Installation Guide

Task 15: Configuring a RADIUS server PMP 450i and PTP 450i Configuration and User
Guide
Configuring your RADIUS servers for SM authentication
Your RADIUS server must be configured to use the following:
• EAPTTLS or MSCHAPv2 as the Phase 1/Outer Identity
protocol.
• If Enable Realm is selected on the SM’s Configuration => Security tab, then the
same
Realm appears there (or access to it).
• The same Phase 2 (Inner Identity) protocol as configured on the SM’s Configuration
> Security tab under Phase 2 options.
• The username and password for each SM configured on each SM’s
Configuration
=> Security
tab.
• An IP address and NAS shared secret that is the same as the IP address and Shared
Secret configured on the AP’s Configuration => Security tab for
that RADIUS
server.
• A server private certificate, server key, and CA certificate that complement the public
certificates distributed to the SMs, as well as the Canopy dictionary file
that defines
Vendor Specific Attributes (VSAa). Default certificate files and
the dictionary file are
available from the software
site: https://support.cambiumnetworks.com/files/PMP450i
after entering your name, email address, and either Customer Contract Number or
the MAC address of
a module covered under the 12 month warranty.
Optionally, operators may configure the RADIUS server response messages (Accept
or Reject) so that the user has information as to why they have been rejected. The
AP displays the RADIUS Authentication Reply message strings in the Session Status
list as part of each SM’s information. The SM will show this string (listed as
Authentication Response on the SM GUI) on the main Status page in the Subscriber
Module Stats section.
Aradial AAA servers only support operator-configurable Authentication Accept
responses, not Authentication Reject responses.
pmp-0957 (April 2015) 199