<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I have found a Cisco document (FAQ-Wireless-Security.pdf) with the following statement:</div><div><br class="webkit-block-placeholder"></div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 14px/normal Helvetica; "><b>Q. Why does MAC authentication not work with Wi−Fi Protected Access</b><span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 14px/normal Helvetica; "><b>(WPA) in Cisco IOS Software Release 12.3(8)JA2?</b><span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; "><b>A.</b> The only level of security for MAC authentication is to check the MAC address of the<span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; ">client against a list of permitted MAC addresses. This is considered very weak. In earlier<span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; ">Cisco IOS Software releases, you could configure MAC authentication and WPA to encrypt<span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; ">the information. But because WPA itself has a MAC address that checks, Cisco decided not<span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; ">to allow this type of configuration in later Cisco IOS Software releases and decided only to<span style="font: 12.0px Helvetica"> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 11px/normal Times; ">improve security features.<span style="font: 12.0px Helvetica"> </span></div><div><br class="webkit-block-placeholder"></div><div>Regards,</div><div><br class="webkit-block-placeholder"></div><div>John</div>
</div><br><div><div>On 5 Feb 2008, at 20:04, <a href="mailto:A.L.M.Buxey@lboro.ac.uk">A.L.M.Buxey@lboro.ac.uk</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi,<br><br><blockquote type="cite">When installing FreeRadius 2.0.1, the only thing you should need is to add <br></blockquote><blockquote type="cite">this to /etc/raddb/users<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">username<span class="Apple-tab-span" style="white-space:pre"> </span>Cleartext-Password := "thepassword"<br></blockquote><br>..and the clients file (and maybe even the firewall on the server! ;-) )<br>so that the AP acting as a NAS can talk to FR :-)<br><br><blockquote type="cite">...and it should work. If it doesn't, by far the most likely explanation is <br></blockquote><blockquote type="cite">that you have the Cisco AP configured incorrectly; you will need to examine <br></blockquote><blockquote type="cite">the Cisco documentation, this is not a Cisco support list.<br></blockquote><br>agreed.<br><br>alan<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></body></html>