[ASK] Does Cisco WLC 5508 support config AD with Windows Server 2016 FFL?

[williammanurung]

Hi Everyone,

I want to upgrade my active directory to windows server 2016 forest functional level, then is it possible for my wlc configure radius server authentication to active directory windows server 2016?

Best regards,

William

[Rafael E]

If you want to use AD as your user database you need a RADIUS server in between so that RADIUS manages the communication with Active directory. 

WLC does not support that communication. 

[williammanurung]

Hi rafael,

So, can we only configure radius server on SSID configuration in WLC?

I mean, maybe there are any other requirement compatibility matrix between windows server 2016 FFL with cisco WLC 5508?

William

[Jurgens Lombard]

You can use the Windows NPS services to be your RADIUS server and integrate this with your WLC. There are many examples on the internet and it all depends on what type of EAP authentication you want to use. Below is an example of using PEAP authentication.
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/115988-nps-wlc-config-000.html

[Rafael E]

there isn't from WLC perspective i would not even know that RADIUS is taking the credentials from AD. that is a communication between RADIUS and your AD. 

[Jurgens Lombard]

The reason why I suggested to take the NPS path as the WLC won't be able to do this task.

[Daniel Ordóñez Flores]

Hi @williammanurung 

Until a couple of days ago I thought the same that Rafael, "you need a Radius Server" but the truth is you don´t. I just deploy a 5508 (8.5.161.) without a radius server. I just follow this post:

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/211277-WLC-with-LDAP-Authentication-Configurati.html

Actually  I got the answer for a TAC Engineer because I thought I need to configure NPS service on one 2012 server, but actually, AD and WLC can communicate directly, is no the best option, but they can

Regards 

[williammanurung]

Hi @Daniel Ordóñez Flores 

What version Windows Server do you use?

[patoberli]

I suggest you install the NPS Role with the Radius feature on a Windows Server for this, as this will allow you way more functionality. You can also do it with LDAP, but you will have some limitations.