topic Re: WLC integration with LDAP (Active Directory) in Wireless

WLC integration with LDAP (Active Directory)

jain.nitin — Sun, 04 Jul 2021 00:31:21 GMT

Hi All, I would like to integrate Active Directory with Wireless controller. Can any one help me on this how can I do this? what will be the settings for users laptop? peap or LEAP

Re: WLC integration with LDAP (Active Directory)

huangedmc — Thu, 30 Apr 2009 10:02:28 GMT

According to our SE, integration w/ Active Directory via LDAP is currently not supported.

It had something to do w/ how the password is wrapped...can't remember the details now.

We use ACS for AAA via RADIUS so it's not a problem for us.

If you have MS IAS that can support RADIUS then maybe that'll work.

Re: WLC integration with LDAP (Active Directory)

jain.nitin — Thu, 30 Apr 2009 17:58:36 GMT

look at this document

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a03e09.shtml

Re: WLC integration with LDAP (Active Directory)

huangedmc — Thu, 30 Apr 2009 18:58:48 GMT

I should've clarified...WLC supports Microsoft AD via LDAP, but only for EAP-FAST, and EAP-TLS.

If you plan on using it for PEAP, it won't work.

I'm told a new maintenance release will be out in June.

Maybe the limitation will be removed then.

Open a TAC case or check w/ your SE to make sure my info is up to date.

Re: WLC integration with LDAP (Active Directory)

jain.nitin — Wed, 06 May 2009 18:19:45 GMT

Thanks for your help. Could you please let me know if i integrate wlc with AD directly then what would be configuration for windows PC. Means like we configure for PEAP for windows wireless client.

Thanks

Re: WLC integration with LDAP (Active Directory)

gamccall — Wed, 06 May 2009 18:32:44 GMT

PEAP + AD + Local EAP on controllers = not work.

PEAP + AD + controllers + RADIUS server = work just fine.

Re: WLC integration with LDAP (Active Directory)

jain.nitin — Wed, 06 May 2009 19:04:33 GMT

I dont understand then what would be the configuration on windows clients Pc/Laptops if I integrate WLC with AD...any idea

Re: WLC integration with LDAP (Active Directory)

gamccall — Thu, 07 May 2009 12:19:10 GMT

What settings, specifically, are you unsure about?

Re: WLC integration with LDAP (Active Directory)

jain.nitin — Fri, 08 May 2009 11:29:24 GMT

what I mean is if I integrate WLC with AD directly without ACS. Then what should be setting on windows Clients' laptop. Like for PEAP there is option to select PEAP & then MSCHAPv2 settings on client laptops.

I hope you got my point.

Re: WLC integration with LDAP (Active Directory)

gamccall — Fri, 08 May 2009 12:11:43 GMT

Here's what Cisco says about supported EAP methods for a Local EAP solution:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Local EAP can use an LDAP server as its backend database to retrieve user credentials.

An LDAP backend database allows the controller to query an LDAP server for the credentials (username and password) of a particular user. These credentials are then used to authenticate the user.

The LDAP backend database supports these Local EAP methods:

EAP-FAST/GTC

EAP-TLS

PEAPv1/GTC.

LEAP, EAP-FAST/MSCHAPv2, and PEAPv0/MSCHAPv2 are also supported, but only if the LDAP server is set up to return a clear-text password. For example, Microsoft Active Directory is not supported because it does not return a clear-text password. If the LDAP server cannot be configured to return a clear-text password, LEAP, EAP-FAST/MSCHAPv2, and PEAPv0/MSCHAPv2 are not supported.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

GTC is not supported by default on Windows systems, so you would have to install a third-party wireless client such as Cisco CSSC.

Re: WLC integration with LDAP (Active Directory)

Step — Fri, 04 Oct 2019 08:48:37 GMT

What's the purpose of the Local EAP? I'm interested in if I can configure WLC without Local EAP.

Re: WLC integration with LDAP (Active Directory)

Step — Fri, 04 Oct 2019 14:10:35 GMT

Ok, I understood. LDAP doesn't include EAP.