Wireless LAN feature -- 3 Leap wlan

Hello everyone.

Today, We will go to  "LEAP Wlan".  Before that, let me introduce something about Wireless authentication system. In Cisco wireless network, there are two kinds of infrastructures .


1. with Radius server

Client   )) ((    AP ----- Switch ---- Radius server
                                     |
                                   WLC


In this approach, We use one radius server as the authentication server. The Radius server can provide the service for authenticating.


2. Without Radius Server

Client   )) ((    AP ----- Switch ---- WLC (local authentication)

Some person will say that we do not have radius server.  Do not worry,  Cisco WLC can provide local authentication service.


In this post, we will use local authentication on  WLC  to run "LEAP WLAN" as the example.


// How to //

1.  Create LEAP profile, Go to [Security] > [Local EAP] > [Profiles]

    [CLI]
    config local-auth eap-profile add LEAP


2.  Once your finished 1. ,  you can edit LEAP and check LEAP
   

    [CLI]

    config local-auth eap-profile method add leap LEAP

3.  You can set some parameters on for this LEAP, as the example.



  [CLI]
  config local-auth active-timeout 360

(*, In this I suppose that the local EAP profile has to be used for at least 6 minutes when an external Radius fails)

  
4.  Setup Layer-2 security parameters
LEAP is an 802.1x authentication mechanism (The est key is 104 bits for windows clients).

 

   [CLI]
   config wlan security wpa disable 3
   config wlan security 802.1x enable 3



5. To allow the authentication to be local, enable local EAP authentication in the AAA servers tab, and choose the LEAP profile.

   [CLI]
   config wlan local-authe enable LEAP 3

(*, The local EAP profile will work only if your WLC does not have any external Radius to reach.)


6. Create your local user  from [Security] > [AAA] > [Local Net User]

  [CLI]
  config netuser add wlan 3 usertype [description] 


It is a little more complicated than the last post, isn't it? :)




Good luck and see you next time.

Reference 

1. 

Cisco LEAP

http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1200-series/prod_qas0900aecd801764f1.html

peer default ip address

Hello everyone.

In this post, i will introduce "peer default ip address". 

To return an IP address from a remote pear, we can use the command "peer default ip address".

--------------------------
// Topology //

R1[S1/0]    -----  [S1/0] R2


// Basic config //

[On R1]

interface Serial0/0

 no ip address

 encapsulation ppp

[On R2]

interface Serial0/1

 ip address 192.168.12.2 255.255.255.0

 encapsulation ppp

--------------------------


As you can see, there are for options for this commands

R1(config-if)#peer default ip address ?
  A.B.C.D    Default IP address for remote end of this interface
  dhcp       Use DHCP proxy client mechanism to allocate a peer IP address
  dhcp-pool  Use local DHCP pools to allocate a peer IP address
  pool       Use IP pool mechanism to allocate a peer IP address


In this post, I will "A.B.C.D", "dhcp-pool" and "pool"


// A.B.C.D//
To assign an IP address from a remote peer by static.


[R1]
interface Serial0/0

 ip address negotiated

[R2]

interface Serial0/1

 peer default ip address 192.168.12.1

After you can shut and no shut the inteface (s1/0) on R2
R2(config-if)#shut
*Mar  1 00:21:31.555: %LINK-5-CHANGED: Interface Serial1/0, changed state to administratively down
*Mar  1 00:21:32.555: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down
R2(config-if)#no shut
*Mar  1 00:21:41.199: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up
*Mar  1 00:21:42.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up

Then, you can see that R1 gets an IP address from remote peer R2. 

R1(config-if)#do sh ip interface s1/0
Serial0/0 is up, line protocol is up
  Internet address is 192.168.12.1/32
  Broadcast address is 255.255.255.255
  Address determined by IPCP
  Peer address is 192.168.12.2

// dhcp-pool //

R1(config)#int s1/0
R1(config-if)#ip address negotiated

define a dhcp pool on R2

R2(config)#ip dhcp pool R2

R2(dhcp-config)#network 192.168.12.0 /24

R2(config)#ip dhcp excluded-address 192.168.12.0 192.168.12.10

interface Serial1/0

 ip address 192.168.12.2 255.255.255.0

 encapsulation ppp

 peer default ip address dhcp-pool R2

 serial restart-delay 0

Now, you can "no shut" the interface S1/0 on R2,  R1 will get the IP address from R2's DHCP pool. To confirm it, inputting "show ip int bri" on R1, you will see as following 

R1(config-if)#do sh ip int bri
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        unassigned      YES unset  administratively down down
Serial1/0              192.168.12.11   YES IPCP   up                    up

// pool //

R1(config)#int s1/0
R1(config-if)#ip address negotiated

define a local pool on R2

R2(config)#ip local pool default 192.168.12.20 192.168.12.30

interface Serial1/0

 ip address 192.168.12.2 255.255.255.0

 encapsulation ppp

 peer default ip address pool

 serial restart-delay 0

The result will be like this 

R1(config-if)#do sh ip int bri
Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/0        unassigned      YES unset  administratively down down
Serial1/0              192.168.12.20   YES IPCP   up                    up


See you next time and Good Luck !!

Reference 
1.
http://www.cisco.com/c/en/us/td/docs/ios/dial/command/reference/dia-cr-book/dia_p1.html

Wireless LAN feature -- 2 wep wlan

Hello everyone

WEP is legacy. The main purpose of WEP is also for testing like open wlan. 

1. Create the wlan as name binha-WEP

2. Select Radio policy and interface, such as the following

3. Go to the layer 2 to static WEP in the Security tab. The longest possible key supported on windows is 104bits.  For the security issue, in this example I assume that the only pre-defined MAC address should be allowed to connect to this WLAN. Therefore, I checked ""allow shared key authentication"

You can also do by CLI:

config wlan create 3 binha-WEP  binha-WEP

config wlan disable

config wlan radio 3 802.11g-only

config wlan security wpa disable 3

config wlan security static-wep-key enable 3

config wlan security static-wep-key encryption 3 104 ascii 1234567890123 1

config wlan mac-filtering enable 3

config wlan security static-wep-key authentication shared-key 3

config wlan enable 3

4. You need to create a MAC filter for that address on your WLC. Go to Security > AAA > [Mac  filtering]. Define a new MAC filter.

You also give the following command in CLI as the example.

config macfilter add 00:19:D2:AF:A8:79 3 management "Filter for binha-WEP"

It is also very simple 
See you next time and Good Luck !!