User's Manual

13-7
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-11350-01
Chapter 13 Configuring RADIUS and TACACS+ Servers
Configuring and Enabling RADIUS
To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global
configuration command.
This example shows how to configure one RADIUS server to be used for authentication and another to
be used for accounting:
AP(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1
AP(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2
This example shows how to configure an SSID for RADIUS accounting:
AP(config)# dot11 ssid batman
AP(config-ssid)# accounting accounting-method-list
This example shows how to configure host1 as the RADIUS server and to use the default ports for both
authentication and accounting:
AP(config)# radius-server host host1
Note You also need to configure some settings on the RADIUS server. These settings include the IP address
of the access point and the key string to be shared by both the server and the access point. For more
information, refer to the RADIUS server documentation.
Configuring RADIUS Login Authentication
To configure AAA authentication, you define a named list of authentication methods and then apply that
list to various interfaces. The method list defines the types of authentication to be performed and the
sequence in which they are performed; it must be applied to a specific interface before any of the defined
authentication methods are performed. The only exception is the default method list (which, by
coincidence, is named default). The default method list is automatically applied to all interfaces except
those that have a named method list explicitly defined.
A method list describes the sequence and authentication methods to be queried to authenticate a user.
You can designate one or more security protocols to be used for authentication, thus ensuring a backup
system for authentication in case the initial method fails. The software uses the first method listed to
Step 5
accounting list-name Enable RADIUS accounting for this SSID. For list-name, specify the
accounting method list. Click this URL for more information on method
lists:
http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide
/scfacct.html
Note To enable accounting for an SSID, you must include the
accounting command in the SSID configuration. Click this URL
to browse to a detailed description of the SSID configuration
mode accounting command:
http://www.cisco.com/en/US/docs/ios/wlan/command/reference/
wl_book.html
Step 6
end Return to privileged EXEC mode.
Step 7
show running-config Verify your entries.
Step 8
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose