Dell PowerConnect W Clearpass 100 Software Guía de usuario descargar pdf (Pagina 119)

Supported Authentication Servers

Based on the security requirements, you can configure internal or external RADIUSservers. This section describes

the following types of authentication servers and authentication termination, which can be configured for a network

profile:

l External RADIUS Server on page 119

l Internal RADIUS Server on page 119

l Authentication Termination on OAW-IAP on page 120

External RADIUS Server

In the external RADIUS server, the IP address of the Virtual Controller is configured as the NAS IP address. Instant

RADIUS is implemented on the Virtual Controller, and this eliminates the need to configure multiple NAS clients for

every OAW-IAP on the RADIUS server for client authentication. Instant RADIUS dynamically forwards all the

authentication requests from a NAS to a remote RADIUS server. The RADIUS server responds to the

authentication request with an Access-Accept or Access-Reject message, and users are allowed or denied access

to the network depending on the response from the RADIUS server.

When you enable an external RADIUS server for the network, the client on the OAW-IAP sends a RADIUS packet

to the local IP address. The external RADIUS server then responds to the RADIUS packet.

Instant supports the following external authentication servers:

l RADIUS (Remote Authentication Dial-In User Service)

l LDAP (Lightweight Directory Access Protocol)

l CPPMServer for AirGroup CoA

To use an LDAP server for user authentication, configure the LDAP server on the Virtual Controller, and configure

user IDs and passwords.

To use a RADIUS server for user authentication, configure the RADIUS server on the Virtual Controller.

RADIUS Server Authentication with VSA

An external RADIUS server authenticates network users and returns to the OAW-IAP the vendor-specific attribute

(VSA) that contains the name of the network role for the user. The authenticated user is placed into the management

role specified by the VSA.

For a complete list of VSAs supported by Instant, see Supported VSAs on page 170.

Internal RADIUS Server

Each OAW-IAP has an instance of free RADIUS server operating locally. When you enable the Internal RADIUS

server option for the network, the client on the OAW-IAP sends a RADIUS packet to the local IP address. The

Internal RADIUS server listens and replies to the RADIUS packet.

The following authentication methods are supported in AOS-W Instant network:

l EAP-TLS— The Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) method supports the

termination of EAP-TLS security using the internal RADIUS server. The EAP-TLS requires both server and

certification authority (CA) certificates installed on the OAW-IAP. The client certificate is verified on the Virtual

Controller (the client certificate must be signed by a known CA), before the username is verified on the

authentication server.

l EAP-TTLS (MSCHAPv2)— The Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-

TTLS) method uses server-side certificates to set up authentication between clients and servers. However, the

actual authentication is performed using passwords.

AOS-W Instant 6.2.1.0-3.3| User Guide Authentication | 119

1 2 ... 114 115 116 117 118 119 120 121 122 123 124 ... 295 296

Sin comentarios

Dell PowerConnect W Clearpass 100 Software Guía de usuario Pagina 119