Cisco G XADCAIAS進(jìn)行x身份驗(yàn)證

1、Cisco 2950G 802.1X+AD+CA+IAS進(jìn)行802.1x身份驗(yàn)證要求：1.       交換機(jī)支持802.1X協(xié)議。2.       有一臺(tái)RADIUS服務(wù)器。3.       一臺(tái)客戶端。網(wǎng)絡(luò)拓?fù)洌候?yàn)證方式：PEAP驗(yàn)證：使用證書AD用戶集成認(rèn)證;環(huán)境：Operation System: Windows 2003 enterprise editionRadius Server: windows IA

2、S(Internet 驗(yàn)證服務(wù)，windows組件中安裝) CA Server: Windows CA證書服務(wù)(windows組件中安裝)Radius Client: Windows自帶。（網(wǎng)絡(luò)連接->屬性->驗(yàn)證），如果沒有“驗(yàn)證”選項(xiàng)卡，則是相關(guān)服務(wù)沒有啟用。（開始->運(yùn)行->services.msc->啟動(dòng)” Wireless Zero Configuration”服務(wù)）配置：1.       安裝域，域名暫時(shí)定為：。過(guò)程略，查看相關(guān)文檔2.     

3、;  安裝IIS(Internet信息服務(wù)),IAS,CA：控制面板>添加/刪除程序->安裝windows組件,如圖: 意先安裝IIS->CA->IAS,順序不能亂了.3.       配置CA:配置過(guò)程略,參考相關(guān)資料.4.       CISCO 2950G-48-EI交換機(jī)配置:Building configuration. Current configuration : 4944 bytes!version 12.1no s

4、ervice padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Layer_4_2!aaa new-modelaaa authentication dot1x default group radiusaaa authorization network default group radius!ip subnet-zero!spanning-tree mode mstno spanning-tree optimize bpdu transmi

5、ssionspanning-tree extend system-iddot1x system-auth-control!interface FastEthernet0/1 switchport access vlan 6!interface FastEthernet0/1.1!interface FastEthernet0/2 switchport access vlan 6!interface FastEthernet0/3 switchport access vlan 6!interface FastEthernet0/4 switchport access vlan 6 spannin

6、g-tree portfast!interface FastEthernet0/5 switchport access vlan 6 spanning-tree portfast! interface FastEthernet0/6 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/7 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/8 switchport access vlan 6 spanning-t

7、ree portfast!interface FastEthernet0/9 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/10 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/11 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/12 switchport access vlan 6 spanning-tr

8、ee portfast!interface FastEthernet0/13 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/14 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/15 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/16 switchport access vlan 6 spanning-tr

9、ee portfast!interface FastEthernet0/17 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/18 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/19 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/20 switchport access vlan 6!interface F

10、astEthernet0/21 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/22 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/23 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/24 switchport access vlan 6 spanning-tree portfast!interface F

11、astEthernet0/25 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/26 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/27 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/28 switchport access vlan 6 spanning-tree portfast!interface F

12、astEthernet0/29 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/30 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/31 switchport access vlan 6 spanning-tree portfast!interface FastEthernet0/32 switchport access vlan 6 spanning-tree portfast!interface F

13、astEthernet0/33 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/34 switchport access vlan 7 spanning-tree portfast! interface FastEthernet0/35 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/36 switchport mode access dot1x port-control auto dot1x guest

14、-vlan 21 spanning-tree portfast!interface FastEthernet0/37 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/38 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/39 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/40 switchport acces

15、s vlan 7 spanning-tree portfast!interface FastEthernet0/41 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/42 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/43 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/44 switchport acces

16、s vlan 7 spanning-tree portfast!interface FastEthernet0/45 switchport access vlan 7 spanning-tree portfast! interface FastEthernet0/46 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/47 switchport access vlan 7 spanning-tree portfast!interface FastEthernet0/48 switchport acce

17、ss vlan 7 spanning-tree portfast!interface GigabitEthernet0/1 switchport mode trunk!interface GigabitEthernet0/2!interface Vlan1 no ip route-cache!interface Vlan6 no ip route-cache shutdown!interface Vlan7 no ip route-cache shutdown!ip http serverradius-server host auth-port 1812 acct-po

18、rt 1813 key testradius-server retransmit 3radius-server vsa send authentication!line con 0line vty 0 4!monitor session 1 source interface Fa0/1monitor session 1 destination interface Fa0/43end Layer_4_2#5.       配置IAS:a)         打開IAS:b)         新建立”RADIUS客戶端”:   c)         新建訪問策略 d)         修改策略屬性6.       客戶端設(shè)置:a)     &