Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

IOS v15 Wlccp authentication infrastructure LEAP instead EAP-TLS

A customer uses autonomous wireless AP's for some smaller site's.

Usely this is no problem, yesterday i installed a new site with Cisco AP2602's running:

Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(2)JA, RELEASE SOFTWARE (fc1)

Technical Support:

Copyright (c) 1986-2012 by Cisco Systems, Inc.

Compiled Thu 23-Aug-12 02:59 by prod_rel_team

ROM: Bootstrap program is C3600 boot loader

BOOTLDR: C3600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)

When configuring the AP i noticed a few CLI warnings about the radius-server host being deprecated soon so i converted it to the new standard.

After installing the WDS AP (which isnt in WDS only mode and also accepts clients) i noticed TACACS was working and also radius for the wireless clients was working.

So everything was working fine......except when i was checking authentications i noticed the WDS AP was not being authenticated to the ACS.

The logging in the ACS showed "EAP-TLS failed SSL/TLS handshake because the client rejected the ACS local-certificate".

Since we do not use EAP-TLS for authentication of the AP's to the ACS(but LEAP) i started searching for a way to force the authentication from the AP's to LEAP instead of EAP-TLS.

I have been searching in release notes and other forums for a way to configure this but i cant find it.

Now i have "fixed" it by disabling EAP-TLS and PEAP on the ACS since the customer does not use this.

But it is possible that the customer would like to use EAP-TLS in the future therefore i would like to configure it on the AP CLI.

Several other sites running IOS v12.3(AP1232,1142 and 3502) are running the same configuration and use LEAP by default i guess since they work OK

I have changed the ACS to prefer LEAP this also works instead of disabling EAP-TLS and PEAP.

Message was edited by: Marc Groenen

CreatePlease to create content