Configuring Authentication Profiles Through the WAC's Web System

Context

In the centralized gateway solution, you can log in to the web system of the WAC to configure the authentication profiles required for wireless user access. When a standalone WAC is used, wireless authentication profiles cannot be configured or delivered through iMaster NCE-Campus. In this case, you need to log in to the web system of the WAC to configure the required wireless authentication profiles.

In the centralized gateway solution, when the built-in authentication server of iMaster NCE-Campus is used for wireless access authentication, you need to configure the mapping between authentication control points, SSIDs, and authentication profiles on the Site Configuration tab page of iMaster NCE-Campus. The configuration process is the same as that in Configuring Authentication Profiles on iMaster NCE-Campus.

Plan Example

Procedure

1. Set the authentication/authorization scheme to RADIUS authentication/authorization.

   Choose Configuration > Security Services > AAA, and click the Authentication/Authorization/Accounting Scheme tab. In the Authentication Scheme List area, click Create. Set Authentication scheme name to wlan-radius-authen and First authentication to RADIUS authentication. After the configuration is complete, click OK.

   Because RADIUS combines authentication and authorization, no authorization scheme needs to be configured.

2. Configure Portal server parameters.

   Choose Configuration > Security Services > AAA, and then choose Portal Server Global Configuration > External Portal. In the Portal Authentication Server List area, click Create. Set parameters as follows and then click OK:

   • Set the server name to wlan-portal.
   • Set the server IP address to 172.16.2.5. (After entering the IP address, click to add it to the server IP address list.)
   • Set the shared key to Admin@1234.
   • Set the URL to https://172.16.2.5:19008/portal.
   • Configure URL options:
     • Switch-MAC keyword: lsw-mac
     • User MAC address keyword: umac
     • User IP address keyword: uaddress
     • User access URL keyword: redirect-url
     • SSID keyword: ssid

3. Configure RADIUS server parameters.

   Choose Configuration > Security Services > AAA, and click the RADIUS tab. In the RADIUS Server Profile area, click Create. Set parameters as follows and then click OK:

   • Set Profile name to wlan-radius.
   • Set Profile default shared key to Admin@1234.
   • Click Create Server.
     • Set the IP address to 172.16.2.5.
     • Set the shared key to Admin@1234.
     • Select Authentication and set Source address of outgoing packets to Loopback.
   • Click Advanced. Set Called-Station-ID format to AC MAC, and select Containing the SSID.

4. Set parameters for the 802.1X profile, Portal profile, and MAC authentication profile.
   • Choose Configuration > Security Services > AAA Profile Mgmt, and click the 802.1X Profile tab. Click Create. Then, set the profile name to employee and click OK.

   • Choose Configuration > Security Services > AAA Profile Mgmt, and click the Portal Profile tab. Click Create. Then, set the profile name to guest and click OK. Select guest from the Portal profile list, set Portal authentication to External Portal server and Primary Portal server group to wlan-portal.

   • Choose Configuration > Security Services > AAA Profile Mgmt, and click the MAC Authentication Profile tab. Click Create. Then, set the profile name to dumb and click OK. Create the MAC authentication profile guest in the same way.

5. Configure authentication profile parameters. The following uses the employee authentication profile employee as an example.
   1. Choose Configuration > Security Services > AAA, and click the Authentication Profile tab. Click Create. Then, set the profile name to employee and click OK.

   1. Click next to employee to expand the list of referenced profiles.
   2. Click 802.1X Profile in the list, and set the 802.1X profile to employee. Then click Apply.

   3. In the list of referenced profiles, click Force Domain Profile and set the domain profile to default. Bind the authentication scheme profile wlan-radius-authen and RADIUS server profile wlan-radius to the domain profile default. Then click Apply.