topic Re: How to setup CCKM in Wireless

How to setup CCKM

BJCiscoUser — Sun, 04 Jul 2021 05:54:37 GMT

Hi,

We are rolling out 20+ APs (1042N-E-K9) and one of the VLANs is used for VoIP. We would like to enable CCKM, but are a little unsure of how to go about it after reading through many of all the documentation. We have successfully enabled one AP to serve as a WDS master, and APs shows up as registered. Below are some of our questions

1. On the AP, what should be the settings for the SSID on which we want to enable CCKM?

a. What Encryption Modes are allowed - can we use TKIP or AES-CCMP, or are we obliged to use CKIP-CMIC?

b. For the SSID, can we enable both CCKM and WPA? And is CCKM with WPA2 supported (chipper AES-CCMP)

c. For AP Authentication, what Method should we chose? TSL, FAST, or is any of them allowed?

2. On the client machines (we are testing with a Lenovo laptop, ccx c4, and Intel pro-tools):

a. We understand that we can choose EAP-TSL for the clients and that should be ok, is that correct?

b. Do we need to use EAP-FAST or LEAP? And if that is the case, then it seems that MS NPS server as RADIUS is not supported…

We would very much appreciate any help with the above questions, as mentioned we read through the various documentation, but we are still unclear on the above mentioned points.

Greetings!

Erik-Benjamin Povlsen

How to setup CCKM

Stephen Rodriguez — Wed, 24 Oct 2012 13:49:45 GMT

Erik, welcome to support forums!

1.) For CCKM and CCXv4 you should use WPA/TKIP/CCKM. CCXv5 supports WPA2/AES/CCKM.

2.)TLS or PEAP will work fine. You do not have to do FAST or LEAP. IMHO LEAP needs to go the way of WEP and the dodo.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

How to setup CCKM

BJCiscoUser — Wed, 24 Oct 2012 14:16:20 GMT

Hi Stephen,

Thank you for taking time to answer our questions!

So just to be sure of our setup then, using CCXv4, something like this will be ok?..:

dot11 ssid VOIP
vlan 5
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa cckm
dot1x eap profile TLS
mobility network-id 5

interface Dot11Radio0
no ip address
no ip route-cache

encryption vlan 5 mode ciphers tkip

And then for the client setup just simple EAP-TSL - with certificates...

Thanks again for helping us out!

Erik-Benjamin Povlsen

How to setup CCKM

Stephen Rodriguez — Wed, 24 Oct 2012 14:25:06 GMT

dot1x eap profile TLS

mobility network-id 5

the above is not needed. that dot1x profile is for if you were using the radio as a bridge and wanted to do 802.1x. WDS goes out over the ethernet to find the 'master' and register/join there for key management.

the mobility network-id command is for WLSM.

but other than those two things that should be removed, the rest of the config looks fine. Just make sure you define the subinterfaces on the radio and fastethernet interfaces.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

How to setup CCKM

BJCiscoUser — Wed, 24 Oct 2012 14:33:18 GMT

Thank you very much, this solved our issues.

Very nice support!

Erik-Benjamin Povlsen

Re: How to setup CCKM

BJCiscoUser — Thu, 25 Oct 2012 08:59:06 GMT

Hi again Steve,

Yesterday we tried the new configuration per your suggestions. But the fast roaming (CCKM) is not working.

We are not exactly sure of what we have wrong in our configuration.

I drop in here two configuration examples, one for our WDS master, and one for a client AP - all test configurations. We would appreciate if you would have an idea of what we have wrong here. Thanks in advance!

## AP-WDS MASTER CONFIG ##

version 12.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

hostname AP2

logging rate-limit console 9

enable secret MyEnableSecret

aaa new-model

aaa group server radius rad_eap

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_mac

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_acct

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_admin

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server tacacs+ tac_admin

aaa group server radius rad_pmip

aaa group server radius dummy

aaa group server radius infra_devices

server 10.12.1.109 auth-port 1812 acct-port 1813

aaa group server radius client_devices

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authentication login method_infra_devices group infra_devices

aaa authentication login method_client_devices group client_devices

aaa authorization exec default local

aaa accounting network acct_methods start-stop group rad_acct

aaa session-id common

dot11 syslog

dot11 vlan-name Network1 vlan 7

dot11 vlan-name Network2 vlan 6

dot11 vlan-name Network3 vlan 5

dot11 vlan-name Network4 vlan 4

dot11 vlan-name VoIP vlan 3

dot11 ssid Network1

vlan 7

authentication open

authentication key-management wpa version 2

guest-mode

wpa-psk ascii MyWPAGuestKey

dot11 ssid Network2

vlan 6

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa cckm

dot11 ssid VOIP

vlan 3

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa cckm

dot11 ssid Network4

vlan 4

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa version 2

eap profile TLS

method tls

eap profile FAST

method fast

username Me privilege 15 password 0 MySpecialPassword

policy-map VoIPTraffic

class class-default

set cos 6

bridge irb

interface Dot11Radio0

no ip address

no ip route-cache

encryption vlan 7 mode ciphers aes-ccm

encryption vlan 6 mode ciphers tkip

encryption vlan 5 mode ciphers aes-ccm

encryption vlan 3 mode ciphers tkip

encryption vlan 4 mode ciphers aes-ccm

ssid Network5

ssid Network4

ssid VOIP

ssid Network6

antenna gain 0

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

interface Dot11Radio0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

bridge-group 7 subscriber-loop-control

bridge-group 7 block-unknown-source

no bridge-group 7 source-learning

no bridge-group 7 unicast-flooding

bridge-group 7 spanning-disabled

interface Dot11Radio0.4

encapsulation dot1Q 4

no ip route-cache

bridge-group 4

bridge-group 4 subscriber-loop-control

bridge-group 4 block-unknown-source

no bridge-group 4 source-learning

no bridge-group 4 unicast-flooding

bridge-group 4 spanning-disabled

interface Dot11Radio0.6

encapsulation dot1Q 6

no ip route-cache

bridge-group 6

bridge-group 6 subscriber-loop-control

bridge-group 6 block-unknown-source

no bridge-group 6 source-learning

no bridge-group 6 unicast-flooding

bridge-group 6 spanning-disabled

interface Dot11Radio0.3

encapsulation dot1Q 3

no ip route-cache

bridge-group 3

bridge-group 3 subscriber-loop-control

bridge-group 3 block-unknown-source

no bridge-group 3 source-learning

no bridge-group 3 unicast-flooding

bridge-group 3 spanning-disabled

service-policy input VoIPTraffic

service-policy output VoIPTraffic

interface Dot11Radio0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

bridge-group 7 subscriber-loop-control

bridge-group 7 block-unknown-source

no bridge-group 7 source-learning

no bridge-group 7 unicast-flooding

bridge-group 7 spanning-disabled

interface Dot11Radio1

no ip address

no ip route-cache

shutdown

antenna gain 0

no dfs band block

channel dfs

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

interface GigabitEthernet0

no ip address

no ip route-cache

duplex auto

speed auto

no keepalive

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

interface GigabitEthernet0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

no bridge-group 7 source-learning

bridge-group 7 spanning-disabled

interface GigabitEthernet0.4

encapsulation dot1Q 4

no ip route-cache

bridge-group 4

no bridge-group 4 source-learning

bridge-group 4 spanning-disabled

interface GigabitEthernet0.6

encapsulation dot1Q 6

no ip route-cache

bridge-group 6

no bridge-group 6 source-learning

bridge-group 6 spanning-disabled

interface GigabitEthernet0.3

encapsulation dot1Q 3

no ip route-cache

bridge-group 3

no bridge-group 3 source-learning

bridge-group 3 spanning-disabled

service-policy input VoIPTraffic

service-policy output VoIPTraffic

interface GigabitEthernet0.5

encapsulation dot1Q 5

no ip route-cache

bridge-group 5

no bridge-group 5 source-learning

bridge-group 5 spanning-disabled

interface BVI1

ip address 10.12.1.109 255.255.255.0

no ip route-cache

ip default-gateway 10.12.1.1

ip http server

no ip http secure-server

ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag

ip radius source-interface BVI1

radius-server attribute 32 include-in-access-req format %h

radius-server host 10.12.12.12 auth-port 1645 acct-port 1646 key NPSKey109

radius-server vsa send accounting

bridge 1 route ip

radius-server local

no authentication eapfast

no authentication mac

nas 10.12.1.101 key 0 WDSKey101

nas 10.12.1.102 key 0 WDSKey102

nas 10.12.1.103 key 0 WDSKey103

nas 10.12.1.104 key 0 WDSKey104

nas 10.12.1.105 key 0 WDSKey105

nas 10.12.1.106 key 0 WDSKey106

nas 10.12.1.107 key 0 WDSKey107

nas 10.12.1.108 key 0 WDSKey108

nas 10.12.1.109 key 0 WDSKey109

user wdsuser password wdspassword

radius-server host 10.12.1.109 auth-port 1812 acct-port 1813 key 0 WDSKey109

radius-server attribute 32 include-in-access-req format %h

wlccp wds priority 254 interface BVI1

wlccp ap username wdsclientap password wdspassword

wlccp authentication-server infrastructure method_infra_devices

wlccp authentication-server client eap method_client_devices

wlccp authentication-server client leap method_client_devices

line con 0

line vty 0 4

end

## AP CLIENT CONFIG EXAMPLE ##

version 12.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

hostname AP1

logging rate-limit console 9

enable secret MyEnableSecret

aaa new-model

aaa group server radius rad_eap

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_mac

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_acct

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server radius rad_admin

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa group server tacacs+ tac_admin

aaa group server radius rad_pmip

aaa group server radius dummy

aaa group server radius infra_devices

server 10.12.1.109 auth-port 1812 acct-port 1813

aaa group server radius client_devices

server 10.12.12.12 auth-port 1645 acct-port 1646

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authentication login method_infra_devices group infra_devices

aaa authentication login method_client_devices group client_devices

aaa authorization exec default local

aaa accounting network acct_methods start-stop group rad_acct

aaa session-id common

dot11 syslog

dot11 vlan-name Network1 vlan 7

dot11 vlan-name Network2 vlan 6

dot11 vlan-name Network3 vlan 5

dot11 vlan-name Network4 vlan 4

dot11 vlan-name VoIP vlan 3

dot11 ssid Network1

vlan 7

authentication open

authentication key-management wpa version 2

guest-mode

wpa-psk ascii MyWPAGuestKey

dot11 ssid Network2

vlan 6

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa cckm

dot11 ssid VOIP

vlan 3

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa cckm

dot11 ssid Network4

vlan 4

authentication open eap eap_methods

authentication network-eap eap_methods

authentication key-management wpa version 2

eap profile TLS

method tls

eap profile FAST

method fast

username Me privilege 15 password 0 MySpecialPassword

policy-map VoIPTraffic

class class-default

set cos 6

bridge irb

interface Dot11Radio0

no ip address

no ip route-cache

encryption vlan 7 mode ciphers aes-ccm

encryption vlan 6 mode ciphers tkip

encryption vlan 5 mode ciphers aes-ccm

encryption vlan 3 mode ciphers tkip

encryption vlan 4 mode ciphers aes-ccm

ssid Network5

ssid Network4

ssid VOIP

ssid Network6

antenna gain 0

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

interface Dot11Radio0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

bridge-group 7 subscriber-loop-control

bridge-group 7 block-unknown-source

no bridge-group 7 source-learning

no bridge-group 7 unicast-flooding

bridge-group 7 spanning-disabled

interface Dot11Radio0.4

encapsulation dot1Q 4

no ip route-cache

bridge-group 4

bridge-group 4 subscriber-loop-control

bridge-group 4 block-unknown-source

no bridge-group 4 source-learning

no bridge-group 4 unicast-flooding

bridge-group 4 spanning-disabled

interface Dot11Radio0.6

encapsulation dot1Q 6

no ip route-cache

bridge-group 6

bridge-group 6 subscriber-loop-control

bridge-group 6 block-unknown-source

no bridge-group 6 source-learning

no bridge-group 6 unicast-flooding

bridge-group 6 spanning-disabled

interface Dot11Radio0.3

encapsulation dot1Q 3

no ip route-cache

bridge-group 3

bridge-group 3 subscriber-loop-control

bridge-group 3 block-unknown-source

no bridge-group 3 source-learning

no bridge-group 3 unicast-flooding

bridge-group 3 spanning-disabled

service-policy input VoIPTraffic

service-policy output VoIPTraffic

interface Dot11Radio0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

bridge-group 7 subscriber-loop-control

bridge-group 7 block-unknown-source

no bridge-group 7 source-learning

no bridge-group 7 unicast-flooding

bridge-group 7 spanning-disabled

interface Dot11Radio1

no ip address

no ip route-cache

shutdown

antenna gain 0

no dfs band block

channel dfs

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

interface GigabitEthernet0

no ip address

no ip route-cache

duplex auto

speed auto

no keepalive

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

interface GigabitEthernet0.7

encapsulation dot1Q 7

no ip route-cache

bridge-group 7

no bridge-group 7 source-learning

bridge-group 7 spanning-disabled

interface GigabitEthernet0.4

encapsulation dot1Q 4

no ip route-cache

bridge-group 4

no bridge-group 4 source-learning

bridge-group 4 spanning-disabled

interface GigabitEthernet0.6

encapsulation dot1Q 6

no ip route-cache

bridge-group 6

no bridge-group 6 source-learning

bridge-group 6 spanning-disabled

interface GigabitEthernet0.3

encapsulation dot1Q 3

no ip route-cache

bridge-group 3

no bridge-group 3 source-learning

bridge-group 3 spanning-disabled

service-policy input VoIPTraffic

service-policy output VoIPTraffic

interface GigabitEthernet0.5

encapsulation dot1Q 5

no ip route-cache

bridge-group 5

no bridge-group 5 source-learning

bridge-group 5 spanning-disabled

interface BVI1

ip address 10.12.1.108 255.255.255.0

no ip route-cache

ip default-gateway 10.12.1.1

ip http server

no ip http secure-server

ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag

ip radius source-interface BVI1

radius-server attribute 32 include-in-access-req format %h

radius-server host 10.12.12.12 auth-port 1645 acct-port 1646 key NPSKey108

radius-server vsa send accounting

bridge 1 route ip

radius-server host 10.12.1.109 auth-port 1812 acct-port 1813 key 0 WDSKey108

radius-server attribute 32 include-in-access-req format %h

wlccp ap username wdsuser password wdspassword

line con 0

line vty 0 4

end

Re: How to setup CCKM

Stephen Rodriguez — Thu, 25 Oct 2012 13:42:15 GMT

On which WLAN is the fast roaming not working? If it's the Voice, what model of phone and firmware are you running? FYI 7921/25/26 should be 1.4(3).

if you do a show wds ap on the master, do you see all the AP registered?

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

Re: How to setup CCKM

BJCiscoUser — Thu, 25 Oct 2012 14:12:27 GMT

Hi,

The fast roaming is not working on the VOIP WLAN. We are not testing with a phone, but with a Lenovo laptop (softphone), running CCXv4 and configured with (Intel PROSet) WPA - Enterprise, TKIP, TSL with User certificate.

If we run the cmd: show wlccp wds ap, all AP shows up as registered.
If we run the cmd: whow wlccp wds mn detail, the client (associated to another AP) shows up with the following details:

BSS: c8f9.f9a6.f270, SSID: VOIP
Vlan Assigned by AAA: 3

Ntwrk-ID: -
Key Mgmt: CCKM, Authentication: EAP
Posture Token:
Up-time: 00:33:36, Lifetime: 127

We have this in the WDS master config, is this ok?

radius-server local
no authentication eapfast
no authentication leap
no authentication mac

Thanks for your help.

Re: How to setup CCKM

BJCiscoUser — Thu, 25 Oct 2012 16:08:10 GMT

Hi Steve,

As an update to my own post, I remember having read somewhere that if we implement CCKM, having the AAA server handing out the vlan id is not allowed/supported, so I disabled that option. That seems to have made things better...

Anyway, we are not completely satisfied with our testing. Is there a command we can run to see if CCKM is working? I remember having read about a command showing the CCKM id assigned to the client?? But I do not remember the exact syntax.

Thanks once again for your time.

Re: How to setup CCKM

George Stefanick — Thu, 25 Oct 2012 16:31:57 GMT

Check the ~mn command

Command	Description
show wlccp ap	Use this command on access points participating in CCKM to display the WDS device's MAC address, the WDS device's IP address, the access point's state (authenticating, authenticated, or registered), the IP address of the infrastructure authenticator, and the IP address of the client device (MN) authenticator.
show wlccp wds { ap \|mn } [ detail ] [mac-addrmac-address ]	On the WDS device only, use this command to display cached information about access points and client devices. •ap—Use this option to display access points participating in CCKM. The command displays each access point's MAC address, IP address, state (authenticating, authenticated, or registered), and lifetime (seconds remaining before the access point must reauthenticate). Use the mac-addr option to display information about a specific access point. •mn—Use this option to display cached information about client devices, also called mobile nodes. The command displays each client's MAC address, IP address, the access point to which the client is associated (cur-AP), and state (authenticating, authenticated, or registered). Use the detail option to display the client's lifetime (seconds remaining before the client must reauthenticate), SSID, and VLAN ID. Use the mac-addr option to display information about a specific client device. If you only enter show wlccp wds, the command displays the access point's IP address, MAC address, priority, and interface state (administratively standalone, active, backup, candidate, or WDS-only). If the state is backup, the command also displays the current WDS device's IP address, MAC address, and priority. If the state is WDS-only, the command displays the device's MAC address, IP address, interface state, access point count, and mobile node count.

Command

Description

show wlccp ap

Use this command on access points participating in CCKM to display the WDS device's MAC address, the WDS device's IP address, the access point's state (authenticating, authenticated, or registered), the IP address of the infrastructure authenticator, and the IP address of the client device (MN) authenticator.

show wlccp wds { ap |mn }
[ detail ] [mac-addrmac-address ]

On the WDS device only, use this command to display cached information about access points and client devices.

•ap—Use this option to display access points participating in CCKM. The command displays each access point's MAC address, IP address, state (authenticating, authenticated, or registered), and lifetime (seconds remaining before the access point must reauthenticate). Use the mac-addr option to display information about a specific access point.

•mn—Use this option to display cached information about client devices, also called mobile nodes. The command displays each client's MAC address, IP address, the access point to which the client is associated (cur-AP), and state (authenticating, authenticated, or registered). Use the detail option to display the client's lifetime (seconds remaining before the client must reauthenticate), SSID, and VLAN ID. Use the mac-addr option to display information about a specific client device.

If you only enter show wlccp wds, the command displays the access point's IP address, MAC address, priority, and interface state (administratively standalone, active, backup, candidate, or WDS-only).

If the state is backup, the command also displays the current WDS device's IP address, MAC address, and priority.

If the state is WDS-only, the command displays the device's MAC address, IP address, interface state, access point count, and mobile node count.

Using Debug Messages

In privileged exec mode, use these debug commands to control the display of debug messages for devices interacting with the WDS device:


Command	Description
debug wlccp ap {mn \| wds-discovery \| state}	Use this command to turn on display of debug messages related to client devices (mn), the WDS discovery process, and access point authentication to the WDS device (state).
debug wlccp dump	Use this command to perform a dump of WLCCP packets received and sent in binary format.
debug wlccp packet	Use this command to turn on display of packets to and from the WDS device.
debug wlccp wds [aggregator \| authenticator \|nm \| state \| statistics]	Use this command and its options to turn on display of WDS debug messages. Use the statistics option to turn on display of failure statistics.
debug wlccp wds authenticator {all \| dispatcher \|mac-authen \| process \| rxdata \| state-machine \|txdata}	Use this command and its options to turn on display of WDS debug messages related to authentication.

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Re: How to setup CCKM

Stephen Rodriguez — Thu, 25 Oct 2012 16:33:23 GMT

you should be able to do a show dot11 association < mac address > and see what the keying is. or the show wlccp wds mn detail shows that the client is CCKM

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered