Home » D-Link Manuals » Wireless » D-Link DWS-3024L » Manual Viewer

D-Link DWS-3024L User Manual - Page 210

FreeRADIUS Example for Wireless Client Configuration

Add to My Manuals
Save this manual to your list of manuals

Page 210 highlights

D-Link Unified Access System User Manual FreeRADIUS Example for Wireless Client Configuration You can use an external RADIUS server, such as a server running FreeRADIUS, to authenticate users who attempt to connect to an access point. The authentication is based on the username and password, and not the wireless client used for access. The RADIUS server can also assign the user to a VLAN after he or she is authenticated by the server. In addition to user-based authentication, you can configure MAC-based authentication to allow or deny wireless clients access to the AP based on the MAC address of the client. Configuring User-Based Authentication and Dynamic VLANs You can configure an entry in the external RADIUS server to pass a users credentials to the access point and to dynamically assign the user to a VLAN. Dynamic VLANs allow you to assign a user to a VLAN, and switches dynamically use this information to configure the port on the switch automatically. Selection of the VLAN is usually based on the identity of the user. The RADIUS server informs the access point of the selected VLAN as part of the authentication. This setup enables users of Dynamic VLANs to move from one location to another without intervention and without having to make any changes to the switches. If you use an external RADIUS server to manage VLANs, you configure the server to use Tunnel attributes in Access-Accept messages in order to inform the access point about the selected VLAN. These attributes are defined in RFC 2868 and their use for dynamic VLAN is specified in RFC 3580. The VLAN attributes defined in RFC3580 are as follows: • Tunnel-Type=VLAN (13) • Tunnel-Medium-Type=802 • Tunnel-Private-Group-ID=VLANID NOTE: The FreeRADIUS dictionary maps the 802 string value to the integer 6, which is why client entries use 6 for the Tunnel-Medium-Type value. To create a user and assign the user to a particular VLAN by using FreeRADIUS, open the etc/raddb/users file, which contains the user account information, and add for the new user. The following example shows the entry for a user in the users file. The username is "johndoe," the password is "test1234." The user is assigned to VLAN 77. johndoe Auth-Type: = EAP, User-Password == "test1234" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 77 Tunnel-Type and Tunnel-Medium-Type use the same values for all stations. Tunnel-PrivateGroup-ID is the selected VLAN ID and can be different for each user. NOTE: Do not use the management VLAN ID of the AP for the value of the TunnelPrivate-Group-ID. 210 © 2001- 2008 D-Link Corporation. All Rights Reserved.

Section	Page
User Manual	1
Table of Contents	3
List of Figures	9
List of Tables	13
About This Document	15
Audience	15
Organization	15
Document Conventions	15
Safety Instructions	16
Safety Cautions	16
General Precautions for Rack-Mountable Products	18
Protecting Against Electrostatic Discharge	19
Battery Handling Reminder	19
Overview of the D-Link Unified Access System	21
D-Link Unified Access System Components	21
D-Link Unified Switch	22
D-Link Access Point	22
WLAN Visualization	23
D-Link Unified Access System Topology	23
Single Unified Switch Deployment	24
Peer Unified Switch Deployment	24
Understanding the User Interfaces	25
Using the Web Interface	26
Interface Configuration Graphic	26
Navigation Menu	27
Configuration and Monitoring Options	27
WLAN Tabs	28
Tools Menu	28
Using the Command-Line Interface	28
Using SNMP	29
Wireless System Features and Standards Support	30
Planning the D-Link Unified Access System Network	33
System Requirements	33
WLAN Topology Considerations	34
Access Point-to-Switch Discovery	36
Access Point Placement	36
Network Planning to Support Layer 3 Roaming	37
Installing the Hardware	39
Hardware Overview	39
Front Panel Components	40
LED Indicators	41
Rear Panel Description	43
Side Panels	43
Installation	44
Package Contents	44
Installation Guidelines	44
Installing the Switch without the Rack	45
Installing the Switch in a Rack	45
Powering On the Switch	46
Power Failure	46
Installing the SFP ports	46
Installing the Optional Modules	47
Install the Module	48
Connecting to the External Redundant Power System	49
Connecting the Switch	49
Connecting the Switch to the Network	50
Connecting the Switch and AP Directly	50
Connecting the Switch and AP through the L2/L3 Network	51
Connecting to the Core Network	51
Installing the D-Link Unified Access System	53
System Deployment Overview	53
Connecting the Switch to the Network	55
Enabling the WLAN Features on the Switch	56
Preparing the Access Points	58
Logging on to the AP	58
Changing the AP Password	59
Configuring 802.1X Authentication Information on the AP	59
Configuring AP-to-Switch Authentication Information	60
Configuring VLAN Information on the Access Point	60
Discovering Access Points and Peer Switches	61
Understanding the Discovery Methods	61
Example 1: L2 Discovery	61
Example 2: IP Address of AP Configured in the Switch	62
Example 3: IP Address of Switch Configured in the AP	63
Example 4: DHCP Option	63
Discovery and Peer Switches	64
Assigning the IP Address to Switches and Managed APs	64
D-Link Unified Switch with Routing Disabled	65
D-Link Unified Switch with Routing Enabled	65
D-Link Access Point	67
Enabling the AP and Peer Switch Discovery	67
D-Link Wireless Device Discovery Protocol	68
Configuring IP Addresses of Peers and APs in the Switch	69
Setting the Switch IP Address in the D-Link Access Point	71
Setting the Switch Information in the DHCP Option	73
Authenticating and Validating Access Points	74
Configuring AP Authentication	75
Using the Local Database for AP Validation	76
Using the RADIUS Database for AP Validation	78
Managing Failed or Rogue APs	80
Configuring Access Point Settings	83
AP Profiles, Networks, and the Local Database	83
Access Point Profiles	83
Networks	84
Local Access Point Database	84
Configuring AAA and RADIUS Settings	85
Configuring Wireless Radio Settings	87
Configuring SSID Settings	92
Managing Virtual Access Point Configuration	93
Configuring the Default Network	94
Enabling and Configuring Additional VAPs	98
Configuring a VAP for L3 Tunnels	99
Configuring AP Security	101
Using No Security	101
Using Static or Dynamic WEP	101
Using WPA/WPA2 Personal or Enterprise	103
Configuring Valid Access Point Settings	106
Managing and Maintaining D-Link Access Points	109
Resetting the Access Points	109
Managing Radio Frequency Settings	110
Configuring Channel Plan and Power Settings	110
Viewing the Channel Plan History	113
Initiating Manual Channel Plan Assignments	114
Initiating Manual Power Adjustments	115
Upgrading the Access Point Software	116
Performing Advanced Access Point Management	118
Enabling AP Debugging	119
Adjusting the Channel and Power	120
Monitoring Status and Statistics	123
Monitoring Wireless Global Information	123
Viewing IP Discovery Status	126
Monitoring Peer Switch Status	126
Monitoring All Access Points	127
Monitoring Managed Access Point Status	130
Viewing Detailed Managed Access Point Status	132
Viewing Managed Access Point Radio Summary Information	133
Viewing Detailed Managed Access Point Radio Information	134
Viewing Managed Access Point Neighbor APs	135
Viewing Clients Associated with Neighbor Access Points	136
Viewing Managed Access Point VAPs	137
Monitoring Managed AP Statistics	138
Viewing Managed Access Point Ethernet Statistics	139
Viewing Detailed Managed Access Point Statistics	139
Viewing Managed Access Point Radio Statistics	140
Viewing Managed Access Point VAP Statistics	141
Viewing Access Point Authentication Failure Status	142
Monitoring Rogue and RF Scan Access Points	143
Monitoring Associated Client Information	145
Viewing Associated Client Status	146
Viewing Detailed Associated Client Status	147
Viewing Associated Client Neighbor AP Status	148
Viewing Associated Client SSID Status	149
Viewing Associated Client VAP Status	149
Viewing Associated Client Statistics	149
Viewing Client Authentication Failure Status	151
Monitoring and Managing Ad Hoc Clients	153
Configuring Advanced Settings	155
Creating, Configuring, and Managing AP Profiles	155
Creating, Copying, and Deleting AP Profiles	157
Applying an AP Profile	158
Configuring Global Settings	159
Enabling SNMP Traps	161
Configuring QoS	163
Configuring the Captive Portal	167
Configuring Global Captive Portal Settings	167
Configuring the Captive Portal	168
Changing the Captive Portal Settings	170
Monitoring and Configuring Captive Portal Users	172
Configuring Users in the Local Database	174
Configuring Users in a Remote RADIUS Server	174
Associating Interfaces with the Captive Portal	175
Viewing the Captive Portal Global Status	177
Viewing CP Activation and Activity Status	178
Viewing Interface Activation Status	179
Viewing Interface Capability Status	181
Viewing the Client Summary	182
Viewing Client Detail	183
Viewing the Client Statistics	184
Viewing the Client Interface Association Status	184
Viewing the Client CP Association Status	185
SNMP Trap Configuration	186
Visualizing the Wireless Network	187
Importing and Configuring a Background Image	188
Setting Up the Graph Components	189
Creating a New Graph	189
Graphing the WLAN Components	192
Understanding the Menu Bar Options	194
Legend Menu	196
Managing the Graph	199
D-Link Unified Access System Default Settings	201
Default D-Link Unified Switch Settings	201
Default D-Link Access Point Settings	202
Default D-Link Access Point Profile Settings	203
Default Captive Portal Settings	204
Configuring the External RADIUS Server	205
Configuring RADIUS Settings for Access Points	205
FreeRADIUS Server Configuration Example	207
Configuring RADIUS Clients	207
Creating and Including an Attribute Dictionary	207
Adding Access Points to the Valid AP Database	208
Configuring RADIUS Settings for Wireless Clients	209
Configuring RADIUS for Client MAC Authentication	209
FreeRADIUS Example for Wireless Client Configuration	210
Configuring User-Based Authentication and Dynamic VLANs	210
Configuring MAC Authentication	211
L3 Roaming Example	213
Configuring the WLAN and Tunnel Interfaces	214
Using a Loopback Interface for the Wireless Functions	215
Creating the VLAN Routing Interface	216
Configuring the L3 Tunnel Network	219
Example of Configuring L3 Roaming by Using the CLI	219
Example of Configuring L3 Roaming by Using the Web Interface	222
Configuring DHCP Relay and the DHCP Server	223
Configuring the Relay Agent	223
Configuring the DHCP Server	224
Understanding Quality of Service	227
QoS and Load Balancing	227
802.11e and WMM Standards Support	227
Coordinating Traffic Flow	228
QoS Queues and DSCP on Packets	228
EDCF Control of Data Frames and AIFS	229
Random Backoff and Contention Windows	230
Packet Bursting for Better Performance	230
TXOP Interval for Client Stations	231
802.1p and DSCP tags	231
Limited Warranty (USA Only)	233
Product Registration	237
Limited Warranty	238
What You Must Do For Warranty Service:	239
What Is Not Covered	239
Trademarks	240
Copyright Statement	240
FCC Warning	240
Technical Support	241
Registration Card All Countries and Regions Excluding USA	266

Match case Limit results 1 per page

210

D-Link Unified Access System User Manual

FreeRADIUS Example for Wireless Client

Configuration

You can use an external RADIUS server, such as a server running FreeRADIUS, to

authenticate users who attempt to connect to an access point. The authentication is based on

the username and password, and not the wireless client used for access. The RADIUS server

can also assign the user to a VLAN after he or she is authenticated by the server.

In addition to user-based authentication, you can configure MAC-based authentication to

allow or deny wireless clients access to the AP based on the MAC address of the client.

Configuring User-Based Authentication and Dynamic VLANs

You can configure an entry in the external RADIUS server to pass a users credentials to the

access point and to dynamically assign the user to a VLAN.

Dynamic VLANs allow you to assign a user to a VLAN, and switches dynamically use this

information to configure the port on the switch automatically. Selection of the VLAN is

usually based on the identity of the user. The RADIUS server informs the access point of the

selected VLAN as part of the authentication. This setup enables users of Dynamic VLANs to

move from one location to another without intervention and without having to make any

changes to the switches.

If you use an external RADIUS server to manage VLANs, you configure the server to use

Tunnel attributes in Access-Accept messages in order to inform the access point about the

selected VLAN. These attributes are defined in RFC 2868 and their use for dynamic VLAN is

specified in RFC 3580.

The VLAN attributes defined in RFC3580 are as follows:

•

Tunnel-Type=VLAN (13)

•

Tunnel-Medium-Type=802

•

Tunnel-Private-Group-ID=VLANID

NOTE:

The FreeRADIUS dictionary maps the 802 string value to the integer 6, which

is why client entries use 6 for the Tunnel-Medium-Type value.

To create a user and assign the user to a particular VLAN by using FreeRADIUS, open the

etc/raddb/users

file, which contains the user account information, and add for the new user.

The following example shows the entry for a user in the

users

file. The username is

“johndoe,” the password is “test1234.” The user is assigned to VLAN 77.

johndoe Auth-Type: = EAP, User-Password == “test1234"

Tunnel-Type = 13,

Tunnel-Medium-Type = 6,

Tunnel-Private-Group-ID = 77

Tunnel-Type and Tunnel-Medium-Type use the same values for all stations. Tunnel-Private-

Group-ID is the selected VLAN ID and can be different for each user.

NOTE:

Do not use the management VLAN ID of the AP for the value of the Tunnel-

Private-Group-ID.