Radius AAA authentication configuration

lharter — Wed, 27 Apr 2022 21:17:07 GMT

I have a 5520 WLC running 8.2.166.0

there are WLANS that appear to use Radius to authenticate using our domain accounts. I see it working in the Logs on the windows radius server (IAS/NPAS) However I cannot discover HOW the Radius Authentication is Linked to the particular wlan? as there are no AAA Servers defined in the WLAN.

does checking the Network User Checkbox cause all wlans to use the radius server for User Authentication? just by clicking Network User?

Re: Radius AAA authentication configuration

Flavio Miranda — Wed, 27 Apr 2022 23:14:12 GMT

For AirOS WLC like 5520 you can find the RADIUS server on the WLAN itself under Security> AAA Servers. For WLAN. If the WLAN has no radius on the Security tab, then it is not using Radius servers.

Re: Radius AAA authentication configuration

Ambuj M — Wed, 27 Apr 2022 23:12:55 GMT

can you share

show wlan <wlan number>

Re: Radius AAA authentication configuration

Haydn Andrews — Thu, 28 Apr 2022 04:26:33 GMT

if there are no RADIUS defined under WLAN>Security>AAA then if the network user is ticked it will use the globally configured RADIUS servers

Re: Radius AAA authentication configuration

MHM Cisco World — Thu, 28 Apr 2022 12:09:05 GMT

There are two AAA config in global of WLC and under WLAN,

under WLAN is override the global.

Re: Radius AAA authentication configuration

lharter — Thu, 28 Apr 2022 13:21:10 GMT

Here is Wlan 6

I think the answer is "Global Servers"

(Cisco Controller) >
(Cisco Controller) >show wlan 6

WLAN Identifier.................................. 6
Profile Name..................................... BUCO Private
Network Name (SSID).............................. BUCO Private
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200

ATF Policy....................................... 0
Number of Active Clients......................... 28
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ internal wireless
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
PMIPv6 Mobility Type............................. none
PMIPv6 MAG Profile........................... Unconfigured
PMIPv6 Default Realm......................... Unconfigured
PMIPv6 NAI Type.............................. Hexadecimal
PMIPv6 MAG location.......................... WLC
Quality of Service............................... Platinum
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Disabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled

Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=5)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers

Authentication................................ Global Servers

Accounting.................................... Global Servers
Interim Update............................. Enabled
Interim Update Interval.................... 0
Framed IPv6 Acct AVP ...................... Prefix
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Disabled
Static WEP Keys............................... Disabled

802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
OSEN IE.................................... Disabled
Auth Key Management
802.1x.................................. Disabled
PSK..................................... Enabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
OSEN-1X................................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Enabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000

Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Disabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Enabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Disabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40

DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Client-Count Based
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled

Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver

(Cisco Controller) >?

Re: Radius AAA authentication configuration

Flavio Miranda — Thu, 28 Apr 2022 13:25:12 GMT

802.1x.................................. Disabled
PSK..................................... Enabled

Here is the answer. This SSID is using PSK and not Radius

Re: Radius AAA authentication configuration

MHM Cisco World — Thu, 28 Apr 2022 15:06:09 GMT

@Flavio Miranda I think you missing thing here,
even if the WLC and client use PSK still PSK can use AAA to check password and forward policy

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/212316-troubleshoot-identity-psk-on-wireless-la.html

So still the Client send the Password and WLC forward it to AAA "config globally" and add WLAN to NAS-ID.

Re: Radius AAA authentication configuration

lharter — Fri, 29 Apr 2022 14:54:52 GMT

Thanks everyone. the answer appears to be that even with 802.1x disbled and PSK enabled. if you check the box to on the Wlan/security/aaa tab to enable the authentication or accounting servers And leave the server entries Blank, Records WIll get Sent to the Radius servers that are defined globally.

I stat e this as i have records in the log files from the NPAS Radius Server that is globally defined on the WLC.

"DOMAINS02","IAS",04/29/2022,09:32:51,4,"34-c0-59-19-61-2f",,"ELD_AN_1st_N:BUCO Mobile","34-c0-59-19-61-2f",,"192.168.18.115","BUCO-WLC","192.168.28.12",8,0,"192.168.28.12","Cisco WLC",04/29/2022 14:32:51,,19,,,,,,0,,,,,,1,,,,"626bf713/34:c0:59:19:61:2f/10893",3,,,,,,,,13,6,,,,"103",,,,,,,,,,,"Use Windows authentication for all users",,,,,

what the Radius and WLC server are doing with these records is still a mystery though. these may only be Accounting entries.

topic Re: Radius AAA authentication configuration in Wireless

Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration

Re: Radius AAA authentication configuration