EasyManua.ls Logo

Cisco ISR User Manual

Cisco ISR
188 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #80 background imageLoading...
Page #80 background image
5-4
Cisco Wireless ISR and HWIC Access Point Configuration Guide
OL-6415-04
Chapter 5 Configuring Encryption Types
Configure Encryption Types
This example shows how to create a 128-bit WEP key in slot 3 for VLAN 22 and sets the key as the
transmit key:
router# configure terminal
router(config)# interface dot11radio 0
router(config-if)# encryption vlan 22 key 3 size 128 12345678901234567890123456
transmit-key
router(config-ssid)# end
WEP Key Restrictions
Table 5-1 lists WEP key restrictions based on your security configuration.
Step 3
encryption
[vlan vlan-id]
key 1-4
size { 40 | 128 } encryption-key
[ 0 | 7 ]
[transmit-key]
Create a WEP key and set up its properties.
(Optional) Select the VLAN for which you want to create
a key.
Name the key slot in which this WEP key resides. You can
assign up to 4 WEP keys for each VLAN.
Enter the key and set the size of the key, either 40-bit or
128-bit. 40-bit keys contain 10 hexadecimal digits; 128-bit
keys contain 26 hexadecimal digits.
(Optional) Specify whether the key is encrypted (7) or
unencrypted (0).
(Optional) Set this key as the transmit key. The key in slot
1 is the transmit key by default.
Note Using security features such as authenticated key
management can limit WEP key configurations. See the
“WEP Key Restrictions” section on page 5-4 for a list
of features that impact WEP keys.
Step 4
end Return to privileged EXEC mode.
Step 5
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Ta b l e 5-1 WEP Key Restrictions
Security Configuration WEP Key Restriction
WPA authenticated key management Cannot configure a WEP key in key slot 1
LEAP or EAP authentication Cannot configure a WEP key in key slot 4
Cipher suite with 40-bit WEP Cannot configure a 128-bit key
Cipher suite with 128-bit WEP Cannot configure a 40-bit key
Cipher suite with TKIP Cannot configure any WEP keys

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco ISR and is the answer not in the manual?

Cisco ISR Specifications

General IconGeneral
BrandCisco
ModelISR
CategoryWireless Access Point
LanguageEnglish

Summary

Chapter 2 Configuring Radio Settings

Configuring Network or Fallback Role

Explains how to configure the wireless device's radio network role and fallback role when the Ethernet port is disabled or disconnected.

Universal Client Mode

Describes Universal Client Mode, where a radio acts as a wireless client, detailing its features and limitations for specific Cisco routers.

Configuring Universal Client Mode

Provides detailed CLI steps to configure Universal Client Mode by setting the radio interface station-role to non-root on Cisco ISR series routers.

Configuring Radio Data Rates

Explains how to choose data rates for wireless transmission, detailing states like Basic, Enabled, and Disabled for optimizing range or throughput.

Configuring Radio Transmit Power

Guides on configuring transmit power based on radio type and regulatory domain, referencing hardware installation guides for details.

Configuring Radio Channel Settings

Explains how to assign static channel settings for access points for consistent performance, discussing 2.4-GHz and 5-GHz channel usage.

Chapter 3 Configuring Multiple SSIDs

Understanding Multiple SSIDs

Defines SSIDs as unique identifiers for wireless networks and explains how to configure up to 16 SSIDs with different settings per SSID.

Configuring Multiple SSIDs

Contains configuration information for multiple SSIDs, including creating SSIDs globally and using RADIUS to restrict them.

Creating an SSID Globally

Provides CLI steps to create an SSID globally in Cisco IOS Releases 12.4 and later, allowing assignment to specific radio interfaces.

Using a RADIUS Server to Restrict SSIDs

Explains how to prevent unauthorized SSID use by creating an authorized SSID list on a RADIUS server for client authentication.

Configuring Multiple Basic SSIDs

Explains support for multiple basic SSIDs (BSSIDs) for 802.11a/g radios, allowing unique DTIM settings and broadcasting multiple SSIDs.

Chapter 4 Configuring an Access Point as a Local Authenticator

Understand Local Authentication

Explains local authentication for wireless LANs without RADIUS servers or as a backup, allowing up to 50 client authentications per second.

Configure a Local Authenticator

Provides instructions for setting up an access point as a local authenticator, covering guidelines, overview, and configuration steps.

Configuring the Local Authenticator Access Point

Details the initial CLI steps to configure an access point as a local authenticator, starting with enabling AAA and then configuring RADIUS server settings.

Configuring Other Access Points to Use the Local Authenticator

Explains how to add the local authenticator to the server list on other access points, emphasizing the order of server entries and RADIUS port requirements.

Configuring EAP-FAST Settings

Discusses customizing EAP-FAST settings like credential timeout, authority ID, and server keys to match network requirements.

Chapter 5 Configuring Encryption Types

Understand Encryption Types

Describes how encryption types like WEP, AES-CCMP, and TKIP protect wireless LAN traffic and recommends full encryption.

Configure Encryption Types

Covers configuring encryption types such as WEP, AES-CCM, TKIP, and broadcast key rotation for wireless LAN security.

Creating Cipher Suites

Guides on creating cipher suites, which are sets of encryption and integrity algorithms, to enable WPA and protect radio communication.

Chapter 6 Configuring Authentication Types

Understand Authentication Types

Describes authentication types configurable on access points, tied to SSIDs, and mentions Open, Shared Key, MAC Address, and EAP authentication.

Configure Authentication Types

Details how to configure authentication types and attach them to SSIDs, including assigning types to an SSID and configuring holdoffs.

Assigning Authentication Types to an SSID

Provides steps to configure authentication types for SSIDs, including open, shared key, MAC address, EAP, and WPA key management.

EAP Authentication to Network

Details EAP Authentication as the highest security level, using RADIUS to perform mutual authentication and derive dynamic WEP keys.

Using WPA Key Management

Explains Wi-Fi Protected Access (WPA) for data protection and 802.1X for key management, detailing WPA and WPA-PSK types.

Matching Access Point and Client Device Authentication Types

Emphasizes matching access point and client adapter security settings for successful authentication, referencing relevant guides and tables.

Chapter 7 Configuring RADIUS Servers

Configuring and Enabling RADIUS

Describes enabling and configuring RADIUS for detailed accounting and administrative control over authentication and authorization processes.

Understanding RADIUS

Defines RADIUS as a distributed client/server system for network security and lists environments where it is suitable and not suitable.

RADIUS Operation

Explains the sequence of events when a wireless user attempts to log in and authenticate via a RADIUS server, including EAP authentication steps.

Configuring RADIUS

Guides on configuring RADIUS support by identifying RADIUS server hosts and defining method lists for authentication, authorization, and accounting.

Identifying the RADIUS Server Host

Details the components of access point-to-RADIUS server communication and how to identify RADIUS servers by hostname, IP address, and ports.

Configuring RADIUS Login Authentication

Explains how to configure AAA authentication by defining named method lists and applying them to interfaces, ensuring user authentication sequence.

Defining AAA Server Groups

Guides on configuring AAA server groups to group existing server hosts for authentication, allowing subsets for specific services.

Configuring RADIUS Authorization for User Privileged Access and Network Services

Describes using AAA authorization to restrict user network access, specifically for privileged EXEC mode, based on user profiles.

Starting RADIUS Accounting

Explains how to enable AAA accounting to track user activity and resource consumption, reporting it to the RADIUS server.

Configuring Settings for All RADIUS Servers

Guides on configuring global communication settings for all RADIUS servers, including key, retransmit, timeout, and deadtime values.

Chapter 8 Configuring VLANs

Configuring VLANs

Provides instructions on configuring VLANs on the access point to operate with VLANs on the wired LAN, including assigning SSIDs and authentication settings.

Incorporating Wireless Devices into VLANs

Explains how to connect wireless devices to VLANs by configuring SSIDs to recognize specific VLAN IDs, enabling flexible network segmentation.

Configuring a VLAN

Details the three-step process to configure VLANs on an access point: enable VLANs, assign SSIDs to VLANs, and assign authentication settings.

Using a RADIUS Server to Assign Users to VLANs

Explains how a RADIUS server can assign users or groups to specific VLANs upon authentication, mapping clients based on attributes like Tunnel Type and Tunnel Private Group ID.

Chapter 9 Configuring QoS

Understanding QoS for Wireless LANs

Explains Quality of Service (QoS) for wireless LANs, focusing on prioritizing traffic and improving network performance and bandwidth utilization.

Configuring QoS

Guides on configuring QoS on access points to provide preferential treatment to certain traffic, improving network predictability and bandwidth allocation.

Related product manuals