topic Hello Florin, in Wireless

FlexConnect Groups 802.1x Authentication

Florin Barhala — Mon, 05 Jul 2021 07:31:44 GMT

Hi guys,

I have a vWLC running 7.5 and several locations running FlexConnect.

One SSID is using 802.1x with PEAP on Windows 2008. I have started the config with Local Switching and Central Authentication.

I defined on Security Radius the right server, setup PSK and authentication works fine, from all over the sites.

I also setup FlexConnect groups so each site's APs belong to a specific FlexConnect group. As we speak I used only the newest tab: Wlan Vlan mapping, which worked pretty fine (I found out the hard way, it's dependant of AP Groups setup).

Now I want to enable FlexConnect Local Auth and for that I configured one primary server on the FlexConnect group General Tab: I added the IP and the PSK in use. But auth now, doesn't work.

I read the documentation, still I find it pretty vague, what am I missing here? Do I still need to define each AP as Radius client on the Win_Radius_Server?

Many thanks,

Florin.

If you are testing WAN link

Rasika Nayanajith — Tue, 25 Mar 2014 19:18:48 GMT

If you are testing WAN link down scenario (where AP operate as standalone mode) then your local radius server should knows APs as it will forward the RADIUS request to server.

Do you have local RADIUS server ?

HTH

Rasika

Hi Rasika,FlexConnect is

Florin Barhala — Tue, 25 Mar 2014 19:25:46 GMT

Hi Rasika,

FlexConnect is configured for local switching and central authentication; Radius servers are configured on Security Radius. There are two: one Radius server in the same subnet with vWLC and APs and one at 4 hops away. All works fine.

But when I go to Wlan and tick Local Authentication, no client can get access to that Wlan.

Obviously I am missing some configuration, but what? To mention that both APs and vWLC are in the same subnet, and I didn't stop the vWLC yet.

When you enable this "Local

Rasika Nayanajith — Tue, 25 Mar 2014 20:26:03 GMT

When you enable this "Local Auth" option, any of your RADIUS gets any hits from client request ?

If you do "debug client <client-mac>" you would get some clue what's going on. Which state client get stuck dot1X-REQD or DHCP-REQD, etc ?

HTH

Rasika

*** Pls rate all useful responses ****

I honestly didn't check. I

Florin Barhala — Tue, 25 Mar 2014 20:30:18 GMT

I honestly didn't check. I will have a look tomorrow, but meanwhile back to my original question:

- when using FlexConnect Groups do I still need to define each of the AP group member as a Radius Client on the RADIUS Server?

YES, if you want this setup

Rasika Nayanajith — Tue, 25 Mar 2014 20:40:50 GMT

YES, if you want this setup to work even WLC is not reachable scenarios.

HTH

Rasika

Ok, so this is needed for

Florin Barhala — Wed, 26 Mar 2014 01:47:26 GMT

Ok, so this is needed for Standalone mode.

What if the WLC is still available? What are then the requirements?

If WLC availabe in your

Rasika Nayanajith — Wed, 26 Mar 2014 05:17:35 GMT

If WLC availabe in your branch & APs are in "connected mode" then RADIUS Auth requrest coming from clients are handled by WLC. So your RADIUS server should see the request coming from WLC management & not from APs directly.

In "standalone mode" APs will directly forwarded those to RADIUS server as WLC is no longer in the picture.

HTH

Rasika

**** Pls rate all useful responses ***

Thanks for the explanation

Florin Barhala — Wed, 26 Mar 2014 08:20:03 GMT

Thanks for the explanation Rasika, it makes sense.

Now back to my scenario, my first round of tests is keeping APs in connected mode. Furthermore I am using the same identical Radius Server.

It's just when I tick Local Authentication, it stops working; removing that option and switching back, it all works. From this I assume enabling Local Authentication requires additional configuration, but what am I missing?

Hi guys,2 months later and I

Florin Barhala — Tue, 13 May 2014 20:31:24 GMT

Hi guys,

2 months later and I made some steps close to this. For anyone that wants to use FlexConnect Local Authentication here are the steps:

1. Use FlexConnect Groups (General tab\AAA) and add at least one primary Radius server.

2. Make sure you add all your APs from that FlexConnect Group as Radius Clients on your Radius Server.

3. Tick FlexConnect Local Authentication in WLAN (Advanced tab)

And now it works. The question is: if one WLAN uses FlexConnect CentralAuthentication and either WLC fails or APs simply cannot access the WLC is there any method/option that all APs would automatically transition to FlexConnect LocalAuthentication?

HI Florin, Probably you have

Jaime Gonzalez Gomez — Wed, 15 Apr 2015 13:15:58 GMT

HI Florin,

Probably you have already received answer for last question but in case someone else has the same question, I would say there is no way to do that automatic transition.

Jaime

Hi mate, Thanks for dropping

Florin Barhala — Wed, 15 Apr 2015 13:18:51 GMT

Hi mate,

Thanks for dropping by; as we speak I got the same answer: no possibility for the switch over.

Hello Florin,

Aret Avedis SET — Mon, 21 Mar 2016 15:14:35 GMT

Hello Florin,

I want to know how you declare the access point on the radius server in order to enable the authentication request send directly by the access point?

Thanks

Regards

Hi All,

jain.nitin — Sun, 11 Jun 2017 18:25:04 GMT

Hi All,

I am trying to configure flexgroup radius server which points to local ISE PSN in branch thinking that it will override global radius server which is configured under corporate ssid on a centralized controller but it does not seems to be working.

users are still being authenticated from global radius server. I know this flexconnect group radius should work for ap in standalone and connected mode. My aps are in connected mode currently.

hope to see some help on this.