Пример конфигурации точки доступа Cisco Aironet 1242AG [01.02.2007]
hostname AP1242AG
enable secret 5 $1$6rSf$8ehUHs1squp3KoV1NX3aR1
ip subnet-zero
no aaa new-model
dot11 ssid AP1242AGSSID
authentication open
guest-mode
power inline negotiation prestandard source
username Cisco password 7 14341B180F0B
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption key 1 size 128bit 7 76003767BE9C601C0D02573EC038 transmit-key
encryption mode wep mandatory
ssid AP1242AGSSID
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
no shutdown
encryption key 1 size 128bit 7 6B48597012974856427E9D212655 transmit-key
encryption mode wep mandatory
ssid AP1242AGSSID
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
hold-queue 160 in
interface BVI1
ip address 192.168.0.2 255.255.255.0
no ip route-cache
ip default-gateway 192.168.0.1
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
control-plane
bridge 1 route ip
line con 0
password 7 08607D7D2A3F3129
login
line vty 0 15
password 7 054A373C026A7A37
login
end
Доступ для беспроводных устройств, поддерживающих LEAP-идентификацию, можно настроить через RADIUS-сервер. Точка доступа Cisco Aironet 1242AG умеет работать в качестве простого RADIUS-сервера для небольшой сети. Настраивается он очень просто:
configure terminal
dot11 ssid AP1242AGSSID
no authentication open
authentication network-eap radius_eap
end
radius-server local
nas 192.168.0.2 key 12345 (IP-адрес самой точки доступа)
user 7920 password 12345
end
Несколько точек доступа могут использовать одну из них (ту, чей IP-адрес указывается в настройке) в качестве сервера идентификации — нужно только задать на всех один и тот же ключ.
Постоянный адрес страницы: http://www.hypercomp.ru/articles/cisco-aironet-1242ag-sample-config/
Источник
Настройка точки доступа Cisco 1242 AG с аутентификацией через RADIUS-сервер [21.02.2007]
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap-01
ip subnet-zero
ip domain name domain.com
ip name-server 192.168.0.203
aaa new-model
aaa group server radius rad_eap
server 192.168.0.203 auth-port 1645 acct-port 1646
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login default local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 vlan-name DLAN vlan 1
dot11 vlan-name TLAN vlan 2
dot11 ssid dlan
vlan 1
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
dot11 ssid tlan
vlan 2
authentication open eap eap_methods
authentication network-eap eap_methods
username admin privilege 15 password 7 074A156B6C5C0D0215573F2B26
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 2 mode wep mandatory
encryption vlan 1 mode ciphers tkip
ssid dlan
ssid tlan
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
station-role root
interface Dot11Radio0.1
encapsulation dot1Q 1
no ip route-cache
bridge-group 254
bridge-group 254 subscriber-loop-control
bridge-group 254 block-unknown-source
no bridge-group 254 source-learning
no bridge-group 254 unicast-flooding
bridge-group 254 spanning-disabled
interface Dot11Radio0.2
encapsulation dot1Q 2 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
encryption vlan 2 mode wep mandatory
encryption vlan 1 mode ciphers tkip
ssid dlan
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 254
bridge-group 254 block-unknown-source
no bridge-group 254 source-learning
no bridge-group 254 unicast-flooding
bridge-group 254 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
hold-queue 160 in
interface FastEthernet0.1
encapsulation dot1Q 1
no ip route-cache
bridge-group 254
no bridge-group 254 source-learning
bridge-group 254 spanning-disabled
interface FastEthernet0.2
encapsulation dot1Q 2 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address 192.168.0.198 255.255.255.0
no ip route-cache
ip default-gateway 192.168.0.1
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
snmp-server community OurCommunity RO
radius-server attribute 32 include-in-access-req format %h
radius-server host 192.168.0.203 auth-port 1645 acct-port 1646 key 0 1234567890
radius-server vsa send accounting
bridge 1 route ip
line con 0
password cisco
login
line vty 0 4
password cisco
login
Постоянный адрес страницы: http://www.hypercomp.ru/articles/configuring-cisco-1242ag-with-eap-over-radius/
Источник