Proxim ORINOCO AP-2000 - Manual (Page 78)

78
Performing Advanced Configuration
RADIUS Profiles
Configuring RADIUS Profiles on the AP define a profile for RADIUS Servers used by the system or by a VLAN. The
network administrator can define RADIUS Servers per Authentication Mode and per VLAN .
The AP communicates with the RADIUS server defined in a profile to provide the following features:
– MAC Access Control Via RADIUS Authentication
– 802.1x Authentication using RADIUS
– RADIUS Accounting
Also, RADIUS Based Management Access allows centralized user management.
The network administrator can configure default RADIUS authentication servers to be used on a system-wide basis, or
in networks with VLANs enabled the administrator can also configure separate authentication servers to be used for
MAC authentication, EAP authentication, or Accounting in each VLAN. You can configure the AP to communicate with
up to six different RADIUS servers per VLAN/SSID:
•
Primary Authentication Server (MAC-based authentication)
• Back-up Authentication Server (MAC-based authentication)
• Primary Authentication Server (EAP/802.1x authentication)
• Back-up Authentication Server (EAP/802.1x authentication)
• Primary Accounting Server
• Back-up Accounting Server
The back-up servers are optional, but when configured, the AP will communicate with the back-up server if the primary
server is off-line. After the AP has switched to the backup server, it will periodically check the status of the primary
RADIUS server every five (5) minutes. Once the primary RADIUS server is again online, the AP automatically reverts
from the backup RADIUS server back to the primary RADIUS server. All subsequent requests are then sent to the
primary RADIUS server.
You can view monitoring statistics for each of the configured RADIUS servers.
RADIUS Servers per Authentication Mode and per VLAN
The user can configure separate RADIUS authentication servers for each authentication mode and for each SSID
(VLAN). For example:
•
the user can configure separate RADIUS servers for RADIUS MAC authentication and 802.1x authentication
• the user can configure separate RADIUS servers for each VLAN: the Sales VLAN could support only WEP clients,
whereas the Marketing VLAN could support 802.1x and WEP clients.
Figure 4-20 RADIUS Servers per VLAN
This figure shows a network with separate authentication servers for each authentication type and for each VLAN. The
clients in VLAN 1 are authenticated using the authentication servers configured for VLAN 1. The type of authentication
AP