WLC "radius server overwrite interface" setting

[andrewswanson]

Hello

I'm looking at using "radius server overwrite interface" on a WLAN as a replacement for Called-Station-ID for Radius to match on SSID.

When I enable "radius server overwrite interface" on a WLAN and join a client to the SSID I can see (via packet capture) that the WLC is correctly sourcing the Radius packets with the WLAN's "dynamic" interface IP Address. The problem is that the Radius server doesn't repond to these requests. Radius is configured with rules to match the new IP address but I see nothing (pass or fail) in the logs.

Interestingly, the packet captures shows the correct NAS IP address (the WLAN interface IP Address) but always shows the WLC hostname as NAS-ID (regardless of NAS-ID settings on the WLAN or WLAN interface)

I've tried WLC software 7.4.110.0, 7.4.121.0 and 7.6.100.0 with the same results but Radius never responds. Radius is Cisco ACS 5.5.0.46. Any ideas as to why this is happening?

Thanks
Andy

[andrewswanson]

The solution for this was embarassingly simple. The packet captures for when Radius Server Interface Overwrite was enabled correctly showed the Radius packets with the correct source IP (the WLAN dynamic Interface). On the SVI for this interface, there was a very strict ACL which was dropping the Radius traffic. Once the ACL was amended to allow the Radius traffic, authentication worked perfectly. In ACS I can see the passed authentication logged  with the NAS IP address listed correctly as the WLAN dynamic Interface IP Address.

I reallly should have checked this before posting - my apologies and thanks for your help.

Cheers

andy

[Scott Fella]

Not a problem. At least you found that ACL!

Sent from Cisco Technical Support iPhone App