

23x0# set radius server r1 address 10.1.1.1 key starry

2Configure the server group sg1 with member r1. Type the following command:

23x0# set server group sg1 members r1

3Enable all 802.1X users of SSID thiscorp using PEAP-MS-CHAP-V2 to authenticate MS-CHAP-V2 on server group sg1. Type the following command:

23x0# set authentication dot1x ssid thiscorp * peap-mschapv2 sg1

4To generate a public-private key pair and a self-signed EAP certificate, type the following commands:

23x0# crypto generate key eap 1024 key pair generated

23x0# crypto generate self-signed eap

Country Name: US

State Name: CA

Locality Name: campus1

Organizational Name: Example

Organizational Unit: IT

Common Name: WSS6

Email Address: admin@example.com

Unstructured Name: wiring closet 55

5Save the configuration:

WSS-20save config

success: configuration saved.

320657-A