Software Configuration Guide, Cisco IOS XE Denali 16.1.x (Catalyst 3850 Switches)

Prerequisites for IPv6 WLAN Security

A client VLAN must be mapped to the WLAN configured on the device

Restrictions for IPv6 WLAN Security

RADIUS Server Support

If multiple RADIUS servers are configured for redundancy, the user database must be identical in all the servers for the backup to work properly.

Radius ACS Support

You must configure RADIUS on both your Cisco Secure Access Control Server (ACS) and your device
RADIUS is supported on Cisco Secure ACS version 3.2 and later releases.

Information About IPv6 WLAN Security

Information About RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a client/server protocol that provides centralized security for users attempting to gain management access to a network. It serves as a back-end database similar to Local EAP and provides authentication and accounting services.

Authentication—The process of verifying users when they attempt to log into the device

Users must enter a valid username and password for the device to authenticate users to the RADIUS server. If multiple databases are configured, then specify the sequence in which the backend database must be tried.
Accounting— The process of recording user actions and changes.

Whenever a user successfully executes an action, the RADIUS accounting server logs the changed attributes, the user ID of the person who made the change, the remote host where the user is logged in, the date and time when the command was executed, the authorization level of the user, and a description of the action performed and the values provided. If the RADIUS accounting server is unreachable, the users can continue their sessions uninterrupted.

User Datagram Protocol— RADIUS uses User Datagram Protocol (UDP) for its transport. It maintains a database and listens on UDP port 1812 for incoming authentication requests and UDP port 1813 for incoming accounting requests. The device, which requires access control, acts as the client and requests AAA services from the server. The traffic between the device and the server is encrypted by an algorithm defined in the protocol and a shared secret key configured on both devices.

Configures multiple RADIUS accounting and authentication servers. For example, you can have one central RADIUS authentication server but several RADIUS accounting servers in different regions. If you configure multiple servers of the same type and the first one fails or becomes unreachable, the controller automatically tries the second one, then the third one if necessary, and so on.

When RADIUS method is configured for the WLAN, the device will use the RADIUS method configured for the WLAN. When the WLAN is configured to use local EAP, the RADIUS method configured on the WLAN points to Local. The WLAN must also be configured with the name of the local EAP profile to use.

If no RADIUS method is configured in the WLAN, the device will use the default RADIUS method defined in global mode.

Information About Local EAP

Local EAP is an authentication method that allows users and wireless clients to be authenticated locally. It is designed for use in remote offices that maintain connectivity to wireless clients when the back-end system is disrupted or the external authentication server goes down. When you enable local EAP, the device serves as the authentication server and the local user database, which removes dependence on an external authentication server. Local EAP retrieves user credentials from the local user database or the LDAP back-end database to authenticate users. Local EAP supports LEAP, EAP-FAST, EAP-TLS, PEAPv0/MSCHAPv2, and PEAPv1/GTC authentication between the controller and wireless clients.

Without an EAP profile name being provided, or if a name was provided for an EAP profile that does not exist, then EAP by default allows no EAP method for local authentication.

Note

The LDAP back-end database supports these local EAP methods: EAP-TLS, EAP-FAST/GTC, and PEAPv1/GTC. LEAP, EAP-FAST/MSCHAPv2, and PEAPv0. MSCHAPv2 is supported only if the LDAP server is set up to return a clear-text password.

Note

Device support Local EAP authentication against external LDAP databases such as Microsoft Active Directory and Novell’s eDirectory. For more information about configuring the controller for Local EAP authentication against Novell’s eDirectory, see the Configure Unified Wireless Network for Authentication Against Novell's eDirectory Database whitepaper.

Figure 1. Local EAP Example

Creating a Local User

SUMMARY STEPS

configure terminal
username aaa_test
password 0 aaa_test
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	username `aaa_test` Example: `Device(config)# username aaa_test`	Creates a username.
Step 3	password 0 `aaa_test` Example: `Device(config)# username aaa_test password 0 aaa_test`	Assigns a password for the username.
Step 4	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Device# configure terminal
Device(config)# username aaa_test password 0 aaa_test
Device(config)# end

Creating an Client VLAN and Interface

SUMMARY STEPS

configure terminal
vlan
exit
interface vlan vlan_ID
ip address
ipv6 address
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	vlan Example: `Device(config)# vlan 137`	Creates a VLAN.
Step 3	exit Example: `Device (config-vlan)# exit`	Exits VLAN configuration mode.
Step 4	interface vlan `vlan_ID` Example: `Device (config)# interface vlan 137`	Associates the VLAN to an interface.
Step 5	ip address Example: `Device(config-if)# ip address 10.7.137.10 255.255.255.0`	Assigns an IP address to the VLAN interface.
Step 6	ipv6 address Example: `Device(config-if)#ipv6 address 2001:db8::20:1/64`	Assigns an IPv6 address to the VLAN interface.
Step 7	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Example

Device# configure terminal
Device(config)# vlan 137
Device(config-vlan)#exit
Device(config)#interface vlan 137
Device(config-if)#ip address 10.7.137.10 255.255.255.0
Device(config-if)#ipv6 address 2001:db8::20:1/64
Device(config-if)#end

Configuring a EAP Profile

SUMMARY STEPS

eap profile name
method leap
method tls
method peap
method mschapv2
method md5
method gtc
method fast profile my-fast
description my_localeap profile
exit
eap method fast profile myFast
authority-id [identity|information]
local-key 0 key-name
pac-password 0 password
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	eap profile `name` Example: `Device(config)# eap profile wcm_eap_prof`	Creates a EAP profile.
Step 2	method leap Example: `Device(config-eap-profile)# method leap`	Configures EAP-LEAP method on the profile.
Step 3	method tls Example: `Device(config-eap-profile)# method tls`	Configures EAP-TLS method on the profile.
Step 4	method peap Example: `Device(config-eap-profile)# method peap`	Configures PEAP method on the profile.
Step 5	method mschapv2 Example: `Device(config-eap-profile)# method mschapv2`	Configures EAP-MSCHAPV2 method on the profile.
Step 6	method md5 Example: `Device(config-eap-profile)# method md5`	Configures EAP-MD5 method on the profile.
Step 7	method gtc Example: `Device(config-eap-profile)# method gtc`	Configures EAP-GTC method on the profile.
Step 8	method fast profile `my-fast` Example: `Device(config-eap-profile)# eap method fast profile my-fast Device (config-eap-profile)#description my_local eap profile`	Creates a EAP profile named my-fast.
Step 9	description `my_local`eap profile Example: `Device (config-eap-profile)#description my_local eap profile`	Provides a description for the local profile.
Step 10	exit Example: `Device (config-eap-profile)# exit`	Exits the eap-profile configuration mode.
Step 11	eap method fast profile `myFast` Example: `Device (config)# eap method fast profile myFast`	Configures the EAP method profile.
Step 12	authority-id `[identity\|information]` Example: `Device(config-eap-method-profile)# authority-id identity my_identity Device(config-eap-method-profile)#authority-id information my_information`	Configure the authority ID and information for the EAP method profile.
Step 13	local-key 0 `key-name` Example: `Device(config-eap-method-profile)# local-key 0 test`	Configures the local server key.
Step 14	pac-password 0 `password` Example: `Device(config-eap-method-profile)# pac-password 0 test`	Configures the PAC password for manual PAC provisioning.
Step 15	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Example

Device(config)#eap profile wcm_eap_prof
Device(config-eap-profile)#method leap 
Device(config-eap-profile)#method tls
Device(config-eap-profile)#method peap
Device(config-eap-profile)#method mschapv2
Device(config-eap-profile)#method md5
Device(config-eap-profile)#method gtc
Device(config-eap-profile)#eap method fast profile my-fast
Device (config-eap-profile)#description my_local eap profile
Device(config-eap-profile)# exit
Device (config)# eap method fast profile myFast
Device(config-eap-method-profile)#authority-id identity my_identity
Device(config-eap-method-profile)#authority-id information my_information
Device(config-eap-method-profile)#local-key 0 test
Device(config-eap-method-profile)#pac-password 0 test
Device(config-eap-method-profile)# end

Creating a Local Authentication Model

SUMMARY STEPS

aaa new-model
authentication dot1x default local
dot1x method_list local
aaa authentication dot1x dot1x_name local
aaa authorization credential-download name local
aaa local authentication auth-name authorization authorization-name
session ID
dot1x system-auth-control

DETAILED STEPS

	Command or Action	Purpose
Step 1	aaa `new-model` Example: `Device(config)# aaa new-model`	Creates a AAA authentication model.
Step 2	authentication dot1x default local Example: `Device(config)# aaa authentication dot1x default local`	Implies that the dot1x must use the default local RADIUS when no other method is found.
Step 3	dot1x `method_list` local Example: `Device(config)# aaa authentication dot1x wcm_local local`	Assigns the local authentication for wcm_local method list.
Step 4	aaa authentication dot1x `dot1x_name` local Example: `Device(config)# aaa authentication dot1x aaa_auth local`	Configures the local authentication for the dot1x method.
Step 5	aaa authorization credential-download `name` local Example: `Device(config)# aaa authorization credential-download wcm_author local`	Configures local database to download EAP credentials from Local/RADIUS/LDAP.
Step 6	aaa local authentication `auth-name` authorization `authorization-name` Example: `Device(config)# aaa local authentication wcm_local authorization wcm_author`	Selects local authentication and authorization.
Step 7	session ID Example: `Device(config)# aaa session-id common`	Configures a session ID for AAA.
Step 8	dot1x system-auth-control Example: `Device(config)# dot1x system-auth-control`	Enables dot.1x system authentication control.

Example

Device(config)# aaa new-model
Device(config)# aaa authentication dot1x default local
Device(config)# aaa authentication dot1x wcm-local local
Device(config)# aaa authentication dot1x aaa_auth local
Device(config)# aaa authorization credential-download wcm_author local
Device(config)# aaa local authentication wcm_local authorization wcm_author
Device(config)# aaa session-id common
Device(config)# dot1x system-auth-control

Creating a Client WLAN

Note

This example uses 802.1x with dynamic WEP. You can use any other security mechanism supported by the wireless client and configurable on the device

SUMMARY STEPS

configure terminal
wlan wlan name <identifier> SSID
broadcast-ssid
no security wpa
security dot1x
security dot1x authentication-list wcm-local
local-auth wcm_eap_prof
client vlan 137
no shutdown
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	wlan `wlan name` <identifier> `SSID` Example: `Device(config)# wlan wlanProfileName 1 ngwcSSID`	Creates a WLAN.
Step 3	broadcast-ssid Example: `Device(config-wlan)# broadcast-ssid`	Configures to broadcast the SSID on a WLAN.
Step 4	no security wpa Example: `Device(config-wlan)# no security wpa`	Disables the wpa for WLAN to enable 802.1x.
Step 5	security dot1x Example: `Device(config-wlan)# security dot1x`	Configures the 802.1x encryption security for the WLAN.
Step 6	security dot1x authentication-list `wcm-local` Example: `Device(config-wlan)# security dot1x authentication-list wcm-local`	Configures the server group mapping to the WLAN for dot1x authentication.
Step 7	local-auth `wcm_eap_prof` Example: `Device (config-wlan)# local-auth wcm_eap_profile`	Configures the eap profile on the WLAN for local authentication.
Step 8	client vlan `137` Example: `Device(config-wlan)# client vlan 137`	Associates the VLAN to a WLAN.
Step 9	no shutdown Example: `Device(config-wlan)# no shutdown`	Enables the WLAN.
Step 10	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Example

Device# config terminal
Device(config)#wlan wlanProfileName 1 ngwcSSID
Device(config-wlan)#broadcast-ssid
Device(config-wlan)#no security wpa
Device(config-wlan)#security dot1x 
Device(config-wlan)#security dot1x authentication-list wcm-local
Device (config-wlan)# local-auth wcm_eap_prof
Device(config-wlan)#client vlan 137
Device(config-wlan)#no shutdown
Device(config-wlan)#end
Device#

Configuring Local Authentication with WPA2+AES

SUMMARY STEPS

configure terminal
aaa new model
dot1x system-auth-control
aaa authentication dot1x default local
aaa local authorization credential-download default local
aaa local authentication default authorization default
eap profile wcm_eap_profile
method leap
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	aaa `new model` Example: `Device(config)# aaa new-model`	Creates a AAA authentication model.
Step 3	dot1x system-auth-control Example: `Device(config)# dot1x system-auth-control`	Enables dot1x system authentication control.
Step 4	aaa authentication dot1x default local Example: `Device(config)# aaa authentication dot1x default local`	Configures the local authentication for the default dot1x method.
Step 5	aaa local authorization credential-download default local Example: `Device(config)# aaa authorization credential-download default local`	Configures default database to download EAP credentials from local server.
Step 6	aaa local authentication default authorization default Example: `Device(config)# aaa local authentication default authorization default`	Selects the default local authentication and authorization.
Step 7	eap profile `wcm_eap_profile` Example: `Device(config)#eap profile wcm_eap_profile`	Creates an EAP profile.
Step 8	method leap Example: `Device(config)# method leap`	Configures EAP-LEAP method on the profile.
Step 9	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Device# configure terminal
Device(config)# aaa new-model
Device(config)# dot1x system-auth-control
Device(config)# aaa authentication dot1x default local
Device(config)# aaa authorization credential-download default local
Device(config)# aaa local authentication default authorization default
Device(config)#eap profile wcm_eap_profile
Device(config)# method leap
Device(config)# end

Creating Client VLAN for WPA2+AES

Create a VLAN for the WPA2+AES type of local authentication. This VLAN is later mapped to a WLAN.

SUMMARY STEPS

configure terminal
vlan vlan_ID
exit
interface vlan vlan_ID
ip address
ipv6 address
exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	vlan `vlan_ID` Example: `Device (config)# vlan 105`	Creates a VLAN.
Step 3	exit Example: `Device (config-vlan)# exit`	Exits from the VLAN mode.
Step 4	interface vlan `vlan_ID` Example: `Device(config)# interface vlan 105`	Associates the VLAN to the interface.
Step 5	ip address Example: `Device(config-if)# ip address 10.8.105.10 255.255.255.0`	Assigns IP address to the VLAN interface.
Step 6	ipv6 address Example: `Device(config-if)#ipv6 address 2001:db8::10:1/64`	Assigns IPv6 address to the VLAN interface.
Step 7	exit Example: `Device (config-if)# exit`	Exits from the interface mode.

Device# configure terminal
Device(config)# vlan105
Device (config-vlan)# exit
Device (config)# interface vlan 105
Device(config-if)#ip address 10.8.105.10 255.255.255.0
Device(config-if)#ipv6 address 2001:db8::10:1/64
Device(config-if)#exit
Device(config)#

Creating WLAN for WPA2+AES

Create a WLAN and map it to the client VLAN created for WPA2+AES.

SUMMARY STEPS

configure terminal
wlan wpas2-aes-wlan 1 wpas2-aes-wlan
client vlan 105
local-auth wcm_eap_profile
security dot1x authentication-list default
no shutdown
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	wlan `wpas2-aes-wlan` `1` `wpas2-aes-wlan` Example: `Device(config)#wlan wpa2-aes-wlan 1 wpa2-aes-wlan Device(config-wlan)#`	Creates a WLAN.
Step 3	client vlan `105` Example: `Device(config-wlan)#client vlan 105 Device(config-wlan)#`	Maps the WLAN to the client VLAN.
Step 4	local-auth `wcm_eap_profile` Example: `Device(config-wlan)#local-auth wcm_eap_profile`	Creates and sets the EAP profile on the WLAN.
Step 5	security dot1x authentication-list default Example: `Device(config-wlan)#security dot1x authentication-list default`	Uses the default dot1x authentication list.
Step 6	no shutdown Example: `Device(config-wlan)#no shutdown Device(config-wlan)#`	Enables the WLAN.
Step 7	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Device# configure terminal
Device(config)#wlan wpa2-aes-wlan 1 wpa2-aes-wlan
Device(config-wlan)#client vlan 105
Device(config-wlan)#local-auth wcm_eap_profile
Device(config-wlan)#security dot1x authentication-list default 
Device(config-wlan)#no shutdown
Device(config-wlan)# exit

Configuring RADIUS Authentication Server Host

SUMMARY STEPS

configure terminal
radius server One
address ipv4 address auth-port auth_port_number acct-port acct_port_number
address ipv6 address auth-port auth_port_number acct-port acct_port_number
key 0cisco

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	radius server One Example: `Device (config)# radius server One`	Creates a radius server.
Step 3	address ipv4 `address` auth-port `auth_port_number` acct-port `acct_port_number` Example: `Device (config-radius-server)# address ipv4 10.10.10.10 auth-port 1812 acct-port 1813`	Configures the IPv4 address for the radius server.
Step 4	address ipv6 `address` auth-port `auth_port_number` acct-port `acct_port_number` Example: `Device (config-radius-server)# address ipv6 2001:db8::25:2 auth-port 1812 acct-port 1813`	Configures the IPv6 address for the radius server.
Step 5	key `0cisco` Example: `Device (config-radius-server)# key 0 cisco`	exit
Step 6	Example: `Device (config-radius-server)# exit`	Exits from the radius server mode.

Device# configure terminal
Device (config)# radius server One
Device (config-radius-server)# address ipv4 10.10.10.10 auth-port 1812 acct-port 1813 
Device (config-radius-server)# address ipv6 2001:db8::25:2 auth-port 1812 acct-port 1813
Device (config-radius-server)# key 0 cisco
Device (config-radius-server)#exit

Configuring RADIUS Authentication Server Group

SUMMARY STEPS

configure terminal
aaa new-model
aaa group server radius wcm_rad
server <ip address>auth-port 1812acct-port 1813
aaa authentication dot1x method_list group wcm_rad
dot1x system-auth-control
aaa session-id common

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	aaa new-model Example: `Device(config)#aaa new-model`	Creates a AAA authentication model.
Step 3	aaa group server radius `wcm_rad` Example: `Device(config)# aaa group server radius wcm_rad Device(config-sg-radius)#`	Creates an radius server-group.
Step 4	server `<ip address>`auth-port `1812`acct-port `1813` Example: `Device(config-sg-radius)# server One auth-port 1812 acct-port 1813 Device(config-sg-radius)# server Two auth-port 1812 acct-port 1813 Device(config-sg-radius)# server Three auth-port 1812 acct-port 1813`	Adds servers to the radius group created in Step 3. Configures the UDP port for RADIUS accounting server and authentication server.
Step 5	aaa authentication dot1x `method_list` group `wcm_rad` Example: `Device(config)# aaa authentication dot1x method_list group wcm_rad`	Maps the method list to the radius group.
Step 6	dot1x system-auth-control Example: `Device(config)# dot1x system-auth-control`	Enables the system authorization control for the radius group.
Step 7	aaa session-id common Example: `Device(config)# aaa session-id common`	Ensures that all session IDs information sent out, from the radius group, for a given call are identical.

Device# configure terminal
Device(config)# aaa new-model
Device(config)# aaa group server radius wcm_rad
Device(config-sg-radius)# server One auth-port 1812 acct-port 1813
Device(config-sg-radius)# server Two auth-port 1812 acct-port 1813
Device(config-sg-radius)# server Three auth-port 1812 acct-port 1813
Device(config)# aaa authentication dot1x method_list group wcm_rad
Device(config)# dot1x system-auth-control
Device(config)# aaa session-id common
Device(config)#

Creating a Client VLAN

SUMMARY STEPS

configure terminal
vlan 137
exit
interface vlan 137
ip address 10.7.137.10 255.255.255.0
ipv6 address 2001:db8::30:1/64
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	vlan `137` Example: `Device(config)# vlan 137`	Creates a VLAN and associate it to the interface.
Step 3	exit Example: `Device (config-vlan)# exit`	Exits from the VLAN mode.
Step 4	interface vlan `137` Example: `Device (config)# interface vlan 137`	Assigns a VLAN to an interface.
Step 5	ip address `10.7.137.10` `255.255.255.0` Example: `Device(config-if)# ip address 10.7.137.10 255.255.255.0`	Assigns an IPv4 address to the VLAN interface.
Step 6	ipv6 address `2001:db8::30:1/64` Example: `Device(config-if)# ipv6 address 2001:db8::30:1/64`	Assigns an IPv6 address to the VLAN interface.
Step 7	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Device# configure terminal
Device(config)# vlan137
Device(config-vlan)# exit
Device(config)# interface vlan137
Device(config-if)# ip address 10.7.137.10 255.255.255.0
Device(config-if)# ipv6 address 2001:db8::30:1/64
Device(config-if)# end

Creating 802.1x WLAN Using an External RADIUS Server

SUMMARY STEPS

configure terminal
wlan ngwc-1x<ssid> ngwc-1x
broadcast-ssid
no security wpa
security dot1x
security dot1x authentication-list wcm-rad
client vlan 137
no shutdown
end

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `Device# configure terminal`	Enters global command mode.
Step 2	wlan `ngwc-1x`<ssid> `ngwc-1x` Example: `Device(config)# wlan ngwc_8021x 2 ngwc_8021x`	Creates a new WLAN for 802.1x authentication.
Step 3	broadcast-ssid Example: `Device(config-wlan)# broadcast-ssid`	Configures to broadcast the SSID on WLAN.
Step 4	no security wpa Example: `Device(config-wlan)# no security wpa`	Disables the WPA for WLAN to enable 802.1x.
Step 5	security dot1x Example: `Device(config-wlan)# security dot1x`	Configures the 802.1x encryption security for the WLAN.
Step 6	security dot1x authentication-list `wcm-rad` Example: `Device(config-wlan)# security dot1x authentication-list wcm-rad`	Configures the server group mapping to the WLAN for dot1x authentication.
Step 7	client vlan `137` Example: `Device(config-wlan)# client vlan 137`	Associates the VLAN to a WLAN.
Step 8	no shutdown Example: `Device(config-wlan)# no shutdown`	Enables the WLAN.
Step 9	end Example: `Device(config)# end`	Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit the global configuration mode.

Example

Device# configure terminal
Device(config)#wlan ngwc_8021x 2 ngwc_8021x
Device(config-wlan)# broadcast-ssid
Device(config-wlan)# no security wpa
Device(config-wlan)# security dot1x 
Device(config-wlan)# security dot1x authentication-list wcm-rad
Device(config-wlan)# client vlan 137
Device(config-wlan)# no shutdown
Device(config-wlan)# end

Additional References

Related Topic	Document Title
IPv6 command reference	IPv6 Command Reference (Catalyst 3850 Switches)
WLAN command reference	WLAN Command Reference, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
WLAN configuration	WLAN Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)

Error Message Decoder


Description	Link
To help you research and resolve system error messages in this release, use the Error Message Decoder tool.	https://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi

MIBs


MIB	MIBs Link
All supported MIBs for this release.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

Technical Assistance


Description	Link
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.	http://www.cisco.com/support

Feature Information for IPv6 WLAN Security

This table lists the features in this module and provides links to specific configuration information:


Feature	Release	Modification
IPv6 WLAN Security Functionality	Cisco IOS XE 3.2SE	This feature was introduced.

Bias-Free Language

Results

Chapter: Configuring IPv6 WLAN Security

Configuring IPv6 WLAN Security

Prerequisites for IPv6 WLAN Security

Restrictions for IPv6 WLAN Security

RADIUS Server Support

Radius ACS Support

Information About IPv6 WLAN Security

Information About RADIUS

Information About Local EAP

Creating a Local User

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Creating an Client VLAN and Interface

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example

Configuring a EAP Profile

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example

Creating a Local Authentication Model

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example

Creating a Client WLAN

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example

Configuring Local Authentication with WPA2+AES

SUMMARY STEPS

DETAILED STEPS

Example:

Example: