Lobby ambsssador user authenticatio using a RADIUS server

I have Wism installed in unified wireless network, MS IAS server is sittign in between enterprise AD and Wism. Wireless clients are getting authentincated via ISA againt enterprise AD without any issue.
Now I want to authenticate the admin users in WLC ( for example Lobby admin users) also with AD using the same method.
I tried adding a RADIUS server in WLC on "administraiton>AAA servers" . But the external authentication doesn't seems to be happaning. Does someone has any exmaple on this type of configuraiton ?

you can use Radius to authenticate management user, but I'm afraid can't use it to authenticate Lobby admin user.
To authen management user, you need:
1. in WLC, when creating Radius server, need to enable "management"
2. In Radius, you need to enable service type[006] to be administrative in user's IETF(Radius) attribute

Similar Messages

  • Using RSA RADIUS Server and WLC 7.4 to dynamically asssign users to VLAN

    Hello,
    What we are trying to do:
    John logs on to wifi using RSA fob for password. RSA sends back auth request with attibutes to WLC 7.4 that magically knows how to interpret the attributes and puts John on vlan 10. Mary logs on with her fob and gets put on VLAN 20.
    We dont have ISE. We dont have ACS. We have RSA Authentication Manager 7.0
    We have looked high and low for documentation for this kind of setup and we find stuff that is close to a match but not quite.
    Here is what we are seeing
    1. dynamic vlan assignment is not working -- radius server is set with the attributes
    2. RSA authentication works
    3. John and Mary are always put into the VLAN where the MGMT interface is
    4. I can see that attributes are making it back to the WLC by sniffing
    We are stuck at this point. Any help would be much appreciated,
    P.

    Here is a little more background:
    We have created a dynamic interface in VLAN 157
    Wireless LAN has been assigned to MGMT interface which is on VLAN 35
    This is a VWLC ver 7.4.100
    AP is attached to VWLC (only FlexConnect mode is supported)
    RADIUS Server has been configured
    Users are getting assigned to VLAN 35
    Also I have attached some screenshots and two packet captures so you can see what the RSA is sending back with your own eyes
    I dont see any atttributes in the capture when RSA sends to the VWLC
    I see attributes in the capture when RSA send to my local RADIUS Client (My PC)
    And to answer your question we have sending a VLAN ID (157)

  • Multiple stand alone servers using one radius server?

    Hello, I have a question.
    I'm working for a company and our problem is we need a username and password for every server.
    We would like to set up a Radius server using an extension so it can use a SQL database for the users.
    Is it possible to put 1 username and 1 password for each user in this database so we don't need more then one for each server?
    Also can we set up policy's for those users so they can't access every stand-alone server.
    Kind Regards,
    Michael

    Hi,
    Based on my research, when a RADIUS client (access server) sends connection requests and accounting messages to a RADIUS server, the RADIUS server will sends back an Access-Accept message or sends back an Access-Reject message to authenticate and authorize
    the connection requests based on a set of rules and the information in the user account database. The Access-Accept message can contain connection restrictions that are implemented by the access server for the duration of the connection.
    In addition, according to your description, it seems that you used the SQL database as the User account database. Did you use NPS as a RADIUS server? If yes, maybe you can configure related network policy to restrict access. I would appreciate it if you can
    introduce more detailed information about your environment. The link below may be helpful:
    Configuring Microsoft NPS (Network Policy Server) / (Internet Authentication Service)IAS as Wireless LAN Controller (WLC) RADIUS Server
    Best regards,
    Susie

  • OTP of ASDM using external radius server ( Not RSA )

    Hello,
    Just seeing if the ASDM will support OTP using an external radius server, and not RSA.  I see there was a feature added to 8.2 that states its possible with RSA, but nothing of any other support.  Just checking to see if someone know for sure.
    Thanks,
    Jason

    I did see in the Release notes for ASDM 6.2, that SDI is support with RSA.  Can anyone confirm or not if it works with Radius too ( OTP ).
    http://www.cisco.com/en/US/docs/security/asdm/6_2/release/notes/asdmrn62.html

  • Using MS Radius Server with WLC

    I'm currenlty running WLC version 4.1.171. For authentication I'm using Microsoft IAS. I was able to get this to work by using Web Authentication but I want to use 802.1x w/ PEAP. I've been researching this and most of the documents talk about ACS. I did find one document on how to make this work, however I still have not been able to get authenicated. I'm hoping someone has some documentation on how to configure IAS on MS WIN Ser 2003. Thanks in advance.
    Here is the document I've been using: http://wireless.dweezle.org/Docs/PEAP/Step-by-Step%20Guide%20for%20Setting%20Up%20Secure%20Wireless%20Access.ppt

    Hi,
    can You send me some information about configuring WEB-AUTH with IAS ?
    I cannot figure how to comfigure user / ias in my server .
    I've done EAPTLS with the same IAS, but now i was trying to do simple user/pass authentication, if it's possible.
    Many thanks
    Luigi

  • Deploying a report to the end user without using Crystal Reports Server

    Hello,
      I'm using Crystal Reports Professional XI.
      I finished creating a report that contains several subreports.  Now it's time for me to deploy the report to the end user so that they can start running it.  The company that I'm doing this consulting work for does not have Crystal Reports Server setup so what is the best approach to deploying this report to the end user?  For now it would just be one user using the report but down the road there could be other people within his department that are running it as well.
        if you have any questions or need additional information to answer my posting just let me know.  Have a good day.
    Regards,
    Ting

    Hi Ting,
    I see now.... In older versions of CR like 8.5 there was a Deployment Wizard one could use to compile the report and runtime into an executable to run on an end users PC so that user could preview and refresh the reports.
    That ability stopped as of CR 8.5 or earlier, I don't recall exactly now.
    Yes, if they want to be able to run your report they will need to install a copy of Crystal Reports, then just send them your RPT file, they can then set Database location to their DB Source and then preview and refresh the report as required.
    Or as mentioned use a third party app to do the same or write your own. It's quite simple to do and likely one of our samples applications is all you need with a few basic changes, report source and DB log on info would need to be updated.
    As for licensing, the end user must purchase a copy of Crystal Reports to be able to use your application. Third Party app's would include the licensing mostly but check with them if you go that way.
    The convenient part is if the users want to write their own reports they can.
    And for your sake if you want to protect your reports the next version of CR has a read only RPT file format that all the user can do is preview and refresh the report. They can not edit it in anyway.
    Thanks again
    Don

  • Is it possible to map a Sponsor Group in Cisco ISE to a user group in Active Directory, through a RADIUS server?

    Hi!!
    We are working on a mapping between a Sponsor Group in Cisco ISE and a user group in Active Directory....but the client wants the mapping to be through a RADIUS SERVER, for avoiding ISE querying directly the Active Directory.
    I know it is possible to use a RADIUS SERVER as an external identity source for ISE.....but, is it possible to use this RADIUS SERVER for this sponsor group handling?
    Thanks and regards!!

    Yes It is possible to map Sponser group to user group in AD and if you want to know how to do please open the below link and go to Mapping Active Directory Groups to Sponsor Groups heading.
    http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html#wp1096365

  • 10.6.4 Server L2TP VPN using external RADIUS - Authorization Failed

    I'm using 10.6.4 with VPN L2TP configured successfully using local user database for authentication. Now i want to configure the VPN to use Steel Belted Radius server for authentication (that hooked up to another LDAP server) for authentication.
    I've configured the VPN service to use the radius server, authentication to radius is occurring but i'm getting errors that the user is not authorized to use the VPN service.
    Is there a way to configure 10.6's VPN service to authorize any user that successfully authenticates against Radius?
    NOTE: I've played around with Server Admin's access for VPN, with it set to all users, everyone ect, this did not make any difference to the error i'm getting from the vpn service.
    Here's the log out put when the connection fails.
    2010-08-27 12:52:34 PDT Loading plugin /System/Library/Extensions/L2TP.ppp
    2010-08-27 12:52:34 PDT Listening for connections...
    2010-08-27 12:52:39 PDT Incoming call... Address given to client = 192.168.105.1
    Fri Aug 27 12:52:39 2010 : Directory Services Authorization plugin initialized
    Fri Aug 27 12:52:39 2010 : L2TP incoming call in progress from '[ip address redacted]'…
    Fri Aug 27 12:52:39 2010 : L2TP received SCCRQ
    Fri Aug 27 12:52:39 2010 : L2TP sent SCCRP
    Fri Aug 27 12:52:39 2010 : L2TP received SCCCN
    Fri Aug 27 12:52:39 2010 : L2TP received ICRQ
    Fri Aug 27 12:52:39 2010 : L2TP sent ICRP
    Fri Aug 27 12:52:39 2010 : L2TP received ICCN
    Fri Aug 27 12:52:39 2010 : L2TP connection established.
    Fri Aug 27 12:52:39 2010 : using link 0
    Fri Aug 27 12:52:39 2010 : Using interface ppp0
    Fri Aug 27 12:52:39 2010 : Connect: ppp0 <--> socket[34:18]
    Fri Aug 27 12:52:39 2010 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : lcp_reqci: returning CONFACK.
    Fri Aug 27 12:52:39 2010 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : sent [LCP EchoReq id=0x0 magic=0x55fc9b88]
    Fri Aug 27 12:52:39 2010 : sent [CHAP Challenge id=0xc8 <086a03234947113037497f4326585a1f>, name = "OSX SERVER"]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoReq id=0x0 magic=0x7e9db3cb]
    Fri Aug 27 12:52:39 2010 : sent [LCP EchoRep id=0x0 magic=0x55fc9b88]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoRep id=0x0 magic=0x7e9db3cb]
    Fri Aug 27 12:52:39 2010 : rcvd [CHAP Response id=0xc8 <5ad3c0cb063694e473f51c9252e007f400000000000000003701b4fa8e7b844e072cddeceefa73 173d7415c85cae976700>, name = "USERNAME"]
    Fri Aug 27 12:52:40 2010 : sent [CHAP Success id=0xc8 "S=934D6E79F45791A61C378789A4D719BC6F249574"]
    *Fri Aug 27 12:52:40 2010 : CHAP peer authentication succeeded for USERNAME*
    *Fri Aug 27 12:52:40 2010 : DSAccessControl plugin: User 'USERNAME' not authorized for access*
    *Fri Aug 27 12:52:40 2010 : sent [LCP TermReq id=0x2 "Authorization failed"]*
    Fri Aug 27 12:52:40 2010 : Connection terminated.
    Fri Aug 27 12:52:40 2010 : L2TP disconnecting...
    Fri Aug 27 12:52:40 2010 : L2TP sent CDN
    Fri Aug 27 12:52:40 2010 : L2TP sent StopCCN
    Fri Aug 27 12:52:40 2010 : L2TP disconnected
    2010-08-27 12:52:40 PDT --> Client with address = 192.168.105.1 has hungup
    Message was edited by: sarah mays

    I'm using 10.6.4 with VPN L2TP configured successfully using local user database for authentication. Now i want to configure the VPN to use Steel Belted Radius server for authentication (that hooked up to another LDAP server) for authentication.
    I've configured the VPN service to use the radius server, authentication to radius is occurring but i'm getting errors that the user is not authorized to use the VPN service.
    Is there a way to configure 10.6's VPN service to authorize any user that successfully authenticates against Radius?
    NOTE: I've played around with Server Admin's access for VPN, with it set to all users, everyone ect, this did not make any difference to the error i'm getting from the vpn service.
    Here's the log out put when the connection fails.
    2010-08-27 12:52:34 PDT Loading plugin /System/Library/Extensions/L2TP.ppp
    2010-08-27 12:52:34 PDT Listening for connections...
    2010-08-27 12:52:39 PDT Incoming call... Address given to client = 192.168.105.1
    Fri Aug 27 12:52:39 2010 : Directory Services Authorization plugin initialized
    Fri Aug 27 12:52:39 2010 : L2TP incoming call in progress from '[ip address redacted]'…
    Fri Aug 27 12:52:39 2010 : L2TP received SCCRQ
    Fri Aug 27 12:52:39 2010 : L2TP sent SCCRP
    Fri Aug 27 12:52:39 2010 : L2TP received SCCCN
    Fri Aug 27 12:52:39 2010 : L2TP received ICRQ
    Fri Aug 27 12:52:39 2010 : L2TP sent ICRP
    Fri Aug 27 12:52:39 2010 : L2TP received ICCN
    Fri Aug 27 12:52:39 2010 : L2TP connection established.
    Fri Aug 27 12:52:39 2010 : using link 0
    Fri Aug 27 12:52:39 2010 : Using interface ppp0
    Fri Aug 27 12:52:39 2010 : Connect: ppp0 <--> socket[34:18]
    Fri Aug 27 12:52:39 2010 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : lcp_reqci: returning CONFACK.
    Fri Aug 27 12:52:39 2010 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
    Fri Aug 27 12:52:39 2010 : sent [LCP EchoReq id=0x0 magic=0x55fc9b88]
    Fri Aug 27 12:52:39 2010 : sent [CHAP Challenge id=0xc8 <086a03234947113037497f4326585a1f>, name = "OSX SERVER"]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoReq id=0x0 magic=0x7e9db3cb]
    Fri Aug 27 12:52:39 2010 : sent [LCP EchoRep id=0x0 magic=0x55fc9b88]
    Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoRep id=0x0 magic=0x7e9db3cb]
    Fri Aug 27 12:52:39 2010 : rcvd [CHAP Response id=0xc8 <5ad3c0cb063694e473f51c9252e007f400000000000000003701b4fa8e7b844e072cddeceefa73 173d7415c85cae976700>, name = "USERNAME"]
    Fri Aug 27 12:52:40 2010 : sent [CHAP Success id=0xc8 "S=934D6E79F45791A61C378789A4D719BC6F249574"]
    *Fri Aug 27 12:52:40 2010 : CHAP peer authentication succeeded for USERNAME*
    *Fri Aug 27 12:52:40 2010 : DSAccessControl plugin: User 'USERNAME' not authorized for access*
    *Fri Aug 27 12:52:40 2010 : sent [LCP TermReq id=0x2 "Authorization failed"]*
    Fri Aug 27 12:52:40 2010 : Connection terminated.
    Fri Aug 27 12:52:40 2010 : L2TP disconnecting...
    Fri Aug 27 12:52:40 2010 : L2TP sent CDN
    Fri Aug 27 12:52:40 2010 : L2TP sent StopCCN
    Fri Aug 27 12:52:40 2010 : L2TP disconnected
    2010-08-27 12:52:40 PDT --> Client with address = 192.168.105.1 has hungup
    Message was edited by: sarah mays

  • When WLC authenticate users with secondary RADIUS server?

    Hi Sir,
    I'm configuring a WLC4404-100. One of the WLANs points to two RADIUS Servers for Authentication and Accounting (please see attached).
    I'd like to know, under what circumstances will the WLC authenticate users against the secondary RADIUS Server (in my case, the ACS with IP address 10.200.67.84)?
    Please advise.
    Thank you.
    B.Rgds,
    Lim TS

    Hi,
    I navigated to the following on the WLC:
    MANAGEMENT -> SNMP -> Trap Logs
    I noticed the following SNMP trap:
    Fri Dec 8 11:23:21 2006 No Radius Servers Are Responding
    I checked the 2nd ACS server, and true, at around the same time 11:23, the 2nd ACS server was authenticating users.
    I checked the 1st ACS server; at around the same time 11:23, there wasn't any service suspension or database replication going on. What's the cause of this WLC authenticating with the 2nd ACS server? The network is robust and I don't expect any latency issue. The two RADIUS servers are serving only wireless users, the number is about 120.
    On the WLC, I used the default of 2 seconds Retransmit Timeout for both the RADIUS Authentication Servers. Should I fine-tune it to higher value?
    Retransmit Timeout - Specify the time in seconds after which the RADIUS authentication request will timeout and a retransmission will be taken up by the controller. You can specify a value between 2 to 30 seconds.
    There are Passed Authentications logged on the 1st ACS server after during & after 11:23. So, I suspect the WLC is doing a kind of load-balancing across the two RADIUS servers.
    Please advise.
    Thank you.
    B.Rgds,
    Lim TS

  • Exchange Server 2013 and RADIUS server(freeRADIUS2)

    I am a student and doing an internship. I have to test Microsoft Exchange Server 2013.
    I am using Windows Server 2012, I already installed Exchange
    Server 2013 on it and everything works as intended.
    But I couldn't find out how to configure my Windows Server 2012 in order to authenticate my mailbox users from Exchange Server 2013 with a RADIUS
    server which is not on my Windows Server 2012. I have to use their RADIUS server ( freeRADIUS2 ), the RADIUS server from
    the company where I am doing my internship.
    I already did the checklist that is on http://technet.microsoft.com/en-us/library/cc772591.aspx. I configured the NPS as
    a RADIUS proxy, because that's what I need.
    So after doing everything that is on that checklist, my question is:
    Is it possible that the Exchange Server 2013 will use my NPS which is now configured as a NPS RADIUS proxy to authenticate my mailbox users that I have on my Exchange Server 2013?

    thanks for such a quick response.
    Just a small question about the link that you put. Does member server mean other server other than domain controller?
    Regards,
    Yes, Also the server on which you are installing Exchange should have exchange installed.
    Cheers,
    Gulab Prasad
    Technology Consultant
    Blog:
    http://www.exchangeranger.com    Twitter:
      LinkedIn:
       Check out CodeTwo’s tools for Exchange admins
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

  • Exchange Server 2013 with a RADIUS server (freeRADIUS).

    Hello,
    I am a student and doing an internship. I have to test Microsoft Exchange Server 2013.
    I am using Windows Server 2012, I already installed Exchange Server 2013 on it and everything works as intended.
    But I couldn't find out how to configure my Windows Server 2012 in order to authenticate my mailbox users from Exchange Server 2013 with a RADIUS server which is not on my Windows Server 2012. I have to use their RADIUS server (freeRADIUS), the RADIUS server
    from the company where I am doing my internship.
    I already created a NPS and added the RADIUS Client + Remote
    RADIUS Server Groups. I created a Connection Request Policies with the condition:
    User Name *
    I forwarded the Connection Request to the
    Remote RADIUS server that I created in Remote RADIUS Server Groups and then I registered the NPS in th AD. But it's still not working. 
    Maybe I did something wrong or I misunderstood something or does this even work with Exchange Server 2013? To authenticate mailbox users with a RADIUS server before they can login into their mailbox and use their mailbox?
    Thanks in advance.

    Hi,
    I suggest we refer to the following article to double confirm the Network Policy Server is registered properly.
    http://technet.microsoft.com/library/cc732912.aspx
    Thanks,
    Simon Wu
    TechNet Community Support

  • Connecting AE to a RADIUS server wirelessly

    I have found several posts on this subject, but none that have the same circumstances. I am running a Snow Leopard Server with RADIUS enabled to authenticate users connecting to my AEBS/s. I need to join an AE to the network wirelessly to connect a printer which is in an area where I can't run cabling.
    I have tried numerous times and spent a lot of time on the internet looking for a solution. In most cases the perpetrators are trying to connect to a University network or some such. In my case I control both sides of the equation.
    Does anyone have an idea how I may be able to connect the AE to the AEBS wirelessly using the RADIUS server (802.1X, TTLS)?

    I to have the same issue.  Have Airport Extreme connected to RADIUS server and I want to extend that with an airport express so I can use airplay on my stereo in living room.  Somebody help please.

  • WPA2-Enterprise + EAP (PEAP) and 802.1x to authenticate to RADIUS server NPS

    I need to connect my iPhone and my iPad to the corporate wireless network using WPA2-Enterprise and 802.1x to authenticate against a RADIUS server with my corporate user. What is the procedure to configure the clients? Certificates is not necessary on the client. Radius server is a NPS of Microsoft and the WLC is a 5508 of Cisco.
    thanks !!!

    WPA and WPA2 are all actually interim protocols that are used until the standardization of IEEE 802.11i standard. Wi-fi appliance decided that ratification and standardization of 802.11i standards will take more time. So, they came up with WPA.
    Now, WPA2 is advanced version of WPA. WPA2 uses AES as encryption algorithm. Whereas, WPA use TKIP as encryption mode which in turn uses RC4 encryption algorithm.
    WPA and WPA2 are actually are of 2 types respectively.
    WPA/WPA2-PSK - This is mainly for small offices. This uses Pre-Shared Key for authentication.
    WPA/WPA2 -Enterprise - This uses a RADIUS Server for authentication. This is an extension to 802.1x authentication. But this uses stronger encryption scheme(WPA uses RC4 and WPA2 uses AES).
    Any authentication mechanism that involves a separation authentication server for authentication like ACS server is called 802.1x authentication.
    EAP stands for Extensible Authentication Protocol. It refers to the type or method of 802.1x Authentication by the RADIUS/Tacacs server. A RADIUS server can authenticate a wireless client with various EAP methods.
    LEAP is one type of EAP. It uses username and password for authenticating wireless clients. LEAP is cisco proprietory.
    There are also EAP types which uses other user credentials like Certificates, SIM etc for authentcation.
    The following document might clarify your doubts.
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00805e8297.shtml

  • 1602i standalone AP cannot ping RADIUS server

    I have a new 1602i standalone AP trying to use RADIUS authentication.  For some reason the 1602 cannot ping the RADIUS server, but will get a response from other devices.  Both are on the same subnet, the new one at .213 and the RADIUS at .209.
    AP6#ping xxx.xx.120.209
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.209, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    AP6#ping xxx.xx.120.217
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.217, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
    The RADUIS server is able to ping the new AP successfully.
    AP1#ping xxx.xx.120.213
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx.120.213, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms
    Any thoughts to why that AP is unable to ping that one particular client?  Other APs are successfully contacting it for RADIUS authentication.

    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname AP6
    logging rate-limit console 9
    enable secret 5 xxxxxxxxxxxx
    aaa new-model
    aaa group server radius rad_eap
     server xxx.xx.120.209 auth-port 1812 acct-port 1813
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone -0500 -5 0
    clock summer-time -0400 recurring
    no ip routing
    no ip cef
    dot11 syslog
    dot11 ssid xxx.xx
       authentication open eap eap_methods
       authentication network-eap eap_methods
       authentication key-management wpa
    crypto pki token default removal timeout 0
    username Cisco privilege 15 password 7 xxxxx
    bridge irb
    interface Dot11Radio0
     no ip address
     no ip route-cache
     encryption mode ciphers tkip
     ssid  MANH
     antenna gain 0
     stbc
     beamform ofdm
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface Dot11Radio1
     no ip address
     no ip route-cache
     shutdown
     antenna gain 0
     dfs band 3 block
     channel dfs
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface GigabitEthernet0
     no ip address
     no ip route-cache
     duplex auto
     speed auto
     bridge-group 1
     bridge-group 1 spanning-disabled
     no bridge-group 1 source-learning
    interface BVI1
     ip address dhcp client-id GigabitEthernet0
     no ip route-cache
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    snmp-server view dot11view ieee802dot11 included
    snmp-server community  RW
    snmp-server chassis-id AP6
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps tty
    snmp-server enable traps entity
    snmp-server enable traps disassociate
    snmp-server enable traps deauthenticate
    snmp-server enable traps authenticate-fail
    snmp-server enable traps dot11-qos
    snmp-server enable traps switch-over
    snmp-server enable traps rogue-ap
    snmp-server enable traps wlan-wep
    snmp-server enable traps config-copy
    snmp-server enable traps config
    snmp-server enable traps syslog
    snmp-server enable traps cpu threshold
    snmp-server enable traps aaa_server
    snmp-server host .0.39 public
    radius-server local
      user user1 nthash 7
    radius-server attribute 32 include-in-access-req format %h
    radius-server host xxx.xx.120.209 auth-port 1812 acct-port 1813 key 7
    radius-server vsa send accounting
    bridge 1 route ip
    line con 0
    line vty 0 4
     transport input all
    sntp server xxx.xx.0.11
    sntp broadcast client
    end

  • Cisco AAA authentication with windows radius server

    Cisco - Windows Radius problems
    I need to created a limited access group through radius that I can have new network analysts log into
    and not be able to commit changes or get into global config.
    Here are my current radius settings
    aaa new-model
    aaa group server radius IAS
     server name something.corp
    aaa authentication login USERS local group IAS
    aaa authorization exec USERS local group IAS
    radius server something.corp
     address ipv4 1.1.1.1 auth-port 1812 acct-port 1813
     key mypassword
    line vty 0 4
     access-class 1 in
     exec-timeout 0 0
     authorization exec USERS
     logging synchronous
     login authentication USERS
     transport input ssh
    When I log in to the switch, the radius server is passing the corrrect attriubute
    ***Jan 21 13:59:51.897: RADIUS:   Cisco AVpair       [1]   18  "shell:priv-lvl=7"
    The switch is accepting it and putting you in the correct priv level.
    ***Radius-Test#sh priv
       Current privilege level is 7
    I am not sure why it logs you in with the prompt for  privileged EXEC mode when
    you are in priv level 7. This shows that even though it looks like your in priv exec
    mode, you are not.
    ***Radius-Test#sh run
                    ^
       % Invalid input detected at '^' marker.
       Radius-Test#
    Now this is where I am very lost.
    I am in priv level 7, but as soon as I use the enable command It moves me up to 15, and that gives me access to
    global config mode.
    ***Radius-Test#enable
       Radius-Test#
    Debug log -
    Jan 21 14:06:28.689: AAA/MEMORY: free_user (0x2B46E268) user='reynni10'
    ruser='NULL' port='tty390' rem_addr='10.100.158.83' authen_type=ASCII service=ENABLE priv=15 vrf= (id=0)
    Now it doesnt matter that I was given priv level 7 by radius because 'enable' put me into priv 15
    ***Radius-Test#sh priv
       Current privilege level is 15
       Radius-Test#
    I have tried to set
    ***privilege exec level 15 enable
    It works and I am no longer able to use 'enable' when I am at prv level 7, but I also cannot get the commands they will need to work.
    Even if I try to do
    ***privilege exec level 7 show running-config (or other variations)
    It will allow you to type sh run without errors, but it doest actually run the command.
    What am I doing wrong?
    I also want to get PKI working with radius.

    I can run a test on my radius system, will report back accordingly, as it's a different server than where I am currently located.
    Troubleshooting, have you deleted the certificate/network profile on the devices and started from scratch?

Maybe you are looking for