Technical Specs

Table Of Contents

Router (config-if)# mesh-security mesh-key lifetime 60

Mesh-Security config and keys do not appear in the CGR configuration as shown by show running-config or show

startup-config.

Note

Sample Cisco Resilient Mesh Security Configuration

The following example shows what is required for mesh-security:

aaa new-model

aaa group server radius nps-group

server name nps-radius

aaa authentication enable default none

aaa authentication dot1x default group nps-group

<...snip...>

dot1x system-auth-control

<...snip...>

interface Wpan4/1

no ip address

ip broadcast-address 0.0.0.0

no ip route-cache

ieee154 beacon-async min-interval 120 max-interval 900 suppression-coefficient 1

ieee154 panid 7224

ieee154 ssid migration_far2

ieee154 txpower -30

authentication host-mode multi-auth

authentication port-control auto

ipv6 address 2092:1:1:1::/64

ipv6 enable

ipv6 dhcp relay destination 2010:A0B0:1001:22::2

dot1x pae authenticator

mesh-security mesh-key lifetime 259200

end

radius server nps-radius

address ipv4 <IP address> auth-port 1645 acct-port 1646

key <RADIUS key>

The MTU setting on the AAA server must be set to 800 bytes or lower, because IEEE802.1x implementation in RMEs limits

the MTU to 800 bytes. RADIUS servers can use auth-port 1812 and acct-port 1813 instead of 1645 and 1646, respectively.

Note

REVIEW DRAFT - CISCO CONFIDENTIAL