Perform these steps in order to configure the RADIUS server for EAP-FAST authentication:
1. Create a User Database to Authenticate EAP-FAST Clients
2. Add the WLC as AAA Client to the RADIUS Server
3. Configure EAP-FAST Authentication on the RADIUS Server with Anonymous In-band PAC Provisioning
4. Configure EAP-FAST Authentication on the RADIUS Server with Authenticated In-band PAC Provisioning
EAP-FAST Authentication with Wireless LAN Controllers and External RADIUS Server Configuration Example
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00808e5d6b.shtml