• Provisioning an LSC on an AP does not require an AP to turn off its radios, which is vital for mesh APs,
which may get provisioned over-the-air.
• Because mesh APs need a dot1x authentication, a CA and ID certificate is required to be installed on
the server in the controller.
• LSC provisioning can happen over Ethernet and over-the-air in case of MAPs.You have to connect the
mesh AP to the controller through Ethernet and get the LSC certificate provisioned. After the LSC
becomes the default, an AP can be connected over-the-air to the controller using the LSC certificate.
Differences Between LSCs for Mesh APs and Normal APs
CAPWAP APs use LSC for DTLS setup during a JOIN irrespective of the AP mode. Mesh APs also use the
certificate for mesh security, which involves a dot1x authentication with the controller through the parent AP.
After the mesh APs are provisioned with an LSC, they need to use the LSC for this purpose because MIC
will not be read in.
Mesh APs use a statically configured dot1x profile to authenticate.
This profile is hardcoded to use "cisco" as the certificate issuer. This profile needs to be made configurable
so that vendor certificates can be used for mesh authentication (enter the
config local-auth eap-profile
cert-issuer vendor "prfMaP1500LlEAuth93"
command).
You must enter the
config mesh lsc enable/disable
command to enable or disable an LSC for mesh APs.
This command will cause all the mesh APs to reboot.
An LSC on mesh is open for very specific Oil and Gas customers with the 7.0 release. Initially, it is a
hidden feature. The
config mesh lsc enable/disable
is a hidden command. Also, the
config local-auth
eap-profile cert-issuer vendor "prfMaP1500LlEAuth93"
command is a normal command, but the
"prfMaP1500LlEAuth93" profile is a hidden profile, and is not stored on the controller and is lost after
the controller reboot.
Note
Certificate Verification Process in LSC AP
LSC-provisioned APs have both LSC and MIC certificates, but the LSC certificate will be the default one.
The verification process consists of the following two steps:
1
The controller sends the AP the MIC device certificate, which the AP verifies with the MIC CA.
2
The AP sends the LSC device certificate to the controller, which the controller verifies with the LSC CA.
Getting Certificates for LSC Feature
To configure LSC, you must first gather and install the appropriate certificates on the controller. The following
steps show how to accomplish this using Microsoft 2003 Server as the CA server.
Cisco Mesh Access Points, Design and Deployment Guide, Release 7.3
OL-27593-01
185
Connecting the Cisco 1500 Series Mesh Access Points to the Network
Locally Significant Certificates for Mesh APs