RADIUS Configuration for Wireless Users in Cisco Packet Tracer

Radius Configuration for Wireless Users

In this Cisco Packet Tracer RADIUS Configuration example, we will configure a RADIUS Server to authenticate wireless users connected to a Wireless Router. Unlike WPA2 PSK Configuration, where wireless clients use the same pre-shared key, RADIUS-based authentication allows users to connect to the WLAN with individual usernames and passwords.

 

Firstly, we will configure the RADIUS Server, including its IP address, AAA client and user credentials. Then, we will configure the Wireless Router to communicate with the RADIUS Server. Lastly, we will configure the wireless clients and verify that they can successfully connect to the WLAN using the credentials configured on the RADIUS Server.

 

RADIUS uses UDP port 1812 for authentication and authorization and UDP port 1813 for accounting. Historically, UDP port 1645 and UDP port 1646 were used for RADIUS authentication and accounting respectively.

 

For our Wireless Radius Configuration Example, we will use the below topology:

 

 

We will follow the below steps during this configuration lesson:

1. RADIUS Server Configuration
2. Wireless Router Configuration
3. Laptop Configurations
4. Verification Tests

 

So, let’s start our configuration.

 

---

Download All Packet Tracer Labs

---

Full Packet Tracer Configurations For CCNA, CCNP & CCIE

---

RADIUS Server Configuration

First, we will configure RADIUS Server. On RADIUS Server, we will follow three sub steps. These are :

• IP Configuration
• AAA Client Configuration
• User Configuration

 

On the Config tab, on the interfaces, we will confiugre the RADIUS Server IP address. Our RADIUS Server IP address is 192.168.0.2/24 here. We will both configure ip address and subnet mask, 255.255.255.0.

 

 

After that, we will go to the Services tab and there, we will configure AAA setting. This is the key part of this configuration. We will connect Wireless Router and RADIUS Server here. Beside, we will define the users who can connect to this wireless router.

 

Client Name is the name of the Wireless Router and Client IP is the Wireless Router interface IP towards RADIUS Server. It is 192.168.0.1/24. Secret is the key used between RADIUS Server and Wireess router. And lastly, the service type is the service that we will use. RADIUS or TACACS+. We will also turn on the service by selecting “On”.

 

 

Below, in the user setup, we will define the user’s username and password. The users that are registered here, can connect to the Wireless Router anymore. Other users, will not.

 

I have used below usernames and passwords:

1.User

Username: gokhan

Password : xyz

 

2.User

Username : gheorgehagi

Password : 123

 

As you see, I like Gheorge Hagi a lot:) He is an old football player of Galatasaray and Barcelona. He is a legend.

 

---

Wireless Router Configuration

On Wireless Router, we will configure three sub level. Here, firstly we will configure IP address of the router interface. It is 192.168.0.1/24 and this interface is connected to the RADIUS Server. We can do this both on GUI tab or on Config tab. Here, we will use Config tab.

 

 

The other part is,  wireless tab. In this tab, we select the authentication method as WPA2 Authentication. We can also select other choices here. We will also set the RADIUS Server IP and the shared secret. This shared secret key is the first key that we have configured on RADIUS Server.

Here, we will not change the SSID. We will use “Default” as SSID.

 

 

---

Laptop Configurations

Laslty, we will configure Laptops. Here, firstly we should turn off the laptop and then remove the default Ethernet card. After that we drag and drop wireless Ethernet card. Then, we can turn on the laptop again.

 

 

 

To configure IP address of the laptop, we will go to desktop tab and IP configuration. Here, we will select DHCP for auto IP address configuration.

 

 

Secondly, we will configure the wireless tab for laptop. In this tab, our SSID will be “default” again. Here, we will select WPA2 Authentication and we will set user id and password. The user id is one of the users in RADIUS Server and the password is its password. In the first laptop, we will use “gokhan” as username and “xyz” as password. If we write wrong username and password, this laptop can not connect to the wireless user.

 

 

We will also configure the other two laptops. On the second laptop, we will configure other user. We will use, user “gheorgehagi” and password “123”.

 

 

In  the third one again, we will use the first user, username gokhan and password xyz.

 

---

RADIUS Configuration Verification

After completing the RADIUS Server, Wireless Router and laptop configurations, it is time to verify our RADIUS configuration on Cisco Packet Tracer. Firstly, we will check whether the laptops can successfully connect to the wireless network using the usernames and passwords configured on the RADIUS Server. A user with valid credentials should be authenticated by the RADIUS Server and allowed to connect to the WLAN.

After all these configurations, as you can see all the laptops are connected to the Wireless Server with the credentials on RADIUS Server.

 

 

After a successful connection, we can also check whether the laptop receives an IP address through the DHCP Server. Then, we can use the ping command to test connectivity with the other devices in the wireless network. Laptops got the below IP addresses

• Laptop1: 192.168.0.104
• Laptop2: 192.168.0.100
• Laptop3: 192.168.0.103

 

Let’s go to Laptop1 and ping Wireless Router and the other laptops from here.

 

C:\>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:

Reply from 192.168.0.1: bytes=32 time=25ms TTL=255

Reply from 192.168.0.1: bytes=32 time=11ms TTL=255

Reply from 192.168.0.1: bytes=32 time=9ms TTL=255

Reply from 192.168.0.1: bytes=32 time=9ms TTL=255

Ping statistics for 192.168.0.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 9ms, Maximum = 25ms, Average = 13ms

 

C:\>ping 192.168.0.100

Pinging 192.168.0.100 with 32 bytes of data:

Reply from 192.168.0.100: bytes=32 time=46ms TTL=128

Reply from 192.168.0.100: bytes=32 time=15ms TTL=128

Reply from 192.168.0.100: bytes=32 time=23ms TTL=128

Reply from 192.168.0.100: bytes=32 time=19ms TTL=128

Ping statistics for 192.168.0.100:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 15ms, Maximum = 46ms, Average = 25ms

 

C:\>ping 192.168.0.103

Pinging 192.168.0.103 with 32 bytes of data:

Reply from 192.168.0.103: bytes=32 time=33ms TTL=128

Reply from 192.168.0.103: bytes=32 time=19ms TTL=128

Reply from 192.168.0.103: bytes=32 time=20ms TTL=128

Reply from 192.168.0.103: bytes=32 time=16ms TTL=128

Ping statistics for 192.168.0.103:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 16ms, Maximum = 33ms, Average = 22ms

 

---

Testing with Incorrect RADIUS Credentials

In the first test we saw that all  the devices can connect to the Wireless Router. But what if we five incorrect RADIUS credentials? In this test, we will also test our configuration by entering an incorrect username or password on one of the laptops. Since these credentials do not match a user configured on the RADIUS Server, authentication should fail and the laptop should not successfully connect to the WLAN.

 

In Laptop1, we will enter an incorrect password to test RADIUS authentication. As soon as we change the password to an incorrect one, the wireless connection is lost because the RADIUS Server cannot authenticate the user.

 

 

As you can see, Laptop1 is no longer connected to the Wireless Router. This shows that our RADIUS authentication is working correctly. A wireless user with incorrect credentials cannot successfully connect to the WLAN.

 

Now, let’s test RADIUS authentication on Laptop2 by entering an incorrect username.

 

 

As you can see, Laptop2 loses its wireless connection after we enter an incorrect username. Since the username does not match any valid user configured on the RADIUS Server, the authentication fails and Laptop2 cannot connect to the WLAN.

 

After entering the correct username and password again, the RADIUS Server successfully authenticates the user and allows the laptop to reconnect to the wireless network.

 

---

Comparison: RADIUS vs WPA2 PSK

RADIUS and WPA2 PSK aretwo methods used to authenticate wireless clients in a WLAN. WPA2 PSK is simpler because in this solution, all wireless clients use the same pre-shared key. In other words, only one password is used to conenct the wireless network. On the other hand, RADIUS-based authentication provides centralized user authentication and allows users to have individual credentials, making it more suitable for enterprise wireless networks.

 

Let’s give a comparison table as RADIUS versus WPA2 PSK:

 

Feature	WPA2 PSK	RADIUS Authentication
Authentication	Shared Pre-Shared Key	Individual User Credentials
Username	Not Required	Required
Password	Common PSK	Individual Password
RADIUS Server	Not Required	Required
User Management	Limited	Centralized
Best For	Small / Simple WLANs	Enterprise WLANs