[c-nsp] Cisco AIRONET WPA-Enterprise w/Windows question..
Enno Rey
erey at ernw.de
Sat Nov 28 14:09:41 EST 2009
Hi,
On Sat, Nov 28, 2009 at 01:35:02PM -0500, Howard Leadmon wrote:
> I have a question hopefully someone can give me a pointer or shed some
> light on..
>
>
>
> I have both an Aironet 1242AG and now a 1252AG access point, which are
> working fine. I have WPA2-Personal with a shared key setup and running
> great as well. As it was my impression that Vista and Win7 both supported
> Enterprise authentication, which I figured would be better and more secure
> than using the personal shared key stuff.
>
>
>
> I have tried, and googled, and I for the life of me just can't seem to get
> Enterprise auth going.. Does anyone have any docs on getting the Aironet
> and Windows to play together, configs, or links to info that will help?
> Just FYI, I am trying to use the radius server built into the AP, as I
> figured that would be simple enough, hopefully doing that is ok..
>
Attached (below) you find a productive config file (anonymized sufficiently I hope) and a "config snippet template" for RADIUS auth against local database.
You should be able to understand (and assemble) the relevant pieces. Feel free to contact me off-list if you don't succeed...
The "standard windows client config" is described for example in:
https://www.cisco.com/en/US/docs/wireless/wlan_adapter/cb21ag/user/2.0/configuration/guide/winapEkh.html
And this doc on hardening the APs might be interesting as well:
http://www.ernw.de/content/e7/e183/e691/download693/ERNW_hard_cisco_aps_erey_ger.pdf
thanks,
Enno
--
Enno Rey
ERNW GmbH - Breslauer Str. 28 - 69124 Heidelberg - www.ernw.de
Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902
PGP FP 055F B3F3 FE9D 71DD C0D5 444E C611 033E 3296 1CC1
Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey
*** TROOPERS10 - This time it's a home match ***
International Security Conference & Hacking Summit
*** 8-12 March 2010 - Heidelberg, Germany ***
*************** www.troopers.de ******************
==============================
Config snippet/template
! must be configured before 'radius-server local' is even ! available
aaa new-model
! enter local radius-server config mode
radius-server local
! include devices that act as RADIUS clients
nas 20.20.20.20 key radius123!
nas 20.20.20.21 key rad234!
! configure users
! user wds necessary for WDS communication
user wds pass wds456
! user needed for infrastructure_AP authentication
user infrastructureap pass infra678
! other users e.g. for LEAP
user erey pass hallo123
user fbrandtner pass franky
user tschuster pass franke
! 'point to self' radius-server config (as client)
! note port numbers!
radius-server host 20.20.20.20 kauth-port 1812 acct-port 1813 ey radius123!
======================
Full sample config
!
! No configuration change since last restart
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname A0119BG01
!
no logging console
enable secret 5 $1$3aRl$ms3dlasjaksjXefaQoRH.J1
!
clock timezone GMT 1
clock summer-time mesz recurring last Sun Mar 2:00 last Sun Oct 3:00
ip subnet-zero
no ip domain lookup
ip domain name warehouse.com
!
!
aaa new-model
!
!
aaa group server radius rad_eap
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius dummy
!
aaa group server radius Infrastructure
server 10.28.86.1 auth-port 1812 acct-port 1813
!
aaa group server radius rad_pmip
!
aaa group server radius rad_eap1
!
aaa group server radius user
server 10.28.86.1 auth-port 1812 acct-port 1813
server 10.0.184.20 auth-port 1645 acct-port 1646
server 10.0.184.21 auth-port 1645 acct-port 1646
!
aaa authentication login method_user group user
aaa authentication login mac_methods local
aaa authentication login method_infrastructure group Infrastructure
aaa authentication login eap_methods group user
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
!
dot11 ssid abc115EPtz9aoMDE
vlan 3
authentication open
authentication key-management wpa
wpa-psk ascii 7 BADEAFFE
!
dot11 ssid abcm303GHos7aoISI
vlan 2
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
!
!
crypto pki trustpoint TP-self-signed-724177026
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-724177026
revocation-check none
rsakeypair TP-self-signed-724177026
!
!
crypto ca certificate chain TP-self-signed-724177026
certificate self-signed 01
30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 37323431 37373032 36301E17 0D303230 33303130 30303035
395A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3732 34313737
30323630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
C68F64C4 AE33F858 240A1126 8C2E41AF 511C542D 17E4DD0E 3E29BD36 7F8B280C
26FE86DB B671E0DD FC5C23F9 E5ED65E2 95990E9C C73A1A30 70B2C011 4D5803E0
2FA3E66E EB109922 4385B2B0 DB755888 692E7B80 A6811950 726DC7FB E8DF3175
72734D2A 611DF0D4 342E7AD0 E1AB1638 9D5EC5B7 35569203 AE1B113D 4AACAE0B
02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
23041830 16801447 DF8B63E0 D1A0E27A D2CFE272 A6A8F3C0 B819B430 1D060355
1D0E0416 041447DF 8B63E0D1 A0E27AD2 CFE272A6 A8F3C0B8 19B4300D 06092A86
4886F70D 01010405 00038181 009E3010 9569DBE5 C3DBE314 FFF59CC1 DE75CB77
9082FDBD 7883DBBD 28556576 4F8FF831 625E146E 52FC84D0 13B8CB7B EC84AB50
C3E3AB1E 464056B7 9027010D E4E881FE 316CBFA5 617E5697 DBC11AF8 837299E8
7A3BE1B5 902E3FFF E77D1B00 405EAD3F 4FEE79BD 617DF22A 28FE4C7C 80D6021B
16832994 2F8A462C 7FF45615 B7
quit
username ibm_inst privilege 15 password 7 xyz
!
!
policy-map Office
class class-default
set cos 0
policy-map POS
class class-default
set cos 5
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
shutdown
!
encryption vlan 2 mode ciphers aes-ccm
!
encryption mode ciphers aes-ccm
!
encryption vlan 3 mode ciphers tkip
!
ssid abc115EPtz9aoMDE
!
ssid abcm303GHos7aoISI
!
speed basic-1.0 basic-2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0
power local cck 30
power local ofdm 30
power client 30
channel 2437
station-role root fallback shutdown
infrastructure-client
!
interface Dot11Radio0.2
encapsulation dot1Q 2 native
service-policy input POS
service-policy output POS
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.3
encapsulation dot1Q 3
service-policy input Office
service-policy output Office
no ip route-cache
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
bridge-group 3 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
speed 100
full-duplex
!
interface FastEthernet0.2
encapsulation dot1Q 2 native
service-policy input POS
service-policy output POS
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface FastEthernet0.3
encapsulation dot1Q 3
service-policy input Office
service-policy output Office
no ip route-cache
bridge-group 3
no bridge-group 3 source-learning
bridge-group 3 spanning-disabled
!
interface BVI1
ip address 10.28.86.1 255.255.252.0
no ip route-cache
!
ip default-gateway 10.28.87.254
no ip http server
ip http authentication local
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
snmp-server view basic iso included
snmp-server view basic ieee802dot11 included
snmp-server community a0_wlan_wh_ro view basic RO
snmp-server community a0_wlan_wh_rw view basic RW
snmp-server enable traps tty
radius-server local
nas 10.28.86.1 key 7 abc
user wds nthash 7 0A7BADE
user abc001IBMinst nthash 7 some_hash
user abc002IBMinst nthash 7 some_hash
user abc003IBMinst nthash 7 some_hash
user abc004IBMinst nthash 7 some_hash
user abc005IBMinst nthash 7 some_hash
!
radius-server attribute 32 include-in-access-req format %h
radius-server host 10.28.86.1 auth-port 1812 acct-port 1813 key 7 ABDC
radius-server host 10.0.184.21 auth-port 1645 acct-port 1646 key 7 ABDC
radius-server host 10.0.184.20 auth-port 1645 acct-port 1646 key 7 ABDC
radius-server vsa send accounting
!
control-plane
!
bridge 1 route ip
!
!
wlccp ap username wds password 7 ABCD
wlccp authentication-server infrastructure method_infrastructure
wlccp authentication-server client leap method_user
wlccp wds priority 100 interface BVI1
wlccp wnm ip address 10.1.240.41
!
line con 0
terminal-type ansi
transport preferred all
transport output all
line vty 0 4
terminal-type ansi
transport preferred all
transport input all
transport output all
line vty 5 15
terminal-type ansi
transport preferred all
transport input all
transport output all
!
sntp server 192.168.4.35
sntp broadcast client
end
More information about the cisco-nsp
mailing list