Enabling Peap-Ms-Chap-V2 Offload; Combining Eap Offload With Pass-Through Authentication - D-Link DWS-1008 - AirPremier MobileLAN Switch Product Manual

Enabling PEAP-MS-CHAP-V2 Offload

The following example illustrates how to enable PEAP-MS-CHAP-V2 offload. In this example, all EAP
processing is offloaded from the RADIUS server, but MS-CHAP-V2 authentication and authorization are
done via a RADIUS server.
The MS-CHAP-V2 lookup matches users against the user list on a RADIUS server.
1. Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type
the following command:
DWS-1008# set radius server r1 address 10.1.1.1 key starry
2. Configure the server group sg1 with member r1. Type the following command:
DWS-1008# set server group sg1 members r1
3. Enable all 802.1X users of SSID thiscorp using PEAP-MS-CHAP-V2 to authenticate
MS-CHAP-V2 on server group sg1. Type the following command:
DWS-1008# set authentication dot1x ssid thiscorp * peap-mschapv2 sg1
4. Save the configuration:
DWS-1008 save config
success: configuration saved.
Combining EAP Offload with Pass-Through
The following example illustrates how to enable PEAP-MS-CHAP-V2 offload for the marketing (mktg)
group and RADIUS pass-through authentication for members of engineering. This example assumes
that engineering members are using DNS-style naming, such as is used with EAP-TLS. A switch server
certificate is also required.
1. Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type
the following command:
DWS-1008# set radius server r1 address 10.1.1.1 key starry
2. Configure the server group sg1 with member r1. Type the following command:
DWS-1008# set server group sg1 members r1
3. To authenticate all 802.1X users of SSID bobblehead in the group mktg using PEAP on the
switch and MS-CHAP-V2 on server sg1, type the following command:
DWS-1008# set authentication dot1x ssid bobblehead mktg\* peap-mschapv2 sg1
D-Link DWS-1008 User Manual
Authentication