cisco IOS's limited RADIUS server abilities

[xyyz]

i was reading the later versions of IOS made the routers into small RADIUS servers. i've been scouring the net for examples, but so far i haven't found anything.

can anyone shed any light on this?

 

[cpals]

Not sure about the routers, but the AP's we have feature a local radius server feature.

 

[xyyz]

the 1100's? don't they use IOS nowdays?

 

[Goosemaster]

Originally posted by: cpals
Not sure about the routers, but the AP's we have feature a local radius server feature.

really? cool.


So wher do they get authentication confirmation from? They don't store any data locally do they?

 

[nightowl]

The routers can be set up as radius servers as well as the APs. I have my 350 AP set up for Radius doing EAP-FAST right now.

 

[randal]

So wher do they get authentication confirmation from? They don't store any data locally do they?

Yes, they do. I had the opportunity to work with some 350s many moons ago and they were very easy to turn into radius servers with locally-stored profiles.

 

[Goosemaster]

I have a cisco 2610 with 12.3 IP IOS. Can I use it as a radius server?

 

[ScottMac]

I'm pretty sure that you can't.

The APs running IOS (for Cisco APs) have a small (50 entry) RADIUS server built into the code.

Standard Router or Switch IOS doesn't have this code.

The APs can do LEAP & EAP-FAST or regular username/password (maybe MD5 too) ... the AP won't take an authentication cert, so PEAP & EAP-TLS are not available (from the AP's RADIUS).

FWIW

Scott

 

[Goosemaster]

Originally posted by: ScottMac
I'm pretty sure that you can't.

The APs running IOS (for Cisco APs) have a small (50 entry) RADIUS server built into the code.

Standard Router or Switch IOS doesn't have this code.

The APs can do LEAP & EAP-FAST or regular username/password (maybe MD5 too) ... the AP won't take an authentication cert, so PEAP & EAP-TLS are not available (from the AP's RADIUS).

FWIW

Scott

 

[nightowl]

Some Cisco routers can be configured as a Radius server just like the APs. Just look and see if you have the "radius-server local" command to see if you can turn on the server. If it is not there you might need to up the IOS version.

 

[Goosemaster]

Originally posted by: nightowl
Some Cisco routers can be configured as a Radius server just like the APs. Just look and see if you have the "radius-server local" command to see if you can turn on the server. If it is not there you might need to up the IOS version.

thanks