Cisco EWLC on C9115AX access point with AD integration & MAC together

[Muzammel]

Hello,

We are configuring Cisco Embedded Wireless Controller on C9115AX Access Point. We are having some difficulties when configuring two seperate SSID name AD_User and MAC_User. We want "AD_User" will have AD/RADIUS integration so that AD user/password will be used to get WiFi access, on the other hand SSID "MAC_User" will be authenticated via MAC with/wihout user/password.
But above two scenario are not working at the same; when AD_User works with AD credentials but MAC user does not work and vice versa.

Can anyone confirm if this a limitation of EWLC? If not thenhow to configure any specific documents or guideline pls.

Thanks & Regards,

Muzammel Haque

[Scott Fella]

What radius server are you using?  I know with Cisco ISE you can do MAB, mac address bypass with rules and with AD creds, you can do EAP-PEAP with either user creds or machine credentials.  This is not a limitation to EWC or really any wireless systems. It depends on your rules and how you combine that to make things work.  

To clarify, you do have two separate SSID's.  What you are saying that only one works at a time, or are you trying to switch from one to the other nd vices versa and that is causing issues.  You really want to create SSID's that users will only connect to one or the other, not both as that can be an issue also.

What I would do is build one SSID at a time and get them working. PEAP with AD creds is really what you need, I would beleive the MAB is for dumb devices, can't those do PSK?

[Muzammel]

Hi Scott,

Thank you for your reply. We have Microsoft NPS as RADIUS. Actually I have created two SSID 1. AD_User and 2. MAC_User. Target is to configure AD_User with AD authentication and MAC_User with MAC bindings and local WLC authentocation. 

Above two SSID and authentication works seperately but not both at the same time.

Thanks,

Muzammel

[Scott Fella]

What do you mean the same time?  You want to use both at the same time, so like a device connects to wireless, then the user has to enter their ad credentials and if that passes, then check if the mac address exists in a database?

[Muzammel]

Mean AD users will use SSID "AD_Users" with their domain username & password, and the users don't have AD accounts will use "MAC_Users" SSID with MAC bindings and with/without username/password.

Thanks,

Muzammel

[Scott Fella]

I think this will be a limitation on NPS not on the wireless.  SSID "AD_Users" should work normally, but your SSID "MAC_Users", where does this database live?  Why not just use PSK for those that don't have AD credentials?

https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/16-12/config-guide/ewc_cg_16_12/mac_authentication_bypass.html