Connect a WLC to a NPS Server

[rui-b-rodrigues]

Hello,

I'm trying to config a NPS server with WLC, to authenticate on WLAN with AD users.

The WLC has various interfaces,

10.10.10.10 (Management)

10.10.11.10 (LAN)

10.10.12.10 (Guest)

The NPS Server as an IP add: 10.10.11.99.

If in the NPS server, the radius client IP is configured as the as the management IP of the WLC (10.10.10.10) I received the message:

A RADIUS message was received from the invalid RADIUS client IP address 10.10.11.99

If in the NPS server the radius client IP is configured as the as the LAN IP interface (10.10.11.10) I do not received any error message, but the client doesn't authenticate.

Is there any way to force the WLC when contacting to NPS to use the management IP and not the LAN IP interface.

I follow the example from cisco where the the Network policies are:

Windows Groups

NAS Port-Type: Wireless

and

Authentication Type: EAP or PEAP

but my NPS server isn't a 2003 srv, but a 2012 R2 srv.

Can anybody help what am I doing wrong?

Thank you

[balaji.bandi]

here is a step by step guide : ( there is a configuration to use management interface)

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/115988-nps-wlc-config-000.html

[rui-b-rodrigues]

Hello,

that was the example i refer in my post.

Isn't working.

On the WLC, making a debug to aaa I can check the username from the AD machine, but the answer is:

Access-Reject received from RADIUS server

[Error] Client requested no retries for mobile

Returning AAA Error 'Authentication Failed' (-4) for mobile

AuthorizationResponse: 0x404e0874

I'm trying from a windows 7 laptop with a user inside a AD group, that is in the network policy condition.

Thank you.

[MHM Cisco World]

check the network user box, try enable it and see result I think when enable it the WLC will use Management IP.

[JPavonM]

This is a classic routing mistake.

NPS is sharing subnet with production interface in the WLC, so all the packets been sent from the WLC to NPS server are forwarded via this interface.

To solve this, you need to add a static route to NPS server IP address in the WLC pointing to NPS server with source the management interface.

HTH
-Jesus
*** Please Rate Helpful Responses ***