Eap-Fast PAC issue on secondary controller

[foreidd1962]

Folks,

Have a controller based depolyment with (2) 5508s and an 1121 ACS appliance running 5.1 code. Controllers are setup identically and we are radius authenticating users to AD via the ACS. Everything works great on the primary controller, but when I test failover to the secondary controller, my authentication fails and I get the following error message in my ACS logs:

12126  EAP-FAST cryptobinding verification passed

12147  Machine Authentication is disabled

12161  Cannot provision Authorization PAC when the stateless session resume is disabled

12106  EAP-FAST authentication phase finished successfully

11503  Prepared EAP-Success

Also, I never get prompted to accept a pac from the secondary controller. Any ideas?

Thanks in advance.....

[Stephen Rodriguez]

That sounds like the option is not enabled under the EAP Fast config.  You should be able to enabld it and test.

As for the PAC, that comes from the ACS not the WLC, so you shouldn't be prompted for a new PAC.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered