Cisco 2100 Series Configuration Manual page 466

Adding Mesh Access Points to the Mesh Network
Configuring RADIUS Servers
For details on configuring ACS and non-ACS servers, usernames and importing EAP-FAST certificates,
refer to the "Configuring the RADIUS Server" section in Chapter 6 of this configuration guide.
For additional configuration details on Cisco ACS servers, refer to the following links:
Note
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_installation_and_configuration_gu
ides_list.html
http://www.cisco.com/en/US/products/sw/secursw/ps4911/tsd_products_support_series_home.html
(UNIX)
Adding a Username to a RADIUS Server
Add MAC addresses of mesh access point that are authorized and authenticated by external RADIUS
servers to the user list of that server prior to enabling RADIUS authentication for a mesh access point.
For remote authorization and authentication, EAP-FAST uses the manufacturer's certificate (CERT) to
authenticate the child mesh access point. Additionally, this manufacturer certificate-based identity
serves as the username for the mesh access point in user validation.
For IOS-based mesh access points (1130, 1240, 1522, 1524), in addition to adding the MAC address to
the user list, you need to enter the platform_name_string–Ethernet_MAC_address (for example,
c1240-001122334455). The controller first sends the MAC address as user name; if this first attempt
fails, then the controller sends the platform_name_string–Ethernet_MAC_address as user name.
If you only enter the platform_name_string–Ethernet_MAC_address to the user list, you will see a
Note
first-try failure log on the AAA server; however, the IOS-based mesh access point will still be
authenticated.
Using the GUI to Enable External Authentication of Mesh Access Points
Using the controller GUI, follow these steps to enable external authentication for a mesh access point.
Click Wireless > Mesh to open the Mesh page (see
Step 1
Cisco Wireless LAN Controller Configuration Guide
8-14
(Windows)
Chapter 8 Controlling Mesh Access Points
Figure 8-9).
OL-17037-01