10
votes
Accepted
Do I need to re-authenticate every time I switch a access point?
If your access points are independent, then yes, each time you connect to an access point, you need to authenticate. This happens automatically in the background but incurs some delay and the ...
- 19.3k
9
votes
Accepted
How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?
UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev)
UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
- 151
8
votes
Do I need to re-authenticate every time I switch a access point?
It depends on how your access points are set up. If your access points are centrally managed by a wireless controller, then the wireless controller will synchronize authentication traffic from radius ...
6
votes
Accepted
Cisco 3750G - SSH Diffie Hellman Group 1 SHA1 Error
Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, ...
- 16.1k
5
votes
Accepted
AAA authentication for all users and a single user for local only?
Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely.
username localadmin password ...
- 66.1k
5
votes
Accepted
Port Security Or 802.1X Authentication On Non-Server Network
The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
- 79.8k
4
votes
Accepted
How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?
I can sympathize, IOS authentication mechanisms are not simple to understand.
The closest command that does what you want is show aaa method-lists authentication. However, this command is not really ...
- 29.8k
4
votes
Accepted
How does NAC or NAP enhance 802.1X?
802.1X does perform either a computer or a user authentication to allow the network access.
NAC is a generic term designing any form of Network Access Control.
Then 802.1X is one kind of NAC. I ...
- 364
4
votes
Accepted
Dell N3000 - Use port security for certain ports while Dot1x is globally enabled
You can try to disable dot1x port-control on a specific interface under interface configuration mode using no form command of no dot1x port-control ...
- 3,754
4
votes
secure authentication over LAN 802.1X
There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x,
and here is one from the Freeradius Wiki.
These two links ...
- 66.1k
4
votes
Accepted
Cisco 2960 radius configuration
This line:
aaa authorization exec default local
Doesn't allow you to start a shell (Exec) with Radius credentials.
You should change it to:
aaa authorization exec default group radius local
- 66.1k
3
votes
Accepted
Authorize IoT devices to connect to a WPA2 network without a password
In short, you can't.
One option is to create a separate WLAN (with a separate SSID) that has a static password. You should also apply strong filtering on that WLAN, so that the devices can reach ...
- 66.1k
3
votes
Accepted
How to force users to authenticate to get IP adress from DHCP?
There's a standard to achieve this: 802.1X.
Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
- 19.3k
3
votes
Cisco IOS public-key auth with privilege 15 and no password
This works on 2960x software 152-7.E4:
ip ssh version 2
no ip ssh server algorithm authentication password
no ip ssh server algorithm authentication keyboard
line vty 0 15
transport input ssh
This ...
3
votes
Doubt on handling mutable fields in IP header when computing digest or authentication data
You are misunderstanding what that is telling you. Simply for the purposes of the calculation, you use zero for those fields; you don't actually change those fields to zero for the packet.
- 97.7k
3
votes
Accepted
How does IPv6 AH guarranties authentication?
Before 2 hosts start using AH with each other, they need to agree on a common set of parameters, a security association or SA. This is typically achieved using the IKE protocol (IKEv1 or IKEv2).
As ...
- 2,628
3
votes
What's the difference between DIAMETER and 802.1X Authentication?
802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication ...
- 79.8k
3
votes
How to generate cisco key-hash string
Cisco uses various hashes. Simply search for cisco password hash algorithm , and you will find explanations, such as Cisco Routers Password Types:
Cisco Routers Password Types
Feb 13, 2020
Knowledge ...
- 97.7k
2
votes
Juniper MX Radius server configuration: No authentication-server list configured
Mar 2 15:36:55.369155 authd_create_application_specific_radius_server: No authentication-server list configured
It seems you missed radius server in "profile local-kpn". Try following configuration :...
- 21
2
votes
What does aaa mean?
That stands for Authentication, Authorization, and Accounting. It controls who is authorized on a device, what authorization each has, and accounting of who is doing what.
Cisco has documents, e.g. ...
- 97.7k
2
votes
Accepted
What is happening during CHAP PPP authentication between Cisco routers?
Note: By default, the router uses its hostname to identify itself to the peer. However, this CHAP username can be changed through the ppp chap hostname command. Refer to PPP Authentication Using the ...
- 151
2
votes
How do i factory reset a Allied Telesyn AT-9924t?
Following the steps from here you should be able to reset the password.
1. Connect to the router using a RS-232 cable
2. Connect to the router via HyperTerminal
3. Settings for HyperTerminal = 9600 - ...
- 21
2
votes
Accepted
How does Tacacs server forward the credentials from client to Authentication server?
RADIUS was designed to authenticate and log dial-up remote users to a
network, and TACACS+ is used most commonly for administrator access to
network devices like routers and switches.
http://www....
- 4,349
2
votes
Accepted
Cisco TACACS authentication config
The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
- 66.1k
2
votes
Accepted
How to Multiple Radius server in ASA
You can add the second server to the "SecureID" Server Group as well:
aaa-server SecureID (inside) host 10.1.1.2
key *****
authentication-port 1812
accounting-port 1813
Because both AAA Server in ...
- 164
2
votes
AAA authentication for all users and a single user for local only?
This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens):
aaa authentication login default local ...
- 1,135
2
votes
IKE phase 1 and phase 2
ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2.
Arent the cookies generated by hashing the senders IP, port , protocol and timestamp?
It's open to ...
- 278
2
votes
Accepted
IKE phase 1 and phase 2
Good questions.
1)The 1st and 2nd packets are transfer of SA proposals and cookies.
Question:Arent the cookies generated by hashing the senders IP, port ,
protocol and timestamp? If thats the case, ...
- 14.5k
2
votes
Accepted
security benefits of using RADIUS in router authentication - packet tracer
There are two main benefits:
Convenience, which for managing large numbers of networking equipment means that everything is up-to-date and not missed.
Single point of reference which can be instantly ...
- 16.1k
2
votes
Authenticating WiFi users with NFC tap points
As a slightly-alternative answer to your question, have you considered using QR codes for this? It might be there are more QR-reading phones than NFC-reading phones.
I've had good success with QR-...
- 16.1k
Only top scored, non community-wiki answers of a minimum length are eligible