Configure RADIUS in Cisco Business Wireless Access Point

Available Languages

Download Options

  • PDF     (574.9 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (757.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (1.7 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:May 13, 2020
Document ID:1589476953477543

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Objective

The objective of this document is to show you how to configure RADIUS in Cisco Business Wireless (CBW) Access Point (AP).

Applicable Devices | Firmware Version

Introduction

If you are looking to configure RADIUS in your CBW AP, you have come to the right place! The CBW APs support the latest 802.11ac Wave 2 standard for higher performance, greater access, and higher-density networks. They deliver industry-leading performance with highly secure and reliable wireless connections, for a robust, mobile end-user experience.

Remote Authentication Dial-In User Service (RADIUS) is an authentication mechanism for devices to connect and use a network service. It is used for centralized authentication, authorization, and accounting purposes. A RADIUS server regulates access to the network by verifying the identity of the users through the login credentials entered. For example, a public Wi-Fi network is installed in a university campus. Only those students who have the password can access these networks. The RADIUS server checks the passwords entered by the users and grants or denies access to the Wireless Local Area Network (WLAN) as appropriate.

If you are ready to configure RADIUS on your CBW AP, let’s get started!

Table of Contents

Configure RADIUS on your CBW AP

Beginner Help

This toggled section highlights tips for beginners.

Logging In

Log into the Web User Interface (UI) of the Primary AP. To do this, open a web browser and enter https://ciscobusiness.cisco. You may receive a warning before proceeding. Enter your credentials.You can also access the Primary AP by entering https://[ipaddress] (of the Primary AP) into a web browser.

Tool Tips

If you have questions about a field in the user interface, check for a tool tip that looks like the following: tooltip icon

Trouble locating the Expand Main Menu icon?

Navigate to the menu on the left-hand side of the screen, if you don’t see the menu button, click this icon to open the side-bar menu.menu button

Cisco Business App

These devices have companion apps that share some management features with the web user interface. Not all features in the Web user interface will be available in the App.

Frequently Asked Questions

If you still have unanswered questions, you can check our frequently asked questions document. FAQ

Step 1

Login to your CBW AP using a valid username and password.

Login to your CBW AP using a valid username and password.

Step 2

Click on the bidirectional arrow symbol at the top of the web user-interface (UI) to Switch to Expert View.

Click on the bidirectional arrow symbol at the top of the web user-interface (UI) to Switch to Expert View.

You will see the following pop-up screen. Click OK to proceed.

Click OK to proceed

Step 3

Navigate to Management > Admin Accounts.

Navigate to Management > Admin Accounts

Step 4

To add the RADIUS servers, click on the RADIUS tab.

To add the RADIUS servers, click on the RADIUS tab.

Step 5

From the Authentication Call Station ID Type drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message. The following options are available:

  • IP Address
  • Primary AP MAC Address
  • AP MAC Address
  • AP MAC Address:SSID
  • AP Name:SSID
  • AP Name
  • AP Group
  • Flex Group
  • AP Location
  • VLAN ID
  • AP Ethernet MAC Address
  • AP Ethernet MAC Address:SSID
  • AP Label Address
  • AP Label Address:SSID
  • AP MAC:SSID AP Group
  • AP Eth MAC:SSID AP Group

From the Authentication Call Station ID Type drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message.

Step 6

Select the Authentication MAC Delimiter from the drop- down list. The options are:

  • Colon
  • Hyphen
  • Single-hyphen
  • No Delimiter

Select the Authentication MAC Delimiter from the drop- down list.

Step 7

Choose the Accounting Call Station ID Type from the drop-down list.

Choose the Accounting Call Station ID Type from the drop-down list.

Step 8

Choose the Accounting MAC Delimiter from the drop-down list.

Choose the Accounting MAC Delimiter from the drop-down list.

Step 9

Specify the RADIUS server Fallback Mode from the drop-down list. It can be one of the following:

  • Off - Disables RADIUS server fallback. This is the default value.
  • Passive - Causes the primary AP to revert to a server with a lower priority from the available backup servers without using extraneous probe messages. The primary AP ignores all inactive servers for a time period and retries later when a RADIUS message needs to be sent.
  • Active – Causes the primary AP to revert to a server with a lower priority from the available backup servers by using RADIUS probe messages to proactively determine whether a server that has been marked inactive is back online. The primary AP ignores all inactive servers for all active RADIUS requests. Once the primary server receives a response from the recovered ACS server, the active fall back RADIUS server no longer sends probe messages to the server requesting the active probe authentication.

Specify the RADIUS server Fallback Mode from the drop-down list.

Step 10

If you enabled Active Fallback mode, enter the name to be sent in the inactive server probes in the Username field.

If you enabled Active Fallback mode, enter the name to be sent in the inactive server probes in the Username field.

You can enter up to 16 alpha numeric characters. The default value is cisco-probe.

Step 11

If you enabled Active Fallback mode, enter the probe interval value (in seconds) in the Interval field. The interval serves as inactive time in passive mode and probe interval in active mode.

If you enabled Active Fallback mode, enter the probe interval value (in seconds) in the Interval field.

The valid range is 180 to 3600 seconds, and the default value is 300 seconds.

Step 12

Enable the AP Events Accounting slider button to activate sending of accounting requests to RADIUS server.

During network issues, the APs join/disjoin from the primary AP. Enabling this option ensures that these events are monitored and the accounting requests are sent to the RADIUS server to help you detect the network issues.

Enable the AP Events Accounting slider button to activate sending of accounting requests to RADIUS server.

Step 13

Click Apply.

Click Apply.

Step 14

To configure the RADIUS Authentication server, click on Add RADIUS Authentication Server.

To configure the RADIUS Authentication server, click on Add RADIUS Authentication Server.

Step 15

In the Add/Edit RADIUS Authentication pop-up window, configure the following:

  • Server Index - Select 1 through 6
  • Network User - Enable the state. By default this is Enabled
  • Management - Enable the state. By default this is Enabled
  • State - Enable the state. By default this is Enabled
  • CoA - You can choose to enable this option by moving the slider button
  • Server IP Address - Enter the IPv4 address of the RADIUS server
  • Shared Secret - Enter the shared secret
  • Port Number - Enter the port number being used for communicating with the RADIUS server.
  • Server Timeout - Enter the server timeout

Click Apply.

In the Add/Edit RADIUS Authentication pop-up window configure the settings and click Apply.

Step 16

To Add RADIUS Accounting Server, you would follow the same steps as in Step 15 as the page contains similar fields.

To Add RADIUS Accounting Server, you would follow the same steps as in Step 15 as the page contains similar fields.

Configure WLAN

Step 1

To configure WLAN that is going to handle WPA2 authentication with RADIUS, navigate to Wireless settings > WLAN.

To configure WLAN that is going to handle WPA2 authentication with RADIUS, navigate to Wireless settings > WLAN.

Step 2

Click on Add New WLAN/RLAN.

Click on Add New WLAN/RLAN.

Step 3

In the General tab, enter the Profile Name. The SSID field will auto-populate. You can choose to enable Local Profiling. Click Apply.

In the General tab, enter the Profile Name. The SSID field will auto-populate. You can choose to enable Local Profiling. Click Apply.

Step 4

Navigate to WLAN Security tab. From the Security Type drop-down menu, choose WPA2Enterprise. Select External Radius as the Authentication Server. You can choose to enable Radius Profiling.

Step 5

Navigate to RADIUS Server section. Click on Add RADIUS Authentication Server.

Navigate to RADIUS Server section. Click on Add RADIUS Authentication Server.

Step 6

Verify the details of the RADIUS Authentication Server that you have configured and click Apply.

Verify the details of the RADIUS Authentication Server that you have configured and click Apply.

Step 7

Click on Add RADIUS Accounting Server.

Click on Add RADIUS Accounting Server.

Step 8

Verify the details of the RADIUS Accounting Server that you have configured and click Apply.

Verify the details of the RADIUS Accounting Server that you have configured and click Apply.

Step 9

Navigate to VLAN & Firewall, Traffic Shaping, Advanced, and Scheduling tabs to configure the settings based on your network preferences. Click Apply.

Navigate to VLAN & Firewall, Traffic Shaping, Advanced, and Scheduling tabs to configure the settings based on your network preferences. Click Apply.

Verification

To test the RADIUS authentication, do the following:

Step 1

Navigate to Advanced > Primary AP Tools.

Navigate to Advanced > Primary AP Tools.

Step 2

Click on Troubleshooting Tools.

Click on Troubleshooting Tools.

Step 3

In the Radius Response section, enter the Username and Password for the WLAN Profile that you have configured previously and click Start.

In the Radius Response section, enter the Username and Password for the WLAN Profile that you have configured previously and click Start.

Step 4

Once the verification is completed successfully, you will see the following notification on your screen.

Once the verification is completed successfully, you will see the following notification on your screen

Conclusion

There you have it! You have now learned the steps to configure RADIUS on your CBW AP. For more advanced configurations, refer to the Cisco Business Wireless Access Point Administration Guide.

Revision History

Revision Publish Date Comments
1.0
13-May-2020
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products