Solved

802.1x Setup 5508 WLC

Posted on 2012-12-27
7
2,902 Views
1 Endorsement
Last Modified: 2013-01-23
Hey Experts,

I'm looking to get any additional tips to configuring 802.1x authentication over wireless on a Cisco 5508 and 1142 AP's. The config on the WLC is very straightforward: one WLAN that will use 802.1x to authenticate users. We have one ACS and AD server to handle the authentication process. I'm still verifying what type of authentication we will be doing, EAPOL, EAP-TLS, ETC

 Is the configuration on the WLC as simple as configuring the RADIUS server and enabling 802.1x for the SSID on the controller? Are there any cool testing methods in case authentication does not work? It seems pretty straight forward, but I'm looking for any gotchas that may arise that you have experienced. I'm not a wireless guy per say. If you need more info, I will gladly provide. Thanks again guys.
1
Comment
Question by:Leeeee
  • 3
  • 3
7 Comments
 
LVL 9

Expert Comment

by:newmath
Comment Utility
RADIUS out of Active Directory is pretty straight forward. If AD fails to authenticate a client, and the access points are setup for RADIUS authentication, then that client would simply not join the wireless network.
0
 
LVL 21

Accepted Solution

by:
mcsween earned 500 total points
Comment Utility
I just set this up in my environment.  You will need a Root CA and a NPS server.  I set my domain joined computers to only authenticate using only the computer certificate (smart card or other certificate in NPS).  You can setup your WiFi networks for the clients in Group Policy under Computer Config, Policies, Windows Settings, Security Settings,  Wireless Network Policies.

I set mine up to use TLS Authentication Only (Certificates) with the exception of a half dozen people that are allowed to use PEAP/EAP-MSCHAP v2.  This can be accomplished with multiple Network Policies on your NPS server.

Here are some links I used to set mine up.

This one gets you the jist of what you are doing but he doesn't use a LAG to connect the controller to the network which I strongly suggest you do.
http://araihan.wordpress.com/2010/04/30/complete-guide-to-build-a-cisco-wireless-infrastructure-using-cisco-wlc-5500-cisco-1142-ap-and-microsoft-radius-server/

Here is how Cisco wants you to do it, I used most of this and this talks about setting up the LAG.
http://www.cisco.com/en/US/docs/solutions/Enterprise/Medium_Enterprise_Design_Profile/chap4.html

This will help you get your Root CA setup (do not install this on a domain controller unless you absolutely have to)
http://technet.microsoft.com/en-us/library/cc772393(v=ws.10).aspx

Follow Other Cisco Lightweight Access Points (LAPs) about 1/2 way down to setup DHCP server to autoconfigure  your access points
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808714fe.shtml
0
 
LVL 21

Expert Comment

by:mcsween
Comment Utility
If you run into specific questions feel free to post in here and I'll help as best I can.  If this controller is going to support multiple subnets across WAN links you will also want to setup H-REAP (local switching) for the APs located outside the building where the WLC is.  If you are not familiar with the term CAPWAP read up on it and you will see why H-REAP is needed in remote offices.

http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080736123.shtml
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 5

Author Comment

by:Leeeee
Comment Utility
@mcsween, Awesome thank you. We have LAG set up from the WLC to a stack of 3750's. Let me digest some of the material in the links. We will not be using H-REAP as nothing will be traversing the WAN, at least not currently. I'm more concerned about the Microsoft side of things (they're running a PKI environment with smart cards) then the 802.1x set up on the controller.

Thanks again, I'll report back.
0
 
LVL 21

Expert Comment

by:mcsween
Comment Utility
The 802.1x setup on the controller is a piece of cake; just enter the radius server and secret on the WLC and that's it.  Configuring your NPS server can be a bit tricky if you aren't familiar with it.  

I'm not using smart cards in my environment but as I understand them, they work the exact same way as certificates.  You will still want to enable certificate auto-enrollment for your wireless computers (AD Computer objects) so they can authenticate to the wireless before the user logs on.  Once the user logs in the authentication switches over to the user or smart card.
0
 
LVL 5

Author Comment

by:Leeeee
Comment Utility
@mods, please keep this open...implementing next week..thanks
0
 
LVL 5

Author Comment

by:Leeeee
Comment Utility
Straight forward, thanks mcsween.
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
For Sennheiser, comfort, quality and security are high priority areas. This paper addresses the security of Bluetooth technology and the supplementary security that Sennheiser’s Contact Center and Office (CC&O) headsets provide.  
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now