Using cisco air-ap1815i-i-k9 with Microsoft RADIS server

[sara-borghol]

Hello, 

We are using access point cisco air-ap1815i-i-k9 that are connected to our network and controlled by controller of same model, we configure a RADIUS parameter in WLAN (SSID) settings, we tested the cisco controller with the RADIUS server and the authentication succeeded. But when we try to connect to access point unit using RADIUS authentication, it gives time out,

We notice that the authentication attempts from the access point doesn't reach the RADIUS server as the event viewer and log files on the RADIUS server don't show anything about these attempts. 

Our RADIUS server is Microsoft.

Any help?

[MHM Cisco World]

Can i see how you config aaa server  and aaa group and l2 secuirty 

MHM

[sara-borghol]

We install and configure Active directory, Certification Authority and NPS server, we create a wireless group and add it to the policy at the NPS

We configure the Cisco controller IP and the Cisco access point IP as RADIUS clients in the NPS
the policy as shown:

The RADIUS server, the controller, and the access point, each is on a different Vlan, but there is a routing between them and they ping each other.

We still not configure aaa group 
Should I configure  802.1X feature (dot1.x) on the switch port ?

[Flavio Miranda]

@sara-borghol 

You add the AP as supplicant. Check the link below

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-6/b_cisco_mobility_express_8_6/b_cisco_mobility_express_8_6_chapter_0111.html#task_0A9281D4762741E3985C2FE37CDDDBC9 

[sara-borghol]

Unfortunately, Our Cisco access point  AireOS release is 8.5.140, less than 8.6 ,

[Flavio Miranda]

 If you use a packet capture or wireshark and sniff the switch port where the access point is connected, does it send any radius packet at all?

[sara-borghol]

It shows some RADIUS packets with similar content as it tries connecting 5 times each time. (10.16.31.243 is the controller IP)

This is one of them

[Flavio Miranda]

If the Radius request is leaving the AP but dont make it on the NPS, you might have something in between dropping the packet.

 I see Fortnet on the capture. Is it a  firewall?

[sara-borghol]

Yes, it is a firewall, but the AP unit, AP Controller and RADIUS server are all on the same zone, no policies on firewall between them. 

[Flavio Miranda]

You probably need to sniff the next interface the traffic would pass for. Maybe the interface where the nps is connected