The config file below is guaranteed to work.
I have an ACS 3.0 server doing the MAC Authentication. So you have to take the MAC address that you want to allow, throw the MAC in the user name and password fields in the ACS and just load the AP with config below and CHANGE the IP to yours or it will not work.
Please leave your comments, if this becomes popular I will start publishing different configs such as LEAP+MAC, LOCAL SERVER, WDS, HOT STANDBY, etc...
By the way at the time of this message my AP1230 had 12.2(11) JA and my 350 Client had 5.20.17 So take the time to update the firmware.
God bless America and Good luck!
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname GOM_1200IOS
!
aaa new-model
!
!
aaa group server radius rad_eap
server 10.1.2.197 auth-port 1812 acct-port 1812
!
aaa group server radius rad_mac
server 10.1.2.197 auth-port 1812 acct-port 1812
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa group server radius wlccp_rad_infra
!
aaa group server radius wlccp_rad_eap
!
aaa group server radius wlccp_rad_leap
!
aaa group server radius wlccp_rad_mac
!
aaa group server radius wlccp_rad_any
!
aaa group server radius wlccp_rad_acct
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods group rad_mac
aaa authentication login wlccp_infra group wlccp_rad_infra
aaa authentication login wlccp_eap_client group wlccp_rad_eap
aaa authentication login wlccp_leap_client group wlccp_rad_leap
aaa authentication login wlccp_mac_client group wlccp_rad_mac
aaa authentication login wlccp_any_client group wlccp_rad_any
aaa authorization exec default local
aaa authorization ipmobile default group rad_pmip
aaa accounting network acct_methods start-stop group rad_acct
aaa accounting network wlccp_acct_client start-stop group wlccp_rad_acct
aaa session-id common
enable secret 5xxxxx
!
username xxxx password xxxxx
ip subnet-zero
!
iapp standby timeout 5
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption key 1 size 40bit xxxxx transmit-key
!
ssid GOM_1230
authentication open mac-address mac_methods
!
speed basic-1.0 basic-2.0 basic-5.5 basic-11.0
rts threshold 2312
channel 2462
station-role root
no cdp enable
dot1x reauth-period server
dot1x client-timeout 600
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no cdp enable
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface BVI1
ip address xxx.xxx.220.45 255.255.255.0
no ip route-cache
!
ip default-gateway 10.250.220.254
ip http server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag/ivory/1100
ip radius source-interface BVI1
no cdp run
snmp-server community GOM_AP1230 RO
snmp-server enable traps tty
radius-server local
group AP1230
!
user xxxxx nthash 7 xxxxx group AP1230
!
radius-server host 10.1.2.197 auth-port 1812 acct-port 1812 key 7 01342929
radius-server retransmit 3
radius-server attribute 32 include-in-access-req format %h
radius-server authorization permit missing Service-Type
radius-server vsa send accounting
bridge 1 route ip
!
!
line con 0
line vty 5 15
!
end
