532 Configuring AAA for network usersNN47250-500 (320657-F Version 02.01)Assigning encryption types to wireless usersWhen a user turns on a wireless laptop or PDA, the device attempts to find an access point and form an association withit. Because APs support the encryption of wireless traffic, clients can choose an encryption type to use. You canconfigure APs to use the encryption algorithms supported by the Wi-Fi Protected Access (WPA) security enhancementto the IEEE 802.11 wireless standard. (For details, see “Configuring user encryption” (page 291).)If you have configured APs to use specific encryption algorithms, you can enforce the type of encryption a user or groupmust have to access the network. When you assign the Encryption-Type attribute to a user or group, the encryption typeor types are entered as an authorization attribute into the user or group record in the local WSS database or on theRADIUS server. Encryption-Type is a Nortel vendor-specific attribute (VSA).Clients who attempt to use an unauthorized encryption method are rejected.Assigning and clearing encryption types locallyTo restrict wireless uses or groups with user profiles in the local WSS database to particular encryption algorithms foraccessing the network, use one of the following commands:set user username attr encryption-type valueset usergroup groupname attr encryption-type valueset mac-user username attr encryption-type valueset mac-usergroup groupname attr encryption-type valueWSS Software supports the following values for Encryption-Type, listed from most secure to least secure. (For userencryption details, see “Configuring user encryption” (page 291).)For example, the following command restricts the MAC user group mac-fans to access the network by using only TKIP:WSS# set mac-usergroup mac-fans attr encryption-type 4Encryption-type value Encryption algorithm assigned1 Advanced Encryption Standard using Counterwith Cipher Block Chaining MessageAuthentication Code (CBC-MAC)—orAES_CCM.2 Reserved.4 Temporal Key Integrity Protocol (TKIP).8 Wired-Equivalent Privacy protocol using104 bits of key strength (WEP_104). This is thedefault.16 Wired-Equivalent Privacy protocol using 40 bitsof key strength (WEP_40).32 No encryption.64 Static WEP
