Using The Cli To Configure Radius - Cisco 2100 Series Configuration Manual

Chapter 5 Configuring Security Solutions
d.
To specify the order of authentication when multiple databases are configured, click Security > Priority
Step 24
Order > Management User. The Priority Order > Management User page appears (see
Figure 5-5
For Authentication Priority, choose either Radius or TACACS+ to specify which server has priority over
Step 25
the other when the controller attempts to authenticate management users. By default, the local database
is always queried first. If the username is not found, the controller switches to the TACACS+ server if
configured for TACACS+ or to the RADIUS server if configured for Radius. The default setting is local
and then Radius.
Click Apply to commit your changes.
Step 26
Click Save Configuration to save your changes.
Step 27

Using the CLI to Configure RADIUS

Using the controller CLI, follow these steps to configure RADIUS.
Note Refer to the
values of the parameters used in the CLI commands.
Step 1 To specify whether the IP address, system MAC address, or AP MAC address of the originator will be
sent to the RADIUS server in the Access-Request message, enter this command:
config radius callStationIdType {ip_address, mac_address, ap_mac_address, ap_macaddr_ssid}
Step 2 Use these commands to configure a RADIUS authentication server:
•
•
OL-17037-01
If you enabled Active fallback mode in
Interval in Sec field. The interval serves as inactive time in passive mode and probe interval in active
mode. The valid range is 180 to 3600 seconds, and the default value is 300 seconds.
Priority Order > Management User Page
"Using the GUI to Configure RADIUS" section on page 5-6
config radius auth add index server_ip_address port# {ascii | hex} shared_secret—Adds a
RADIUS authentication server.
config radius auth keywrap {enable | disable}—Enables AES key wrap, which makes the shared
secret between the controller and the RADIUS server more secure. AES key wrap is designed for
Federal Information Processing Standards (FIPS) customers and requires a key-wrap compliant
RADIUS authentication server.
Step b, enter the probe interval value (in seconds) in the
Cisco Wireless LAN Controller Configuration Guide
Configuring RADIUS
Figure 5-5).
for the valid ranges and default
5-11