Hot answers tagged

10 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
user avatar
  • 2,628
7 votes

Is it possible to back up network devices configs on a RADIUS server (automatically or manual)

Radius is a networking protocol, aimed at Authentication, Authorization, and Accounting. It is not designed to backup configurations. Now a device that can act as a Radius server may be able to ...
user avatar
  • 18.4k
6 votes

Regarding Dot1X dynamic VLAN assignment

Alex, hеllo there! Ive builded test environmet for you, so i am using freeradius 2.1.12+dfsg-1.2 (on debian), and switch hp 2650. Ive just repeated your config, and have no problems with this. My ...
user avatar
  • 926
5 votes
Accepted

Cisco IPv6 BNG Radius Attributes

Have a look @ http://blog.ipspace.net/2011/09/ipv6-mplsvpn-6vpe-with-pppoe-and-radius.html Is this what you are trying to achieve? They confirm that: Cisco-AVPair += "ip:vrf-id=vrf-name", Cisco-...
user avatar
  • 480
5 votes
Accepted

AAA authentication for all users and a single user for local only?

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password ...
user avatar
  • 63k
5 votes
Accepted

Port Security Or 802.1X Authentication On Non-Server Network

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
user avatar
  • 71.5k
4 votes
Accepted

PPPoE - How does it reach the Radius Server?

For your home router to establish a WAN connection to your ISP, a few things specific to PPP must happen first. You may also have to do some research on LCP and NCP. Check this link below, it may ...
user avatar
  • 1,016
4 votes

secure authentication over LAN 802.1X

There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x, and here is one from the Freeradius Wiki. These two links ...
user avatar
  • 63k
4 votes
Accepted

Connecting networks from different states

It is possible, although it is generally not considered a good practice. WAN providers used to use different protocols for WAN circuits (frame-relay, HDLC, PoS, etc.), so a router was needed to ...
user avatar
  • 63k
4 votes
Accepted

Cisco 2960 radius configuration

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local
user avatar
  • 63k
3 votes
Accepted

RADIUS test works but actual logon fails

The mistake/oversight in my config is here: aaa authentication login default local group radius Using the radius keyword at the end instead of the explicit name of the RADIUS group defined elsewhere ...
user avatar
  • 1,125
3 votes

PPPoE - How does it reach the Radius Server?

In short, your client does not interact directly with the RADIUS server, the head-end router does. Your client speaks to the head-end router, which is configured to only allow authenticated ...
user avatar
  • 247
3 votes
Accepted

EAP packets generated for plain MAC-based authentication

what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach? Here's a freeradius-users thread which ...
user avatar
  • 1,173
3 votes
Accepted

Configure radius server via GUI in Cisco WLC

WLCs are NOT Radius Servers, you need an external Radius server and then point the WLCs to it The page you are on right now is to configure credentials to actually be able to query the external ...
user avatar
3 votes
Accepted

Manage Wifi clients

I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason) As you mentioned Windows and ACS, you can still use ...
user avatar
3 votes
Accepted

WLC HA Pair Ip address when takeover

I see you put the tag of aironet, so that I assume you are using Cisco WLC. I used to manage this kind of WLC HA and I can be sure that both WLCs share the same IP address (here is 1.1.1.1) as long ...
user avatar
  • 3,744
3 votes
Accepted

RADIUS accounting Stop messages not being sent

The answer was to use dot1x port-control mac-based on each port that you want authenticated.
user avatar
3 votes

Assigning static IP addresses to dialin PPP users on Cisco IOS

Actually this is relatively easy. Yes, you need AAA, but you don't need an external server. aaa authentication ppp default local aaa authorization network default local aaa attribute list Static-1.2....
user avatar
3 votes

using 802.1x with nic teaming

LACP and 802.1X don't mix. Unless there are vendor-specific extensions allowing that(?) you can't use them simultaneously on a port. Link aggregation is normally used between switches or towards ...
user avatar
  • 71.5k
3 votes
Accepted

Radius EAP-TLS: How to force a local IP per device/certificate?

IP addresses are assigned by a DHCP server. Simply add reservations based on MAC addresses to your DHCP server.
user avatar
  • 71.5k
3 votes

What's the difference between DIAMETER and 802.1X Authentication?

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication ...
user avatar
  • 71.5k
2 votes
Accepted

Regarding Dot1X dynamic VLAN assignment

Wow, I would have never though of this one. It was just a random solution. So, the problem was with authorize section in my default site configuration at /etc/raddb/sites-enabled/default, it was kind ...
user avatar
  • 837
2 votes

PPPoE - How does it reach the Radius Server?

The router you dial into forwards the authentication request to a RADIUS server, the client itself does not contact the RADIUS server directly. The router's configuration will have a list of RADIUS ...
user avatar
  • 655
2 votes
Accepted

Does 802.1X Multiple Hosts mode only work for access points or even through another switch?

EAPOL is done at layer 2, so it's frames not packets, and should be passed through except when the second switch has 802.1X enabled. If 802.1X is enabled on the second switch then it will either not ...
user avatar
  • 525
2 votes
Accepted

Cisco ISR L2TP VPN local vs radius authentication problem

I found the problem. I did not think this would be it so I overlooked it multiple times but after trying it, it worked. I feel so silly now. On the virtual template 1 I changed ppp authentication ms-...
user avatar
  • 181
2 votes
Accepted

Cisco 3750 802.1x -- Invalid Eapol packet length

Could you test this out, after hours, requires a switch reboot? Switch Config: conf t ! system mtu jumbo 9000 Windows Server 2008R2 config: adjust MTU to 9000 This may help. Take a look at this ...
user avatar
2 votes

Configure Cisco Aironet 1600 AP with RADIUS and multiple VLANs

Normally you'd have two SSID's, one "company" SSID and one "guest" SSID that maps to their respective VLAN's. However, you could use something like NAC (Network Admission Control) and "trick" the ...
user avatar
  • 655
2 votes

Configure Cisco Aironet 1600 AP with RADIUS and multiple VLANs

One way to solve this problem is to change the AP connection to a layer 2 trunk with both VLANs on the trunk. You can have two different SSIDs (one for users, one for guests) and each SSID is ...
user avatar
  • 63k
2 votes
Accepted

Fiber Network Bandwidth Control without Radius/PPPoE (Service Provider-Limit Client Bandwidth)

Many switches (smart ones) can do bandwidth limiting on a per-port basis - this is a robust, distributed method of limiting BW from a provider perspective for port-connected clients. Since most ...
user avatar
  • 2,736

Only top scored, non community-wiki answers of a minimum length are eligible