topic Re: Authentication with ACS in Wireless

Authentication with ACS

FinningCL — Sun, 04 Jul 2021 04:18:34 GMT

I need to authenticate my wireless network with Cisco Secure ACS 4.2 for the internet users (guest network), but I don't want to use a CA Certificate. Can I do that? How I have to do it? What authentication protocol I must use? Where can I find this configuration?

Authentication with ACS

Scott Fella — Thu, 29 Dec 2011 15:43:48 GMT

Do you have a WLC? What type of authentication are you trying to use?

You can do that, but that would mean you would need to put all the guest usernames and password into ACS. If you have a WLC, usually you would use that to host the splash page and the guest credentials.

Authentication with ACS

hugovivar — Thu, 29 Dec 2011 17:23:52 GMT

Thanks for your answer. I was trying to use EAP-FAST. but I couldn't make it work.

I don’t have a WLC and I need to authenticate the wireless connection by the ACS software because the users will use only internet and I need to have a control for the time connection. I know that I have to create usernames and passwords, but I don’t have another choice.

Do you have a tips for this implementation? I need the authentication only.

Thanks

Re: Authentication with ACS

Scott Fella — Thu, 29 Dec 2011 17:33:38 GMT

If you plan on using authentication for internal users, you might as well do 802.1x PEAP which only requires a cert on the ACS. You can then tie ACS to AD or just have local credentials in ACS.

Thanks,

Scott Fella

Sent from my iPhone

Authentication with ACS

hugovivar — Thu, 29 Dec 2011 17:50:48 GMT

I'll use only local credentials, because the user that will use this wireless don't have the credentials in the AD. If I use PEAP and a CERT is necessary to install the cert in the laptops?

Thanks

Re: Authentication with ACS

Scott Fella — Thu, 29 Dec 2011 19:14:52 GMT

PEAP only requires a certificate in ACS (Radius)

Sent from Cisco Technical Support iPhone App

Re: Authentication with ACS

Scott Fella — Thu, 29 Dec 2011 19:18:13 GMT

Here is a good link for autonomous configuration.

http://www.cisco.com/en/US/products/hw/wireless/ps4570/prod_configuration_examples_list.html

Sent from Cisco Technical Support iPhone App

Re: Authentication with ACS

hugovivar — Mon, 02 Jan 2012 15:09:43 GMT

I was checking the link and I am trying to load the certificate in the ACS, but when I try to connect my laptop to the network the wireless client ask me the certificate installed in the PC. What I have to do if I only need the authentication?

Re: Authentication with ACS

Scott Fella — Mon, 02 Jan 2012 15:13:06 GMT

The only certificate required for PEAP is a server side certificate installed on the radius server. If you are trying to EAP-TLS, then you need the one on the radius server and in each client. I would first try to use PEAP and get that to work before you even try EAP-TLS.

Please check how you setup your client device.

Thanks,

Scott Fella

Sent from my iPhone

Re: Authentication with ACS

Scott Fella — Mon, 02 Jan 2012 15:17:07 GMT

Have you successfully added a certificate in ACS? You can use a self signed certificate.

Verify the radius configuration.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/configuration/guide/peap_tls.html

Sent from Cisco Technical Support iPhone App

Re: Authentication with ACS

Stephen Rodriguez — Mon, 02 Jan 2012 15:18:55 GMT

in the client config there is a check box to validate the server certificate. You can uncheck this box, as the client does not need to validate the cert.

HTH,

Steve

Sent from Cisco Technical Support iPad App

Authentication with ACS

hugovivar — Mon, 02 Jan 2012 19:20:49 GMT

The certificate was installed, but when I try to enable the PEAP configuration the Cisco ACS show me this error

"Failed to initialize PEAP or EAP-TLS authentication protocol because CA certificate is not installed. Install the CA certificate using "ACS Certification Authority Setup" page."

What I have to do? I tried to enable the certificate 4 times and the results is the same.

Re: Authentication with ACS

Scott Fella — Mon, 02 Jan 2012 19:33:37 GMT

That means you don't have a valid certificate installed. You need to create a new self signed certificate and make sure it is enabled for EAP.

Thanks,

Scott Fella

Sent from my iPhone

Re: Authentication with ACS

Scott Fella — Mon, 02 Jan 2012 19:37:06 GMT

Remove the other certificates and here is a link.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/User_Guide/SCAuth.html#wp327462

Thanks,

Scott Fella

Sent from my iPhone