topic Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server in Network Security

Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

sara-borghol — Sun, 29 Dec 2024 11:47:48 GMT

Hello,

We are using access point cisco air-ap1815i-i-k9 that are connected to our network and controlled by controller of same model, we configure a RADIUS parameter in WLAN (SSID) settings, we tested the cisco controller with the RADIUS server and the authentication succeeded. But when we try to connect to access point unit using RADIUS authentication, it gives time out,

We notice that the authentication attempts from the access point doesn't reach the RADIUS server as the event viewer and log files on the RADIUS server don't show anything about these attempts.

Our RADIUS server is Microsoft.

Any help?

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

MHM Cisco World — Sun, 29 Dec 2024 11:50:10 GMT

Can i see how you config aaa server and aaa group and l2 secuirty

MHM

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

Flavio Miranda — Sun, 29 Dec 2024 12:26:23 GMT

@sara-borghol

You add the AP as supplicant. Check the link below

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-6/b_cisco_mobility_express_8_6/b_cisco_mobility_express_8_6_chapter_0111.html#task_0A9281D4762741E3985C2FE37CDDDBC9

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

sara-borghol — Sun, 29 Dec 2024 19:24:57 GMT

We install and configure Active directory, Certification Authority and NPS server, we create a wireless group and add it to the policy at the NPS

We configure the Cisco controller IP and the Cisco access point IP as RADIUS clients in the NPS
the policy as shown:

The RADIUS server, the controller, and the access point, each is on a different Vlan, but there is a routing between them and they ping each other.

We still not configure aaa group
Should I configure 802.1X feature (dot1.x) on the switch port ?

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

sara-borghol — Sun, 29 Dec 2024 19:10:38 GMT

Unfortunately, Our Cisco access point AireOS release is 8.5.140, less than 8.6 ,

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

Flavio Miranda — Sun, 29 Dec 2024 20:00:01 GMT

If you use a packet capture or wireshark and sniff the switch port where the access point is connected, does it send any radius packet at all?

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

sara-borghol — Mon, 30 Dec 2024 09:47:24 GMT

It shows some RADIUS packets with similar content as it tries connecting 5 times each time. (10.16.31.243 is the controller IP)

This is one of them

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

Flavio Miranda — Mon, 30 Dec 2024 10:43:55 GMT

If the Radius request is leaving the AP but dont make it on the NPS, you might have something in between dropping the packet.

I see Fortnet on the capture. Is it a firewall?

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

sara-borghol — Mon, 30 Dec 2024 10:55:52 GMT

Yes, it is a firewall, but the AP unit, AP Controller and RADIUS server are all on the same zone, no policies on firewall between them.

Re: Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

Flavio Miranda — Mon, 30 Dec 2024 12:45:36 GMT

You probably need to sniff the next interface the traffic would pass for. Maybe the interface where the nps is connected