topic Re: WDS uses LEAP between AP's, but I want WPA for my clients in Wireless

WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Sun, 04 Jul 2021 17:08:56 GMT

Hello, I have a WLSE which I want to use for enhanced radio management of my network. I don't care about fast roaming. For that I need a WDS enabled AP, which authenticates all others, and itself, through LEAP.

I wish my wireless clients use WPA with LEAP for authentication. On the tests I'm doing, I can only associate clients properly to the AP if using LEAP or Open not with WPA, if WDS is enabled on the AP.

If I disable WDS I can authenticate with success WPA w/ LEAP, and all other EAP types. Why is that?

I think the problem is related with the mecanism used for fast reassociation (CCKM) that tunnels all authentication through the WDS AP, which only understands CCKM. How can I bypass that and still have WPA (on a separate vlan) and WDS?

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dewman03 — Wed, 10 Nov 2004 05:44:19 GMT

HM, you have your encryption set to do tkip only,

and you set wpa to mandatory, can clients authenticate>?

encryption [vlan vlan-id] mode ciphers tkip

authentication key-management wpa

That would force them to use wpa, or no connection at all

Also, what are the client cards? CIsco, or other manufacture? What 3rd party software are you using for LEAP?

What IOS ver your AP running?

12.3(2)JA, is comming out soon.

The release notes were posted today (NOV 9)

Good reading

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Wed, 10 Nov 2004 16:17:23 GMT

hello,

I am forcing clients to use wpa just like the commands you've shown on your reply.

The wireless card I'm using is the proxim 8470-Wd, which is Cisco Compatible. I don't know if it supports CCKM, but it does support LEAP. With WDS, it LEAP authenticates perfectly, but when I configure WPA, using LEAP as auth scheme, with WDS enabled, the AP does not authenticate the client.

Are you suggesting to use authentication key-management WPA cckm, in order to allow both?

Like that I will only LEAP authenticate (if the client supports CCKM )without WPA?

I didn't try it with PEAP, but I think I shouldn't have any problems

Thanks for the 12.3(2)JA tip!

Gustavo

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Thu, 11 Nov 2004 01:05:37 GMT

If you do not configure WDS, can the wireless clients associate with WPA and LEAP?

I would like to know if this problem is related to WDS or not. I am not sure if Proxim 8470-wd is CCX compliant or not. From the following link, I do not find it:

http://www.cisco.com/en/US/partners/pr46/pr147/partners_pgm_partners_0900aecd800a7907.html

You need CCXv2 complaince for LEAP + WPA.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Thu, 11 Nov 2004 10:37:26 GMT

Yes, they can, I tested the situation being associated myself.

I associate with WPA/LEAP and then turn on WDS - The AP deauthenticates me instantly.

Are you saying that with a CB21 card I shouldn't have any problems?

Unfortunatey I don't have any...

Either way, thanks for your help.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Thu, 11 Nov 2004 17:52:07 GMT

The key here is that IAS does not support LEAP.

If you configure LEAP or LEAP+WPA on the CB21AG and the WDS AP points to the IAS server for client authentications, it does not work. When an infrastructure AP receives an authentication request from the CB21AG, the infrastrucre AP relays the request to the WDS AP, which in turn follow the request to the IAS. IAS will send the 802.1x types it support. As IAS does not support LEAP, the CB21AG and IAS cannot agree on a common 802.1x types. Thus, the authentication will fail.

In my last response, I meant that you configure a 802.1x type supported by IAS (e.g. PEAP-MS CHAP v2). You can do it.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Thu, 11 Nov 2004 19:05:59 GMT

Sorry, my mistake, didn't say which kind of server I was using. I'm using Cisco ACS 3.2.3.

No IAS involved.

Either Way, I said that I could authenticate LEAP, with or with out WPA.

The problem is that when I authenticate pure LEAP with WDS everything is fine, but not WPA/LEAP with WDS.

Unfortunately I don't have the CB21AG, to test if the problem is related to CCXv2 extensions.

Thanks for your help

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Thu, 11 Nov 2004 23:43:54 GMT

How do you configure the ADU? You need to choose WPA->LEAP, not 802.1x->LEAP.

Also, you need to configure ciphers->tkip in the AP and make WPA as mandatory in SSID Manager.

If the wireless adapter is CCXv2 compliant, the wireless adapter should able to associate with LEAP+WPA.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Fri, 12 Nov 2004 10:06:55 GMT

Even with WDS enabled on the AP?

I am choosing wpa->leap

and I'm configuring the AP ok.

When I do sh dot11 assoc all-cli on the AP I see that I'm associated using WPA, not having WDS enabled

If it should be able to associate, using WPA+LEAP, being CCXv2, then probably the card I'm using is NOT ccxv2 compliant.

Unfortunately I'm stuck, cause I don't have any card CCXv2 compliant for sure.

But that alerts me for the problem that besides the clients having to support WPA, there's the restriction, (if you are right and the problem is related to CCXv2) of the clients having also CCXv2 compatible cards.

I cannot enforce that restriction, so, I'll try other authentication schemes, (authentication key management) that supposedly work with WDS and WLSE.

Thank you for your help

Gustavo

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Fri, 12 Nov 2004 22:20:04 GMT

I think that wireless clients do not know WDS at all. They know WPA and 802.1x types. I doubt that enable or disable WDS on the AP makes any difference.

My problem is the other around. I do not have any non-ccx v2 compliant clients which allows me to configure WPA and LEAP. Thus, I cannot test it. I do have a Linksys WPC55 which is CCXv1 compliant. However, it does not allow me to configure WPA + LEAP.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

mcnaz-yeo — Sat, 13 Nov 2004 13:43:11 GMT

Hi dixho,

Can CCXv2 compliant abke to work with eap-fast+wpa. Thanks

Regards

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Sat, 13 Nov 2004 20:46:46 GMT

No. EAP-FAST is a requirements of CCXv3. Please go to the following URL on CCX requirements:

http://www.cisco.com/en/US/partners/pr46/pr147/program_additional_information_new_release_features.shtml

Re: WDS uses LEAP between AP's, but I want WPA for my clients

mcnaz-yeo — Sat, 13 Nov 2004 23:23:27 GMT

I dont see any CCX V3,on your URL. I persume is internal info. can you provide me the date when will be available

Regards

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Sat, 13 Nov 2004 23:52:31 GMT

I think that CCXv3 information is available soon. I was told that the CCX information is being updated. Please go back to the link later.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

etmarcof — Sat, 13 Nov 2004 23:54:49 GMT

Hi,

Regarding PEAP-MS-CHAPv2 is supported in V2 or V3?

I only saw PEAP-GTC. in doc.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Sun, 14 Nov 2004 00:01:20 GMT

PEAP MS-CHAP v2 is not Cisco propietary. Most wireless adapters use Microsoft supplicant. Thus, you will never see PEAP MS-CHAP v2 in CCX.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Mon, 15 Nov 2004 11:43:01 GMT

I agree with you regarding the clients, but as I saw, when I have wds enabled on the AP, it forwards the request to the WDS server AP, because of fast roaming feature. Apparently the key management the WDS AP support does not include WPA, so the authentication fail.

Can you confirm this?

Thank you

Re: WDS uses LEAP between AP's, but I want WPA for my clients

dixho — Wed, 17 Nov 2004 02:06:39 GMT

I would like to clarify the different between WDS and fast secured roaming. Enable WDS does not mean fast secured roaming. WDS is a requirement for radio managmenet and fast secured roaming.

If you want fast secured roaming, you need CCKM. CCKM and WPA are mutually exclusive.

I use one AP and an ACS server to replicate the problem. I can associate with LEAP+WPA in WDS environment.

Re: WDS uses LEAP between AP's, but I want WPA for my clients

Gustavo Novais — Wed, 17 Nov 2004 10:12:04 GMT

When I did a debug aaa state machine on the AP, with WDS enabled, I saw the request being redirected to the wlccp. That gave me the impression that the WDS AP would act as a "proxy" for my authentication request. I thought that the problem could be related with the fact that wlccp uses LEAP to authenticate AP's, and the clients should also use LEAP to authenticate. As wlccp doesn't know about wpa, I thought that that was the reason for the authentication failed.

I tried to insert the command point the clients to another method list "wlccp authentication clients XXXXX", but even then, nothing.

As you told me that that could be related with CCX version, I am at the moment unable to test that, only have proxim card, so I rested.

Thank you for your help.