Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Is current WLC 5500 Device Certificate required for EAP-TLS to work?

Posted on 2016-10-27
2
Medium Priority
?
115 Views
Last Modified: 2016-10-27
In the document below I see that WLC device certificate be installed on the Cisco WLC as part of the overall getting EAP working process. If the device certificate expires - what would be the impact of any configured EAP-TLS? PEAP? It seems like I've read elsewhere that the certificates that mattered for EAP-TLS were on the wireless client and at the RADIUS server.

You can view the device certificate via WLC GUI at Security/IPSec Certs/ID Certs.

http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
0
Comment
Question by:amigan_99
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 47

Accepted Solution

by:
Craig Beck earned 2000 total points
ID: 41863320
You only need a certificate on the WLC if you're doing local EAP or web-auth.

To process EAP-style authentication with RADIUS it's not necessary to have a certificate on the WLC; only on the RADIUS server. Depending on the type of EAP authentication used you may also need a certificate on the client too.
1
 
LVL 1

Author Closing Comment

by:amigan_99
ID: 41863355
That explains exactly what I saw among a group of WLC's - some with expired certs and some not. And it turns out the ones with good certs were doing EAP-TLS but with local EAP. Thank you very much for clarifying this!
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.
In this article, we’ll look at how to deploy ProxySQL.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

671 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question