Alcatel-Lucent IAP93 Betriebsanweisung PDF herunterladen (Seite 136)

External RADIUS Server

In the external RADIUS server, the IP address of the Virtual Controller is configured as the NAS IP address. AOS-W

Instant RADIUS is implemented on the Virtual Controller, and this eliminates the need to configure multiple NAS

clients for every OAW-IAP on the RADIUS server for client authentication. AOS-W Instant RADIUS dynamically

forwards all the authentication requests from a NAS to a remote RADIUS server. The RADIUS server responds to

the authentication request with an Access-Accept or Access-Reject message, and users are allowed or denied

access to the network depending on the response from the RADIUS server.

When you enable an external RADIUS server for the network, the client on the OAW-IAP sends a RADIUS packet

to the local IP address. The external RADIUS server then responds to the RADIUS packet.

AOS-W Instant supports the following external authentication servers:

l RADIUS (Remote Authentication Dial-In User Service)

l LDAP (Lightweight Directory Access Protocol)

l CPPMServer for AirGroup CoA

To use an LDAP server for user authentication, configure the LDAP server on the Virtual Controller, and configure

user IDs and passwords.

To use a RADIUS server for user authentication, configure the RADIUS server on the Virtual Controller.

RADIUS Server Authentication with VSA

An external RADIUS server authenticates network users and returns to the OAW-IAP the vendor-specific attribute

(VSA) that contains the name of the network role for the user. The authenticated user is placed into the management

role specified by the VSA.

For a complete list of VSAs supported by AOS-W Instant, see Understanding VLAN Assignment on page 180.

Internal RADIUS Server

Each OAW-IAP has an instance of free RADIUS server operating locally. When you enable the Internal RADIUS

server option for the network, the client on the OAW-IAP sends a RADIUS packet to the local IP address. The

Internal RADIUS server listens and replies to the RADIUS packet.

The following authentication methods are supported in AOS-W Instant network:

l EAP-TLS— The Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) method supports the

termination of EAP-TLS security using the internal RADIUS server. The EAP-TLS requires both server and

certification authority (CA) certificates installed on the OAW-IAP. The client certificate is verified on the Virtual

Controller (the client certificate must be signed by a known CA), before the username is verified on the

authentication server.

l EAP-TTLS (MSCHAPv2)— The Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-

TTLS) method uses server-side certificates to set up authentication between clients and servers. However, the

actual authentication is performed using passwords.

l EAP-PEAP (MSCHAPv2)— EAP-PEAP is an 802.1X authentication method that uses server-side public key

certificates to authenticate clients with server. The PEAP authentication creates an encrypted SSL / TLS tunnel

between the client and the authentication server. Exchange of information is encrypted and stored in the tunnel

ensuring the user credentials are kept secure.

l LEAP— Lightweight Extensible Authentication Protocol (LEAP) uses dynamic WEP keys for authentication

between the client and authentication server.

To use OAW-IAP’s internal database for user authentication, add the names and passwords of the users to be

authenticated.

AOS-W Instant 6.3.1.1-4.0 | User Guide Authentication | 136

1 2 ... 131 132 133 134 135 136 137 138 139 140 141 ... 334 335

Keine Kommentare

Alcatel-Lucent IAP93 Betriebsanweisung Seite 136