Link to home
Create AccountLog in
Avatar of Leeeee
LeeeeeFlag for United States of America

asked on

802.1x Setup 5508 WLC

Hey Experts,

I'm looking to get any additional tips to configuring 802.1x authentication over wireless on a Cisco 5508 and 1142 AP's. The config on the WLC is very straightforward: one WLAN that will use 802.1x to authenticate users. We have one ACS and AD server to handle the authentication process. I'm still verifying what type of authentication we will be doing, EAPOL, EAP-TLS, ETC

 Is the configuration on the WLC as simple as configuring the RADIUS server and enabling 802.1x for the SSID on the controller? Are there any cool testing methods in case authentication does not work? It seems pretty straight forward, but I'm looking for any gotchas that may arise that you have experienced. I'm not a wireless guy per say. If you need more info, I will gladly provide. Thanks again guys.
Avatar of newmath
newmath
Flag of United States of America image

RADIUS out of Active Directory is pretty straight forward. If AD fails to authenticate a client, and the access points are setup for RADIUS authentication, then that client would simply not join the wireless network.
ASKER CERTIFIED SOLUTION
Avatar of Bradley Fox
Bradley Fox
Flag of United States of America image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
If you run into specific questions feel free to post in here and I'll help as best I can.  If this controller is going to support multiple subnets across WAN links you will also want to setup H-REAP (local switching) for the APs located outside the building where the WLC is.  If you are not familiar with the term CAPWAP read up on it and you will see why H-REAP is needed in remote offices.

http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080736123.shtml
Avatar of Leeeee

ASKER

@mcsween, Awesome thank you. We have LAG set up from the WLC to a stack of 3750's. Let me digest some of the material in the links. We will not be using H-REAP as nothing will be traversing the WAN, at least not currently. I'm more concerned about the Microsoft side of things (they're running a PKI environment with smart cards) then the 802.1x set up on the controller.

Thanks again, I'll report back.
The 802.1x setup on the controller is a piece of cake; just enter the radius server and secret on the WLC and that's it.  Configuring your NPS server can be a bit tricky if you aren't familiar with it.  

I'm not using smart cards in my environment but as I understand them, they work the exact same way as certificates.  You will still want to enable certificate auto-enrollment for your wireless computers (AD Computer objects) so they can authenticate to the wireless before the user logs on.  Once the user logs in the authentication switches over to the user or smart card.
Avatar of Leeeee

ASKER

@mods, please keep this open...implementing next week..thanks
Avatar of Leeeee

ASKER

Straight forward, thanks mcsween.