Microsoft NPS/RADIUS authentication for WLC management access

[Steven-Williams-83]

Really struggling here and managed to lock myself out of my WLC. I have setup the radius device IP and network policy using service type as administrative. NPS works for access my switches and routers so I know its working. I moved radius to the top in the WLC above LOCAL so it will use radius auth. but now nothing works, not even local admin, which means its talking to radius server just not configured right for a policy. Where do I go next.?

[Haydn Andrews]

what model WLC?

In order to get back in with Local auth remove the WLC as a NAD form the RADIUS server and it should fail back to local auth

[c_s1]

Did you get this taken care of, or are you still needing help.

[Scott Fella]

Policies are different because of the GUI.  So your conditions you use for a switch and router will only work for ssh on the controller.  You need to define a few attributes for AireOS.  Take a look at this guide.

Management Access for AireOS WLC through Microsoft NPS - Cisco

[Steven-Williams-83]

This did not work. 

[Scott Fella]

I don't have any more recommendations.  I've used NPS back in the day's and moved to Cisco ISE for TACACS.  Your only option is to search other guides and blogs to see how folks have integrated AireOS WLC's with MS NPS. 

Your radius logs will point you to where its failing and then you can search that up.  You should have a separate policy for your wired vs your wireless due to the attributes you need for AireOS.

[c_s1]

Get TAC on the phone.

[JPavonM]

@Scott Fella guide is what needs to be done.

I've both AireOS and C9800 using NPS for admin access using RADIUS and it works fine, so yours might be a problem (the only steps I've not configured in my NPS profile are neither to mark the "NAS Identifier" condition as we are using NPS for all network devices so left that on the default "Use windows Authentication for all users", nor to use the "NAS-Prompt" for read-only access)