Dell PowerConnect W-IAP92 Dell Instant 6.2.0.0-3.2.0.0 User Guide - Page 113

Configuring an External RADIUS Server

Get Dell PowerConnect W-IAP92 PDF manuals and user guides View all Dell PowerConnect W-IAP92 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 113 highlights

EAP-Generic Token Card (GTC)- This EAP method permits the transfer of unencrypted usernames and passwords from client to server. The main uses for EAP-GTC are one-time token cards such as SecureID and the use of LDAP or RADIUS as the user authentication server. You can also enable caching of user credentials on the W-IAP as a backup to an external authentication server. EAP-Microsoft Challenge Authentication Protocol version 2 (MS-CHAPv2)- This EAP method is widely supported by Microsoft clients. A RADIUS server must be used as the backend authentication server. If you are using the W-IAP's internal database for user authentication, you need to add the names and passwords of the users to be authenticated. If you are using an LDAP server for user authentication, you need to configure the LDAP server on the Virtual Controller, and configure user IDs and passwords. If you are using a RADIUS server for user authentication, you need to configure the RADIUS server on the Virtual Controller. Configuring an External RADIUS Server To configure an external RADIUS server for a wireless network: 1. Click New in the Networks tab and select the appropriate Primary usage. 2. Click Next to continue. 3. Use the VLAN tab to specify how the clients on this network get their IP address and VLAN. 4. Click Next to continue. 5. In the Security tab, slide the bar to Enterprise and update the following fields: a. Key Management- Select the type of key for encryption and authentication. b. Termination- Select Enabled to terminate the EAP portion of 802.1X authentication on the access point instead of RADIUS server. c. Authentication server 1- Select New from the drop-down list to authenticate user credentials for the RADIUS server at run time and update the following fields: l RADIUS Server n Name- Enter the name of the new external RADIUS server. n IP address- Enter the IP address of the external RADIUS server. n Auth port- Enter the authorization port number of the external RADIUS server. The port number is set to 1812 by default. n Accounting port- Enter the accounting port number. This port is used to send accounting records to the RADIUS server. The port number is set to 1813 by default n Shared key- Enter a shared key for communicating with the external RADIUS server. n Timeout- Indicates the timeout for one RADIUS request. The W-IAP retries to send the request several times (as configured in the "Retry count") before the user gets disconnected. e.g. If the "Timeout" is 5 sec, "Retry counter" is 3, user is disconnected after 20 sec ("Timeout" x "Retry counter + 1). The default value is 5 seconds. n Retry count- Specify a number between 1 and 5. Indicates the maximum number of authentication requests that are sent to server group, and the default value is 3 requests. n RFC 3576- When enabled, the Access Points process RFC 3576-compliant Change of Authorization (CoA) and Disconnect messages from the RADIUS server. Disconnect messages cause a user session to be terminated immediately, whereas CoA messages modify session authorization attributes such as data filters. Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 | User Guide 113 | Authentication

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
EAP-Generic Token Card (GTC)— This EAP method permits the transfer of unencrypted
usernames and passwords from client to server. The main uses for EAP-GTC are one-time token
cards such as SecureID and the use of LDAP or RADIUS as the user authentication server. You
can also enable caching of user credentials on the W-IAP as a backup to an external
authentication server.
EAP-Microsoft Challenge Authentication Protocol version 2 (MS-CHAPv2)— This EAP method is
widely supported by Microsoft clients. A RADIUS server must be used as the backend
authentication server.
If you are using the W-IAP’s internal database for user authentication, you need to add the names
and passwords of the users to be authenticated. If you are using an LDAP server for user
authentication, you need to configure the LDAP server on the Virtual Controller, and configure
user IDs and passwords. If you are using a RADIUS server for user authentication, you need to
configure the RADIUS server on the Virtual Controller.
Configuring an External RADIUS Server
To configure an external RADIUS server for a wireless network:
1.
Click
New
in the
Networks
tab and select the appropriate
Primary usage
.
2.
Click
Next
to continue.
3.
Use the
VLAN
tab to specify how the clients on this network get their IP address and VLAN.
4.
Click
Next
to continue.
5.
In the
Security
tab, slide the bar to
Enterprise
and update the following fields:
a.
Key Management
— Select the type of key for encryption and authentication.
b.
Termination
— Select Enabled to terminate the EAP portion of 802.1X authentication on
the access point instead of RADIUS server.
c.
Authentication server 1
— Select
New
from the drop-down list to authenticate user
credentials for the RADIUS server at run time and update the following fields:
l
RADIUS Server
n
Name— Enter the name of the new external RADIUS server.
n
IP address— Enter the IP address of the external RADIUS server.
n
Auth port— Enter the authorization port number of the external RADIUS server. The
port number is set to 1812 by default.
n
Accounting port— Enter the accounting port number. This port is used to send
accounting records to the RADIUS server. The port number is set to 1813 by default
n
Shared key— Enter a shared key for communicating with the external RADIUS server.
n
Timeout— Indicates the timeout for one RADIUS request. The W-IAP retries to send
the request several times (as configured in the "Retry count") before the user gets
disconnected. e.g. If the "Timeout" is 5 sec, "Retry counter" is 3, user is disconnected
after 20 sec ("Timeout" x "Retry counter + 1). The default value is 5 seconds.
n
Retry count— Specify a number between 1 and 5. Indicates the maximum number of
authentication requests that are sent to server group, and the default value is 3
requests.
n
RFC 3576— When enabled, the Access Points process RFC 3576-compliant Change
of Authorization (CoA) and Disconnect messages from the RADIUS server.
Disconnect messages cause a user session to be terminated immediately, whereas CoA
messages modify session authorization attributes such as data filters.
Dell PowerConnect W-Series Instant Access Point
6.2.0.0-3.2.0.0
|
User Guide
113
|
Authentication