Hi Scott, What I want to achieve is a Layer 2 authentication. I have posted this request before and tried it with MS Radius server, but the problem is this would work only if machines are joined to Domain. Where in my case I can't join them .. https://supportforums.cisco.com/comment/9595246#comment-9595246 Thanks, ... View more

So WLC is useless when it comes to authentication feature without additional devices... All of this complexity just to promote and sell other products such as NAP or ISE :)... ... View more

What I mean is...if you enable HotSpot on your mobile and setup security and connect to it using your laptop you will be promoted to put the security pass. Is this possible without Radius or ISE? Coffee shop another good example where the Browser automatically will be launched where in the current configuration it's not. Which confuse lots our students and staff and take huge amount of IT staff to attend that call and do the authentication process. How the Browser can be launched automatically? Thanks, ... View more

Is there away I can achieve SSID prompt authentication without ISE or radius? ... View more

Hi, Thanks for your feedback, I will go through the links provided and response back very shortly.   Regards,   ... View more

Hi Victor, Any recommendation on the below updates that I just posted?   thanks,   ... View more

Hi Sandeep, How this can be accomplished? In the WLC SSID configuration I have the following; WPA+WPA2 WPA2 Policy WPA2 Encryption = ASE Authentication Key Management   802.1X  Enable   In the IAS configuration, I do have the following configuration; NAS-Port-Type matches "Wireless - IEEE 802.11 Or Wireless - Other" AND Windows-Groups matches "DomainName\Domain Users" Dial-in Constraints: Allow access only thrgh these media (NAS-Port-Type) * Wireless - IEEE 802.11 * Wireless - Other Advanced Tab: Vendor-Specific ---- Radius Standard Cisco Service-Type ------- Radius Standard Login In the Authentication Tab: Microsoft Encyrpted Authentication version 2 Enabled EAP Methods: Protected EAP (PEAP)   Thanks,   ... View more

Hello, I have followed the steps outlined in this http://www.pskl.us/wp/?p=125&cpage=1#comment-14543 tutorial but I'm unable to proceed further on this as whenever I connect the client it prompt for the username and password when I supply the username I get Warning in the IAS which is wrong username/password. I quoted in this tutorial "The first time you connect, you’ll be asked to accept the RADIUS server’s certificate." Does that mean the certificate has to be installed on the client machines in order for them to authenticate and connect to the WiFi network? Also I can see the client machine Event Error 36882 "SChannel" which is stated that the Certificate received from the remote server was issued by an Untrusted Certificate Authority and none of the data contained can be validated. Connection request failed. In my environment I have WLC 5508 and IAS 2003. Any help can be provided to achieve this? Thanks,   ... View more

Hi Victor,   Any help on this? I have replied yesterday with the required screen shots.   thanks,   ... View more

Hello Guys, thanks for yout cooperation, I have done this configuration and still it asks for certificate to be installed. as whenever I connect to this test SSID, it ask for username and password when I supply it, it doesn't connect at all. Please find the attached configuration of both IAS and WLC on this particular SSID.   Highly appreciate your response. Regards, Hussain   ... View more

Hello Singh, Yes there are AP Groups and all the APs are under one group as we are broadcasting the three SSIDs in whole campus. Majority of the clients laptops are same modle/hardware/configuration/drivers etc etc.. Since the implementation in Octorber, we haven't face any performance issue, clients connected in an open SSID and are prompted from ISA server to supply their credentials as it's setup in client's browser. The only things we have added/changed are the following; Introduced three SSIDs with L3 WebAuth. All  three SSIDs are authenticated against Radius server 2003 with two  profiles only, each limited to security group which are allowed to be  authenticated.  Clients complained/frustrated as soon as the WiFi session expired, they have to be authenticated again therefore, and based on @scott recommendation, I have enabled the Sleeping Mode option in only two SSIDs. How  the sleeping Mode works? does it disconnect the clients only from the  AP and retain the session in the controller, and upon client reconnects  the session will resume again? I'm afraid that the sleeping session will be attached to the AP itself which causes the lack of performance on the client sides.. Any other recommendation to be checked other than the sleeping mode? I will reduce the number of hours to 1 hour only instead of 12 hours. Thanks for your assistance all. ... View more