Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

WIreless Authentication With ACS

I have Cisco 1310 Autonomous Access Points about 30 of them, Cisco Secure Access Control Server. ALL i need to do is authenticate 100's of users with the above resources, I dont want to buy any certificates. And i have got lots of Vista users, think LEap doesn't work with VIsta right??? Could anyone suggest an alternative effective authentication method.

Thanks in advance

5 REPLIES
Hall of Fame Super Silver

Re: WIreless Authentication With ACS

You can setup PEAP... just setup a MS Certificate Authority server and generate a cert. I don't know if LEAP is supported on Vista or not... unless you use the Cisco card.

-Scott
*** Please rate helpful posts ***

Re: WIreless Authentication With ACS

1. Generate a self-signed certificate on the ACS

2. Export a copy of the certificate

3. Configure PEAP-MSCHAPv2 on ACS

4. Configure usernames / passwords on ACS, -OR- back ACS off to an external database (ie, LDAP)

5. Create a WPA-TKIP / WPA2-AES network - (consider a dedicated WDS Server if roaming is required).

6. Back the network off to WDS, and point WDS at ACS, -OR- if no WDS, point APs straight at ACS

7. Configure ACS to accept incomming requests from the WDS / APs.

8. Configure Clients to use WPA-TKIP / WPA2-AES + PEAP-MSCHAPv2.

and finally...

9. If you want to go the whole nine yards, install the public half of the certificate on your clients, and configure them to check the identity of the RADIUS server before they authenticate.

Lots of people don't do step 9, but if you don't want to be vulnerable to spoofing / mitm attacks, you should really do it properly. Without step 9, an attacker could potentially spoof your infrastructure and start stealing usernames / passwords from the MsChap-v2 exchange.

Re: WIreless Authentication With ACS

heh, or setup a CA on your domain, and push the certificate and client configs out using Domain Policy (requires Win2k3 SP1)

Community Member

Re: WIreless Authentication With ACS

Kool and thanku very much everyone, i have got some idea now, i'll do some reading and start setting up , thankyou verymuch, i'll probably have soeme more doubts, which i;ll get clarified from you people.

Community Member

Re: WIreless Authentication With ACS

hey i read that for this the ACS uses the windows username and password, is it true, adn also i don't have any domains within my campus, everyone can connect without any domain authentication to th network.

if i use the internal DAtabase of the ACS, where will the client enter his access credentials if i do not have any domain controller etc.

272
Views
0
Helpful
5
Replies
CreatePlease to create content