topic Re: Wireless SSID with Certificate in Wireless

Wireless SSID with Certificate

sreelalggbm — Sun, 04 Jul 2021 05:40:47 GMT

Dear All,

I have a wireless network with cisco 5508 WLC for corporate network ,Cisco WLC for guest network, ACS 4.2, and 200 accesspoints.

Corporate SSID authentication- WPA1 & 2 with Dot1X(Via ACS)

Guest SSID authentication- Webauth with ACS

I need to configure an SSID for scanners.

Is there any way to configure the scanners wireless authentication via ACS with a trusted certificate?

Thanks in advance

Sreelal

Re: Wireless SSID with Certificate

Scott Fella — Mon, 17 Sep 2012 08:06:51 GMT

You need to find out if the scanners can support 802.1x. If they do, then you need to find out from the scanner manufacture how to import the trusted root cert for the certificate you have already installed in ACS. You might not need to install the trusted root cert , depending if the device has it already in the OS.

Sent from Cisco Technical Support iPhone App

Wireless SSID with Certificate

sreelalggbm — Mon, 17 Sep 2012 08:33:02 GMT

Hai,

Thanks a lot for your reply

Scanner is supporting WPA1 & 2 with AES. But I couldnt find the option for Dot1x.

Is there any way to configure the certificate on this protocols?

Do you have any document which clearly explains the procedure for using certificate for wireless clients?

Do we need to install any certificate on the WLC?

If yes, is it posssible to install via FTP/TFTP?

If our client is a pC or laptop, we have to install the same certifiate on Laptop and ACS correct??

thanks a lot

Re: Wireless SSID with Certificate

Scott Fella — Mon, 17 Sep 2012 08:38:03 GMT

If the scanners do not support 802.1x then you can't use certificates. The scanners most likely only support open, WEP, wpa-tkip PSK or wpa2-aes PSK.

You have to work with what the scanners can do.

Sent from Cisco Technical Support iPhone App

Wireless SSID with Certificate

sreelalggbm — Mon, 17 Sep 2012 09:35:28 GMT

Can you please share a document which clearly explains the procedure for using certificate for wireless clients?

Wireless SSID with Certificate

sreelalggbm — Mon, 17 Sep 2012 11:04:03 GMT

My Scanner supports EAP-FAST,EAP-TLS, LEAP,PEAP,TTLS .

So I can use the certifactes correct?

Can you advice me what is the config will be on the WLC and ACS?

Re: Wireless SSID with Certificate

Scott Fella — Mon, 17 Sep 2012 11:38:35 GMT

It would be that same as you other SSID that uses dot1x.

Sent from Cisco Technical Support iPhone App

Wireless SSID with Certificate

sreelalggbm — Mon, 17 Sep 2012 12:36:16 GMT

Do I need to install any certificate on the WLC?

Do I need to install new crtificate on ACS?

There is already one certficate installed on the WLC for webauth and another certificate.

Thanks in advance

Wireless SSID with Certificate

Scott Fella — Mon, 17 Sep 2012 12:40:41 GMT

The certificate on the WLC has nothing to do with dot1x. You already have a certificate in ACS so you don't need one.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Re: Wireless SSID with Certificate

Peter Nugent — Mon, 17 Sep 2012 16:57:05 GMT

Wrong topic!!!!!!!!

Doh!

Re: Wireless SSID with Certificate

edondurguti — Mon, 17 Sep 2012 17:05:25 GMT

Sree,

Do you know what kind of certificate are you using?

Is it self signed or it's a 3rd party, like go daddy, verisign etc?

When you try to connect with a windows pc for the first time do you see any error? that is asking you to connect/terminate or stuff like that.

I'd suggest using LEAP for your Scanners, or use PEAP if you have third party cert.

It all depends on what kind of cert you have :]

Wireless SSID with Certificate

sreelalggbm — Tue, 18 Sep 2012 06:02:19 GMT

Hai,

Thanks for your reply.

Customer has one certificate server(CA). We need to generate the certficate from that CA .

Our scanner expert will load the generated certficate into the scanner

My Scanner supports EAP-FAST,EAP-TLS, LEAP,PEAP,TTLS

So Can I go with LEAP for scanners?

Do you have any document or steps for completeing this task?

SSID config on WLC?

ACS 4.2 Config?

On PC side what config we need to do (If we are connecting a PC to the same SSID)?

Once again thanking you !!

Re: Wireless SSID with Certificate

Scott Fella — Tue, 18 Sep 2012 07:58:56 GMT

Wait... You said you have an SSID that is using 802.1x? Do you not know how that is configured on the radius, wlc or the client? You can do a search on Cisco's site for your configuration examples as there are many out there.

Sent from Cisco Technical Support iPhone App

Wireless SSID with Certificate

sreelalggbm — Tue, 18 Sep 2012 08:36:49 GMT

we have SSID that is using 802.1x This is working without certificate validation

Re: Wireless SSID with Certificate

Scott Fella — Tue, 18 Sep 2012 11:42:15 GMT

So why not use the same?

It seems like you want to do EAP-TLS on a scanner... Well if that's what you want to do, you need to import a certificate into the device and that's it. Maybe modify your radius policy to allow for EAP-TLS if it's not enabled.

Sent from Cisco Technical Support iPhone App

Wireless SSID with Certificate

sreelalggbm — Wed, 19 Sep 2012 04:37:06 GMT

Dear Scott,

Thanks for your mail..

I am supporting an infrastrecture which was configured by someone..

I will proceed with following steps

Install a certficate on the radius server which is validated by a CA server and enable EAP-TLS.

Also I need to install the same certificate on the scanner.

Configure the SSID on the scanner with EAP-TLS and select this cert for authentication.

Correct me If I am wrong

Thanks in advance

sree