PEAP with 3504 and Microsoft NPS

[drehstrom]

Hi there,

I'm trying to set up an WLAN within our facility using 802.1x authentication using certificate based PEAP. Wireless Controller is a CISCO 3504, set to WPA2 with 802.1x. RADIUS is running by Microsoft NPS.

I configured clients, RADIUS, and WLC by miscellaneous manuals I found but it just doesn't work. In the NPS-log I see the request coming in a being processed by the RADIUS but failing because the request always comes with Authentication-Type 5 (EAP) instead of 11. So it seems the RADIUS is working correctly.

Now I'm all out of ideas where to look. I'm not even sure if it's a client or a WLC problem. I configured the client WLAN exactly as I did with the wired network (which is working great).

Any hint or help is appreciated...

[Scott Fella]

Wired uses eap-tls typically as that is easier. If you are using PEAP, then maybe it’s your protocol configuration in radius that is the issue. PEAP you can use computer auth or user auth and you need to make sure you have that set. I would assume you have a different policy for wired and wireless. 

[Scott Fella]

Take a look at this guide:

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/115988-nps-wlc-config-000.html

[drehstrom]

Hi Scott,

thanks for helping me out here. I already found the guide you suggest and followed it most of the way.

I do use different policies for wired and wireless but RADIUS isn't using either. I'm pretty sure that's because the request is coming in as EAP not PEAP. So RADIUS is using the last policy which is usually the "BLOCK ALL OTHERS". Thats exactly what the IAS-log says. As long as the WLC isn't changing the request it has to be a client problem. But I'm not sure about that. There are so many configuration items not mentioned within the guides I found (I'm probably using a newer firmware) that I'm unsure everything is set right.

Bye
Stephan