11-17
Cisco Aironet 1400 Series Wireless Bridges Software Configuration Guide
OL-4059-01
Chapter 11 Configuring RADIUS and Servers
Configuring and Enabling
Operation
When an administrator attempts a simple ASCII login by authenticating to a bridge using ,
this process occurs:
1.
When the connection is established, the bridge contacts the daemon to obtain a username
prompt, which is then displayed to the administrator. The administrator enters a username, and the
bridge then contacts the daemon to obtain a password prompt. The bridge displays the
password prompt to the administrator, the administrator enters a password, and the password is then
sent to the daemon.
allows a conversation to be held between the daemon and the administrator until the
daemon receives enough information to authenticate the administrator. The daemon prompts for a
username and password combination, but can include other items, such as the user’s mother’s
maiden name.
2.
The bridge eventually receives one of these responses from the daemon:
–
ACCEPT—The administrator is authenticated and service can begin. If the bridge is configured
to require authorization, authorization begins at this time.
–
REJECT—The administrator is not authenticated. The administrator can be denied access or is
prompted to retry the login sequence, depending on the daemon.
–
ERROR—An error occurred at some time during authentication with the daemon or in the
network connection between the daemon and the bridge. If an ERROR response is received, the
bridge typically tries to use an alternative method for authenticating the administrator.
–
CONTINUE—The administrator is prompted for additional authentication information.
After authentication, the administrator undergoes an additional authorization phase if authorization
has been enabled on the bridge. Administrators must first successfully complete
authentication before proceeding to authorization.
3.
If authorization is required, the daemon is again contacted, and it returns an
ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response
contains data in the form of attributes that direct the EXEC or NETWORK session for that
administrator, determining the services that the administrator can access:
–
Telnet, rlogin, or privileged EXEC services
–
Connection parameters, including the host or client IP address, access list, and administrator
timeouts
Configuring
This section describes how to configure your bridge to support . At a minimum, you must
identify the host or hosts maintaining the daemon and define the method lists for
authentication. You can optionally define method lists for authorization and accounting. A
method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts
on an administrator. You can use method lists to designate one or more security protocols to be used,
thus ensuring a backup system if the initial method fails. The software uses the first method listed to
authenticate, to authorize, or to keep accounts on administrators; if that method does not respond, the
software selects the next method in the list. This process continues until there is successful
communication with a listed method or the method list is exhausted.
