topic Re: Bridge Security (1310G) in Wireless

Bridge Security (1310G)

ciscoprolin — Sat, 03 Jul 2021 21:31:57 GMT

Hi,

we have established a bridge connection between a 1310G Root Bridge and a 1310G Non Root Bridge with the following settings for this bridge SSID: "Open Authentication" with "WPA mandatory and WPA Preshared Key" in Client Authenticated Key Management.

Moreover we have a 2nd SSID with EAP (Radius) for network authentication.

a). can this scenario be viewed as secure ?

b). is it possible to use EAP-Authentication (e.g. Network EAP with LEAP) for the Bridge SSID as well ? If yes, how can we do this ?

We enabled local authentication on the Root Bridge with Bridge and Non Root Bridge as AAA-Clients - and the usernames/passwords defined in it were entered in AP authentication. But this failed.

Thanks,

Thorsten

Re: Bridge Security (1310G)

Gustavo Novais — Fri, 24 Aug 2007 15:48:26 GMT

Hi, coincidently I'm trying to do the same thing, (the authentication part) and with no success.

I found a link on CCO, http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008058f53e.shtml

but it isn't working.

Besides, they specify that we should use network-eap for authentication, but they don't specify any method list for AAA, which is mandatory (at least on the CLI).

If you find out anything, plase reply to this post

Re: Bridge Security (1310G)

Gustavo Novais — Fri, 24 Aug 2007 18:31:00 GMT

Hello, I managed to put a config with LEAP and WPA 2 working on a P2P link, authenticated by a ACS on the Root side.

I'll past the relevant config for the root and non-root.

hostname BR1300-NonRoot

dot11 ssid test

authentication network-eap DUMMY

authentication key-management wpa version 2

authentication client username bridgelink password XXXXXX

infrastructure-ssid

interface Dot11Radio0

encryption mode ciphers aes-ccm

ssid test

station-role non-root bridge

end

======ROOT=======

hostname BR1300-Root

aaa new-model

aaa authentication login EAP-LIST group radius

dot11 ssid test

authentication network-eap EAP-LIST

authentication key-management wpa version 2

infrastructure-ssid

interface Dot11Radio0

encryption mode ciphers aes-ccm

ssid test

station-role root bridge

interface BVI1

ip address XXXXXXXXXX

no ip route-cache

radius-server host ACS-RADIUS IP auth-port 1645 acct-port 1646 key XXXXXXXXXXXXXXXXXXX