Cisco Cisco Access Registrar 4.2 Specifikace stáhnout pdf (Strana 245)

5-61

Cisco Wireless LAN Controller Configuration Guide

OL-13826-01

Chapter 5 Configuring Security Solutions

Configuring Identity Networking

The RADIUS server typically indicates the desired VLAN by including tunnel attributes within the

Access-Accept. However, the IEEE 802.1X Authenticator may also provide a hint as to the VLAN to be

assigned to the Supplicant by including Tunnel attributes within the Access- Request.

For use in VLAN assignment, the following tunnel attributes are used:

• Tunnel-Type=VLAN (13)

• Tunnel-Medium-Type=802

• Tunnel-Private-Group-ID=VLANID

Note that the VLANID is 12-bits, taking a value between 1 and 4094, inclusive. Since the

Tunnel-Private-Group-ID is of type String as defined in RFC2868, for use with IEEE 802.1X, the

VLANID integer value is encoded as a string.

When Tunnel attributes are sent, it is necessary to fill in the Tag field. As noted in RFC2868, section 3.1:

• The Tag field is one octet in length and is intended to provide a means of grouping attributes in the

same packet which refer to the same tunnel. Valid values for this field are 0x01 through 0x1F,

inclusive. If the Tag field is unused, it must be zero (0x00).

• For use with Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, Tunnel-Private-Group-ID,

Tunnel-Assignment-ID, Tunnel-Client-Auth-ID or Tunnel-Server-Auth-ID attributes (but not

Tunnel-Type, Tunnel-Medium-Type, Tunnel-Password, or Tunnel-Preference), a tag field of greater

than 0x1F is interpreted as the first octet of the following field.

• Unless alternative tunnel types are provided, (e.g. for IEEE 802.1X Authenticators that may support

tunneling but not VLANs), it is only necessary for tunnel attributes to specify a single tunnel. As a

result, where it is only desired to specify the VLANID, the tag field should be set to zero (0x00) in

all tunnel attributes. Where alternative tunnel types are to be provided, tag values between 0x01 and

0x1F should be chosen.

Configuring AAA Override

The Allow AAA Override option of a WLAN allows you to configure the WLAN for identity

networking. It allows you to apply VLAN tagging, QoS, and ACLs to individual clients based on the

returned RADIUS attributes from the AAA server.

Note If a client moves to a new interface due to the AAA override and then you apply an ACL to that interface,

the ACL does not take effect until the client reauthenticates. To work around this issue, apply the ACL

and then enable the WLAN so that all clients connect to the ACL already configured on the interface, or

disable and then re-enable the WLAN after you apply the interface so that the clients can reauthenticate.

Most of the configuration for allowing AAA override is done at the RADIUS server, where you should

configure the Access Control Server (ACS) with the override properties you would like it to return to the

controller (for example, Interface-Name, QoS-Level, and VLAN-Tag).

On the controller, simply enable the Allow AAA Override configuration parameter using the GUI or

CLI. Enabling this parameter allows the controller to accept the attributes returned by the RADIUS

server. The controller then applies these attributes to its clients.

1 2 ... 240 241 242 243 244 245 246 247 248 249 250 ... 635 636

Žádné komentáře

Cisco Cisco Access Registrar 4.2 Specifikace Strana 245