User's Manual

5-13
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-11350-01
Chapter 5 Administering the Access PointWireless Device Access
Controlling Access Point Access with RADIUS
Step 3
radius-server host {hostname |
ip-address} [auth-port port-number]
[acct-port port-number] [timeout
seconds] [retransmit retries] [key
string]
Specify the IP address or host name of the remote RADIUS server host.
• (Optional) For auth-port port-number, specify the UDP destination
port for authentication requests.
• (Optional) For acct-port port-number, specify the UDP destination
port for accounting requests.
• (Optional) For timeout seconds, specify the time interval that the
wireless device waits for the RADIUS server to reply before
retransmitting. The range is 1 to 1000. This setting overrides the
radius-server timeout global configuration command setting. If no
timeout is set with the radius-server host command, the setting of
the radius-server timeout command is used.
• (Optional) For retransmit retries, specify the number of times a
RADIUS request is resent to a server if that server is not responding
or responding slowly. The range is 1 to 1000. If no retransmit value
is set with the radius-server host command, the setting of the
radius-server retransmit global configuration command is used.
• (Optional) For key string, specify the authentication and encryption
key used between the wireless device and the RADIUS daemon
running on the RADIUS server.
Note The key is a text string that must match the encryption key used
on the RADIUS server. Always configure the key as the last item
in the radius-server host command. Leading spaces are ignored,
but spaces within and at the end of the key are used. If you use
spaces in your key, do not enclose the key in quotation marks
unless the quotation marks are part of the key.
To configure the wireless device to recognize more than one host entry
associated with a single IP address, enter this command as many times as
necessary, making sure that each UDP port number is different. The
wireless device software searches for hosts in the order in which you
specify them. Set the timeout, retransmit, and encryption key values to use
with the specific RADIUS host.
Step 4
aaa group server radius group-name Define the AAA server-group with a group name.
This command puts the wireless device in a server group configuration
mode.
Step 5
server ip-address Associate a particular RADIUS server with the defined server group.
Repeat this step for each RADIUS server in the AAA server group.
Each server in the group must be previously defined in Step 2.
Step 6
end Return to privileged EXEC mode.
Step 7
show running-config Verify your entries.
Step 8
copy running-config startup-config (Optional) Save your entries in the configuration file.
Step 9
Enable RADIUS login authentication. See the “Configuring RADIUS
Login Authentication” section on page 13-7.
Command Purpose