WLC 5520 setting - authentication of clients laptop

[Barry Landon]

A client today was able to connect to the WLC via ap as normal.  The user was then able to unauthenticated the device and connect to a spoofed SSID. What blocked him to go any further was PEAP to Cisco ISE.  Question is, is there a setting within the WLC that can be enabled which detects a source client authentication and unauthenticated itself and then the client is dropped.  An added security measure.   

[patoberli]

That is all handled by your radius server, if I understood your question correct. The WLC will simply forward the authentication request to the radius.
I suggest using correctly signed certificates on the radius, then the client should not connect to a spoofed ssid with spoofed radius server (which shouldn't have the same hostname/certificate combination). This of course requires the enabled "Validate certificate" setting, something that is often disabled on Android (but enabled by default on Windows or Apple OS).