Aironet 1100 and Window Radius

[sbantz]

I have seven Aironet 1100's in a large building. I want to control access by device MAC address for 35 devices for security purposes. I don't want to have to enter all 35 mac addresses on each of the devices. In reading the documentation, it appears that you can use RADIUS to control access this way. However, it is not clear what I would have to do to configure this. Can I use the Windows 2000 server RADIUS service to handle this for me? I would be most grateful for any instructions on how to use Windows 2000 RADIUS services with the Aironet 1100 devices.

Thanks in advance.

p.s. If there is a better way to do this, please let me know.

[dixho]

I have never tried to use an IAS (Windows 2000 server Radius service) for this. It should be the same though. Create the username and password as the MAC address of the wireless client (in the format of xxxxxxxxxxxx). You configure a radius server in "Server Manager" under "SECURITY". Then, configure Priority for MAC Authentication. Finally, click on "Advanced Security" under "SECURITY" and select the appropriate option for MAC authentication.

[sbantz]

Thanks for the tips. I did get Windows Radius set up correctly and it is talking to the Aironet 1100. The only problem I am running into now is that Windows is not accepting the password that is being sent to RADIUS for the requesting client. I created accounts with a username matching the mac address of the wireless device in a format of xxxxxxxxxxxx and a password exactly the same. When I watch the radius request come in, the username is being accepted as \DOMAINNAME\xxxxxxxxxxxx, which I expected. However, the request is being rejected by RADIUS because of a bad password. I have tried a blank password, one with dashes as delimiters, and one with periods as delimiters. Nothing seems to work. Is the password sent from the Aironet supposed to be the MAC address?

[dixho]

Do you have an extra AP handy? If you do, please configure the extra AP as radius server.

http://www.cisco.com/en/US/partner/products/hw/wireless/ps4570/products_configuration_example09186a00801c0912.shtml

You can see that we do send both username and password as xxxxxxxxxxx.

[sbantz]

Yes, I do have an extra AP. Is there another location where I can view that document you hyperlinked? I don't seem to have access to that portion of the website.

Thanks for your advice.

[dixho]

attach the document in pdf format.