8021x authenticated access of AP's with WLC

[Alan Douglas]

Hi there

I have a cisco 2504 WLC with 1600 and 1700 series access pointes.

For several reason we have to put authentication controls on AP's in a certain part of our office, we use 802.1x lan authentication with windows 2008 radius servers backed on to active directory.

When I've added non windows kit for LAN authentication before I've always have to add @domain.name at the end of the username and password to the username for it to authenticate against AD.

If I try and add a username in that format into the 8021x supplicant section for the access point on the WLC it refuses to add the @

I get the error

blanks only number, illegal characters are not allowed in the username

Does anyone know if there's a workaround for this?

It hard to tell if this should or should not work, I've seen documentation for other cisco ap's that suggest @ should be legal at the AP level so I'm not sure if its that or a controller issue.

Any suggestions appreciated

[Freerk Terpstra]

Cisco access-points only support EAP-FAST to authenticate themselves against the network infrastructure. Sadly EAP-FAST is not support within Microsoft's NPS implementation. I'm afraid that the only way for you to get this going is with the use of MAB, which is less secure and a pain to configure within NPS. Another solution (again less secure) might be to configure sticky port-security for the interfaces on which access-points are connected on.

Please rate useful posts... :-)