• If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.
Xin chào ! Nếu đây là lần đầu tiên bạn đến với diễn đàn, xin vui lòng danh ra một phút bấm vào đây để đăng kí và tham gia thảo luận cùng VnPro.

Announcement

Collapse
No announcement yet.

Em muốn hỏi về xác thực 802.1x

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Em muốn hỏi về xác thực 802.1x

    Hiện tại em đang triển khai 802.1x với mô hình:
    Client XP-----SW 2960------IAS
    Hiện tại là xác thực từ SW với IAS thì OK rồi ví dụ phía dưới:
    --------------------
    SW-CNTT04#test aaa group radius test1 123456a@ legacy
    Attempting authentication test to server-group radius using radius
    User was successfully authenticated.

    SW-CNTT04#
    015057: *Apr 24 18:10:54.376: AAA: parse name=<no string> idb type=-1 tty=-1
    015058: *Apr 24 18:10:54.376: AAA/MEMORY: create_user (0x2BC897C) user='test1' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
    015059: *Apr 24 18:10:54.376: RADIUS: Pick NAS IP for u=0x2BC897C tableid=0 cfg_addr=0.0.0.0
    015060: *Apr 24 18:10:54.376: RADIUS: ustruct sharecount=1
    015061: *Apr 24 18:10:54.376: Radius: radius_port_info() success=0 radius_nas_port=1
    015062: *Apr 24 18:10:54.376: RADIUS/ENCODE: Best Local IP-Address 10.4.20.244 for Radius-Server 10.4.29.18
    015063: *Apr 24 18:10:54.376: RADIUS(00000000): Send Access-Request to 10.4.29.18:1812 id 1645/71, len 57
    015064: *Apr 24 18:10:54.376: RADIUS: authenticator F9 E5 1A 6C B3 41 6A 0E - EE 03 DF 33 BA 31 45 94
    015065: *Apr 24 18:10:54.376: RADIUS: NAS-IP-Address [4] 6 10.4.20.244
    015066: *Apr 24 18:10:54.384: RADIUS: NAS-Port-Type [61] 6 Async [0]
    015067: *Apr 24 18:10:54.384: RADIUS: User-Name [1] 7 "test1"
    015068: *Apr 24 18:10:54.384: RADIUS: User-Password [2] 18 *
    015069: *Apr 24 18:10:54.384: RADIUS: Received from id 1645/71 10.4.29.18:1812, Access-Accept, len 74
    015070: *Apr 24 18:10:54.384: RADIUS: authenticator D4 EF 15 40 36 AB 69 A2 - FC F8 0F 7B 24 14 4B D0
    015071: *Apr 24 18:10:54.384: RADIUS: Service-Type [6] 6 Framed [2]
    015072: *Apr 24 18:10:54.384: RADIUS: Tunnel-Medium-Type [65] 6 00:ALL_802 [6]
    015073: *Apr 24 18:10:54.384: RADIUS: Tunnel-Private-Group[81] 4 "29"
    015074: *Apr 24 18:10:54.384: RADIUS: Tunnel-Type [64] 6 00:VLAN [13]
    015075: *Apr 24 18:10:54.384: RADIUS: Class [25] 32
    015076: *Apr 24 18:10:54.384: RADIUS: 2B 43 03 59 00 00 01 37 00 01 0A 04 1D 12 01 C6 0F 77 08 A7 49 86 00 00 00 00 00 00 00 17 [ +CY7wI]
    015077: *Apr 24 18:10:54.384: RADIUS: saved authorization data for user 2BC897C at 1F91900
    015078: *Apr 24 18:10:54.384: AAA/MEMORY: free_user (0x2BC897C) user='test1' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
    --------------------------------

    Cấu hình SW của em đây ạ:
    SW-CNTT04#show run
    Building configuration...

    Current configuration : 10063 bytes
    !
    version 12.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    service sequence-numbers
    !
    hostname SW-CNTT04
    !
    boot-start-marker
    boot-end-marker
    !
    enable password 7 02150C5903094C010D4F0D140C19
    !
    username anhnc privilege 2 password 7 104D000A0618
    username shb-admin privilege 15 password 7 14041A09040B690B652937382B1D
    username cisco privilege 2 password 7 030752180500
    aaa new-model
    !
    !
    aaa authentication login default local
    aaa authentication dot1x default group radius
    aaa authorization exec default local
    aaa authorization network default group radius
    !
    !
    !
    aaa session-id common
    system mtu routing 1500
    ip subnet-zero
    !
    !
    !
    crypto pki trustpoint TP-self-signed-4276715776
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4276715776
    revocation-check none
    rsakeypair TP-self-signed-4276715776
    !
    !
    crypto pki certificate chain TP-self-signed-4276715776
    certificate self-signed 01
    30820242 308201AB A0030201 02020101 300D0609 2A864886 F70D0101 04050030
    31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
    69666963 6174652D 34323736 37313537 3736301E 170D3933 30333031 30303030
    35335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
    4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 32373637
    31353737 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
    8100C42F D1F3682C 7649FDD8 30364D6F B5AB4B82 80E9CFC1 75195E23 FC2F72F4
    F1386C3C 63107A63 F97ECAE4 A37EFA53 050D9076 2EEB6660 0190A028 616A8E82
    CB8DE052 429A943E 6ACF87F0 CD42ADCE 324BFAF8 953ED848 81392727 8FB03F00
    43A7B0D1 B45105AD C0EDD026 64EE6769 12A445B9 DDCCA505 0D32DE9B F4F4F81D
    3D0B0203 010001A3 6A306830 0F060355 1D130101 FF040530 030101FF 30150603
    551D1104 0E300C82 0A53572D 434E5454 30342E30 1F060355 1D230418 30168014
    A7828EC1 8213C249 919F6C41 AFBDF9F4 AB3BEFDB 301D0603 551D0E04 160414A7
    828EC182 13C24991 9F6C41AF BDF9F4AB 3BEFDB30 0D06092A 864886F7 0D010104
    05000381 8100A2EA 9B7BB98D 5C34BAFC D9A0E5AD 445F92A6 EC91F7A4 837F1BF4
    43AD0E46 75247098 78B39916 AA97B68E CFD57C01 AC1008E1 ACBB487E BF364CF7
    32ABB519 45E310A7 0BAFB352 5AA3EB2C 5AB47E25 19CFEAFE E9E2FF58 67FF4384
    1AFD6924 8998D952 B2ABF958 F0DE70E3 D6594024 E8600186 D2C82361 2A9F6515
    833A1A18 12E4
    quit
    !
    !
    dot1x system-auth-control
    dot1x guest-vlan supplicant
    !
    !
    !
    errdisable recovery cause udld
    errdisable recovery cause bpduguard
    errdisable recovery cause security-violation
    errdisable recovery cause channel-misconfig
    errdisable recovery cause pagp-flap
    errdisable recovery cause dtp-flap
    errdisable recovery cause link-flap
    errdisable recovery cause sfp-config-mismatch
    errdisable recovery cause gbic-invalid
    errdisable recovery cause psecure-violation
    errdisable recovery cause port-mode-failure
    errdisable recovery cause dhcp-rate-limit
    errdisable recovery cause mac-limit
    errdisable recovery cause vmps
    errdisable recovery cause storm-control
    errdisable recovery cause inline-power
    errdisable recovery cause loopback
    errdisable recovery cause small-frame
    spanning-tree mode pvst
    spanning-tree extend system-id
    !
    vlan internal allocation policy ascending
    !
    !
    !
    interface FastEthernet0/1
    description "***May tinh A Longdm***"
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/2
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/3
    description "***Lap top cua Tuan Anh***"
    switchport mode access
    switchport port-security mac-address 0026.9e94.1dfa
    spanning-tree portfast
    !
    interface FastEthernet0/4
    description "***Destop cua Tuan ANh***"
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/5
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/6
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/7
    description "***Ket noi may tinh cua Cong Anh tren tang 2***"
    switchport mode access
    switchport port-security mac-address 0019.bb43.f7ba
    spanning-tree portfast
    !
    interface FastEthernet0/8
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/9
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/10
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/11
    description ****Connect to Laptop Hoannv****
    switchport mode access
    switchport port-security
    switchport port-security mac-address 7884.3ccd.7cfa
    spanning-tree portfast
    !
    interface FastEthernet0/12
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/13
    description ***connect to PC Cuongle****
    switchport mode access
    switchport port-security maximum 4
    switchport port-security
    spanning-tree portfast
    !
    interface FastEthernet0/14
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/15
    description ***Connect to PC LoanTTT***
    switchport mode access
    switchport port-security maximum 4
    switchport port-security
    spanning-tree portfast
    !
    interface FastEthernet0/16
    description ***Connect to PC HoaNH****
    switchport mode access
    switchport port-security maximum 4
    switchport port-security
    spanning-tree portfast
    !
    interface FastEthernet0/17
    description ****Connect to PC AnhNN****
    switchport mode access
    switchport port-security maximum 10
    switchport port-security
    spanning-tree portfast
    !
    interface FastEthernet0/18
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/19
    description ****connect to Laptop MAC_ Hungdq ****
    switchport mode access
    switchport port-security maximum 2
    switchport port-security
    switchport port-security mac-address 0025.4ba2.b374
    switchport port-security mac-address 0800.27e5.f0e7
    spanning-tree portfast
    !
    interface FastEthernet0/20
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/21
    description ***connect to PC Hungdq***
    switchport mode access
    switchport port-security
    switchport port-security mac-address 20cf.3064.bc94
    spanning-tree portfast
    !
    interface FastEthernet0/22
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/23
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/24
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/25
    description ***Connect to PC Vinhmv****
    switchport mode access
    switchport port-security mac-address 0024.81ca.b4a3
    spanning-tree portfast
    !
    interface FastEthernet0/26
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x reauthentication
    dot1x guest-vlan 41
    dot1x auth-fail vlan 1
    spanning-tree portfast
    !
    interface FastEthernet0/27
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/28
    switchport access vlan 29
    switchport mode access
    switchport port-security
    switchport port-security aging time 2
    switchport port-security violation restrict
    switchport port-security aging type inactivity
    macro description cisco-desktop
    spanning-tree portfast
    spanning-tree bpduguard enable
    !
    interface FastEthernet0/29
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/30
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/31
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/32
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/33
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/34
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/35
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/36
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/37
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/38
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/39
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/40
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/41
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/42
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/43
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/44
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/45
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/46
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/47
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/48
    switchport access vlan 29
    switchport mode access
    spanning-tree portfast
    !
    interface GigabitEthernet0/1
    switchport mode trunk
    !
    interface GigabitEthernet0/2
    switchport mode trunk
    !
    interface Vlan1
    ip address 10.4.20.244 255.255.255.0
    no ip route-cache
    !
    ip default-gateway 10.4.20.1
    ip http server
    ip http authentication local
    ip http secure-server
    radius-server host 10.4.29.18 auth-port 1812 acct-port 1813 key 123456789
    !
    control-plane
    !
    privilege exec level 2 show startup-config
    !
    line con 0
    password 7 104D000A0618
    line vty 0 4
    exec-timeout 1000 0
    password 7 104D000A0618
    line vty 5 15
    exec-timeout 1000 0
    password 7 104D000A0618
    !
    end

    SW-CNTT04#
    SW-CNTT04#
    -----------------------------------------
    Nhưng khi xác thực trên client toàn báo lỗi "Authentication fail"

  • #2
    Bạn tham khảo : http://www.cesnet.cz/doc/techzpravy/...uthentication/

    Mình không biết bạn cấu hình Authen server đã đúng chưa ? Trong link là cách cấu hình Radius server sử dụng ACS, chứ ko dùng IAS .
    Trịnh Anh Luân
    - Email : trinhanhluan@vnpro.org
    - Search my site
    - Search VNPRO.ORG

Trung Tâm Tin Học VnPro
Địa chỉ: 149/1D Ung Văn Khiêm P25 Q.Bình thạnh TPHCM
Tel: (08) 35124257 (5 lines)
Fax: (08) 35124314

Home page: http://www.vnpro.vn
Support Forum: http://www.vnpro.org
Network channel: http://www.dancisco.com
  • Chuyên đào tạo quản trị mạng và hạ tầng Internet
  • Phát hành sách chuyên môn
  • Tư vấn và tuyển dụng nhân sự IT
  • Tư vấn thiết kế và hỗ trợ kỹ thuật hệ thống mạng

Blog: http://www.vnpro.org/blog
Wifi forum: http://www.wifipro.org

Comment


  • #3
    đưa cái này lên cho học hỏi thêm nè...
    authentication với XP sp3 trở lên nhé



    !
    Current configuration : 10130 bytes
    !
    version 12.2
    no service pad
    service timestamps debug uptime
    service timestamps log uptime
    no service password-encryption
    !
    hostname BD-Floor1-Switch-3
    !
    boot-start-marker
    boot-end-marker
    !
    enable password vvvvv
    !******************************
    aaa new-model
    !
    !
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    !
    !
    !
    aaa session-id common
    system mtu routing 1500
    vtp mode transparent
    ip subnet-zero
    !
    !
    !
    crypto pki trustpoint TP-self-signed-2436013824
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-2436013824
    revocation-check none
    rsakeypair TP-self-signed-2436013824
    !
    !
    crypto pki certificate chain TP-self-signed-2436013824
    certificate self-signed 01
    3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
    31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
    69666963 6174652D 32343336 30313338 3234301E 170D3933 30333031 30303030
    35375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
    4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 34333630
    31333832 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
    8100F495 07C577F0 B297F6A1 5C55F72F A76EE8B0 492D94F8 1337B3A7 B5A668A9
    C3114C87 21C91E0F 51AC6E30 F3552920 712BC742 3C9AB23C A1A964A1 D8861909
    1CE37609 C6C60413 29473D79 08AB74FA D5B0109E 435109D3 E5040CC9 AD4CB84C
    FEBC0225 3500DEE0 CD445715 24F18B97 783B7CC1 B9D7D9C5 6BB47CCB 1937D495
    BA2D0203 010001A3 73307130 0F060355 1D130101 FF040530 030101FF 301E0603
    551D1104 17301582 1342442D 466C6F6F 72312D53 77697463 682D332E 301F0603
    551D2304 18301680 146891DC 76214FCB F5667ECC CD269C4C BAF71070 B8301D06
    03551D0E 04160414 6891DC76 214FCBF5 667ECCCD 269C4CBA F71070B8 300D0609
    2A864886 F70D0101 04050003 818100C5 1BDA35A1 3EE541BF 6B982F03 F580A814
    C8BCC194 41A2C496 FE81482D 637A4F1E 7F914AA9 F0AD2BED 86DBF6CA 39AD2AC0
    DC830B96 D4FB877F B0E69D65 F5CA0167 9644B7BB C649AA1F 8A4B595E 1F184621
    A0125248 F0F9B5DF 8F9B69F2 35D96545 B947FA1B 98ECBEA7 5F675AED C127F2DD
    7DB4AA30 59BDD01A 5275FDA8 FD1C34
    quit
    !
    !
    dot1x system-auth-control
    !
    !
    !
    spanning-tree mode pvst
    spanning-tree extend system-id
    !
    vlan internal allocation policy ascending
    !
    vlan 2
    !
    vlan 3
    name test
    !
    vlan 4
    name Non-Compliant
    !
    vlan 5
    name Cachly
    interface FastEthernet0/9
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/10
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/11
    switchport access vlan 2
    !
    interface FastEthernet0/12
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/13
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/14
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/15
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/16
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/17
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/18
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/19
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/20
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/21
    description "LE DOAN BINH win7 home"
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/22
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/23
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/24
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/25
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/26
    switchport access vlan 2
    switchport mode access
    dot1x pae authenticator
    dot1x port-control auto
    dot1x violation-mode protect
    dot1x timeout reauth-period 43200
    dot1x reauthentication
    spanning-tree portfast
    !
    interface FastEthernet0/27
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/28
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/29
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/30
    switchport access vlan 2
    !
    interface FastEthernet0/31
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/32
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/33
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/34
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/35
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/36
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/37
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/38
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/39
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/40
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/41
    switchport access vlan 2
    !
    interface FastEthernet0/42
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/43
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/44
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/45
    switchport access vlan 2
    switchport mode access
    shutdown
    spanning-tree portfast
    !
    interface FastEthernet0/46
    switchport access vlan 4
    !
    interface FastEthernet0/47
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface FastEthernet0/48
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface GigabitEthernet0/1
    switchport mode trunk
    !
    interface GigabitEthernet0/2
    switchport mode trunk
    !
    interface Vlan1
    ip address 192.168.48.21 255.255.255.0
    no ip route-cache
    !
    ip http server
    ip http secure-server
    snmp-server community IT-PTSC-MC RO
    snmp-server enable traps snmp linkdown linkup
    snmp-server host 172.16.2.89 version 2c IT-PTSC-MC
    radius-server host 192.168.48.2 auth-port 1812 acct-port 1813 keycccccccccc
    !

    Comment


    • #4
      Vậy cho mình hỏi là nếu khi user không có tài khoản trong database của ACS hoặc dùng domain để chứng thực khi connect vào hệ thống, thì khi đó mình có tự động gán vlan nào đó để cho user đi internet không ?

      Comment


      • #5
        Trong mô hình của em ko có CA và AD nhé chỉ có radius server(IAS)thôi, và user là được tạo trên local của IAS. Mỗi lần cắm PC vào cổng nó hỏi user/pass rồi nhưng gõ vào là nó bảo "Authencation fail" luôn . Mà với acount em test trên Sw bằng câu lệnh "test" thì OK.
        Giờ ko biết làm cách nào nữa:50::50::50::50::50::50::50::50::50::50::50::50 ::50::50::50::50::50::50::50:

        Comment


        • #6
          IAS thì mình đã từng làm thử rồi, nhưng có 1 điều bất tiện của IAS trên 2k3 là nó chỉ có thể gán vlan cho user cùng với IAS server thôi.

          Comment


          • #7
            Nếu như bạn dùng soft cisco ACS thì rất là ok.Có thể làm tất cả các thiết bị.

            Comment


            • #8
              vậy bạn CCnMS dùng IOS gì cho con 2960 đấy ?

              Comment


              • #9
                Originally posted by mystery1983 View Post
                vậy bạn CCnMS dùng IOS gì cho con 2960 đấy ?
                Cảm ơn bạn mình đang dùng Sw 2960(c2960-lanbasek9-mz.122-44.SE6).
                bạn nói như trên là "Vlan user phải cùng vlan IAS" điều này mình thấy hơi bất tiện và vô lý. Trong thực tế user nằm ở các vlan khác nhau và khác với vlan server.
                YM của mình là: phamduchanh83
                Rất muốn hỏi thêm bạn về con IAS.
                Last edited by CCnMS; 21-12-2011, 09:14 AM.

                Comment


                • #10
                  Em muốn nó xác thực được đã chứ chưa muốn đến phần gán VLAN, giờ dùng cứ type acount vào là báo "Authentication failed"

                  Comment


                  • #11
                    Chào bạn,

                    Bạn xem lại 2 phần :

                    Cấu hình trên Sw :
                    Cấu hình xác thực dot1x cho cổng f0/x trên Switch

                    - Bật AAA:
                    Switch(config)#aaa new-model

                    - Chỉ ra RADIUS Server được sử dụng để xác thực:
                    Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

                    - Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
                    Switch(config)#aaa authentication dot1x default group radius

                    - Bật dot1x trên Switch và trên cổng đấu với Client:
                    Switch(config)#dot1x system-auth-control
                    Switch(config)#int f0/1
                    Switch(config-if)#dot1x port-control auto


                    Và xem cách cấu hình server authen đúng chưa ?
                    Trịnh Anh Luân
                    - Email : trinhanhluan@vnpro.org
                    - Search my site
                    - Search VNPRO.ORG

                    Trung Tâm Tin Học VnPro
                    Địa chỉ: 149/1D Ung Văn Khiêm P25 Q.Bình thạnh TPHCM
                    Tel: (08) 35124257 (5 lines)
                    Fax: (08) 35124314

                    Home page: http://www.vnpro.vn
                    Support Forum: http://www.vnpro.org
                    Network channel: http://www.dancisco.com
                    • Chuyên đào tạo quản trị mạng và hạ tầng Internet
                    • Phát hành sách chuyên môn
                    • Tư vấn và tuyển dụng nhân sự IT
                    • Tư vấn thiết kế và hỗ trợ kỹ thuật hệ thống mạng

                    Blog: http://www.vnpro.org/blog
                    Wifi forum: http://www.wifipro.org

                    Comment


                    • #12
                      Originally posted by luancb View Post
                      Chào bạn,

                      Bạn xem lại 2 phần :

                      Cấu hình trên Sw :
                      Cấu hình xác thực dot1x cho cổng f0/x trên Switch

                      - Bật AAA:
                      Switch(config)#aaa new-model

                      - Chỉ ra RADIUS Server được sử dụng để xác thực:
                      Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

                      - Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
                      Switch(config)#aaa authentication dot1x default group radius

                      - Bật dot1x trên Switch và trên cổng đấu với Client:
                      Switch(config)#dot1x system-auth-control
                      Switch(config)#int f0/1
                      Switch(config-if)#dot1x port-control auto


                      Và xem cách cấu hình server authen đúng chưa ?
                      Thực sự là không biết sai ở đâu, cái lab của mình chỉ khác lab khuyến cáo là mình ko dùng user của AD mà dùng tạo user bằng tay trên con IAS thôi. Mình dùng câu lệnh "test" (được bôi đỏ phía trên) thì thấy "access-accept" thì mình nghĩ là phần radius server không có vấn đề gì.
                      Nhưng xác thực tại client cứ báo lỗi :50::50::50::50::50::50::50::50::50::50::50::50::5 0::50::50::50::50::50::50::50::50::50::50:

                      Comment


                      • #13
                        Originally posted by luancb View Post
                        Chào bạn,

                        Bạn xem lại 2 phần :

                        Cấu hình trên Sw :
                        Cấu hình xác thực dot1x cho cổng f0/x trên Switch

                        - Bật AAA:
                        Switch(config)#aaa new-model

                        - Chỉ ra RADIUS Server được sử dụng để xác thực:
                        Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

                        - Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
                        Switch(config)#aaa authentication dot1x default group radius

                        - Bật dot1x trên Switch và trên cổng đấu với Client:
                        Switch(config)#dot1x system-auth-control
                        Switch(config)#int f0/1
                        Switch(config-if)#dot1x port-control auto


                        Và xem cách cấu hình server authen đúng chưa ?
                        Thực sự là không biết sai ở đâu, cái lab của mình chỉ khác lab khuyến cáo là mình ko dùng user của AD mà dùng tạo user bằng tay trên con IAS thôi. Mình dùng câu lệnh "test" (được bôi đỏ phía trên) thì thấy "access-accept" thì mình nghĩ là phần radius server không có vấn đề gì.
                        Nhưng xác thực tại client cứ báo lỗi :50::50::50::50::50::50::50::50::50::50::50::50::5 0::50::50::50::50::50::50::50::50::50::50:

                        Comment


                        • #14
                          bác nào đáo qua topic thì giúp em với:50::50::50::50::50::50::50::50::50::50:

                          Comment

                          • Working...
                            X