client authentication with AD credentials

[john.wright]

Is it possible to authenticate a client with just their Active Directory credentials?

[Christos Stefaneskou]

Hi,

Yes it is by using PEAP-MSCHAP v2.

Regards

[john.wright]

from what I have been reading it looks like most of the effort involves server work; is that correct?

I saw this earlier on my AP

Authentication Methods Profiles

Current Authentication Methods Profiles < NEW >56 Profile Name: Authentication Methods: md5gtctlsleapmschapv2fast

[Christos Stefaneskou]

I assume that you use Autonomous AP.

Local radius on Autonomous AP supports only LEAP-EAP FAST-MAC for client authentication and you have to specify username/pass localy on AP.

If you want to use AD you have to setup an external radius server like ACS,ISE or MS IAS.

Most part of config is done on the external radius server.

Hope this helps.

Regards.

[john.wright]

Ok

Thanks for the help.

Is there a good document for my server team to consult?

[Christos Stefaneskou · Accepted solution]

http://pcloadletter.co.uk/2011/07/11/cisco-wifi-active-directory-auth/

http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100397-peap-ias.html

http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113670-eap-authentication-00.html

https://supportforums.cisco.com/document/67941/peap-authentication-configuration-example-windows-xp

Hope this helps.

Regards

***Don't forget to rate helpful posts***