EAP-TLS Authentication with FlexConnect and RADIUS

[Tobias Ebel]

Hi,

there is a Cisco 2504 wlc which manages several 2602 access points.

The access points are configured in FlexConnect mode with local bridiging enabled for some SSIDs.

One SSID is configured for EAP-TLS authentication via RADIUS to Microsoft NPS server and AD integrated CA.

This setup is working fine so far. But the RADIUS authentication is done by the wlc. I would like the access points to do the RADIUS authentication instead of the wlc. Is that possible and how can I achieve this?

Regards,

Tobias

[stefan.angerer]

Hi Tobias,

you need to enable FlexConnect Local Authentication on the SSID (advanced settings).

Typically you put the FlexConnect APs in a Flex Group and assign the RADIUS servers there (but don't enable "Local Authentication" on the group, it's a totally different feature!), but you could also configure AAA servers on a per AP basis using CLI.

http://www.cisco.com/en/US/docs/wireless/controller/7.2/configuration/guide/cg_flexconnect.html#wp1225434

Regards

Stefan

[Saurav Lodh]

Please follow "Configuring an Access  Point for Local Authentication on a WLAN (GUI)" in the following  link

http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/flexconnect/config_flexconnect_chapter_01.html