Creating and Managing Authentication Profiles

This topic describes:

Managing Authentication Profiles

• Create a new Authentication profile by clicking Add. For directions, see Creating an Authentication Profile.
• Modify an existing profile by selecting it and clicking Edit.
• View information about a profile, including the interfaces it is associated with, by clicking the profile name or by selecting the profile and clicking Details.
• Delete an Authentication profile by selecting a profile and clicking Delete.

  Note: You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.

• Clone a profile by selecting a profile and clicking Clone.

Table 79 describes the information provided about Authentication profiles on the Manage Authentication Profiles page. This page lists all Authentication profiles defined for your network, regardless of the scope you selected in the network view.

Creating an Authentication Profile

In Network Director, you can create an Authentication profile to configure methods to be used to authenticate users. You can also specify details about the accounting servers to be used for accounting purposes.

For an Authentication profile, you must specify the following:

• A profile name
• At least one access rule

After you create an Authentication profile, you can include it in a WLAN profile or a Port profile. The Authentication profile specified in a WLAN profile or a Port profile acts as the default profile for all the users and devices that connect to that WLAN or on the port.

Procedure

1. Click in the Network Director banner.
2. Under Select View, select either Logical View, Location View, Device View or Custom Group View.

   Note: Do not select Dashboard View, Datacenter View or Topology View.

3. From the Tasks pane, select the type of network (Wired or Wireless), the appropriate functional area (System, AAA, or Wireless), and select the name of the profile that you want to create. For example, to create a radius profile for a wireless device, click Wireless > AAA > Radius. The Manage Profile page opens.
4. Click Add to add a new profile.

   Procedure

   If you chose to create a profile for the wired network, Network Director opens the Device Family Chooser window.

   1. From the Device Family Chooser, select the device family for which you want to create a profile. The available device families are Switching (EX), Campus Switching ELS (Enhanced Layer 2 Software), Data Center Switching Non ELS and Data Center Switching ELS.
   2. Click OK.

      The Create Authentication Profile page for the selected device family is displayed.

   If you chose to create a profile for the wireless network, Network Director opens the Create Authentication Profile for Wireless page.

5. Specify authentication settings by doing one of the following:
   • For EX Series switches, Campus Switching Enhanced Layer 2 Software, or Data Center Switching profiles, specify the settings as described in Specifying Authentication Settings for Switches.
   • For controllers, specify the settings as described in Specifying Authentication Settings for Wireless.
6. Click Done to save the Authentication profile.

   The system saves the Authentication profile and displays the Manage Authentication Profiles page. Your new or modified Authentication profile is listed in the table of Authentication profiles.

Specifying Authentication Settings for Switches

To configure an Authentication profile for switching devices, enter the Create Authentication Profile page settings described in Table 80 for creating Authentication profiles on switches. Required settings are indicated by a red asterisk (*) that appears next to the field label in the user interface.

To skip configuring the advanced settings and accept the default settings, click Done. You can now link the Authentication profile to a Port profile. For directions, see Creating and Managing Port Profiles.

To configure advanced switch settings, click Advanced Settings and enter the Advanced Settings described in Table 81.

Click OK.

The Advanced Settings window closes and you once again see the Create Authentication Profile for Switching page.

Click Done.

The Manage Authentication Profiles page reappears with your new Authentication profile listed.

You can now link the Authentication profile to a Port profile. For more details, see Creating and Managing Port Profiles.

Specifying Authentication Settings for Wireless

While configuring an Authentication profile for wireless devices, you define one or more access rules. Each access rule is specific to an access type or authentication mechanism, such as 802.1X, MAC, Web, and open authentication. All authentication mechanisms are supported in a chain and are allowed in any sequence with one exception—Web authentication and Open authentication must not be configured simultaneously in one Authentication profile.

Procedure

1. Enter the wireless authentication settings described in Table 82. Required settings are indicated by a red asterisk (*) that appears next to the field label in the user interface.

   Table 82: Authentication Profile Wireless Settings

   Field	Description
   Profile Name	Type the name of the profile. You can use up to 32 characters for profiles created for wireless devices. Profile name must not contain special characters or spaces. Note that profiles that are automatically created by Network Director as part of device discovery or out-of-band changes might contain the underscore (_) character.
   Description	Type the description of the profile.

2. Add at least one access rule by clicking Add under Access Rule.

   The Add Access Rules window opens.

3. Enter the access rule settings described in Table 83. Required settings are indicated by a red asterisk (*) that appears next to the field label in the user interface.

   Table 83: Wireless Access Rule Settings

   Field	Description
   Access Type	Select the type of access for the rule, either 802.1X Access (default), MAC Access, Web Access, or Open Access: 802.1X Access—Select to authenticate the client using 802.1X authentication method. For more information, see Understanding the IEEE 802.11 Standard for Wireless Networks. MAC Access—Select to authenticate the client using MAC RADIUS authentication method. Web Access—Select to have the client log in to a web page before granting access to the SSID. Open Access—Select to automatically authenticate the client and enable access to the SSID requested by the client, without requiring a username and password from the client. If you select open access as the access type, you must either enable local accounting or specify an Access profile to be able to save the access rule. The remaining options in this window vary, depending on which Access Type you choose.
   Matching Glob (all)	Type the user glob for the access rule. A user glob is shorthand method for matching an authentication, authorization, and accounting (AAA) command to either a single user or a set of users. A user glob can contain up to 80 characters long and cannot include spaces or tabs. The double-asterisk (**) wildcard characters with no delimiter characters match all user names. The single-asterisk (*) wildcard character matches any number of characters up to, but not including, a delimiter character in the glob. Valid user glob delimiter characters are the at (@) sign and the period (.). Note: The matching glob value that you specify must be unique and cannot be used for any other access rules within the given authentication profile.
   EAP Type (801.X Access)	If you selected 802.1X Access, you also need to indicate an EAP type. Extensible Authentication Protocol (EAP) is a generic point-to-point protocol that supports multiple authentication mechanisms. Select the EAP type that you want to use for this access rule: PEAP Offload—Select if you want to offload all EAP processing from server groups. In this case, the RADIUS server is not required to communicate using the EAP protocols. Local EAP-TLS—Select if you want to use a local database to authenticate clients. EAP-TLS provides encryption and data integrity checking for the connection. Local EAP-TLS can only be used with Local Authentication. External Authentication Server(default)—Select if you want to use an external server for authentication. Note: If you select to use an external server for authentication, you must not select the Enable Local Authentication.
   Enable Authentication	Selected by default to enable authentication for this access rule.
   Enable Local Authentication	Select to have users authenticated against the local database on the controller. Tip: Network Director displays this check box only if you selected Enable Authentication.
   MAC Prefix (MAC Access)	If MAC Access is the access type, you can enable MAC prefix authentication.
   Enable Accounting	Select to enable accounting for this access rule and display the accounting settings. Accounting collects and sends information used for billing, auditing, and reporting. Accounting can be done using RADIUS or by using local accounting. If Enable Accounting is selected, you can configure these additional accounting parameters: Enable Local Accounting—Select if you want to enable local accounting. If you select local accounting, the accounting information is stored locally on the controller. Record Type—Select the local accounting mode to be used for this access rule: Start-Stop—When this mode is selected, a start record is generated when a user is first connected, and an update record is generated when a user roams from one wireless access point to another. A stop record is generated when a user terminates the session. Stop-Only—When this mode is selected, a stop record is generated when a user terminates the session.
   Access Profile	Specify an Access profile (default is None) to use for this access rule. Network Director displays the Access Profile field when you have enabled authentication, accounting, or both, for the given access rule. Specify an Access profile for each access rule, unless: Open Access is the access type. 802.1X Access is the access type and Local EAP-TLS as the EAP type.

4. Click OK to save and add the wireless access rule to the list of access rules in the Create Authentication Profile page. You can create one or more access rules and authenticate each user or device group differently depending on your security policy and requirements.
5. You can configure a wireless web portal by providing the information listed in Table 84.

   Table 84: Wireless Web Portal Authentication

   Web Portal Settings A web portal is a web site that brings information together from diverse sources in a uniform way. The following Web Portal settings are valid only when the corresponding WLAN Service Profile has Fall Through Access set to web-portal. See Creating and Managing a WLAN Service Profile for more information and directions.
   Web Portal Login Page	Type the name of a Web portal login page, for example, http://www.example.com. Web traffic will be directed to this location for logging into the Web portal. For more information about Web login, see “Configuring Web Portal Web AAA” in the Mobility System Software Configuration Guide. Tip: Web Portal settings are valid only when Fall Through Access is set to WEB Portal in a WLAN Service Profile. When you link this Authentication Profile to a WLAN Service Profile with Fall Through Access set to WEB Portal, the settings are used.
   Web Portal Logout	Optionally, enable Web Portal Logout, and provide the name of the Web Portal Logout Page, for example, http://www.example.com.

6. Click Done.

   The Manage Authentication Profiles for Wireless (WLC) page reappears with your new wireless Authentication profile listed. You can now link the Authentication profile to a WLAN profile. For more details, see Creating and Managing a WLAN Service Profile.

What To Do Next

• For switching devices, link the Authentication profile to a Port profile. For more details, see Creating and Managing Port Profiles.
• For wireless devices, link the Authentication profile to a WLAN profile. For more details, see Creating and Managing a WLAN Service Profile.

Related Documentation

• Understanding Authentication Profiles
• Creating and Managing Port Profiles
• Creating and Managing a WLAN Service Profile
• Network Director Documentation home page