2

I'm using a RADIUS server (NPS on Windows 2008 R2) to centrally manage authentication for a bunch of Cisco devices, including switches and wireless access points; I'm currently using RADIUS to authenticate IOS console/SSH logins, and provide administrative access to those devices to Active Directory users.

I'm planning to implement RADIUS/AD authentication for wireless users, too; the focus of this question is not how to do this, but a different problem: how can I apply different NPS policies to users accessing IOS for administrative duties, and to users accessing wireless access points? What RADIUS attributes can I filter on in order to distinguish a IOS login from a wireless login?

Improve this question

1 Answer 1

Reset to default
1

The RADIUS attribute to filter on is "NAS-Port-Type" (attribute 61); the relevant values are:

  • Administrative access:
    • Async (0) (for console access
    • Virtual (5) (for Telnet/SSH access
  • Wireless access:
    • Wireless - IEEE 802.11 (19)
    • Wireless - Other (18)

Source: http://www.iana.org/assignments/radius-types/radius-types.xml#radius-types-13

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .