can we Integrate Cisco WLC 2504 with Active Directory

[Seshu kumar Yangala]

Dear Team,

We are trying to integrate Active Directory with WLC 2504 controller but not successful. Which is the best way to do? does 2504 will support AD integration or not? I have gone through Cisco Docs but i am finding confusion on AD part. Can any one advise me or send me proper docs. Thanks in advance.

Regards,

Seshu

[Philip D'Ath]

We mostly use the built in (built into Windows Server) Microsoft NPS service (RADIUS) which authenticates RADIUS against active directory.

Pretty much everything on the WLC supports this.

You can also do direct LDAP authentication, but this is really only usable for web authentication.

[dapo dimeji]

Hello Guys I have a problem with this same WLC2504. any help?

I have a WLC 2504 which has a broken connection to the RADIUS and Certificate Authentication Sever. The server seems to have developed an issue whereby
its lost communication with the Global Catalogue and therefore won't allow a domain login, only local login. This server is
a windows server 2003 running the IAS (Internet Authentication Service).
On the server side it gives the below error:

Access request for user host/ABC.efg.gov.uk was discarded.
 Fully-Qualified-User-Name = <undetermined>
 NAS-IP-Address = 192.168.1.4
 NAS-Identifier = HQMAIN-WLC
 Called-Station-Identifier = 0014.a8bd.0940
 Calling-Station-Identifier = b4b6.7689.0d5f
 Client-Friendly-Name = HQ-WLC
 Client-IP-Address = 192.168.1.5
 NAS-Port-Type = Wireless - IEEE 802.11
 NAS-Port = 1
 Proxy-Policy-Name = Use Windows authentication for all users
 Authentication-Provider = Windows
 Authentication-Server = <undetermined>
 Reason-Code = 4
 Reason = The Active Directory global catalog cannot be accessed.

On the WLC side i am getting the below error:

*Dot1x_NW_MsgTask_4: Mar 02 17:11:24.182: #DOT1X-3-AAA_AUTH_SEND_FAIL: 1x_aaa.c:817 Unable to send AAA message for client ac:7b:a1:e4:ea:e4
*Dot1x_NW_MsgTask_4: Mar 02 17:08:52.306: #DOT1X-3-AAA_AUTH_SEND_FAIL: 1x_aaa.c:817 Unable to send AAA message for client ac:7b:a1:e4:ea:e4
*Dot1x_NW_MsgTask_4: Mar 02 17:08:52.300: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:449  Authentication Aborted for client ac:7b:a1:e4:ea:e4
*Dot1x_NW_MsgTask_6: Mar 02 17:05:51.322: #DOT1X-3-AAA_AUTH_SEND_FAIL: 1x_aaa.c:817 Unable to send AAA message for client 7c:5c:f8:14:a7:c6
*Dot1x_NW_MsgTask_5: Mar 02 17:01:57.195: #DOT1X-3-AAA_AUTH_SEND_FAIL: 1x_aaa.c:817 Unable to send AAA message for client c4:d9:87:ac:6a:75

Can anyone advise if there is a way to bypass the RADIUS Server and have clients get authentication direct from Active
Directory? Or what is the best work around pending when this server or another server can be setup back online?

ANy suggestions will be appreciated.

[Philip D'Ath]

If you want to use WPA/WPA2 Enterprise mode you need the RADIUS server working.

[George Stefanick]

The 2504 itself doesn't integrate. Like Phil mentioned you can integrate LDAP and your can point the controller to a 802.1X server. But the WLC itself doesn't integrate. 

[mohanak]

Integrate with LDAP server : http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/108008-ldap-web-auth-wlc.html#anc10

http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-2/configuration/guide/cg/cg_security_sol.html#wp2154527