Table of Contents
Advertisement
PAP
l
CHAP
l
ARAP
l
MS-CHAP
l
The TACACS server cannot be attributed to any SSID or wired profile in general as the authentication server
and is configured only for the IAP management users.
Dynamic Load Balancing between Two Authentication Servers
You can configure two authentication servers to serve as a primary and backup RADIUS server and enable load
balancing between these servers. Load balancing of authentication servers ensures that the authentication
load is split across multiple authentication servers and enables the IAPs to perform load balancing of
authentication requests destined to authentication servers such as RADIUS or LDAP.
The load balancing in IAP is performed based on outstanding authentication sessions. If there are no
outstanding sessions and if the rate of authentication is low, only primary server will be used. The secondary is
used only if there are outstanding authentication sessions on the primary server. With this, the load balance
can be performed across RADIUS servers of asymmetric capacity without the need to obtain inputs about the
server capabilities from the administrators.
Configuring an External Server for Authentication
You can configure RADIUS, TACACS, LDAP, and ClearPass Policy Manager servers through the Instant UI or the
CLI.
In the Instant UI
To configure an external authentication server:
1. Navigate to Security > Authentication Servers. The Security window is displayed.
2. To create a new server, click New. A window for specifying details for the new server is displayed.
3. Configure parameters based on the type of sever.
RADIUS—To configure a RADIUS server, specify the attributes described in the following table:
l
Table 33: RADIUS Server Configuration Parameters
Parameter
Name
Server
address
RadSec
156
| Authentication and User Management
Description
Enter a name for the server.
Enter the host name or the IP address of the external RADIUS server.
Set RadSec to Enabled to enable secure communication between the RADIUS server and IAP clients
by creating a TLS tunnel between the IAP and the server.
If RadSec is enabled, the following configuration options are displayed:
RadSec port—Communication port number for RadSec TLS connection. By default, the port
l
number is set to 2083.
RFC 3576—When set to Enabled, it allows the IAPs to process RFC 3576-compliant Change of
l
Authorization (CoA) and disconnect messages from the RADIUS server.
NAS IP address
l
Aruba Instant 6.5.0.0-4.3.0.0 | User Guide
Hide quick links:
Advertisement
Table of Contents
