Wireless controller 5520 failover senario , Access 802.1x authentication with radius server

[JlassiAhmed0345]

Hi 

 WLC 5520  and ISE 

i got a question, in case of central authentication 802.1x with ISE, and the WLC is failed is there a method to configure the flexconnect AP to continue to authenticate new users that would  access the network using the Radius server.

thanks

[Scott Fella]

If any radius server is not reachable for authentication, then any new clients or clients that is going through a re-auth would fail.

[JlassiAhmed0345]

thanks for your reply 

the radius server is reachable for the Access Point. 

ISE(radius) : UP

WLC: down 

Flexconnect AP can reach ISE.

in this case how to configure a Flexconnect Access point to authenticate new users?

thanks

[balaji.bandi]

Any new or re-auth fails , so better to have redundency  in place

[JlassiAhmed0345]

Thanks for your reply

so if  I understood you well, you mean that in case of WLC failure, we lose the ability to re-auth or authenticate new users with 802.1x, even when, we are using a flexconnect .

as is mentioned in the link below , it's possible to authenticate 802.1x new users when WLC is down: 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-3/Flex_7500_DG.html#pgfId-43489

best regards

[Scott Fella]

What I meant is if radius is not available, which means that the link goes down at a site, the aps have no way to communicate to radius. The o my way in your case is to have a radius serv in prem since you are using FlexConnect.

[JlassiAhmed0345]

thanks for your reply 

so how to configure flexconnect access point to authenticate or re-auth 802.1x  users via a local backup radius server.

note : WLC is down 

[Scott Fella]

Search for “Cisco WLC FlexConnect radius”. Here is a link to another thread on the same topic.

https://community.cisco.com/t5/wireless-security-and-network/cisco-wlc-flex-connect-ssid-radius-authentication-when-wlc-is/td-p/3792394

[JlassiAhmed0345]

Thanks for your reply

so if  I understood you well, you mean that in case of WLC failure, we lose the ability to re-auth or authenticate new users with 802.1x, even when, we are using a flexconnect .

as is mentioned in the link below , it's possible to authenticate 802.1x new users when WLC is down: 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-3/Flex_7500_DG.html#pgfId-43489

best regards