Specifications

ManualsBrandsEnterasys ManualsComputer equipmentRoamAbout RBT-8100

381

382

383

384

385

386

387

388

389

390

Configuring AAA for Users of Third-Party APs

17-38 Configuring AAA for Network Users

Requirements

Third-Party AP Requirements

•Thethird‐partyAPmustbeconnectedtotheRoamAboutSwitchthroughawiredLayer2

link.MSScannotprovidedataservicesiftheAPandR oamAboutSwitchareindifferentLayer

3subnets.

•TheAPmustbeconfiguredastheRoamAboutSwitch’sRADIUSclient.

•TheAPmustbeconfiguredsothat

alltrafficforagivenSSIDismappedtothesame802.1Q

taggedVLAN.IftheAPhasmultipleSSIDs,eachSSIDmustuseadifferenttagvalue.

•TheAPmustbeconfiguredtosendthefollowinginformationinaRADIUSaccess‐request,for

eachuserwhowantstoconnectto

theWLANthroughtheRoamAboutSwitch:

–SSIDrequestedbytheuser.TheSSIDcanbeattachedtotheendofthecalled‐station‐id

(perCongdon),orcanbeinaVSA(forexample,cisco‐vsa:ssid=r12‐cisco‐1).

–Calling‐station‐idthatincludesthe user’sMACaddress.TheMACaddresscan

beinany

ofthefollowingformats:

‐ Separatedbycolons(forexample,AA:BB:CC:DD:EE:FF)

‐ Separatedbydashes(forexample,AA‐BB‐CC‐DD‐EE‐FF)

‐ Separatedbydots(forexample,AABB.CCDD.EEFF)

– Username

•TheAPmustbeconfiguredtosendaRADIUSstop‐accountingrecordwhenauser’ssession

ends.

RoamAbout Switch Requirements

•TheRoamAboutSwitchportconnectedtothethird‐partyAPmustbeconfiguredasawired

authenticationport.IfSSIDtrafficfromtheAPistagged,thesameVLANtagvaluemustbe

usedonthewiredauthenticationport.

•AMACauthenticationrulemustbeconfiguredtoauthenticatetheAP.

•TheRoamAbout

SwitchmustbeconfiguredasaRADIUSproxyfortheAP.TheRoamAbout

SwitchisaRADIUSservertotheAPbutremainsaRADIUSclienttotherealRADIUSservers.

•AnauthenticationproxyrulemustbeconfiguredfortheAP’susers.Therulematchesbased

onSSIDandusername,and

selectstheauthenticationmethod(aRADIUSservergroup)for

proxying.

Note: The RoamAbout Switch system IP address must be the same as the IP address configured on

the VLAN that contains the proxy port.