802.1X ACS Self Signed External Windows DB

[ricardorojas123]

I can configure the ACS server whit Self Signed and integrate it into a Windows database?

The users will be authenticate whit 802.1X configured in a WLAN in WLC4400.

[Stephen Rodriguez]

Yes, that will work.  The one caveat to this, is if you are doing PEAP, do not check the box for "validate server certificate", unless you export the cert from ACS and push to your clients.

[ricardorojas123]

Thanks Stephen Rodriguez,

I  have configured the certificate on the ACS, and I installed the  certificate in the stations, and users are authenticated on the wireless  network, but the username and password are configured on the server.

To use the windows accounts. What do I have to configure?

[Stephen Rodriguez]

You need to configure ACS to talk to AD.  in 4.x this should be under External Databases, WIndows Database, Configure.

[ricardorojas123]

Thanks Sthephen,

I have configured this in the ACS:

1. The ACS server is member server, for example LAB.

2. In External User Database / Windows Database / Configure / In the configure domain list I select the domain called LAB.

3. System Configuration/ACS Certificate Setup/Generate Self-Signed. I enter all parameter requerided and the certificate is created.

4. The certificate is installed in the wireless client and the wireless profile is configured selecting the certificate. In the windows profile of the wireless conection, I uncheck the Automatically use my Windows logon name and password, this option is disable to use the local database of the ACS.

The only configuration necessary for the integration of the ACS server whit the Windows domain. Is that the server is a member of the Windows domain and select the domain in the domain list in the acs? and check the option "Automatically use my Windows logon name and password"

[Stephen Rodriguez]

That sounds about right.  Now you can go in the database mappings and map to specific OU's if you want to get a little more granular than just the enitre forest.