Creating and Managing LDAP Profiles
Lightweight Directory Access Protocol (LDAP) is an Internet protocol that email and other programs use to look up information from a server. Use LDAP to look up encryption certificates, pointers to printers and other services on a network, in addition to providing a single logon where one user password is used for different services. LDAP authentication is appropriate for any kind of directory-like information where fast lookups and infrequent updates are used. From Network Director, you can create and manage LDAP profiles for both wireless and EX Switching ELS.
In addition to an LDAP server, you can configure a RADIUS server for both authentication and accounting purposes—for directions, see Creating and Managing RADIUS Profiles .
This topic describes:
Managing LDAP Profiles
From the Manage LDAP Profiles page, you can:
Create a new LDAP profile by clicking Add. For directions to add an LDAP profile, see Creating LDAP Profiles.
Modify an existing LDAP profile by selecting it and clicking Edit.
View information about a profile by selecting the group and clicking Details or by clicking the profile name.
Delete LDAP profiles by selecting the profile and clicking Delete.
You cannot delete profiles that are in use—that is, assigned to objects or used by other profiles. To see the current assignments for a profile, select the profile and click Details.
Clone an LDAP profile by selecting a profile and clicking Clone.
Table 1 describes the information provided about LDAP profiles on the Manage LDAP Profiles page. This page lists all LDAP profiles defined for your network, regardless of your current selected scope in the network view.
Table 1: LDAP Profile Information
Name given to the LDAP server profile when it was created.
IP address of the LDAP server.
UDP port being used by the LDAP server.
Domain using the LDAP server.
Date and time when this profile was created.
Date and time when this profile was last modified.
The username of the user who created or modified the profile.
All columns of information may not be displayed. To show or hide fields in the table, click the down arrow on the field header, select Columns, and select or clear the check box adjacent to the field that you want to show or hide.
Creating LDAP Profiles
To create an LDAP profile:
- Click in the Network Director banner.
- Under Select View, select either Logical View, Location View, Device View or Custom
Do not select Dashboard View, Datacenter View or Topology View.
- From the Tasks pane, select the type of network (Wired or Wireless), the appropriate functional area (System, AAA, or Wireless), and select the name of the profile that you want to create. For example, to create a radius profile for a wireless device, click Wireless > AAA > Radius. The Manage Profile page opens.
- Click Add to add a new profile.
The Create LDAP Profile page for the selected device family is displayed.
- Enter settings for the LDAP profile as described in Specifying Settings for an LDAP Profile.
- Click Done.
Specifying Settings for an LDAP Profile
Use the Create LDAP Profile page to define LDAP directory information services over an IP network.
Table 2 describes the LDAP settings.
Table 2: LDAP Profile Settings
Type a name for the server, using up to 64 alphanumeric characters and no special characters other than the underscore. The name must be unique among servers.
Type the IP address of the LDAP server.
Using the arrows, adjust the number of the UDP port to use for LDAP authentication messages. The default port is 389 for unencrypted LDAP servers and 636 for unencrypted LDAP servers.
|Advanced LDAP Settings|
Fully Qualified Domain Name
Type a fully qualified domain name (FQDN)—this is the complete domain name for a specific computer, or host, on the Internet. The FQDN consists of two parts: the host name and the domain name. For example, an FQDN for a server might be ldap12.example.com. The host name is ldap12, and the host is located within the domain example.com. This domain name specifies all domain levels, including the top-level domain and the root zone. A fully qualified domain name is specified with a trailing dot, for example:
Using the arrows, adjust the number of seconds before Network Director checks an LDAP server that was previously unresponsive. The default value is 5 seconds.
Using the arrows, adjust the number of seconds Network Director tries to establish connection with RADIUS server before giving an unreachable error.
Select either SASL-MD5 or SIMPLE-AUTH to establish authentication for an LDAP session.
Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols. It decouples authentication mechanisms from application protocols, in theory enabling any authentication mechanism supported by SASL to be used in any application protocol that uses SASL.
SIMPLE-AUTH sends the user's domain name and password in plain text. The server then checks the password against the password attribute in the named entry.
Tip: We recommend that connections using SIMPLE-AUTH be encrypted using Transport Layer Security (TLS).
MAC Address Format
Select None, Hyphens, Colons, One-Hyphen, or Raw to determine the MAC address format used with the LDAP server. For example:
Tip: A media access control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used as a network address for most IEEE 802 network technologies, including Ethernet.
Base domains contain no extra dots. For example, example.com is a base domain, but www.example.com is not because it contains an extra dot.
Enter a domain prefix to identify a subdomain. The subdomain name can be used to identify services, devices, or regions.
Use MAC as Password
Check this option if you want each client device to use its MAC address as its password for the LDAP server.
If you are not using individual MAC addresses as passwords for the LDAP server, provide a common password here.
Click Done to create the LDAP Server profile. The profile appears on the list on the Manage LDAP Profiles page.
What to Do Next
Link the LDAP server to an Access profile for either wireless or for Campus Switching with ELS. For directions, see Creating and Managing Access Profiles.
Assigned settings from any profile, including this one, have lower priority than settings made directly to a controller or an access point. For more information, see Adding and Managing an Individual Access Point and Configuring a Controller .