Wireless SSID with Certificate

[sreelalggbm]

Dear All,

  I have a wireless network with cisco 5508 WLC for corporate network ,Cisco WLC for guest network, ACS 4.2, and 200 accesspoints.

Corporate SSID authentication-   WPA1 & 2  with Dot1X(Via ACS)

Guest        SSID authentication- Webauth with ACS

I need to configure an SSID for scanners.

Is there any way to configure the scanners wireless authentication via ACS with a trusted certificate?

Thanks in advance

Sreelal

[Scott Fella]

You need to find out if the scanners can support 802.1x. If they do, then you need to find out from the scanner manufacture how to import the trusted root cert for the certificate you have already installed in ACS. You might not need to install the trusted root cert , depending if the device has it already in the OS.

Sent from Cisco Technical Support iPhone App

[sreelalggbm]

Hai,

Thanks a lot for your reply

Scanner is supporting WPA1 & 2 with AES. But I couldnt find the option for Dot1x.

Is there any way to configure the certificate on this protocols?

Do you have any document which clearly explains the procedure for using certificate for wireless clients?

Do we need to install any certificate on the WLC?

If yes, is it posssible to install via  FTP/TFTP?

If our client is a pC or laptop, we have to install the same certifiate on Laptop and ACS correct??

thanks a lot

[Scott Fella]

If the scanners do not support 802.1x then you can't use certificates. The scanners most likely only support open, WEP, wpa-tkip PSK or wpa2-aes PSK.

You have to work with what the scanners can do.

Sent from Cisco Technical Support iPhone App

[sreelalggbm]

Can you please share a document which clearly explains the procedure for using certificate for wireless clients?

[sreelalggbm]

My Scanner supports  EAP-FAST,EAP-TLS, LEAP,PEAP,TTLS .

So I can use the certifactes correct?

Can you  advice me what is the config will be on the WLC and ACS?

[Scott Fella]

It would be that same as you other SSID that uses dot1x.

Sent from Cisco Technical Support iPhone App

[sreelalggbm]

Do I need to install any certificate on the WLC?

Do I need to install new crtificate on ACS?

There is already one certficate installed on the WLC for webauth and another certificate.

Thanks in advance

[Scott Fella]

The certificate on the WLC has nothing to do with dot1x.  You already have a certificate in ACS so you don't need one.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

[Peter Nugent]

Wrong topic!!!!!!!!

Doh!

[edondurguti]

Sree,

Do you know what kind of certificate are you using?

Is it self signed or it's a 3rd party, like go daddy, verisign etc?

When you try to connect with a windows pc for the first time do you see any error? that is asking you to connect/terminate or stuff like that.

I'd suggest using LEAP for your Scanners, or use PEAP if you have third party cert.

It all depends on what kind of cert you have :]

[sreelalggbm]

Hai,

Thanks for your reply.

Customer has one certificate server(CA). We need to generate the certficate from that CA .

Our scanner expert will load the generated certficate into the scanner

My Scanner supports  EAP-FAST,EAP-TLS, LEAP,PEAP,TTLS

So Can I go with  LEAP for scanners?

Do you have any document or steps for completeing this task?

SSID config on WLC?

ACS 4.2 Config?

On PC side what config we need to do (If we are connecting a PC to the same SSID)?

Once again thanking you !!

[Scott Fella]

Wait... You said you have an SSID that is using 802.1x? Do you not know how that is configured on the radius, wlc or the client? You can do a search on Cisco's site for your configuration examples as there are many out there.

Sent from Cisco Technical Support iPhone App

[sreelalggbm]

we have SSID that is using 802.1x  This is working without certificate validation

[Scott Fella]

So why not use the same?

It seems like you want to do EAP-TLS on a scanner... Well if that's what you want to do, you need to import a certificate into the device and that's it. Maybe modify your radius policy to allow for EAP-TLS if it's not enabled.

Sent from Cisco Technical Support iPhone App