THE FASCINATING WORLD OF NETWORKING

Task 1. Configuring the Authentication Server (FreeRadius installed on linux)

Step 1. Download the LISA Server image and configure it on GNS3.

Link: http://brezular.com/2010/12/18/ccnp-switch-and-gns3-part-2-2-freeradius-and-wpa-supplicant-installation-and-configuration/

NOTE Say thanks to Brezular for his excellent work.

​

Step 2. Start LISA Server on GNS3 and login to CentOS.

username/password  = root/password

 

Start the switch, but don’t configure it yet. We need Internet access to configure LISA.

​

Assign an static IP on LISA Server and add the default gateway:

   ifconfig eth0 192.168.1.5 netmask 255.255.255.0 up

   route add default gw 192.168.1.1 dev eth0  

 

NOTE 192.168.1.1 is the IP address of my DSL router. You need Internet connection to install Free Radius. Test the Internet connection by using ping 8.8.8.8

FreeRadius is installed on LISA Server (CentOS LiSa Qemu image), but if not, run the following command in root mode:

   yum install freeradius.i386

​

Step 3. Client configuration (subnet, radius key).

Modify the following file:

    vi /etc/raddb/clients.conf

Add these lines (use the Insert key of the keyboard; remove # if necessary):

#For local testing purposes

client 127.0.0.1 {

    secret = juanma

    shortname = all_subnets

    nastype = other

    }

#For local testing purposes

client 192.168.1.5 {

    secret = juanma

    shortname = all_subnets

    nastype = other

    }

#In the following configuration we choose radius server key (juanma) and access from authenticator (switch) to Radius from all #subnets (0.0.0.0/0).

client 0.0.0.0/0 {

    secret = juanma

    shortname = all_subnets

    nastype = other

    }

 

Save this file with: ESC + :wq + INTRO

​

NOTE juanma = NAS-secret (configured on Authenticator)

In this configuration we choose radius server key (juanma) and access from authenticator (switch) to Radius from all subnets (0.0.0.0/0).

 

A network access server (NAS) is a single point of access to a remote resource.  The client (supplicant) connects to the NAS (Authenticator). The NAS then connects to another resource (Radius Server) asking whether the client's supplied credentials are valid. Based on that answer the NAS then allows or disallows access to the protected resource.

​

Step 4. Users configuration.

There are 3 blocks of commands configured here for supporting different levels  of authentication.

• Privilege level 1 – user exec mode.  Username is admin and password is cisco. You get to this mode after you are successfully authenticated by Radius server during your telnet or console session.

• Privilege level 15 – this is privileged  exec mode (enable mode).  Password is cisco

• Privilege level 15 for Telnet;  mainly used by  lazy administrators who want to jump directly to level 15 . Username is admin15 and password cisco15.

Note: You need to configure aaa authorization exec default group radius in Cisco switch IOS to get level 15 for vty users.

 

a) To add users:

    vi /etc/raddb/users

    #Privilege level 1 — Normal level on Telnet; includes all user-level commands at the router> prompt

    “admin” Auth-Type == Local , User-Password == “cisco”

    Service-Type = “NAS-Prompt-User”

    #Privilege level 15 — Includes all enable-level commands at the router# prompt.

    $enab15$ Auth-Type == Local , User-Password == “cisco”

    #Privilege level 15 for Telnet; vty users get the router# prompt

    #The Command bellow is needed in IOS to get level 15 privilege working for vty users:

    #aaa authorization exec default group radius

    “admin15″  Auth-Type == Local , User-Password == “cisco15″

    Service-Type = “NAS-Prompt-User”,

    cisco-avpair = “shell:priv-lvl=15″

    #Dot1x users configuration

    “CiscoClient” User-Password == “cisco”

 

b) Configure /etc/raddb/radius.conf

    vi /etc/raddb/radius.conf

In oder to configure freeradius for EAP-MD5 , in the /etc/raddb/radiusd.conf file the authorized section must have eap :

    authorize {

    preprocess

    files

    eap

    }

    #In the authenticate section must have eap uncommented:

    authenticate {

    eap

    }

​

c) Configure the  EAP module under /etc/raddb/eap.conf  to support eap-md5 (only see, you do not have to change anything).

     vi /etc/raddb/eap.conf

       eap {

       md5 {

       }

       }

​

Step 5. Start Radius deamon (restart deamon after each change in Free Radius configuration).

    /etc/init.d/radiusd restart

NOTE: maybe this deamon is up and the authentication process fails (two Radius Servers running at the same time), so run the following command:

   killall radiusd

Enter debug mode:

   radiusd –X

If everything is right, at the end of the output we will see: “Ready to process requests”