Contents

Introduction

Prerequisites

Requirements

Components Used

Configure

Network Diagram

Configurations

Configuration on ME

Declare ME on ISE

Create a new user on ISE

Create the Authentication rule

Create the Authorization rule

Configuration of end device

Verify

Authentication process on ME

Authentication process on ISE

Introduction

This documents describes how to set up a WLAN (Wireless Local Area Network) with Wi-Fi Protected Access 2 (WPA2) Enterprise security with a Mobility Express controller and an external Remote Authentication Dial-In User Service (RADIUS) server. Identity Service Engine (ISE) is used as example of external RADIUS servers.

The Extensible Authentication Protocol (EAP) used in this guide is Protected Extensible Authentication Protocol (PEAP). Besides that the client is assigned to an specific VLAN (other than the one assigned to the WLAN ny default).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- 802.1x

- PEAP

- Certification Authority (CA)

- Certificates

Components Used

The information in this document is based on these software and hardware versions:

ME v8.2

ISE v2.1

Windows 10 Laptop

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Configure

Network Diagram

Configurations

The general steps are:

1. Create the Service Set Identifier (SSID) in the ME and declare RADIUS server (ISE in this example) on ME

2. Declare ME on RADIUS server (ISE)

3. Create the authentication rule on ISE

4. Create the authorization rule on ISE

5. Configure the endpoint

Configuration on ME

In order to allow communication between RADIUS server and ME it is needed to register RADIUS server on ME and vice versa. This step shows how to register RADIUS server on ME.

Step 1. Open the GUI of the ME and navigate to Wireless Settings > WLANs > Add new WLAN.

Step 2. Select a name for the WLAN.

Step 3. Specify Security configuration under WLAN Security tab.

Choose WPA2 Enterprise, for Authentication server choose External RADIUS. Click the edit option to add the RADIUS's ip address and pick a Shared Secret key.

<a.b.c.d> corresponds to the RADIUS server.

Step 4. Assign a VLAN to the SSID.

If the SSID needs to be assigned to the AP's VLAN this step can be skipped.

In order to assign the users for this SSID to a specific VLAN (other than AP's VLAN), enable Use VLAN Tagging and assign the desired VLAN ID.

Note: If VLAN Tagging is used, be sure that the switchport where the Access Point is connected to, is configured as trunk port and the AP VLAN is configured as native.

Step 5. Click Apply to finish the configuration.

Step 6. Optional, configure the WLAN to accept the VLAN override.

Enable AAA override on the WLAN and add the needed VLANs. To do so you will nee to open a CLI session to the ME management interface and issue these commands:

>config wlan disable <wlan-id>

>config wlan aaa-override enable <wlan-id>

>config wlan enable <wlan-id>

>config flexconnect group default-flexgroup vlan add <vlan-id>

Declare ME on ISE

Step 1. Open ISE console and navigate to Administration > Network Resources > Network Devices > Add.

Step 2. Enter the information.

Optionally it can be specified a Model name, software version, description and assign Network Device groups based on device types, location or WLCs.

a.b.c.d correspond to the ME's IP address.

For more information about Network Device Groups review this link:

ISE - Network Device Groups

Create a new user on ISE

Step 1. Navigate to Administration > Identity Management > Identities > Users > Add.

Step 2. Enter the information.

In this example this user belongs to a group called ALL_ACCOUNTS but it can be adjusted as needed.

Create the Authentication rule

Authentication rules are used to verify if the credentials of the users are right (Verify if the user really is who it says it is) and limit the authentication methods that are allowed to be used by it.

Step 1.  Navigate to Policy > Authentication.

Step 2. Insert a new authentication rule.

To do so navigate to Policy > Authentication > Insert new row above/below.

Step 3. Enter the needed information

This authentication rule example allows all the protocols listed under the Default Network Access list, this applies to the authentication request for Wireless 802.1x clients and with Called-Station-ID and ends with ise-ssid.

Also, choose the Identity source for the clients that matches this authentication rule, in this example it is used Internal users

Once It is finished click Done and Save

For more information about Allow Protocols Policies consult this link:

Allowed Protocols Service

For more information about Identity sources consult this link:

Create a User Identity Group

Create the Authorization rule

The authorization rule is the one in charge to determine if the client is allowed to join the network or not

Step 1. Navigate to Policy > Authorization.

Step 2. Insert a new rule. Navigate to Policy > Authorization > Insert New Rule Above/Below.

Step 3. Enter the information.

First choose a name for the rule and the Identity groups where the user is stored. In this example the user is stored in group ALL_ACCOUNTS.

After that choose other conditions that make the authorization process to fall into this rule. In this example the authorization process hits this rule if it uses 802.1x Wireless and it is called station ID ends with ise-ssid.

Finally choose the Authorization profile that allows the clients to join the network, click Done and Save.

Optionally, create a new authorization profile that will assign the wireless client to a different VLAN:

Enter the information:

Configuration of end device

Configure a Windows 10 laptop to connect to an SSID with 802.1x Authentication using PEAP/MS-CHAPv2 (Microsoft version of the Challenge-Handshake Authentication Protocol version 2).

In this configuration example ISE uses its self-signed certificate to perform the authentication.

To create the WLAN profile on the windows machine there are two options:

1. Install the self-signed certificate on the machine to validate and trust ISE server to complete the authentication

2. Bypass the validation of the RADIUS server and trust any RADIUS server used to perform the authentication (not recommended, as it can become a security issue)

The configuration for these options are explained on End device configuration - Create the WLAN Profile - Step 7.

End device configuration - Install ISE self-signed certificate

Step 1. Export self-signed certificate from ISE.

Log in to ISE and navigate to Administration > System > Certificates > System Certificates.

Then select the certificate used for EAP Authentication and click Export.

Save the certificate in the needed location. This certificate is installed on the Windows machine.

Step 2. Install the certificate in the Windows machine.

Copy the certificate exported before into the Windows machine, change the extension of the file from .pem to .crt, after that double click on it and select Install Certificate....

Choose to install it in Local Machine, then click Next.

Select Place all certificates in the following store, then browse and choose Trusted Root Certification Authorities. After that click Next.

Then click Finish.

At the end click Yes to confirm the installation of the certificate.

Finally click OK.

End device configuration - Create the WLAN Profile

Step 1. Right click on Start icon and select Control panel.

Step 2. Navigate to Network and Internet and then to Network and Sharing Center and click on Set up a new connection or network.

Step 3. Select Manually connect to a wireless network and click Next.

Step 4. Enter the information with the name of the SSID and security type WPA2-Enterprise and click Next.

Step 5. Select Change connection settings to customize the configuration of the WLAN profile.

Step 6. Navigate to Security tab and click Settings.

Step 7. Choose if RADIUS server is validated or not.

If yes, enable Verify the server's identity by validating the certificate and from Trusted Root Certification Authorities: list select the self-signed certificate of ISE.

After that select Configure and disable Automatically use my Windows logon name and password..., then click OK

Step 8. Configure the user credentials

Once back to Security tab, select Advanced settings, specify authentication mode as User authentication and save the credentials that were configured on ISE to authenticate the user.

Verify

The authentication flow can be verified from WLC or from ISE perspective.

Authentication process on ME

Run this command to monitor the authentication process for a specific user:

> debug client <mac-add-client>

Example of a successful authentication (some output has been omitted):

*apfMsConnTask_0: Nov 25 16:36:24.333: 08:74:02:77:13:45 Processing assoc-req station:08:74:02:77:13:45 AP:38:ed:18:c6:7b:40-01 thread:669ba80

*apfMsConnTask_0: Nov 25 16:36:24.333: 08:74:02:77:13:45 Association received from mobile on BSSID 38:ed:18:c6:7b:4d AP 1852-4

*apfMsConnTask_0: Nov 25 16:36:24.334: 08:74:02:77:13:45 Applying site-specific Local Bridging override for station 08:74:02:77:13:45 - vapId 3, site 'FlexGroup', interface 'management'

*apfMsConnTask_0: Nov 25 16:36:24.334: 08:74:02:77:13:45 Applying Local Bridging Interface Policy for station 08:74:02:77:13:45 - vlan 0, interface id 0, interface 'management'

*apfMsConnTask_0: Nov 25 16:36:24.334: 08:74:02:77:13:45 Set Clinet Non AP specific apfMsAccessVlan = 2400

*apfMsConnTask_0: Nov 25 16:36:24.334: 08:74:02:77:13:45 This apfMsAccessVlan may be changed later from AAA after L2 Auth

*apfMsConnTask_0: Nov 25 16:36:24.334: 08:74:02:77:13:45 Received 802.11i 802.1X key management suite, enabling dot1x Authentication

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0)

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 0.0.0.0 8021X_REQD (3) DHCP required on AP 38:ed:18:c6:7b:40 vapId 3 apVapId 3for this client

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 apfPemAddUser2:session timeout forstation 08:74:02:77:13:45 - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is 0

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 Stopping deletion of Mobile Station: (callerId: 48)

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 Sending assoc-resp with status 0 station:08:74:02:77:13:45 AP:38:ed:18:c6:7b:40-01 on apVapId 3

*apfMsConnTask_0: Nov 25 16:36:24.335: 08:74:02:77:13:45 Sending Assoc Response to station on BSSID 38:ed:18:c6:7b:4d (status 0) ApVapId 3 Slot 1

*spamApTask0: Nov 25 16:36:24.341: 08:74:02:77:13:45 Sent dot1x auth initiate message for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 reauth_sm state transition 0 ---> 1 for mobile 08:74:02:77:13:45 at 1x_reauth_sm.c:47

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 EAP-PARAM Debug - eap-params for Wlan-Id :3 is disabled - applying Global eap timers and retries

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 Disable re-auth, use PMK lifetime.

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 Station 08:74:02:77:13:45 setting dot1x reauth timeout = 1800

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 dot1x - moving mobile 08:74:02:77:13:45 into Connecting state

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.342: 08:74:02:77:13:45 Sending EAP-Request/Identity to mobile 08:74:02:77:13:45 (EAP Id 1)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.401: 08:74:02:77:13:45 Received EAPOL EAPPKT from mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:24.401: 08:74:02:77:13:45 Received Identity Response (count=1) from mobile 08:74:02:77:13:45

.

.

.

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.978: 08:74:02:77:13:45 Processing Access-Accept for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.978: 08:74:02:77:13:45 Username entry (user1) created in mscb for mobile, length = 253

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.978: 08:74:02:77:13:45 Station 08:74:02:77:13:45 setting dot1x reauth timeout = 1800

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.978: 08:74:02:77:13:45 Creating a PKC PMKID Cache entry for station 08:74:02:77:13:45 (RSN 2)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Adding BSSID 38:ed:18:c6:7b:4d to PMKID cache at index 0 for station 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: New PMKID: (16)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: [0000] 80 3a 20 8c 8f c2 4c 18 7d 4c 28 e7 7f 10 11 03

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Adding Audit session ID payload in Mobility handoff

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 0 PMK-update groupcast messages sent

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 PMK sent to mobility group

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Disabling re-auth since PMK lifetime can take care of same.

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Sending EAP-Success to mobile 08:74:02:77:13:45 (EAP Id 70)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Freeing AAACB from Dot1xCB as AAA auth is done for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Found an cache entry for BSSID 38:ed:18:c6:7b:4d in PMKID cache at index 0 of station 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Found an cache entry for BSSID 38:ed:18:c6:7b:4d in PMKID cache at index 0 of station 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: Including PMKID in M1 (16)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: [0000] 80 3a 20 8c 8f c2 4c 18 7d 4c 28 e7 7f 10 11 03

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: M1 - Key Data: (22)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: [0000] dd 14 00 0f ac 04 80 3a 20 8c 8f c2 4c 18 7d 4c

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: [0016] 28 e7 7f 10 11 03

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.979: 08:74:02:77:13:45 Starting key exchange to mobile 08:74:02:77:13:45, data packets will be dropped

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.980: 08:74:02:77:13:45 Sending EAPOL-Key Message to mobile 08:74:02:77:13:45

state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.980: 08:74:02:77:13:45 Reusing allocated memory for EAP Pkt for retransmission to mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.980: 08:74:02:77:13:45 Entering Backend Auth Success state (id=70) for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.980: 08:74:02:77:13:45 Received Auth Success while in Authenticating state for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.980: 08:74:02:77:13:45 dot1x - moving mobile 08:74:02:77:13:45 into Authenticated state

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.983: 08:74:02:77:13:45 Received EAPOL-Key from mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.983: 08:74:02:77:13:45 Received EAPOL-key in PTK_START state (message 2) from mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.983: 08:74:02:77:13:45 Successfully computed PTK from PMK!!!

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.983: 08:74:02:77:13:45 Received valid MIC in EAPOL Key Message M2!!!!!

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 00000000: 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0...............

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 00000010: 00 0f ac 01 0c 00 ......

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 00000010: ac 01 0c 00 ....

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 08:74:02:77:13:45 PMK: Sending cache add

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 08:74:02:77:13:45 Stopping retransmission timer for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 08:74:02:77:13:45 Sending EAPOL-Key Message to mobile 08:74:02:77:13:45

state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.984: 08:74:02:77:13:45 Reusing allocated memory for EAP Pkt for retransmission to mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Received EAPOL-key in PTKINITNEGOTIATING state (message 4) from mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Stopping retransmission timer for mobile 08:74:02:77:13:45

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state 8021X_REQD (3)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Mobility query, PEM State: L2AUTHCOMPLETE

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Building Mobile Announce :

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Building Client Payload:

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Client Ip: 0.0.0.0

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Client Vlan Ip: 172.16.0.136, Vlan mask : 255.255.255.224

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Client Vap Security: 16384

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Virtual Ip: 192.0.2.1

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 ssid: ise-ssid

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Building VlanIpPayload.

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 L2AUTHCOMPLETE (4) DHCP required on AP 38:ed:18:c6:7b:40 vapId 3 apVapId 3for this client

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 Not Using WMM Compliance code qosCap 00

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 38:ed:18:c6:7b:40 vapId 3 apVapId 3 flex-acl-name:

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state L2AUTHCOMPLETE (4)

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 6623, Adding TMP rule

*Dot1x_NW_MsgTask_0: Nov 25 16:36:25.988: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule

type = Airespace AP - Learn IP address

on AP 38:ed:18:c6:7b:40, slot 1, interface = 1, QOS = 0

IPv4 ACL ID = 255, IPv

*apfReceiveTask: Nov 25 16:36:25.989: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) mobility role update request from Unassociated to Local

Peer = 0.0.0.0, Old Anchor = 0.0.0.0, New Anchor = 172.16.0.136

*apfReceiveTask: Nov 25 16:36:25.989: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED

*apfReceiveTask: Nov 25 16:36:25.989: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 6261, Adding TMP rule

*apfReceiveTask: Nov 25 16:36:25.989: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) Replacing Fast Path rule

type = Airespace AP - Learn IP address

on AP 38:ed:18:c6:7b:40, slot 1, interface = 1, QOS = 0

IPv4 ACL ID = 255,

*apfReceiveTask: Nov 25 16:36:25.989: 08:74:02:77:13:45 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255)

*pemReceiveTask: Nov 25 16:36:25.990: 08:74:02:77:13:45 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0

*pemReceiveTask: Nov 25 16:36:25.990: 08:74:02:77:13:45 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0

*apfReceiveTask: Nov 25 16:36:27.835: 08:74:02:77:13:45 WcdbClientUpdate: IP Binding from WCDB ip_learn_type 1, add_or_delete 1

*apfReceiveTask: Nov 25 16:36:27.835: 08:74:02:77:13:45 IPv4 Addr: 0:0:0:0

*apfReceiveTask: Nov 25 16:36:27.835: 08:74:02:77:13:45 In apfRegisterIpAddrOnMscb_debug: regType=1 Invalid src IP address, 0.0.0.0 is part of reserved ip address range (caller apf_ms.c:3593)

*apfReceiveTask: Nov 25 16:36:27.835: 08:74:02:77:13:45 IPv4 Addr: 0:0:0:0

*apfReceiveTask: Nov 25 16:36:27.840: 08:74:02:77:13:45 WcdbClientUpdate: IP Binding from WCDB ip_learn_type 1, add_or_delete 1

*apfReceiveTask: Nov 25 16:36:27.841: 08:74:02:77:13:45 172.16.0.16 DHCP_REQD (7) Change state to RUN (20) last state DHCP_REQD (7)

For an easy way to read debug client outputs, use the Wireless debug analyzer tool:

Wireless Debug Analyzer

Authentication process on ISE

Navigate to Operations > RADIUS > Live Logs in order to see which authentication policy, authorization policy and authorization profile assigned to the user.

For more information click on Details to see a more detailed authentication process.