WRV210 and Radius

I'm trying to configure a Cisco Small Business Router - WRV210 for WPA2-Enterprise wireless security. I'm currently having trouble getting Radius Authentication to work.
Our Radius Server (10.1.0.1) is in our corporate DataCenter. I've successfully configured an IPSec VPN Tunnel to connect the WRV210 to our VPN hub in the DataCenter. Successfull communication from the WRV210 across the VPN to all subnets behind the VPN has been established and tested. The VPN Works. However I can't see any attempts to communicate with our Radius Server when a client connects via WiFi to the router. The Radius Server is a Microsoft Windows 2008 R2 server. Does teh WRV210 require the Radius to be on it's local lan? If that's the case - this is a sucky product like the rest of the Linksys lineup (i've had bad experiences trying to get multiple SSIDs and Radius to work for a Authenticated/Guest access with other Linksys products). Any ideas?

For WRV210, there is a known issue with configuring a Radius Server on a remote subnet over an IPsec tunnel.
A workaround is to configure a special tunnel from WRV210 to the remote subnet with the following settings on WRV210.
Local Security Group
Type: IP Address
IP Address: [WAN IP of WRV210]
Mask: 255.255.255.255

Similar Messages

WPA2 Enterprise and RADIUS

I configured my Aironet 1262N autonomous AP to authenticate and account my users against a FreeRADIUS server. In the RADIUS server database, I saw some records like:
select username, acctauthentic, acctterminatecause, acctstarttime, acctstoptime from radacct where username='xxxxxx';| xxxxxx | RADIUS        | Lost-Carrier       | 2014-02-22 09:15:32 | 2014-02-22 11:15:58 || xxxxxx | RADIUS        | Lost-Carrier       | 2014-02-22 09:15:58 | 2014-02-22 12:16:36 || xxxxxx | Local         | Lost-Carrier       | 2014-02-22 09:16:37 | 2014-02-22 09:22:13 || xxxxxx | Local         | Lost-Carrier       | 2014-02-22 09:22:14 | 2014-02-22 09:27:34 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:27:35 | 2014-02-22 09:33:12 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:33:14 | 2014-02-22 09:38:34 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:38:35 | 2014-02-22 09:43:55 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:43:57 | 2014-02-22 09:49:17 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:49:18 | 2014-02-22 09:54:52 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 09:54:54 | 2014-02-22 10:00:14 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 10:00:14 | 2014-02-22 10:00:26 || xxxxxx   | RADIUS        | Lost-Carrier       | 2014-02-22 10:00:26 | 2014-02-22 10:06:17 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 10:06:19 | 2014-02-22 10:11:39 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 10:11:41 | 2014-02-22 10:17:52 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 14:50:41 | 2014-02-22 14:50:42 || xxxxxx   | RADIUS        | Lost-Carrier       | 2014-02-22 14:50:42 | 2014-02-22 15:01:25 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:01:26 | 2014-02-22 15:06:46 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:06:48 | 2014-02-22 15:12:08 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:12:09 | 2014-02-22 15:20:24 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:20:25 | 2014-02-22 15:28:33 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:28:35 | 2014-02-22 15:33:54 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:33:55 | 2014-02-22 15:39:15 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:39:17 | 2014-02-22 15:44:37 || xxxxxx   | Local         | Lost-Carrier       | 2014-02-22 15:44:38 | 2014-02-22 15:49:59 || xxxxxx   | Local         |                    | 2014-02-22 15:49:59 | NULL                |
As you can see, the Acct-Authentic fields contains two possible values: Local and RADIUS. I didn't create any user with name 'xxxxxx' on AP, and I configure the authentication is against the RADIUS server. Why there are so many Acct-Authentic = 'Local'?
Also, this user always lost his connection and then reconnected quickly. This user login his account in multiple devices, including smart phone and computers. All of them are experiencing the same issue. Is there anyway to debug it? Any protential reasons?
Regards,
Lingfeng Xiong

Hi,
I have exactly the same problem with my freeradius and switchs when swiths are in IOS 15.x .
You can see the log accounting :
|      5971 | 0000007E      | bde8f71b768f2785 |          |           |       | 10.254.1.253 | 50001     | Ethernet    | 2014-04-03 23:23:04 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5972 | 0000007F      | 27c15b7db52213d9 |          |           |       | 10.254.1.253 | 50001     | Ethernet    | 2014-04-03 23:23:04 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5973 | 00000080      | 8fb0d5fe41e82d65 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:23:18 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5974 | 00000081      | fa753225306a1a30 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:23:35 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5975 | 00000082      | 39b6dfcf6aa90e30 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:25:57 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5976 | 00000083      | d7766e99f09aee2f |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-03 23:26:33 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5977 | 00000084      | 7094f61110fe4eef |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:29:22 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5978 | 00000085      | 66ded1d410f07c51 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:30:00 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5979 | 00000086      | 326144c4321e0286 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:30:32 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5980 | 00000087      | 01d1379a4f9c3365 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:32:57 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5981 | 00000088      | 91164743f562dfdb |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:34:59 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5982 | 00000089      | abf1519e403f8305 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-03 23:36:21 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5984 | 0000008B      | 2e199e473e646ba4 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 00:21:01 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5986 | 0000008C      | cb4c2e11189d484c |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 00:28:10 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5987 | 0000008D      | 1e928dc7eabc1e6d |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 00:28:11 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5988 | 0000008E      | f1e3754a954e6863 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 00:28:15 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5989 | 0000008F      | e46d377efc8a47f8 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 01:00:02 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5990 | 00000090      | e098f1dc19bdeee2 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 01:01:02 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5991 | 00000091      | 6ae3acb7d57c9c5a |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 01:56:25 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5992 | 00000092      | abc974156cf20e23 |          |           |       | 10.254.1.253 | 50021     | Ethernet    | 2014-04-04 03:10:56 | NULL                |            1943 | Local         |                   |                  |               0 |           204825 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5993 | 00000093      | be822673509843a6 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 03:51:41 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5994 | 00000094      | 0a4366a6cd9eb0c5 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 07:53:42 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5996 | 00000095      | 5d289b8db37d0c8d |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-04 08:58:22 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      5997 | 00000096      | c4ea1e813085a6d7 |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-04 08:58:22 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      6002 | 0000009A      | a82ac41b1ff5f16b |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-04 09:03:12 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      6004 | 0000009B      | 0719718c780250c2 |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-04 09:53:30 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      6005 | 0000009C      | c58f9c5e30b60fb7 |          |           |       | 10.254.1.253 | 50016     | Ethernet    | 2014-04-04 09:56:54 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      6007 | 0000009D      | f78cc71528fd7898 |          |           |       | 10.254.1.253 | 50024     | Ethernet    | 2014-04-04 09:56:54 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
|      6008 | 0000009E      | 200a1608264cc03c |          |           |       | 10.254.1.253 | 50019     | Ethernet    | 2014-04-04 10:01:14 | 2014-04-04 10:30:24 |            1750 | Local         |                   |                  |          114654 |            93145 |                 |                  | Lost-Carrier       | Framed-User |                |                 |              0 |             0 |                      |
|      6009 | 0000009F      | c5ec021f0ef399c1 |          |           |       | 10.254.1.253 | 50019     | Ethernet    | 2014-04-04 10:01:44 | 2014-04-04 10:30:24 |            1720 | Local         |                   |                  |          109122 |            86295 |                 |                  | Lost-Carrier       | Framed-User |                |                 |              0 |             0 |                      |
|      6013 | 000000A4      | 042773e07781caba |          |           |       | 10.254.1.253 | 50019     | Ethernet    | 2014-04-04 10:30:26 | 2014-04-04 10:39:51 |             565 | Local         |                   |                  |           36891 |            39077 |                 |                  | Lost-Carrier       | Framed-User |                |                 |              0 |             0 |                      |
|      6015 | 000000A5      | f6b305e3f0d6aa5a |          |           |       | 10.254.1.253 | 50019     | Ethernet    | 2014-04-04 10:30:56 | 2014-04-04 10:39:51 |             535 | Local         |                   |                  |           31698 |            32171 |                 |                  | Lost-Carrier       | Framed-User |                |                 |              0 |             0 |                      |
|      6017 | 000000A6      | ef6cad3df24ccd61 |          |           |       | 10.254.1.253 | 50002     | Ethernet    | 2014-04-04 10:42:20 | NULL                |               0 | Local         |                   |                  |               0 |                0 |                 |                  |                    | Framed-User |                |                 |              0 |             0 |                      |
Someone has an idea ?
Thanks,
Best regards,

Cisco ISE with TACACS+ and RADIUS both?

Hello,
I am initiating wired authentication on an existing network using Cisco ISE. I have been studying the requirements for this. I know I have to turn on RADIUS on the Cisco switches on the network. The switches on the network are already programmed for TACACS+. Does anybody know if they can both operate on the same network at the same time?
Bob

Hello Robert,
I believe NO, they both won't work together as both TACACS and Radius are different technologies.
It's just because that TACACS encrypts the whole message and Radius just the password, so I believe it won't work.
For your reference, I am sharing the link for the difference between TACACS and Radius.
http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml
Moreover, Please review the information as well.
Compare TACACS+ and RADIUS
These sections compare several features of TACACS+ and RADIUS.
UDP and TCP
RADIUS uses UDP while TACACS+ uses TCP. TCP offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best-effort delivery. RADIUS requires additional programmable variables such as re-transmit attempts and time-outs to compensate for best-effort transport, but it lacks the level of built-in support that a
TCP transport offers:
TCP usage provides a separate acknowledgment that a request has been received, within (approximately) a network round-trip time (RTT), regardless of how loaded and slow the backend authentication mechanism (a TCP acknowledgment) might be.
TCP provides immediate indication of a crashed, or not running, server by a reset (RST). You can determine when a server crashes and returns to service if you use long-lived TCP connections. UDP cannot tell the difference between a server that is down, a slow server, and a non-existent server.
Using TCP keepalives, server crashes can be detected out-of-band with actual requests. Connections to multiple servers can be maintained simultaneously, and you only need to send messages to the ones that are known to be up and running.
TCP is more scalable and adapts to growing, as well as congested, networks.
Packet Encryption
RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party.
TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes, it is useful to have the body of the packets unencrypted. However, during normal operation, the body of the packet is fully encrypted for more secure communications.
Authentication and Authorization
RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization.
TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.
During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.
Multiprotocol Support
RADIUS does not support these protocols:
AppleTalk Remote Access (ARA) protocol
NetBIOS Frame Protocol Control protocol
Novell Asynchronous Services Interface (NASI)
X.25 PAD connection
TACACS+ offers multiprotocol support.
Router Management
RADIUS does not allow users to control which commands can be executed on a router and which cannot. Therefore, RADIUS is not as useful for router management or as flexible for terminal services.
TACACS+ provides two methods to control the authorization of router commands on a per-user or per-group basis. The first method is to assign privilege levels to commands and have the router verify with the TACACS+ server whether or not the user is authorized at the specified privilege level. The second method is to explicitly specify in the TACACS+ server, on a per-user or per-group basis, the commands that are allowed.
Interoperability
Due to various interpretations of the RADIUS Request for Comments (RFCs), compliance with the RADIUS RFCs does not guarantee interoperability. Even though several vendors implement RADIUS clients, this does not mean they are interoperable. Cisco implements most RADIUS attributes and consistently adds more. If customers use only the standard RADIUS attributes in their servers, they can interoperate between several vendors as long as these vendors implement the same attributes. However, many vendors implement extensions that are proprietary attributes. If a customer uses one of these vendor-specific extended attributes, interoperability is not possible.
Traffic
Due to the previously cited differences between TACACS+ and RADIUS, the amount of traffic generated between the client and server differs. These examples illustrate the traffic between the client and server for TACACS+ and RADIUS when used for router management with authentication, exec authorization, command authorization (which RADIUS cannot do), exec accounting, and command accounting (which RADIUS cannot do).

How to draw an arc of a circle in flash pro cc,considering center and radius as parameters?

Please help to draw curves in flash pro cc,considering center and radius as parameters...

function drawArcF(sp:Sprite,centerX:int,centerY:int,radius:int,startA:int,endA:int,color:uint):voi d{
    if(startA>endA){
        var tempA:int=startA;
        startA=endA
        endA=tempA;
    var degToRad:Number = Math.PI/180;
    with(sp.graphics){
        lineStyle(0,color);
        moveTo(centerX+radius*Math.cos(degToRad*startA),centerY+radius*Math.sin(degToRad*startA)) ;
        for(var i:int=startA+1;i<=endA;i++){
            lineTo(centerX+radius*Math.cos(degToRad*i),centerY+radius*Math.sin(degToRad*i));

WPA2 and Radius server configuration

On the page: http://cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008054339e.shtml
is described how to setup a WPA2 and Radius server.
If I follow this, the Radius server does not work. In the document they descibe that I need to use 10.0.0.1 as the IP, but my AP has a 192.168.1.251 address. Even if I enter that adres, or the 10.0.0.1, it does not work.
Normal WPA2 personal, without Radius does work.
I use a 1100 series AP, (AIR-AP1120B-E-K9) with a AIR-MP21G and the firmware of the radio module is 5.90.11.
The IOS version is 12.3(8)JA2.
Does anyone know what to do?
Haik

Hello,
I understand that. I have given the AP a fixed address, 192.168.1.251. This is outside the DHCP pool, from the router.
Even if I use this address in th Radius configuration, it still does not work. My client (laptop with Intel Pro Wireless 2200 card), detects that there is a Radius server, and asks for a username / password.
But even if I fill it in correctly (copy / paste) it does not work.
So what can be wrong with this configuration?
Haik

Configure PIX to use both TACACS and RADIUS for VPN

PIX 506E using ver 6.3: Whenever I add the command "crypto map mymap client authentication PARTNERAUTH" it removes the current TACACS+ client authentication. I need to have both until I've finished testing the radius server. Can I add an additional crypto map designation command to accomodate and use both the current TACACS+ (ACS) and RADIUS?

Hi,
Unfortunately what you want to do cannot be done on the pix, let's say that you have
multiple vpn groups on your firewall, as soon as you apply the following command:
crypto map mymap client authentication partnerauth
where parnerauth can a radius, tacacs, tacacs+ or an ACS server:
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host 172.18.124.196 cisco123
As soon as you use "crypto map mymap client authentication partnerauth" the authentication
is applied globally on the crytpmap, thus affecting all the vpn groups configured.
You can have multiple vpn groups running on your firewall (dynamic crypto maps) but you
need to associate them to a static crypto map ( crypto dynamic-map dynmap 10 set
transform-set myset).
You can only have 1 crypto map applied to one interface, when you apply this line:
"crypto map mymap client authentication partnerauth"
The authentication is applied to ALL the clients, we cannot separate the extended
authentication based on the vpn group or ip address.
Please rate if that helps !
Regards,
~JG

Tacacs+ for exec and radius for ppp on the same ras

Hi, I'm going to implement tacacs+ for exec control and RADIUS for ppp control in a ras router, using the same ACS for tacacs+ and radius sessions.
Is there any problem with this kind of configuration ?
thank you in advance
Renato

Renato
I have recently done something very similar at a customer site. On a remote access server we configured it to use TACACS for exec control and to use Radius for ppp. In our case we are using different servers but I do not think that would be an issue. We also are generating aaa accounting records for the ppp sessions and sending the accounting records to the TACACS server. I have not had any particular problems with getting this to work.
HTH
Rick

How can I blur a image with two variables : degree and radius?

how can I blur a image with two variables : degree and radius?
a lot of thanks !

What are the values of these variables supposed to represent?

VPN client and radius or CAR

Hello:
I am trying to setup remote access vpn on IOS router with cisco Radius or CAR.
the vpn client user needs to be authenticated by group id and password, and user id and password.
How should I setup CAR, could someone provides me an example?
I saw this sample, but there is no relationship between user and group.
Any suggestions?
thx
[ //localhost/RADIUS/UserLists/Default/joe-coke ]
Name = joe-coke
Description =
Password = <encrypted>
AllowNullPassword = FALSE
Enabled = TRUE
Group~ =
BaseProfile~ =
AuthenticationScript~ =
AuthorizationScript~ =
UserDefined1 =
[ //localhost/RADIUS/UserLists/Default/group1 ]
Name = group1
Description =
Password = <encrypted> (would be "cisco")
AllowNullPassword = FALSE
Enabled = TRUE
Group~ =
BaseProfile~ = group1profile
AuthenticationScript~ =
AuthorizationScript~ =
UserDefined1 =
Define the group attributes such as pre-shared key, IP address pool name, etc. using Cisco
AV-pairs:
[ //localhost/RADIUS/Profiles/group1profile/Attributes ]
cisco-avpair = ipsec:key-exchange=ike
cisco-avpair = ipsec:tunnel-password=cisco123
cisco-avpair = ipsec:addr-pool=pool1
Service-Type = Outbound

you can define the group locally on the router to define the values which the client will use to build the tunnel (pre-shared key, etc). The client's username/pw can then be defined within AAA server to allow access to the network once the tunnel has been established.
The link below should show how to setup the group config in IOS and you should change the AAA method to point to radius instead of local to authenticate the client at your AAA server.
http://www.cisco.com/en/US/partner/products/sw/secursw/ps2308/products_configuration_example09186a00801c4246.shtml

VPN 3000 and Radius authentication/authorization

hello.
I have to configure RADIUS authentication
with a VPN 3000 concentrator.
I'm completely new with this product
(the concentrator).
It seems that, if I want to perform authentication
of username and password with Radius, then I also have to download the entire VPN configuration from the same Radius, using the attibute set loaded with the appropriate dictionary.
am I rigth with this supposition?
I mean: should be possible to authenticate only an username and password externally on RADIUS, while continuing to mantain the user (or group) VPN configuration locally in the concentrator?
thank you.
Davide

No, downloading the entire VPN configuration from the RADIUS server is not necessary. If you are new to configuring VPN's on concentrators or the Concentrator iself, having a look at the support page will be agood idea. It is accessible at http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:Cisco_VPN_3000_Concentrator

Problem with EAP and RADIUS

Hi *,
I have the following problem with RADIUS and EAP authentication.
Radius server sends an "Access-Accept" packet to my AP, but the station does not authenticate.
I've tried with different encryption configuration and with different authentication methods under "dot11 essid", but nothing changes...
What could it be?
Debug piece and configuration follows:
*Jan 25 14:23:34.795: RADIUS/ENCODE(00000012): acct_session_id: 17*Jan 25 14:23:34.795: RADIUS(00000012): sending*Jan 25 14:23:34.799: RADIUS:   4E 47 56 7A 78 65 4A 4F 55 31 47 40 77 6C 61 6E [NGVzxeJOU1G@wlan]*Jan 25 14:23:34.799: RADIUS:   2E 6D 6E 63 30 30 31 2E 6D 63 63 30 30 31 2E 33 [.mnc001.mcc001.3]*Jan 25 14:23:34.799: RADIUS:   67 70 70 6E 65 74 77 6F 72 6B 2E 6F 72 67        [gppnetwork.org]*Jan 25 14:23:34.799: RADIUS: NAS-Port-Type       [61] 6   802.11 wireless           [19]*Jan 25 14:23:34.799: RADIUS: NAS-Port            [5]   6   265                       *Jan 25 14:23:34.799: RADIUS: NAS-Port-Id         [87] 5   "265"*Jan 25 14:23:34.799: RADIUS: NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:34.811: RADIUS/DECODE: EAP-Message fragments, 20, total 20 bytes*Jan 25 14:23:34.831: RADIUS/ENCODE(00000012):Orig. component type = DOT11*Jan 25 14:23:34.831: RADIUS: AAA Unsupported Attr: ssid              [265] 8   *Jan 25 14:23:34.831: RADIUS:   57 69 66 69 45 41                                [WifiEA]*Jan 25 14:23:34.831: RADIUS: AAA Unsupported Attr: interface         [157] 3   *Jan 25 14:23:34.831: RADIUS:   32                                               [2]*Jan 25 14:23:34.831: RADIUS(00000012): Config NAS IP: 192.168.173.2*Jan 25 14:23:34.831: RADIUS/ENCODE(00000012): acct_session_id: 17*Jan 25 14:23:34.835: RADIUS(00000012): sending*Jan 25 14:23:34.835: RADIUS:   10 01 00 01 07 05 00 00 D9 37 C3 D9 79 3E 33 EA [?????????7??y>3?]*Jan 25 14:23:34.835: RADIUS:   F3 7D 73 43 BF BA D0 6A                          [?}sC???j]*Jan 25 14:23:34.835: RADIUS: NAS-Port-Type       [61] 6   802.11 wireless           [19]*Jan 25 14:23:34.835: RADIUS: NAS-Port            [5]   6   265                       *Jan 25 14:23:34.835: RADIUS: NAS-Port-Id         [87] 5   "265"*Jan 25 14:23:34.835: RADIUS: NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:35.035: RADIUS: Received from id 1645/64 192.168.177.158:1812, Access-Challenge, len 304*Jan 25 14:23:35.039: RADIUS:   46 10 78 5F 5F B0 CB 6C 0B 05 00 00 DA C3 BF 28 [F?x__??l???????(]*Jan 25 14:23:35.039: RADIUS:   E0 18 2B 95 97 C2 0A D7 40 53 FE 62              [??+?????@S?b]*Jan 25 14:23:35.039: RADIUS(00000012): Received from id 1645/64*Jan 25 14:23:35.039: RADIUS/DECODE: EAP-Message fragments, 60+220, total 280 bytes*Jan 25 14:23:35.355: RADIUS/ENCODE(00000012):Orig. component type = DOT11*Jan 25 14:23:35.355: RADIUS: AAA Unsupported Attr: ssid              [265] 8   *Jan 25 14:23:35.355: RADIUS:   57 69 66 69 45 41                                [WifiEA]*Jan 25 14:23:35.355: RADIUS: AAA Unsupported Attr: interface         [157] 3   *Jan 25 14:23:35.359: RADIUS:   92 DA 5E 26 CF 40 01 22 7A 8E F5 C1              [??^&?@?"z???]*Jan 25 14:23:35.359: RADIUS: NAS-Port-Type       [61] 6   802.11 wireless           [19]*Jan 25 14:23:35.359: RADIUS: NAS-Port            [5]   6   265                       *Jan 25 14:23:35.359: RADIUS: NAS-Port-Id         [87] 5   "265"*Jan 25 14:23:35.359: RADIUS: NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:35.367: RADIUS: Received from id 1645/65 192.168.177.158:1812, Access-Accept, len 30*Jan 25 14:23:35.367: RADIUS: authenticator 8C 2C 1B 97 82 BB 6C 7F - AA D3 4A AB CA 22 8B B7*Jan 25 14:23:35.367: RADIUS: EAP-Message         [79] 10 *Jan 25 14:23:35.367: RADIUS:   03 01 00 04 00 00 00 00                          [????????]*Jan 25 14:23:35.371: RADIUS(00000012): Received from id 1645/65*Jan 25 14:23:35.371: RADIUS/DECODE: EAP-Message fragments, 8, total 8 bytes*Jan 25 14:23:35.671: %DOT11-7-AUTH_FAILED: Station d023.dbb8.d6a9 Authentication failed
Config:
aaa new-model!aaa group server radius rad_eap server-private 192.168.177.158 auth-port 1812 acct-port 1813 key 7 044803071D2448!aaa authentication login eap_methods group rad_eapaaa authorization exec default if-authenticated aaa authorization network default if-authenticated !         aaa session-id commonip name-server 192.168.177.45!                dot11 ssid WifiEAP1   vlan 10   authentication open eap eap_methods    authentication shared eap eap_methods   authentication key-management wpa optional   guest-mode!         bridge irb!         interface Dot11Radio0 no ip address no ip route-cache !        encryption vlan 10 mode ciphers aes-ccm tkip wep128 !        broadcast-key vlan 10 change 300 !        ssid WifiEAP1 !        antenna gain 0 station-role root!         interface Dot11Radio0.10 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled!         interface GigabitEthernet0 ip address 192.168.173.3 255.255.255.0 no ip route-cache!         interface GigabitEthernet0.1 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled!         interface BVI1 ip address 192.168.173.2 255.255.255.0 no ip route-cache!ip radius source-interface BVI1 bridge 1 route ip
thanks so much!

Stefano: not sure if related but there is an unsupported attribute in the debugs:
Jan 25 14:23:35.355: RADIUS: AAA Unsupported Attr:
*Jan 25 14:23:35.355: RADIUS:   57 69 66 69 45 41
*Jan 25 14:23:35.355: RADIUS: AAA Unsupported Attr: interface
Try to eliminate any configured attributes on radius except those in IETF radius. Then try again.
You may also chech by removing the shared eap as suggested above. Let us know if this works.
Sent from Cisco Technical Support iPad App

Exchange Server 2013 and RADIUS server(freeRADIUS2)

I am a student and doing an internship. I have to test Microsoft Exchange Server 2013.
I am using Windows Server 2012, I already installed Exchange
Server 2013 on it and everything works as intended.
But I couldn't find out how to configure my Windows Server 2012 in order to authenticate my mailbox users from Exchange Server 2013 with a RADIUS
server which is not on my Windows Server 2012. I have to use their RADIUS server ( freeRADIUS2 ), the RADIUS server from
the company where I am doing my internship.
I already did the checklist that is on http://technet.microsoft.com/en-us/library/cc772591.aspx. I configured the NPS as
a RADIUS proxy, because that's what I need.
So after doing everything that is on that checklist, my question is:
Is it possible that the Exchange Server 2013 will use my NPS which is now configured as a NPS RADIUS proxy to authenticate my mailbox users that I have on my Exchange Server 2013?

thanks for such a quick response.
Just a small question about the link that you put. Does member server mean other server other than domain controller?
Regards,
Yes, Also the server on which you are installing Exchange should have exchange installed.
Cheers,
Gulab Prasad
Technology Consultant
Blog:
http://www.exchangeranger.com    Twitter:
  LinkedIn:
   Check out CodeTwo’s tools for Exchange admins
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

BBSM and RADIUS Authenticated Session Limits

I have setup a BBSM System with RADIUS authentication, the authentication traffic is passed to a seperate RSA Box to authenticate user using fobs and everything works fine.
My question is how do I limited the time a user can have a onnection to the BBSM without having to re-authentication

If you are using the 'Access Code' pageset, when the 'Stop Date and Time' of the Access
Code is reached, all currently connected users who have used that Access Code, are
disconnected.
When you define an Access Code, you define a 'Start Date and Time' and a 'Stop Date and
Time' for the Access Code. All users who have Connected by using that Access Code will be disconnected when that Date/Time is reached.
Please refer to
http://www.cisco.com/en/US/products/sw/netmgtsw/ps533/products_user_guide_ch
apter09186a0080192294.html#1038530
for more information on Access Codes.
HTH,
-Joe

WLC and Radius issue

We keep get the following error. And everytime we got this, the clients have been force to re-authentication.
Any idea?
Thanks,
RADIUS server 10.108.32.33:1812 activated on WLAN 1
RADIUS server 10.140.4.9:1812 deactivated on WLAN 1

Go to clients. Look up the client by mac address and look at the PEM state. It will tell you why the client is failing ..
DHCP_REQ is meaning there is a DHCP issue
8021x_REQ means it failed auth
You could also turn off exclude as a test, perhaps these clients are a little slow to auth.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Wlc and radius authenticationn

We have deployed Cisco Airspace AP with Wireless LAN Controllers (4400).
Currently we have the WLC authenticating using radius to ACS version 4.01 servers.
Unfortunately when the primary ACS get rebooted all the athentication requests go to the secondary server which in affect is fine but when the primary comes back up the authenticatons continue to go to the secondary server.
Is there no round-robin feature to enable on the WLC so that it detects that the primary is back up and continue to authenticate to that server ?

I have not seen a way yet except by using a CSS to front-end the ACS servers (mainly done for lad-balancing purposes actually). I am also curious if there is an option as I have been through most web pages many times. Maybe it's buried in the command line.
-Eric
Please remember to rate all helpful posts.

WRV210 and Radius

Similar Messages

Maybe you are looking for