Your original post indicated that you cannot get users to authenticate and receive EAP error messages. Are you able to authenticate wireless users with ACS 5.1 now? I checked my WLC logs and see no EAP timeout messages.
Checked my configuration and here it is (hopefully it's the same as 5.1):
On ACS 5.2
Under Network Resources > Network Devices and AAA Clients, I created a client using my WLC IP with RADIUS checked and a shared secret.
Under Users and Identity Stores > External Identity Stores > Active Directory, I configured a domain name and the credentials. Test Connection to verify connectivity.
In the same tree, select Indentity Store Sequences. I created a group called UserAuth. In that group, Password based is checked and I have selected AD1 under the Authentication and Attribute Retrieval Search List.
Under Access Policies > Service Selection Rules, Rule1 should match Radius and Results are Default Network Access.
Under Access Policies > Default Network Access > Identity, I created a Rule based result selection called PEAP and the conditions were to match EAP-MSCHAPv2. Under Results, I have the Identity Store group UserAuth.
Under Access Policies > Default Network Access > Authorization, I created a standard policy I checked EAP Authentication Method to match EAP-MSCHAPv2, checked AD1:ExternalGroups: contain all or any (depending on your AD groups), and Results are Permit Access.
On WLC 7.0
Under Security > AAA > RADIUS > Authentication, I created a Server Index and all it's settings to match up with the AAA client settings. checked "Network User".
Under WLANs > select the SSID, under the Security tab > AAA Servers, I have enabled Authentication Servers and selected my server I created. I do not have "Local EAP Authentication" checked. Under the Layer2 tab, I have Auth Key Mgmt 802.1x selected.
I might be missing some steps but hope this helps a bit.
Regards.
