10 votes
Accepted

Do I need to re-authenticate every time I switch a access point?

If your access points are independent, then yes, each time you connect to an access point, you need to authenticate. This happens automatically in the background but incurs some delay and the ...
JFL's user avatar
  • 19.6k
9 votes
Accepted

How do you configure a TACACS+ tac_plus server on Ubuntu 16.04 that authenticates against Microsoft Active Directory?

UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev) UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269,...
dt1235's user avatar
  • 151
8 votes

Do I need to re-authenticate every time I switch a access point?

It depends on how your access points are set up. If your access points are centrally managed by a wireless controller, then the wireless controller will synchronize authentication traffic from radius ...
6 votes
Accepted

Cisco 3750G - SSH Diffie Hellman Group 1 SHA1 Error

Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, ...
jonathanjo's user avatar
  • 16.2k
5 votes
Accepted

AAA authentication for all users and a single user for local only?

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password ...
Ron Trunk's user avatar
  • 67.3k
5 votes
Accepted

Port Security Or 802.1X Authentication On Non-Server Network

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
Zac67's user avatar
  • 83.9k
4 votes
Accepted

How does NAC or NAP enhance 802.1X?

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I ...
dan's user avatar
  • 364
4 votes
Accepted

Dell N3000 - Use port security for certain ports while Dot1x is globally enabled

You can try to disable dot1x port-control on a specific interface under interface configuration mode using no form command of no dot1x port-control ...
Hung Tran's user avatar
  • 3,754
4 votes

secure authentication over LAN 802.1X

There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x, and here is one from the Freeradius Wiki. These two links ...
Ron Trunk's user avatar
  • 67.3k
4 votes
Accepted

Cisco 2960 radius configuration

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local
Ron Trunk's user avatar
  • 67.3k
3 votes
Accepted

How to force users to authenticate to get IP adress from DHCP?

There's a standard to achieve this: 802.1X. Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the ...
JFL's user avatar
  • 19.6k
3 votes
Accepted

Authorize IoT devices to connect to a WPA2 network without a password

In short, you can't. One option is to create a separate WLAN (with a separate SSID) that has a static password. You should also apply strong filtering on that WLAN, so that the devices can reach ...
Ron Trunk's user avatar
  • 67.3k
3 votes

Cisco IOS public-key auth with privilege 15 and no password

This works on 2960x software 152-7.E4: ip ssh version 2 no ip ssh server algorithm authentication password no ip ssh server algorithm authentication keyboard line vty 0 15 transport input ssh This ...
Roger Sanghee Gold's user avatar
3 votes

Doubt on handling mutable fields in IP header when computing digest or authentication data

You are misunderstanding what that is telling you. Simply for the purposes of the calculation, you use zero for those fields; you don't actually change those fields to zero for the packet.
Ron Maupin's user avatar
  • 99.4k
3 votes
Accepted

How does IPv6 AH guarranties authentication?

Before 2 hosts start using AH with each other, they need to agree on a common set of parameters, a security association or SA. This is typically achieved using the IKE protocol (IKEv1 or IKEv2). As ...
hertitu's user avatar
  • 2,638
3 votes

What's the difference between DIAMETER and 802.1X Authentication?

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication ...
Zac67's user avatar
  • 83.9k
3 votes

How to generate cisco key-hash string

Cisco uses various hashes. Simply search for cisco password hash algorithm , and you will find explanations, such as Cisco Routers Password Types: Cisco Routers Password Types Feb 13, 2020 Knowledge ...
Ron Maupin's user avatar
  • 99.4k
2 votes

How do i factory reset a Allied Telesyn AT-9924t?

Following the steps from here you should be able to reset the password. 1. Connect to the router using a RS-232 cable 2. Connect to the router via HyperTerminal 3. Settings for HyperTerminal = 9600 - ...
DM.'s user avatar
  • 21
2 votes

Juniper MX Radius server configuration: No authentication-server list configured

Mar 2 15:36:55.369155 authd_create_application_specific_radius_server: No authentication-server list configured It seems you missed radius server in "profile local-kpn". Try following configuration :...
Yahya's user avatar
  • 21
2 votes

What does aaa mean?

That stands for Authentication, Authorization, and Accounting. It controls who is authorized on a device, what authorization each has, and accounting of who is doing what. Cisco has documents, e.g. ...
Ron Maupin's user avatar
  • 99.4k
2 votes
Accepted

Cisco TACACS authentication config

The config you've posted is pretty common, and I suppose it was developed to be as flexible as possible, with separate methods for VTY and console access, as well as separate command authorization for ...
Ron Trunk's user avatar
  • 67.3k
2 votes
Accepted

How to Multiple Radius server in ASA

You can add the second server to the "SecureID" Server Group as well: aaa-server SecureID (inside) host 10.1.1.2 key ***** authentication-port 1812 accounting-port 1813 Because both AAA Server in ...
scherard's user avatar
  • 164
2 votes
Accepted

How does Tacacs server forward the credentials from client to Authentication server?

RADIUS was designed to authenticate and log dial-up remote users to a network, and TACACS+ is used most commonly for administrator access to network devices like routers and switches. http://www....
Ronnie Royston's user avatar
2 votes

AAA authentication for all users and a single user for local only?

This worked for me on a Cisco Catalyst 3850 running IOS 15.2 (you need to configure the rest of the AAA system, this is just the line where the magic happens): aaa authentication login default local ...
Todd Wilcox's user avatar
  • 1,135
2 votes
Accepted

IKE phase 1 and phase 2

Good questions. 1)The 1st and 2nd packets are transfer of SA proposals and cookies. Question:Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? If thats the case, ...
Eddie's user avatar
  • 15k
2 votes

IKE phase 1 and phase 2

ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2. Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? It's open to ...
ecdsa's user avatar
  • 303
2 votes
Accepted

security benefits of using RADIUS in router authentication - packet tracer

There are two main benefits: Convenience, which for managing large numbers of networking equipment means that everything is up-to-date and not missed. Single point of reference which can be instantly ...
jonathanjo's user avatar
  • 16.2k
2 votes

Authenticating WiFi users with NFC tap points

As a slightly-alternative answer to your question, have you considered using QR codes for this? It might be there are more QR-reading phones than NFC-reading phones. I've had good success with QR-...
jonathanjo's user avatar
  • 16.2k
2 votes

Hp procurve 2510 ssh problem

Check whether there's a host key on the 2510: show crypto host-public-key If not, generate one: crypto key generate ssh You might also want to check for firmware updates - host keys are auto ...
Zac67's user avatar
  • 83.9k
2 votes
Accepted

WebAuth With RADIUS For Switch Web Portal

It is for Catalyst 2960-X Switch IOS 15.2. but should work on IE4000 (Link): ip http authentication aaa You can verify your configuration with: show ip http server status At point "http server ...
Pompi's user avatar
  • 131

Only top scored, non community-wiki answers of a minimum length are eligible