I've found that one of my wpa clients requires the wpa ssid to be set for guest mode or it doesn't work...this is what I use (I think I grabbed all the relevant parts out of the config)....
---cut here----
aaa new-model
aaa authentication login eap_methods radius
radius-server key 7 {hex key}
radius-server host {ip address}
radius-server attribute 32 include-in-access-req format %h
!
interface Dot11Radio0
encryption key 2 size 128bit 7 {hex} transmit-key
encryption mode ciphers tkip wep128
ssid wpa
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
guest-mode
---end---
