Cisco Wireless LAN controller as radius client of a Microsoft NPS server that sits behind NAT device

[HyeonCheol Cho]

Hi gurus,

has anyone implemented radius communication across NAT that translates the IP address of the radius client with one to one static translation?

In this scenario, Cisco Wireless LAN controllers are the clients of radius services that is provided by MS NPS servers. The NAD device translates the IP of the radius client.

So, radius request packets seen on the server side appears to originate from the NATed IP address.

In the radius response packet, it normally includes the NAS IP as one of the attributes. But, as the NPS server got the packets with NATed IP of the client, it appears that NAS IP in the radius response packet is the NATed IP which is different from the real IP of the NAS. 

Has anyone ever implemented this before?

[Philip D'Ath]

I would re-engineer this to not have to send RADIUS packets through NAT.  I think you are begging to have issues.

[HyeonCheol Cho]

Thank you for your opinion.

There are some cornerstones where you have no other options. IP conflict during mergers, acquisitions, etc.