WLC C9800 SSID authentication via Active Directory

[ahmed-hassan1110]

Hi Gents,

I have a C9800-L-F-K9 WLC in HA setup running IOS-XE version 16.12.4a, the setup is working fine and users can join SSIDs normally using L2 security and password.

Simply I need the users to authenticate to a certain SSID using their active directory domain account, and I can't find a straight forward document mentioning the procedures and I tried some info from the config guide with no luck as it's not clear at all.

so I appreciate if anyone can share the needed procedures to accomplish this goal.

[Sandeep Choudhary]

Hi,

Go through this doc:

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html

Regards

Dont forget to rate helpful posts

[ahmed-hassan1110]

Hi Sandeep,

But we don’t have ISE server in our setup, just the wireless controller and the AD server.

[moritz.burghuber]

Hi Ahmed,

Do you have an Radius Server, you can use FreeRadius it's free and you can use it with the AD for Authentication. 

[ahmed-hassan1110]

Hi Moritz,

I don't have RADIUS server, please give me some hints on using the FreeRadius with the AD, how the setup will go and what's the needed config on the C9800 in this case?

[Scott Fella]

I would recommend you use a radius server just because you have more flexibility.  However if you want to use ldap, here is a guide that can help you.  Just search around and you probably find more.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/secure-ldap.html

[ahmed-hassan1110]

Hi Scott,

I came across the guide but unfortunately it's not clear enough and  the setup is still not working and keep giving me authentication failed. 

[Scott Fella]

There is not much anyone can do but provide reference guides. Like what was mentioned earlier, using a radius server is the best way to do this, but that is not for the beginners. When doing something like ldap or radius, it’s trail and error especially when you are not familiar with it. All I can say is, keep looking at other guides or blogs and test. Every environment is different and can be possible issues on the ldap side too in which you need someone with experience there.

[sejamc71]

The link provided below is very straight forward and simple. It provides both Gui and CLI commands. The tricky part is actually configuring the Radius portion on a windows server. All you really need on the WLC side is a server running Radius. You're just specifying 802.1x auth and pointing it to your Radius Server essentially. The WLC will send all authentications for applicable SSID to your windows server.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html