topic Re: 802.1x authentication in Wireless

802.1x authentication

abinaya.2.r — Mon, 05 Jul 2021 17:44:38 GMT

Hi,

I need to configure an SSID which will use 802.1x authentication for ipods corporate network.

Is there an option in cisco Wireless environment to use 802.1x authentication without the use of RADIUS servers?

Re: 802.1x authentication

Sandeep Choudhary — Wed, 24 Jul 2019 08:58:28 GMT

You can use local EAP on WLC but its not recommanded from my side.

https://mrncciew.com/2013/04/21/configuring-local-eap-on-wlc/

Best case would be to use cisco ISE integrated with WLC.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/201044-802-1x-authentication-with-PEAP-ISE-2-1.html

Regards

Dont forget to rate helpful posts

Re: 802.1x authentication

abinaya.2.r — Wed, 24 Jul 2019 09:01:19 GMT

We donot have ISE in our network.

I am looking for the options that I can configure along with 802.1x without RADIUS server.

Re: 802.1x authentication

Sandeep Choudhary — Wed, 24 Jul 2019 09:32:29 GMT

If you dont have RADIUS then there is no other option.

Re: 802.1x authentication

abinaya.2.r — Wed, 24 Jul 2019 09:35:08 GMT

Can static WEP be combined? Can the MAC filtering be combined here along with 802.1x?

I have the APs joining this WLC on flexconnect mode.

Re: 802.1x authentication

Sandeep Choudhary — Wed, 24 Jul 2019 10:40:12 GMT

you can combine: Static-WEP+ 802.1x

more info about layer 2 and layer 3 security comptibility :

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/106082-wlc-compatibility-matrix.html

Regards

Dont forget to rate helpful posts

Re: 802.1x authentication

patoberli — Wed, 24 Jul 2019 12:18:39 GMT

Do NOT use WEP!!!
WEP will restrict you to maximum 54 Mbit/s on the AP (no 802.11n and newer features). As WEP is = no encryption use better OPEN without encryption instead of WEP, it provides the same (= none) security.

Re: 802.1x authentication

abinaya.2.r — Wed, 24 Jul 2019 16:58:08 GMT

Basically, I am looking for a solution that would provide 802.1x authentication for non domain clients. So this would involve L2 security as WPA+WPA2 and Authentication key management as 802.1x without a RADIUS server. Is this solution possible?

As a second option, can I have WLC based WPA2 Personal (AES) + Client MAC Address Authentication.?

All the APs are on flex connect mode.

Re: 802.1x authentication

Sandeep Choudhary — Thu, 25 Jul 2019 05:03:58 GMT

HI,

For 802.1x you need a RADIUS server else it will not work.

for your 2nd option(WPA2/AES+MAC filetr): Yes its possible but you need to enter all the MAC address in WLC locally.

FYI: The local user database in WLC is limited to a maximum of 2048 entries and is set to a default value of 512 entries.

Regards

Dont forget to rate helpful posts

Re: 802.1x authentication

abinaya.2.r — Thu, 25 Jul 2019 05:28:04 GMT

Cool.

So, the Layer2 security WPA+WPA2 and authentication key management as 802.1x and mac filtering will work?

The Aps are in flexconnect mode.. Would this combination work?

I notice in the WLC footnotes that mac filtering is not supported for flexconnect APs.

Re: 802.1x authentication

Sandeep Choudhary — Thu, 25 Jul 2019 07:03:55 GMT

yes you are right..

MAC Filtering is not supported on FlexConnect access points in standalone mode.

Regards

Dont forget to rate helpful posts