Nortel Networks 2300 manual 23x0# set radius server r1 address 10.1.1.1 key starry

Configuring AAA for Network Users 475

Combining 802.1X Acceleration with Pass-Through Authentication

The following example illustrates how to enable PEAP-MS-CHAP-V2 offload for the marketing (mktg) group and RADIUS pass-through authentication for members of engineering. This example assumes that engineering members are using DNS-style naming, such as is used with EAP-TLS. An WSS server certificate is also required. Because the WSS switch requires a certificate for authentication, a self-signed certificate is shown in this example.

1Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type the following command:

23x0# set radius server r1 address 10.1.1.1 key starry

2Configure the server group sg1 with member r1. Type the following command:

23x0# set server group sg1 members r1

3To authenticate all 802.1X users of SSID bobblehead in the group mktg using PEAP on the WSS switch and MS-CHAP-V2 on server sg1, type the following command:

23x0# set authentication dot1x ssid bobblehead mktg\* peap-mschapv2 sg1

4To authenticate all 802.1X users of SSID aircorp in @eng.example.com through pass-through to sg1, type the following command:

23x0# set authentication dot1x ssid aircorp *@eng.example.com pass-through sg1

5To generate a public-private key pair and a self-signed EAP certificate, type the following commands:

23x0# crypto generate key eap 1024 key pair generated

23x0# crypto generate self-signed eap Country Name: US

State Name: CA

Locality Name: campus1

Organizational Name: Example

Organizational Unit: IT

Common Name: WSS 33

Email Address: admin@example.com

Unstructured Name: wiring closet south campus

6Save the configuration:

WSS-20save config

success: configuration saved.

Nortel WLAN Security Switch 2300 Series Configuration Guide