NAS Clients

The Authentication NAS Clients Screen displays all configured NAS Clients and is used to create, edit, and delete NAS Clients. NAS acts as a gateway to guard access to a network resource. A client connects to the NAS, and the NAS then connects to a AAA Server to determine whether or not the client’s supplied credentials are valid. The NAS then allows or denies access to the network resource. The network device in the infrastructure attaching with wired or wireless clients will act as a NAS client, communicating to UPAM which acts as a AAA Server.

Creating a NAS Client

Click on the Add icon to bring up the Create NAS Client Item Screen. Complete the fields as described below, then click on the Create button.

• NAS Name - The name of the NAS Client.
• Start IP Address - The starting IP of the NAS Client segment.
• End IP Address - The ending IP of the NAS Client segment.
• Shared Secret - The shared secret used by the NAS client to communicate with the Authentication Server.
• Description - An optional description for the NAS Client.
• DM-Attribute - The DM message is used to disconnect subscriber sessions in the system from a RADIUS server. The DM request message should contain necessary attributes (User Name/Calling Station ID) to identify the subscriber session.
  • User Name - The value should exactly match the subscriber name of the session.
  • Calling Station ID - The value should match the subscriber ID.

In UPAM, there is a system-defined NAS Client Item (All Managed Devices). It cannot be deleted and is used to indicate that all the devices managed by OmniVista are automatically added into the NAS Client Database of UPAM every 15 minutes and perform the AAA process.

The shared secret in the system-defined “All Managed Devices” NAS profile is “123456”. The “All Managed Devices” NAS profile works together with UPAM RADIUS Server, which is downloaded into the devices and applied if configured as a WLAN Service in the Unified Profile application.

You can create a new NAS Item in UPAM and map it to specific device for authentication. In this use case, a corresponding RADIUS Server and AAA Profile must to be created and applied to the device.

Important Notes:

• A NAS device (AOS Switch) can use multiple IP addresses to communicate with other network elements. The NAS IP that carries the user authentication request should be the same as the NAS device management IP in OmniVista. If not, you can manually create a NAS Client with the correct NAS IP address.
• For external RADIUS use cases, UPAM acts as a RADIUS proxy. The shared secret must be the same for the NAS Client, the UPAM RADIUS Server, the UPAM External RADIUS Server, and the third-party External RADUIS Server (e.g., ClearPass). The shared secret for each is configured as follows:
• NAS Client - Configured on the NAS Clients Screen (UPAM – Authentication – NAS Clients)
• UPAM RADIUS Server - Configured on the RADIUS Server Management Screen (Security – Authentication Servers - Radius)
• UPAM External RADIUS Server - Configured on the External Radius Screen (UPAM – Setting – External Radius)
• Third-Party External RADIUS Server - Configured on the Third-Party RADIUS Server.

In other words, if for example you create a NAS Client with “alcatel” as the shared secret, you must make sure the shared secret on all of the above RADIUS Servers is “alcatel”.

Editing a NAS Client

Select a NAS Client in the NAS Clients Registration List and click on the Edit icon. Edit the field(s) as described above, and click on the Apply button. Note that you cannot edit the NAS IP Address or NAS Name.

Deleting a NAS Client

Select a NAS Client in the NAS Clients Registration List and click on the Delete icon. Click OK at the Confirmation Prompt. Note that you cannot delete the “All Managed Devices” Client.

NAS Clients Registration List

The NAS Clients Registration List displays information about all configured NAS Clients.

• NAS Name - The name of the NAS Client.
• Start IP Address - The starting IP of the NAS Client segment.
• End IP Address - The ending IP of the NAS Client segment.
• Description - An optional description for the NAS Client.
• DM-Attribute - The DM message is used to disconnect subscriber sessions in the system from a RADIUS server.
  • User Name - The value should exactly match the subscriber name of the session.
  • Calling Station ID - The value should match the subscriber ID.