Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Autonomous AP for EAP

We've got an ACS 5.1 virtual appliance for device administration  tasks and now we want to authenticate wireless domain users, but only by  it's username/password, without trusting any CA certificates from the  AD (is it required an ACS certificate too?).

Maybe there are some steps I have missed but I cant' locate where is the problem:

This is the configuration of the AP that I have but, is it correct?

aaa group server radius rad_eap

server a.b.c.d auth-port 1812 acct-port 1646

server a.b.c.d auth-port 1645 acct-port 1646

!

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authorization exec default group rad_eap local

!

dot11 vlan-name WPA vlan 199

dot11 ssid LABREDES_CERT

   vlan 199

   authentication open eap eap_methods

   authentication network-eap eap_methods

   guest-mode

   mbssid guest-mode dtim-period 75

!

interface Dot11Radio0

  encryption vlan 199 mode ciphers tkip

....

We  have spent some days and nothing seems to work but nothing appears in  the ACS log, there are no messages in the log, and a debug (radius, aaa authentication) in the AP only  shows (AAA/BIND(0000014E): Bind i/f  )

Any help would be appreciated

1 REPLY

Re: Autonomous AP for EAP

Hi

you need to globally configure your radius servers too!

e.g.: radius-server host a.b.c.d auth 1812 acc 1646 secret

also you need to change your SSID config

dot11 ssid LABREDES_CERT

    authentication key-management wpa

Regarding the certificate: you can use PEAP with MSCHAPv2, and leave the selfsigned certificate on the ACS (so you simply disable certificate validation on your clients), but I would definitely not recommend this.

hope that helps!

Stefan

258
Views
0
Helpful
1
Replies