topic It is unnatural to doubt you, in Wireless

WLC Flexconnect vs 802.1x Local authentication

m.chartier — Mon, 05 Jul 2021 12:21:38 GMT

Hi,

Can someone clarify this point :

We have some AP groupe and Flexconnect Groups and some are used in our branchs offices. We want to use the feature of local authentication with a radius server on some branch to be able to have wifi in case of a WAn failure.

When the AAA will be configured in the flexconnect groups, if I put the server on the branch as primary and another server a secondary, does all the 802.1x queries will goes to the branch server, even when the WAN is available? In the SSID config, the main 802.1x server is in our primary datacenter...but we want to keep 802.1x traffic locally even if the WAN if available.

Thanks,

When the AAA will be

Rasika Nayanajith — Mon, 04 Jul 2016 22:05:27 GMT

When the AAA will be configured in the flexconnect groups, if I put the server on the branch as primary and another server a secondary, does all the 802.1x queries will goes to the branch server, even when the WAN is available?

For the APs that belong to given FlexConnect AP group, authentication request should go to server configure under FlexConnect group.

Refer below for details on FlexConnect design

http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/ch7_HREA.html

HTH

Rasika

*** Pls rate all useful responses ***

If a FlexConnect is

mohanak — Tue, 05 Jul 2016 01:28:08 GMT

If a FlexConnect is configured with both a backup RADIUS server and local authentication, the FlexConnect access point always attempts to authenticate clients using the primary backup RADIUS server first, followed by the secondary backup RADIUS server (if the primary is not reachable), and finally the FlexConnect access point itself (if the primary and secondary are not reachable).

http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-2/configuration/guide/cg/cg_flexconnect.html#15636

It is unnatural to doubt you,

Freerk Terpstra — Tue, 05 Jul 2016 22:25:48 GMT

It is unnatural to doubt you, but are you sure? 🙂

When the WAN is available the access-point is no longer in standalone mode and the WLC should be used again. If you always want to use the settings configured within the FlexConnect group you also need to enable the "FlexConnect local authentication" option within the WLAN I thought?