Hi,
I am actually trying to get MAC-Authentication throught our ACS 3.2 Radius server.My first question is that As I have read any excellent conversation on Cisco forum regarding MAC-Authentication. I have set up everythig on ACS, from user set up, then added the MAC addresses without dotts, like {00095ba3230c}.
in all the required field.
1. Do I need to seup the MAC address list in the AP1200 which is running IOS 12.3(2)JA. In instructions, it says that once you put the mac in the ACS, it will pass to AP1200 automatically, when client device assoiciate to AP. But is does not happenend here, If I setup MAC-filter list, then it work fine, If I don't then client does not get the ip address form DHCP server.
encryption is open with mac and EAP,
I will be happy if some one could help me.
Here is the config from AP1200 below:
aaa new-model
aaa group server radius rad_eap
server 193.x.x.165 auth-port 1645 acct-port 1646
aaa group server radius rad_mac
server 193.x.x.165 auth-port 1645 acct-port 1646
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa group server radius rad_eap2
server 193.x.x.165 auth-port 1645 acct-port 1646
aaa group server radius rad_eap1
server 193.x.x.165 auth-port 1645 acct-port 1646
aaa group server radius rad_mac2
server 193.x.x.165 auth-port 1645 acct-port 1646
aaa authentication login default local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods group rad_mac
aaa authentication login eap_methods2 group rad_eap2
aaa authentication login eap_methods1 group rad_eap1
aaa authentication login mac_methods2 group rad_mac2
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 association mac-list 701
dot11 activity-timeout unknown default 300
dot11 aaa csid unformatted
dot11 network-map
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 1 key 1 size 128bit 7 xxxxx transmit-key
encryption vlan 1 mode ciphers wep128
!
encryption vlan 161 key 2 size 128bit 7 xxxx transmit-key
encryption vlan 161 mode ciphers tkip wep128
!
encryption vlan 168 key 2 size 128bit 7 xxx transmit-key
encryption vlan 168 mode ciphers tkip wep128
!
broadcast-key vlan 1 change 300
!
broadcast-key vlan 161 change 300
!
broadcast-key vlan 168 change 300
!
!
ssid trusted
vlan 161
authentication open eap eap_methods1
!
ssid untrusted
vlan 168
authentication open mac-address mac_methods2 eap eap_methods2
!
speed basic-1.0 basic-2.0 basic-5.5 basic-11.0
rts threshold 2312
power local 50
station-role root fallback shutdown
l2-filter bridge-group-acl
!
ip radius source-interface BVI1
no logging trap
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
access-list 701 permit 000c.41af.9511 0000.0000.0000
access-list 701 permit 0009.5ba3.230c 0000.0000.0000
access-list 701 deny 0000.0000.0000 ffff.ffff.ffff
I alos do not see any good notes on How to set up, MAC_Authentication through ACS 3.2.
regards
Khaleefa
