22
Flex 7500 Wireless Branch Controller Deployment Guide
FlexConnect Groups
Local EAP (Local Authentication Continuation)
Figure 10
Dot1X Authentication (FlexConnect APs Acting as Local-EAP Server)
•
You can configure the controller to allow a FlexConnect AP in standalone or connected mode to
perform LEAP or EAP-FAST authentication for up to 100 statically configured users. The controller
sends the static list of user names and passwords to each FlexConnect access point of that particular
FlexConnect Group when it joins the controller. Each access point in the group authenticates only
its own associated clients.
•
This feature is ideal for customers who are migrating from an autonomous access point network to
a lightweight FlexConnect access point network and are not interested in maintaining a large user
database, or adding another hardware device to replace the RADIUS server functionality available
in the autonomous access point.
•
As shown in
Figure 10
, if the RADIUS/ACS server inside the Data Center is not reachable, then
FlexConnect APs automatically acts as a Local-EAP Server to perform Dot1X authentication for
wireless branch clients.
CCKM/OKC Fast Roaming
•
FlexConnect Groups are required for CCKM/OKC fast roaming to work with FlexConnect access
points. Fast roaming is achieved by caching a derivative of the master key from a full EAP
authentication so that a simple and secure key exchange can occur when a wireless client roams to
a different access point. This feature prevents the need to perform a full RADIUS EAP
authentication as the client roams from one access point to another. The FlexConnect access points
need to obtain the CCKM/OKC cache information for all the clients that might associate so they can
process it quickly instead of sending it back to the controller. If, for example, you have a controller
with 300 access points and 100 clients that might associate, sending the CCKM/OKC cache for all
100 clients is not practical. If you create a FlexConnect Group comprising a limited number of
access points (for example, you create a group for four access points in a remote office), the clients
roam only among those four access points, and the CCKM/OKC cache is distributed among those
four access points only when the clients associate to one of them.
•
This feature along with Backup Radius and Local Authentication (Local-EAP) ensures
no
operational downtime
for your branch sites.
Note
CCKM/OKC fast roaming among FlexConnect and non-FlexConnect access points is not
supported.
