topic Re: PEAP caching in Wireless

PEAP caching

wooiboontan — Sun, 04 Jul 2021 00:16:41 GMT

Hi,

We would like to deploy the LAP in remote site with IAS radius authentication from main office but we are facing the problem that in case of the connection to main office failure the authentication will fail. Is there a way to cache the credential for authenticated account?

The following is the connection of the WLAN:

IAS --- Router (main office) --- WAN --- Router (remote site) --- WLC --- AP1131

Appreciate your comments and suggestion.

Re: PEAP caching

mark.cronin — Mon, 16 Mar 2009 10:13:57 GMT

You may want to speak to Infoblox

I believe they were working on something that can help you

Mark

Re: PEAP caching

Leo Laohoo — Tue, 17 Mar 2009 01:25:20 GMT

Move your WLC to your main office and configure H-REAP.

H-Reap Design and Deployment Guide

http://www.cisco.com/en/US/products/ps6087/products_tech_note09186a0080736123.shtml

H-REAP Modes of Operation Configuration Example

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807cc3b8.shtml

ybrid Remote Edge Access Point (H-REAP) Basic Troubleshooting

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008081103d.shtml

Re: PEAP caching

Johannes Luther — Tue, 17 Mar 2009 05:57:16 GMT

First of all:

Do you have redundant authentication servers? So, is there one in the headquater and one in the remote site?

Re: PEAP caching

wooiboontan — Tue, 17 Mar 2009 06:03:59 GMT

No, we only have a Radius at HQ. Seems like only the HREAP is the only solution which can keep established WLAN connection alive even if the MPLS/WAN connection to HQ go down.

Appreciate everyone comments.

Re: PEAP caching

Johannes Luther — Tue, 17 Mar 2009 06:07:57 GMT

Sorry, I don't get it 🙂

If your WAN connection is going down, the authentication server won't be available. It doesn't matter if you are using HREAP or not. The HREAP AP would have to contact the central authentication server as well.

Sorry for bugging you - perhaps someone could enlighten me and solve that mystery what HREAP could do here.

Re: PEAP caching

wooiboontan — Tue, 17 Mar 2009 06:09:23 GMT

No, we only have a Radius at HQ. Seems like only the HREAP is the only solution which can keep established WLAN connection alive even if the MPLS/WAN connection to HQ go down.

Appreciate everyone comments.

Re: PEAP caching

wooiboontan — Tue, 17 Mar 2009 06:18:38 GMT

You are right. When the WAN connection down no wireless client can get authenticate by the Radius but the existing authenticated wireless client can still access local network resources when using HREAP with central authentication local switching (http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807cc3b8.shtml). So far this is the only workaround I can found.

Re: PEAP caching

Johannes Luther — Tue, 17 Mar 2009 07:10:00 GMT

You just have to make sure, that you won't use a session-timeout. This is very common in 802.1x installations. The client has to re-authenticate every "xx" minutes.

Re: PEAP caching

Leo Laohoo — Tue, 17 Mar 2009 21:09:01 GMT

Thanks for the rating.

One of the benefits (and I'm sure there's alot) of H-REAP is that you don't need a to deploy your WLC's off site. And when your sole WLC goes down for maintenance or faults, and as long as your LAP doesn't reboot, you still have wireless service.