Table of Contents
Advertisement
The dynamically-assigned RADIUS VLAN cannot be the same as the AP's management
VLAN. If the RADIUS server attempts to assign a dynamic VLAN to a client that associates
with an AP with that VLAN as the management VLAN, the AP ignores the dynamic VLAN
assignment and a newly associated client is assigned to the default VLAN for that VAP. A re-
authenticating client retains its previous VLAN ID.
The default management VLAN ID for all APs is 1. The only way to change an AP's
management VLAN ID is by using the
After you change the
apply the changes.
Configuring MAC Authentication
For each network, you can configure whether to use a local or RADIUS database for client
MAC authentication. To use RADIUS-based MAC authentication for wireless clients, you add
an entry for each client in the
Authentication on the switch is set to "Allow," only clients that have an entry in the
are allowed access to the network through the AP. If the default action is set to "deny" the
clients with a MAC address in the
The following line is an example of an entry for a client in the
00-0F-FE-1C-F2-67 Auth-Type: = Local, User-Password == "NOPASSWORD"
The password is always NOPASSWORD, and the MAC address of the client
NOTE:
uses hyphens, not colons.
set management vlan-id
file, you must restart the RADIUS server daemon to
etc/raddb/users
etc/raddb/users
file cannot authenticate with the AP.
users
FreeRADIUS Example for Wireless Client Configuration
Configuring the External RADIUS Server
command from the CLI.
file. If the default action for MAC
etc/raddb/users
file
users
file.
211
Advertisement
Table of Contents
