HI all, we are deploying a wireless eap-tls machine authenticated network. We have a PKI using Windows CA services with one offline root CA and one intermediate issuing CA. For our RADIUS server, I started with a windows NPS server and then changed it to ISE and keep going back and forth as I am troubleshooting. I know our ISE radius server is configured in the WLC properly as we have a guest network that is functional and it uses ISE. The issuing CA has properly sent out the certificate based on the "Radius Server Client Template" and the "Computer" certificate. This is from my client "personal" certificates snap in
I followed the cisco white paper for configuring but am having no luck. I just keep getting
EAP Root cause String: Network authentication failed due to a problem with the user account
EAP Error: 0x40420110
on the client. I am getting no logs on our radius server, which has been ISE as well as a Windows NPS server(Not both at the same time, only one will be used but I tried both thinking maybe it was the Radius server.) So that tells me it is not even hitting the RADIKUS servers. When using ISE, I did import the CA and Intermediate CA as trusted CAs. As well as signed the eap cert signed by Issuing CA. I have a ticket open with ISE TAC and they confirmed that the cert was ok.
So I have decided to break it up for troubleshooting and will start with the wlan and AP settings for the network. I have configured the WLAN to have the following
and the radius server
. I have tried with the following setting unchecked and checked in the Policy that the Policy tag maps the wlan profile too because in the white paper I did see this setting needed to be checked.
I have researched this issue on Microsoft and some have given some examples but they still do not work. So to start, I would just like to make sure my WLC configurations are correct? Any guidance or input is greatly appreciated. Thanks
