topic Re: WLC domain user authentication in Wireless

WLC domain user authentication

jong_r0602 — Sat, 03 Jul 2021 22:51:23 GMT

Hi Guru's

Im having a problem in configuring my WLC domain users. I have ACS v3.3 and WLC 4112.

I followed this instruction but still i keep on authenticating whenever i tried to connect my Laptop to certain SSID. And also, the windows login prompt me only once. Please help me

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml#manual

thanks.

Re: WLC domain user authentication

andrew.prince — Tue, 13 May 2008 09:02:46 GMT

Emmanuel,

What kind of 802.1x authentication are you trying, LEAP, PEAP, EAP-FAST ???? Theses are all depnedant on specific factors in the WLC, ACS & remote device?

Re: WLC domain user authentication

jong_r0602 — Tue, 13 May 2008 23:08:20 GMT

Hi Andrew,

Thanks for the response,

Im currently using PEAP. im able to connect but it keep saying "attempting to authenticate"

I dont know what is the point of failure here. Appreciate your help

Thanks,

Jong

Re: WLC domain user authentication

andrew.prince — Wed, 14 May 2008 07:29:15 GMT

What is the error message if any in the ACS logs?

Re: WLC domain user authentication

jong_r0602 — Wed, 14 May 2008 09:39:53 GMT

it says, user access filtered

Re: WLC domain user authentication

jong_r0602 — Wed, 14 May 2008 22:53:36 GMT

Here's also the log's on my WLC

Its saying "00:0e:35:c0:78:d3 /user 'unknown'" but my login works fine in other device AAA client using external DB also.

Log System Time Trap

0 Wed May 14 23:47:03 2008 RADIUS server 202.162.160.253:1812 failed to respond to request (ID 138) for client 00:0e:35:c0:78:d3 / user 'unknown'

Thanks,

Jong

Re: WLC domain user authentication

jong_r0602 — Thu, 15 May 2008 00:11:41 GMT

Do i need to enable the IPsec?

Re: WLC domain user authentication

Scott Fella — Thu, 15 May 2008 00:43:18 GMT

Verify the shared secret key between the ACS and the WLC.

Re: WLC domain user authentication

andrew.prince — Thu, 15 May 2008 08:13:31 GMT

Have you configured the ACS server to accept authentication requests from the WLC?

Re: WLC domain user authentication

jong_r0602 — Thu, 15 May 2008 23:30:28 GMT

yes i have configured my ACS server to authenticate the user's request via AD.

Sometimes the ACS said that my login is authenticated but sometimes failed. And it takes a long time (10-15 min) to reauthenticate again. And WLC saying "Radius not responding. But sometimes its good.

Re: WLC domain user authentication

SHANNON WYATT — Sat, 17 May 2008 00:44:20 GMT

Have you configured the ACS server to use PEAP? Do you have a certificate on the ACS server (not the self signed cert, but one from a CA?)

Re: WLC domain user authentication

jong_r0602 — Sat, 17 May 2008 10:00:30 GMT

yes i have configured PEAP and LEAP on my ACS. Our systems admin configured a certicate and that's what im using on my ACS. But when im get connected, its suddenly disconnected. Im using 8

Re: WLC domain user authentication

SHANNON WYATT — Sat, 17 May 2008 15:08:20 GMT

Get your config working with LEAP first. Since LEAP doesn't require Certs it eliminates any cert issues. Test with local accounts on the ACS as that removes any issue between the ACS and AD. Also make sure you have the appropriate drivers on the clients.

Re: WLC domain user authentication

nrparks024 — Sat, 17 May 2008 23:07:08 GMT

run a debug on the controller. debug client and then debug aaa events enable. this should lead you in the direction to see what and where it is failing.

Re: WLC domain user authentication

jong_r0602 — Tue, 20 May 2008 06:41:11 GMT

I think my authentication is now been resolved. But i still have a problem, whenever the user logout on the workstation the session will disconnect to the network. Is there a way to make the connection still connected?

Thanks

Jong

Re: WLC domain user authentication

SHANNON WYATT — Tue, 20 May 2008 10:17:49 GMT

Yes, if you are using the Microsoft Zero Config client you need to select the option to authenticate as a computer as available. You should see in your logs either a pass or fail as "host\computername".

If you are using another client (Intel, Cisco, etc), you may or may not be able to make this work. I know on the Intel you can make a persistent connection.

Re: WLC domain user authentication

jong_r0602 — Wed, 21 May 2008 04:03:38 GMT

Hi,

I tried and it said "Machinea authentication is not permitted". What action should i need to do next?

Thanks,

Jong

Re: WLC domain user authentication

SHANNON WYATT — Wed, 21 May 2008 10:26:46 GMT

What said "Machine Authentication is not permited"?

Make sure that ACS has it enabled:

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml

Re: WLC domain user authentication

jong_r0602 — Thu, 22 May 2008 22:51:44 GMT

Yes, I thinks this will work. I'll let you know once I implemented the config.

Good document!

Thanks,

Jong

Re: WLC domain user authentication

jong_r0602 — Thu, 29 May 2008 02:44:29 GMT

Thanks so much for helping me.

Regards,

Jong