topic Re: Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server in Wireless

Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server

Afroza Shultana Tonny — Mon, 05 Jul 2021 17:17:58 GMT

I have a cisco WLC 3504 and Ubuntu Radius Server which works as the external Radius server.

I want the wireless clients to be authenticated using certificates and what will be SSID security settings for this?? Is there any documentation link for this??

Re: Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server

Sathiyanarayanan Ravindran — Mon, 29 Apr 2019 08:18:44 GMT

Hi Afroza,

Please refer this Configure-802-1x-PEAP-with-FreeRadius

Re: Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server

Haydn Andrews — Mon, 29 Apr 2019 09:06:23 GMT

Effectively the you need to do following:

Add the RADIUS server to the WLC

Configure the WLAN for WPA2 Enterprise 802.1x authentication AS per the WLC parts of this document:

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213543-configure-eap-tls-flow-with-ise.html

Where it goes through ISE configurations you need to configure your RADIUS server to EAP-TLS

Here is how FreeRADIUS does it:

https://documentation.meraki.com/MR/Encryption_and_Authentication/Freeradius%3A_Configure_freeradius_to_work_with_EAP-TLS_authentication

Re: Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server

Afroza Shultana Tonny — Tue, 30 Apr 2019 09:25:21 GMT

Hello Haydn,

The solution has worked thanks for your help.

I have another query, the radius server expert says that they need 60s to verify the certificate and asked me is there any option in WLC where I have to put timer for this 60s certificate validation.

Re: Can we use only certificate based authentication for user authentication using Cisco WLC with external Radius server

Haydn Andrews — Tue, 30 Apr 2019 10:06:27 GMT

Glad i could help, make sure you help others out by marking solutions as accepted solutions.

Around timeouts, 60 seconds is a very long time, from a client prospective it it takes 60 seconds to authenticate i'm giving up or logging a ticket. Normally if the RADIUS server is in the same network segment as the WLC then for TLS I have never seen requirement to go past 5 seconds.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configuration-guide/b_cg80/b_cg80_chapter_01010.html

there are also some best practices for EAP style authentications here:

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/118703-technote-wlc-00.html