Host = IP address of your Radius Server (example 172.16.0.252) NAS ID = Name of the Network Access Server, in this example the Aruba Controller name (Aruba3200) NAS IP = IP Address of the Aruba Controller (172.16.0.3) Key = the secret Key passed from Controller to Radius to allow the controller to authenticate Users Names/Passwords “APPLY” at the bottom of the page to save the changes. Ensure that your Radius server has the Aruba Controller configured per the above and the controller is recognized as a NAS server within your Radius. Below we are using the controllers “Diagnostics” > “AAA Test Server” function to test Radius authentication between the controller and the Radius server using an existing Radius account (user name and password). Note – if the MSCHAPv2 fails attempt testing with “PAP” checked. Click “APPLY” at the bottom of the page and “Save Configuration” Create a Server Group - add the Radius Server The new Radius server will now be added to a Server Group While in the “Configuration” > “Security” > “Authentication” menu select the “Servers” tab Enter the name of the Server Group and select “ADD” When completed on the new Server Group created Using the pull down menu select the Radius server created in the previous step Click “Add Server” Click “Apply” and the bottom of the page Adding Radius server to the Server is completed.
Create and add an 802.1x Authentication Profile Presented are the steps necessary to define and configure an 802.1 Authentication Profile within the Controller. While in the “Configuration” > “Security” > “Authentication” menu select the “L2 Authentication tab And select and expand the “802.1X Authentication Profile” Enter the name of the new 802.1X profile (example myemployee-1x) and click ADD Now in the left column on and expand the newly created Profile Select the following (typical settings for connection of Windows networks / servers with Radius ends): Termination = check ON, the controller will terminate the EAP tunnel from the client Termination EAP-Type = eap-peap Termination EAP-Type = eap-mschapv2 “Apply” and “Save Configuration” Create the AAA Profile in the “Configuration” > “Security” > “Authentication” menu select the “AAA Profiles” tab. Select “ADD” and then the new AAA Profile name and select “Add” again (in this example “myemployee-aaa”). When completed – still in the AAA Profiles - click to expand the new AAA Profile (myemployee-aaa) that was just created. Using the pull down menu set the 802.1X Authentication Default Role to “myemployee-role” Click “Apply” at the bottom right of the panel when done With the “myemployee-aaa” still open / expanded scroll down and click on the “802.1X Authentication Profile” in the left column Using the pull down select and set the 802.1X Authentication Profile to “myemployee-1x” When completed select “APPLY” at the bottom of the page. With the “myemployee-aaa” still open / expanded scroll down and click on the “802.1X Authentication Server Group” in the left column Using the pull down select and set the 802.1X Authentication Server Group to “myemployee-serv” DO NOT FORGET to select “APPLY” at the bottom of the page and “Save Configuration”
Creating the SSID Profile In the left column scroll down and find “ADVANCED SERVICES” > “All Profiles” and click on “All Profiles” Select and click on the “Wireless LAN” to expand this section With the Wireless LAN section expanded, scroll down to find, click on and expand the “SSID Profile” Enter the name of the new SSID Profile – click “Add” Click on the new SSID Profile to configure the details Enter the Network Name (SSID) = myemployee (This is the SSID name that will be broadcast and seen in the air – example here: “myemployee”) Select “Apply” at the bottom of the page Note the Network Authentication and Encryption has not been set - select the “Advanced” tab to set these parameters Select the Encryption methods you prefer or that your WLAN will support In this example “wpa2-aes” has been selected When completed click “Apply” and “Save Configuration” Create the Virtual AP Profile Scroll down and find and click on the “Virtual AP Profile” to expand this menu section Enter the name of the new virtual AP (myemployee-vir) and click “Add” Now on and expand the new myemployee Virtual AP Profile Select and set the VLAN Users (if desired) will be placed in on “Apply” at the bottom of the page Move down the menu and click on the “AAA-Profile” within the “myemployee-vir” Virtual AP profile Using the pull down menu select the “myemployee-aaa”