13-23
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-14209-01
Chapter 13 Configuring RADIUS and Servers
Configuring and Enabling
Configuring and Enabling
This section contains this configuration information:
•
Understanding , page 13-23
•
Operation, page 13-24
•
Configuring , page 13-24
•
Displaying the Configuration, page 13-29
Understanding
is a security application that provides centralized validation of users attempting to gain access
to your access point. Unlike RADIUS, does not authenticate client devices associated to the
access point.
services are maintained in a database on a daemon typically running on a UNIX
or Windows NT workstation. You should have access to and should configure a server before
configuring features on your access point.
provides for separate and modular authentication, authorization, and accounting facilities.
allows for a single access control server (the daemon) to provide each
service—authentication, authorization, and accounting—independently. Each service can be tied into its
own database to take advantage of other services available on that server or on the network, depending
on the capabilities of the daemon.
, administered through the AAA security services, can provide these services:
•
Authentication—Provides complete control of authentication of administrators through login and
password dialog, challenge and response, and messaging support.
The authentication facility can conduct a dialog with the administrator (for example, after a
username and password are provided, to challenge a user with several questions, such as home
address, mother’s maiden name, service type, and social security number). The
authentication service can also send messages to administrator screens. For example, a message
could notify administrators that their passwords must be changed because of the company’s
password aging policy.
•
Authorization—Provides fine-grained control over administrator capabilities for the duration of the
administrator’s session, including but not limited to setting autocommands, access control, session
duration, or protocol support. You can also enforce restrictions on the commands that an
administrator can execute with the authorization feature.
•
Accounting—Collects and sends information used for billing, auditing, and reporting to the
daemon. Network managers can use the accounting facility to track administrator activity
for a security audit or to provide information for user billing. Accounting records include
administrator identities, start and stop times, executed commands (such as PPP), number of packets,
and number of bytes.
The protocol provides authentication between the access point and the daemon,
and it ensures confidentiality because all protocol exchanges between the access point and the
daemon are encrypted.
You need a system running the daemon software to use on your access point.
