Choose Commands > Download File to open the Download File to Controller page.

From the File Type drop-down list, choose RADIUS AVP List.

From the Transfer Mode drop-down list, choose from the following options:

• TFTP
• FTP
• SFTP

In the IP Address text box, enter the IPv4 or IPv6 address of the server.

In the File Path text box, enter the directory path of the RADIUS AVP list.

In the File Name text box, enter the name of the RADIUS AVP list.

If you are using an FTP server, follow these steps:

1. In the Server Login Username text box, enter the username to log into the FTP server.

2. In the Server Login Password text box, enter the password to log into the FTP server.

3. In the Server Port Number text box, enter the port number on the FTP server through which the download occurs. The default value is 21. For SFTP, the default value is 22.

Click Download to download the RADIUS AVP list to the controller. A message appears indicating the status of the download.

Choose Security > AAA > RADIUS > Downloaded AVP to open the Download RADIUS AVP List page.

From the WLAN SSID Profile name drop-down list, choose the WLAN SSID profile name.

Click the Auth AVP tab to view the RADIUS authentication attributes mapped to the AVP list.

Click the Acct AVP tab to view the RADIUS accounting attributes mapped to the AVP list.

Choose Commands > Upload File to open the Upload File from Controller page.

From the File Type drop-down list, choose RADIUS AVP List.

From the Transfer Mode drop-down list, choose from the following options:

• TFTP
• FTP
• SFTP

In the IP Address text box, enter the IPv4 or IPv6 address of the server.

In the File Path text box, enter the directory path of the RADIUS AVP list.

In the File Name text box, enter the name of the RADIUS AVP list.

If you are using an FTP server, follow these steps:

1. In the Server Login Username text box, enter the username to log into the FTP server.

2. In the Server Login Password text box, enter the password to log into the FTP server.

3. In the Server Port Number text box, enter the port number on the FTP server through which the download occurs. The default value is 21. For SFTP, the default value is 22.

Click Upload to upload the RADIUS AVP list from the controller. A message appears indicating the status of the upload.

Log on to the controller CLI.

Download the RADIUS AVPs in the XML file format from the FTP server to the controller by entering this command:

Upload the XML file from the controller to the RADIUS server using the command:

Display VSA AVPs using the command:

Edit the XML file using a notepad.

Update the SSID_PROF tag with the WLAN profile name you wish to apply the AVP to.

Update the following fields:

<?xml version="1.0" encoding="UTF-8"?>
<radiusFile>
	<avpList SSID_PROF="DocTest_8500_OPEN" incAuth="true" incAcct="true">
		<radiusAttributes>
			<attributeName>SVR-Zip-Code</attributeName>
			<vendorId>0</vendorId>
			<attributeId>32</attributeId>
			<valueType>STRING</valueType>
			<attributeValue> SYSNAME:APNAME:APLOCATION </attributeValue>
		</radiusAttributes>
		<radiusAttributes>
			<attributeName>W2BW-NASId</attributeName>
			<vendorId>0</vendorId>
			<attributeId>32</attributeId>
			<valueType>STRING</valueType>
		<attributeValue>SYSNAME:APNAME:APLOCATION</attributeValue>
				</radiusAttributes>
			 </avpList>
		</radiusFile>

Download the updated AVP XML file to the WLC.

When the RADIUS download fails, use debug option debug radius avp-xml enable to know more about the error.

Edit the AVP XML file using a text editor and delete the SSID_PROF name.

Download the updated NAS-ID AVP XML file to the Cisco WLC.

Choose Security > RADIUS > Downloaded AVP. On the DOWNLOADED RADIUS AVP LIST page, the Acct tab displays an empty page.

Choose WLANs > WLAN ID > General to open the WLAN > Edit page.

In the general tab, view the greyed out NAS-ID field to view the value type.

Choose Security > RADIUS > Downloaded AVP > Acct AVP tab to open the DOWNLOADED RADIUS AVP LIST page.

Select the Wlan SSID Profile Name from the drop-down list.

Choose WLANs > WLAN ID to open the WLANs > Edit page.

In the Security tab, choose the Layer 2 security tab.

From the Layer 2 Security drop-down list, choose WPA+WPA2.

Choose the PMF state from the drop-down list

If you choose the PMF state as either Optional or Required, do the following:

1. In the Comeback Timer box, enter the association comeback interval in milliseconds. It is the time within which the access point reassociates with the client after a valid security association.

2. In the SA Query Timeout box, enter the maximum time before an Security Association (SA) query times out.

In the Authentication Key Management section, follow these steps:

1. Select or unselect the PMF 802.1X check box to configure the 802.1X authentication for the protection of management frames.

2. Select or unselect the PMF PSK check box to configure the preshared keys for PMF. Choose the PSK format as either ASCII or Hexadecimal and enter the PSK.

Click Apply.

Click Save Configuration.

Choose WLANs to open the WLANs window.

Click a WLAN ID to open the WLANs > Edit window.

Choose Security > Layer 2 tab.

From the Layer 2 Security drop-down list, choose WPA+WPA2.

From the Fast Transition drop-down list, choose Fast Transition on the WLAN.

Check or uncheck the Over the DS check box to enable or disable Fast Transition over a distributed system.

In the Reassociation Timeout field, enter the number of seconds after which the reassociation attempt of a client to an AP should time out. The valid range is 1 to 100 seconds.

Under Authentication Key Management, choose FT 802.1X or FT PSK. Check or uncheck the corresponding check boxes to enable or disable the keys. If you check the FT PSK check box, from the PSK Format drop-down list, choose ASCII or Hex and enter the key value.

From the WPA gtk-randomize State drop-down list, choose Enable or Disable to configure the Wi-Fi Protected Access (WPA) group temporal key (GTK) randomize state.

Click Apply to save your settings.

To enable or disable 802.11r fast transition parameters, use the config wlan security ft { adaptive | enable | disable} wlan-id command.

To enable or disable 802.11r fast transition parameters over a distributed system, use the config wlan security ft over-the-ds { enable | disable} wlan-id command.

To enable or disable the authentication key management for fast transition using preshared keys (PSK), use the config wlan security wpa akm ft psk { enable | disable} wlan-id command.

To enable or disable authentication key management for adaptive using PSK, use the config wlan security wpa akm psk { enable | disable} wlan-id command.

To enable or disable authentication key management for fast transition using 802.1X, use the config wlan security wpa akm ft-802.1X { enable | disable} wlan-id command.

To enable or disable authentication key management for adaptive using 802.1x, use the config wlan security wpa akm 802.1x { enable | disable} wlan-id command.

To enable or disable 802.11r fast transition reassociation timeout, use the config wlan security ft reassociation-timeout timeout-in-seconds wlan-id command.

To view the fast transition configuration on a WLAN, use the show wlan wlan-id command.

To view the fast transition configuration on a client, use the show client detail client-mac command.

To enable or disable debugging of fast transition events, use the debug ft events { enable | disable} command.

Disable the WLAN by entering this command:

Enable sticky key caching by entering this command:

WLAN Identifier.................................. 2
Profile Name..................................... new
Network Name (SSID).............................. new
Status........................................... Disabled
MAC Filtering.................................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
     SKC Cache Support......................... Enabled 
      FT Reassociation Timeout................... 20
      FT Over-The-Air mode....................... Enabled
      FT Over-The-Ds mode........................ Enabled
CCKM tsf Tolerance............................... 1000
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled



Enable the WLAN by entering this command:

Save your settings by entering this command:

Choose WLANs to open the WLANs page.

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page.

Choose WPA+WPA2 from the Layer 2 Security drop-down list.

Under WPA+WPA2 Parameters, select the WPA Policy check box to enable WPA1, select the WPA2 Policy check box to enable WPA2, or select both check boxes to enable both WPA1 and WPA2.

Select the WPA2 Policy-AES check box to enable AES data encryption .

Choose one of the following key management methods from the Auth Key Mgmt drop-down list: 802.1X, CCKM, PSK, or 802.1X+CCKM.

If you chose PSK in Step 7, choose ASCII or HEX from the PSK Format drop-down list and then enter a preshared key in the blank text box. WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Disable the WLAN by entering this command:

Enable or disable WPA for the WLAN by entering this command:

Enable or disable WPA1 for the WLAN by entering this command:

Enable or disable WPA2 for the WLAN by entering this command:

Enable or disable AES or TKIP data encryption for WPA1 or WPA2 by entering one of these commands:

Enable or disable 802.1X, PSK, or CCKM authenticated key management by entering this command:

If you enabled PSK in Step 6, enter this command to specify a preshared key:

Enable or disable authentication key management suite for fast transition by entering this command:

Enable or disable randomization of group temporal keys (GTK) between AP and clients by entering this command:

If you enabled WPA2 with 802.1X authenticated key management or WPA1 or WPA2 with CCKM authenticated key management, the PMK cache lifetime timer is used to trigger reauthentication with the client when necessary. The timer is based on the timeout value received from the AAA server or the WLAN session timeout setting. To see the amount of time remaining before the timer expires, enter this command:

Enable the WLAN by entering this command:

Save your settings by entering this command:

Choose WLAN to open the WLAN page.

Create a new WLAN or click an existing WLAN.

Select the Status Enabled check box.

Choose Security > Layer 2 tab.

Choose WPA+WPA2 from the Layer 2 Security drop-down list.

Select the MAC Filtering check box.

Select PSK Enable check box under Authentication Key Management.

Choose Security > AAA Servers tab.

Select the Authentication Servers Enabled check box.

Select the Server IP address and port number from the drop-down list.

Choose Advanced tab.

Select the Allow AAA Override Enabled check box to enable AAA override. The default value is disabled.

Click Apply.

From the CiscoSecure ACS main menu, choose Group Setup.

Click Edit Settings.

From the Jump To drop-down list, choose RADIUS (Cisco IOS/PIX 6.0).

Select the [009\001] cisco-av-pair check box.

Enter the following Cisco AV-pairs in the [009\001] cisco-av-pair edit box to specify the URL to which the user is redirected and, if configuring conditional web redirect, the conditions under which the redirect takes place, respectively:

Choose WLANs to open the WLANs page.

Click the ID number of the desired WLAN. The WLANs > Edit page appears.

Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page.

From the Layer 2 Security drop-down list, choose 802.1X or WPA+WPA2.

Set any additional parameters for 802.1X or WPA+WPA2.

Choose the Layer 3 tab to open the WLANs > Edit (Security > Layer 3) page.

From the Layer 3 Security drop-down list, choose None.

Check the Web Policy check box.

Choose one of the following options to enable conditional or splash page web redirect: Conditional Web Redirect or Splash Page Web Redirect. The default value is disabled for both parameters.

If the user is to be redirected to a site external to the controller, choose the ACL that was configured on your RADIUS server from the Preauthentication ACL drop-down list.

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Enable or disable conditional web redirect by entering this command:

Enable or disable splash page web redirect by entering this command:

Save your settings by entering this command:

See the status of the web redirect features for a particular WLAN by entering this command:

WLAN Identifier.................................. 1
Profile Name..................................... test
Network Name (SSID).............................. test
...
Web Based Authentication......................... Disabled
Web-Passthrough.................................. Disabled
Conditional Web Redirect......................... Disabled
Splash-Page Web Redirect......................... Enabled
...


Choose Controller > General

From the WebAuth Proxy Redirection Mode drop-down list, choose Enabled or Disabled.

In the WebAuth Proxy Redirection Port text box, enter the port number of the web auth proxy.

Click Apply.

Login to WLC web UI.

For the WLAN, choose either of the two following options:

1. Create a new WLAN by choosing Create New from the drop-down list and click Go.

   The WLANs > New page appears.

2. Click the ID number of the WLAN for which you want to configure Captive Network Assistant Bypass feature.

   The WLANs > Edit page appears.

Choose the Security and Layer 3 tabs to open the WLANs > Edit (Security > Layer 3) page.

From the Layer 3 Security drop-down list, choose:

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Enable, disable or activate global Captive Network Assistant Bypass per WLAN by entering this command:

Choose WLANs to open the WLANs page.

Click the ID number of the WLAN for which you want to configure the fallback policy for web authentication. The WLANs > Edit page appears.

Choose the Security and Layer 3 tabs to open the WLANs > Edit (Security > Layer 3) page.

From the Layer 3 Security drop-down list, choose None.

Select the Web Policy check box.

Click On MAC Filter Failure.

Click Apply to commit your changes.

Click Save Configuration to save your settings.

Enable or disable web authentication on a particular WLAN by entering this command:

See the web authentication status by entering this command:

FT Over-The-Ds mode.............................. Enabled
CKIP ......................................... Disabled
   IP Security................................... Disabled
   IP Security Passthru.......................... Disabled
   Web Based Authentication...................... Enabled-On-MACFilter-Failure
        ACL............................................. Unconfigured
        Web Authentication server precedence:
        1............................................... local
        2............................................... radius
        3............................................... ldap

Choose Security > AAA > LDAP to open the LDAP Servers page.

• If you want to delete an existing LDAP server, hover your cursor over the blue drop-down arrow for that server and choose Remove.

• If you want to make sure that the controller can reach a particular server, hover your cursor over the blue drop-down arrow for that server and choose Ping.

Perform one of the following:

• To edit an existing LDAP server, click the index number for that server. The LDAP Servers > Edit page appears.

• To add an LDAP server, click New. The LDAP Servers > New page appears. If you are adding a new server, choose a number from the Server Index (Priority) drop-down list to specify the priority order of this server in relation to any other configured LDAP servers. You can configure up to 17 servers. If the controller cannot reach the first server, it tries the second one in the list and so on.

If you are adding a new server, enter the IP address of the LDAP server in the Server IP Address text box.

If you are adding a new server, enter the LDAP server’s TCP port number in the Port Number text box. The valid range is 1 to 65535, and the default value is 389.

From the Server Mode (via TLS) drop-down list, choose Disabled to establish LDAP connection (without secure tunnel) between LDAP server and the Cisco WLC using TCP or Enabled to establish a secure LDAP connection using TLS.

Select the Enable Server Status check box to enable this LDAP server or unselect it to disable it. The default value is disabled.

From the Simple Bind drop-down list, choose Anonymous or Authenticated to specify the local authentication bind method for the LDAP server. The Anonymous method allows anonymous access to the LDAP server. The Authenticated method requires that a username and password be entered to secure access. The default value is Anonymous.

If you chose Authenticated in the previous step, follow these steps:

1. In the Bind Username text box, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters.

   Note	If the username starts with “cn=” (in lowercase letters), the controller assumes that the username includes the entire LDAP database path and does not append the user base DN. This designation allows the authenticated bind user to be outside the user base DN.

2. In the Bind Username text box, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters.

In the User Base DN text box, enter the distinguished name (DN) of the subtree in the LDAP server that contains a list of all the users. For example, ou=organizational unit, .ou=next organizational unit, and o=corporation.com. If the tree containing users is the base DN, type.

In the User Attribute text box, enter the name of the attribute in the user record that contains the username. You can obtain this attribute from your directory server.

In the User Object Type text box, enter the value of the LDAP objectType attribute that identifies the record as a user. Often, user records have several values for the objectType attribute, some of which are unique to the user and some of which are shared with other object types.

In the Server Timeout text box, enter the number of seconds between retransmissions. The valid range is 2 to 30 seconds, and the default value is 2 seconds.

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Specify LDAP as the priority backend database server for local EAP authentication as follows:

1. Choose Security > Local EAP > Authentication Priority to open the Priority Order > Local-Auth page.

2. Highlight LOCAL and click < to move it to the left User Credentials box.

3. Highlight LDAP and click > to move it to the right User Credentials box. The database that appears at the top of the right User Credentials box is used when retrieving user credentials.

   Note

   If both LDAP and LOCAL appear in the right User Credentials box with LDAP on the top and LOCAL on the bottom, local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If LOCAL is on the top, local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.

4. Click Apply to commit your changes.

5. Click Save Configuration to save your changes.

(Optional) Assign specific LDAP servers to a WLAN as follows:

1. Choose WLANs to open the WLANs page.

2. Click the ID number of the desired WLAN.

3. When the WLANs > Edit page appears, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

4. From the LDAP Servers drop-down lists, choose the LDAP server(s) that you want to use with this WLAN. You can choose up to three LDAP servers, which are tried in priority order.

   Note	These LDAP servers apply only to WLANs with web authentication enabled. They are not used by local EAP.

5. Click Apply to commit your changes.

6. Click Save Configuration to save your changes.

Specify the LDAP server fallback behavior, as follows:

1. Choose WLAN > AAA Server to open the Fallback Parameters page.

2. From the LDAP Servers drop-down list, choose the LDAP server in the order of priority when the controller attempts to authenticate management users. The order of authentication is from server.

3. Choose Security > AAA > LDAP to view the list of global LDAP servers configured for the controller.

If you are configuring local EAP to use one of the EAP types listed in the note above, make sure that the appropriate certificates and PACs (if you will use manual PAC provisioning) have been imported on the controller.

If you want the controller to retrieve user credentials from the local user database, make sure that you have properly configured the local network users on the controller.

If you want the controller to retrieve user credentials from an LDAP backend database, make sure that you have properly configured an LDAP server on the controller.

Specify the order in which user credentials are retrieved from the backend database servers as follows:

1. Choose Security > Local EAP > Authentication Priority to open the Priority Order > Local-Auth page.

2. Determine the priority order in which user credentials are to be retrieved from the local and/or LDAP databases. For example, you may want the LDAP database to be given priority over the local user database, or you may not want the LDAP database to be considered at all.

3. When you have decided on a priority order, highlight the desired database. Then use the left and right arrows and the Up and Down buttons to move the desired database to the top of the right User Credentials box.

   Note

   If both LDAP and LOCAL appear in the right User Credentials box with LDAP on the top and LOCAL on the bottom, local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If LOCAL is on the top, local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.

4. Click Apply to commit your changes.

Specify values for the local EAP timers as follows:

1. Choose Security > Local EAP > General to open the General page.

2. In the Local Auth Active Timeout text box, enter the amount of time (in seconds) in which the controller attempts to authenticate wireless clients using local EAP after any pair of configured RADIUS servers fails. The valid range is 1 to 3600 seconds, and the default setting is 300 seconds.

Specify values for the Advanced EAP parameters as follows:

1. Choose Security> Advanced EAP.

2. In the Identity Request Timeout text box, enter the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

3. In the Identity Request Max Retries text box, enter the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

4. In the Dynamic WEP Key Index text box, enter the key index used for dynamic wired equivalent privacy (WEP). The default value is 0, which corresponds to a key index of 1; the valid values are 0 to 3 (key index of 1 to 4).

5. In the Request Timeout text box, enter the amount of time (in seconds) in which the controller attempts to send an EAP request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

6. In the Request Max Retries text box, enter the maximum number of times that the controller attempts to retransmit the EAP request to wireless clients using local EAP. The valid range is 1 to 120 retries, and the default setting is 2 retries.

7. From the Max-Login Ignore Identity Response drop-down list, choose Enable to limit the number of devices that can be connected to the controller with the same username. You can log in up to eight times from different devices (PDA, laptop, IP phone, and so on) on the same controller. The default value is enabled.

8. In the EAPOL-Key Timeout text box, enter the amount of time (in seconds) in which the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 1 to 5 seconds, and the default setting is 1 second.

   Note	If the controller and access point are separated by a WAN link, the default timeout of 1 second may not be sufficient.

9. In the EAPOL-Key Max Retries text box, enter the maximum number of times that the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.

10. In the EAP-Broadcast Key Interval text box, enter the interval between the Group Temporal Key (GTK) key rotation for all the stations on a BSSID that is using WPA protocol. The default interval is 3600 seconds.

11. Click Apply to commit your changes.

Create a local EAP profile, which specifies the EAP authentication types that are supported on the wireless clients as follows:

1. Choose Security > Local EAP > Profiles to open the Local EAP Profiles page.

   This page lists any local EAP profiles that have already been configured and specifies their EAP types. You can create up to 16 local EAP profiles.

   Note	If you want to delete an existing profile, hover your cursor over the blue drop-down arrow for that profile and choose Remove.

2. Click New to open the Local EAP Profiles > New page.

3. In the Profile Name text box, enter a name for your new profile and then click Apply.

   Note	You can enter up to 63 alphanumeric characters for the profile name. Make sure not to include spaces.

4. When the Local EAP Profiles page reappears, click the name of your new profile. The Local EAP Profiles > Edit page appears.

5. Select the LEAP, EAP-FAST, EAP-TLS, and/or PEAP check boxes to specify the EAP type that can be used for local authentication.

   Note	You can specify more than one EAP type per profile. However, if you choose multiple EAP types that use certificates (such as EAP-FAST with certificates, EAP-TLS, PEAPv0/MSCHAPv2, and PEAPv1/GTC), all the EAP types must use the same certificate (from either Cisco or another vendor).

   Note	If you select the PEAP check box, both PEAPv0/MSCHAPv2 or PEAPv1/GTC are enabled on the controller.

6. If you chose EAP-FAST and want the device certificate on the controller to be used for authentication, select the Local Certificate Required check box. If you want to use EAP-FAST with PACs instead of certificates, leave this check box unselected, which is the default setting.

   Note	This option applies only to EAP-FAST because device certificates are not used with LEAP and are mandatory for EAP-TLS and PEAP.

7. If you chose EAP-FAST and want the wireless clients to send their device certificates to the controller in order to authenticate, select the Client Certificate Required check box. If you want to use EAP-FAST with PACs instead of certificates, leave this check box unselected, which is the default setting.

   Note	This option applies only to EAP-FAST because client certificates are not used with LEAP or PEAP and are mandatory for EAP-TLS.

8. If you chose EAP-FAST with certificates, EAP-TLS, or PEAP, choose which certificates will be sent to the client, the ones from Cisco or the ones from another Vendor, from the Certificate Issuer drop-down list. The default setting is Cisco.

9. If you chose EAP-FAST with certificates or EAP-TLS and want the incoming certificate from the client to be validated against the CA certificates on the controller, select the Check against CA certificates check box. The default setting is enabled.

10. If you chose EAP-FAST with certificates or EAP-TLS and want the common name (CN) in the incoming certificate to be validated against the Local Net Users configured on the controller, select the Verify Certificate CN Identity check box. The default setting is disabled.

11. If you chose EAP-FAST with certificates or EAP-TLS and want the controller to verify that the incoming device certificate is still valid and has not expired, select the Check Certificate Date Validity check box. The default setting is enabled.

    Note	Certificate date validity is checked against the current UTC (GMT) time that is configured on the controller. Timezone offset will be ignored.

12. Click Apply to commit your changes.

If you created an EAP-FAST profile, follow these steps to configure the EAP-FAST parameters:

1. Choose Security > Local EAP > EAP-FAST Parameters to open the EAP-FAST Method Parameters page.

2. In the Server Key and Confirm Server Key text boxes, enter the key (in hexadecimal characters) used to encrypt and decrypt PACs.

3. In the Time to Live for the PAC text box, enter the number of days for the PAC to remain viable. The valid range is 1 to 1000 days, and the default setting is 10 days.

4. In the Authority ID text box, enter the authority identifier of the local EAP-FAST server in hexadecimal characters. You can enter up to 32 hexadecimal characters, but you must enter an even number of characters.

5. In the Authority ID Information text box, enter the authority identifier of the local EAP-FAST server in text format.

6. If you want to enable anonymous provisioning, select the Anonymous Provision check box. This feature allows PACs to be sent automatically to clients that do not have one during PAC provisioning. If you disable this feature, PACS must be manually provisioned. The default setting is enabled.

   Note	If the local and/or client certificates are required and you want to force all EAP-FAST clients to use certificates, unselect the Anonymous Provision check box.

7. Click Apply to commit your changes.

Enable local EAP on a WLAN as follows:

1. Choose WLANs to open the WLANs page.

2. Click the ID number of the desired WLAN.

3. When the WLANs > Edit page appears, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

4. Unselect the Enabled check boxes for Radius Authentication Servers and Accounting Server to disable RADIUS accounting and authentication for this WLAN.

5. Select the Local EAP Authentication check box to enable local EAP for this WLAN.

6. From the EAP Profile Name drop-down list, choose the EAP profile that you want to use for this WLAN.

7. If desired, choose the LDAP server that you want to use with local EAP on this WLAN from the LDAP Servers drop-down lists.

8. Click Apply to commit your changes.

Enable EAP parameters on a WLAN as follows:

1. Choose WLANs to open the WLANs page.

2. Click the ID number of the desired WLAN.

3. When the WLANs > Edit page appears, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

4. Select the Enable check box to configure EAP parameters for this WLAN.

5. In the EAPOL Key Timeout (200 to 5000 millisec) text box, enter the amount of time (in milliseconds) in which the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 200 to 5000 milliseconds and the default value is 1000 milliseconds.

6. In the EAPOL Key Retries (0 to 4) text box, enter the maximum number of times that the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 0 to 4 retries and the default setting is 2 retries.

7. In the Identity Request Timeout (1 to 120 sec) text box, enter the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds and the default value is 30 seconds.

8. In the Identity Request Retries (1 to 20 sec) text box, enter the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

9. In the Request Timeout (1 to 120 sec) text box, enter the amount of time (in seconds) in which the controller attempts to send an EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

10. In the Request Retries (1 to 20 sec) text box, enter the maximum number of times that the controller attempts to retransmit the EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

11. Click Apply to commit your changes.

Click Save Configuration to save your changes.

If you are configuring local EAP to use one of the EAP types listed in the note above, make sure that the appropriate certificates and PACs (if you will use manual PAC provisioning) have been imported on the controller.

If you want the controller to retrieve user credentials from the local user database, make sure that you have properly configured the local network users on the controller.

If you want the controller to retrieve user credentials from an LDAP backend database, make sure that you have properly configured an LDAP server on the controller.

Specify the order in which user credentials are retrieved from the local and/or LDAP databases by entering this command:

Specify values for the local EAP timers by entering these commands:

• config local-auth active-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to authenticate wireless clients using local EAP after any pair of configured RADIUS servers fails. The valid range is 1 to 3600 seconds, and the default setting is 100 seconds.
• config advanced eap identity-request-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
• config advanced eap identity-request-retries retries —Specifies the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients using local EAP. The valid range is 1 to 20 retries, and the default setting is 20 retries.
• config advanced eap key-index index —Specifies the key index used for dynamic wired equivalent privacy (WEP). The default value is 0, which corresponds to a key index of 1; the valid values are 0 to 3 (key index of 1 to 4).
• config advanced eap request-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
• config advanced eap request-retries retries —Specifies the maximum number of times that the controller attempts to retransmit the EAP request to wireless clients using local EAP. The valid range is 1 to 120 retries, and the default setting is 20 retries.
• config advanced eap eapol-key-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 1 to 5 seconds, and the default setting is 1 second.

  Note	If the controller and access point are separated by a WAN link, the default timeout of 1 second may not be sufficient.

• config advanced eap eapol-key-retries retries —Specifies the maximum number of times that the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.
• config advanced eap max-login-ignore-identity-response {enable | disable} —When enabled, this command ignores the limit set for the number of devices that can be connected to the controller with the same username through 802.1x authentication. When disabled, this command limits the number of devices that can be connected to the controller with the same username. This is not applicable for web authentication users. You can log in up to eight times from different devices (PDA, laptop, IP phone, and so on) on the same controller. The default value is enabled. Use the command config netuser maxUserLogin to set the limit of maximum number of devices per same username.

Specify values for the local EAP timers on a WLAN by entering these commands:

• config wlan security eap-params {enable | disable} wlan_id —Specifies to enable or disable SSID specific EAP timeouts or retries. The default value is disabled.
• config wlan security eap-params eapol-key-timeout timeout wlan_id —Specifies the amount of time (in milliseconds) in which the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 200 to 5000 milliseconds, and the default setting is 1000 milliseconds.
• config wlan security eap-params eapol-key-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.
• config wlan security eap-params identity-request-timeout timeout wlan_id —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
• config wlan security eap-params identity-request-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.
• config wlan security eap-params request-timeout timeout wlan_id —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
• config wlan security eap-params request-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to retransmit the EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

Create a local EAP profile by entering this command:

Add an EAP method to a local EAP profile by entering this command:

Configure EAP-FAST parameters if you created an EAP-FAST profile by entering this command:

Configure certificate parameters per profile by entering these commands:

• config local-auth eap-profile method fast local-cert {enable | disable} profile_name —
Specifies whether the device certificate on the controller is required for authentication.

  Note	This command applies only to EAP-FAST because device certificates are not used with LEAP and are mandatory for EAP-TLS and PEAP.

• config local-auth eap-profile method fast client-cert {enable | disable} profile_name —
Specifies whether wireless clients are required to send their device certificates to the controller in order to authenticate.

  Note	This command applies only to EAP-FAST because client certificates are not used with LEAP or PEAP and are mandatory for EAP-TLS.

• config local-auth eap-profile cert-issuer {cisco | vendor} profile_name —If you specified EAP-FAST with certificates, EAP-TLS, or PEAP, specifies whether the certificates that will be sent to the client are from Cisco or another vendor.
• config local-auth eap-profile cert-verify ca-issuer {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the incoming certificate from the client is to be validated against the CA certificates on the controller.
• config local-auth eap-profile cert-verify cn-verify {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the common name (CN) in the incoming certificate is to be validated against the CA certificates’ CN on the controller.
• config local-auth eap-profile cert-verify date-valid {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the controller is to verify that the incoming device certificate is still valid and has not expired.

Enable local EAP and attach an EAP profile to a WLAN by entering this command:

Save your changes by entering this command:

View information pertaining to local EAP by entering these commands:

• show local-auth config— Shows the local EAP configuration on the controller.

  
  User credentials database search order:
     Primary ..................................... Local DB
  
  Timer:
      Active timeout .............................. 300
  
  Configured EAP profiles:
     Name ........................................ fast-cert
       Certificate issuer ........................ vendor
       Peer verification options:
         Check against CA certificates ........... Enabled
         Verify certificate CN identity .......... Disabled
         Check certificate date validity ......... Enabled
       EAP-FAST configuration:
         Local certificate required .............. Yes
         Client certificate required ............. Yes
       Enabled methods ........................... fast
       Configured on WLANs ....................... 1
  
     Name ........................................ tls
       Certificate issuer ........................ vendor
       Peer verification options:
         Check against CA certificates ........... Enabled
         Verify certificate CN identity .......... Disabled
         Check certificate date validity ......... Enabled
       EAP-FAST configuration:
         Local certificate required .............. No
         Client certificate required ............. No
       Enabled methods ........................... tls
       Configured on WLANs ....................... 2
  
  EAP Method configuration:
     Low-Cipher Support(TLSv1.0 for local EAP)..... Enabled
     EAP-FAST:
       Server key ................................ <hidden>
       TTL for the PAC ........................... 10
       Anonymous provision allowed ............... Yes
       Accept client on auth prov ................ No
       Authority ID .............................. 436973636f0000000000000000000000
       Authority Information ..................... Cisco A-ID
  

• show local-auth statistics —Shows the local EAP statistics.
• show local-auth certificates —Shows the certificates available for local EAP.
• show local-auth user-credentials —Shows the priority order that the controller uses when retrieving user credentials from the local and/or LDAP databases.
• show advanced eap —Shows the timer values for local EAP.

  
  EAP-Identity-Request Timeout (seconds)........... 1
  EAP-Identity-Request Max Retries................. 20
  EAP Key-Index for Dynamic WEP.................... 0
  EAP Max-Login Ignore Identity Response........... enable
  EAP-Request Timeout (seconds).................... 20
  EAP-Request Max Retries.......................... 20
  EAPOL-Key Timeout (seconds)...................... 1
  EAPOL-Key Max Retries......................... 2

  

• show ap stats wlan Cisco_AP —Shows the EAP timeout and failure counters for a specific access point for each WLAN.
• show client detail client_mac —Shows the EAP timeout and failure counters for a specific associated client. These statistics are useful in troubleshooting client association issues.

  
  ...
  Client Statistics:
        Number of Bytes Received................... 10
        Number of Bytes Sent....................... 10
        Number of Packets Received................. 2
        Number of Packets Sent..................... 2
        Number of EAP Id Request Msg Timeouts...... 0
        Number of EAP Id Request Msg Failures...... 0
        Number of EAP Request Msg Timeouts......... 2
        Number of EAP Request Msg Failures......... 1
        Number of EAP Key Msg Timeouts............. 0
        Number of EAP Key Msg Failures............. 0
        Number of Policy Errors.................... 0
        Radio Signal Strength Indicator............ Unavailable
        Signal to Noise Ratio...................... Unavailable
  

• show wlan wlan_id —Shows the status of local EAP on a particular WLAN.

(Optional) Troubleshoot local EAP sessions by entering these commands:

• debug aaa local-auth eap method {all | errors | events | packets | sm} {enable | disable} —
Enables or disables debugging of local EAP methods.

• debug aaa local-auth eap framework {all | errors | events | packets | sm} {enable | disable} —
Enables or disables debugging of the local EAP framework.

  Note	In these two debug commands, sm is the state machine.

• clear stats local-auth —Clears the local EAP counters.

• clear stats ap wlan Cisco_AP —Clears the EAP timeout and failure counters for a specific access point for each WLAN.

  
  WLAN      1
     EAP Id Request Msg Timeouts................... 0
     EAP Id Request Msg Timeouts Failures.......... 0
     EAP Request Msg Timeouts...................... 2
     EAP Request Msg Timeouts Failures............. 1
     EAP Key Msg Timeouts.......................... 0
     EAP Key Msg Timeouts Failures................. 0
  WLAN      2
     EAP Id Request Msg Timeouts................... 1
     EAP Id Request Msg Timeouts Failures.......... 0
     EAP Request Msg Timeouts...................... 0
     EAP Request Msg Timeouts Failures............. 0
     EAP Key Msg Timeouts.......................... 3
  EAP Key Msg Timeouts Failures.............. 1
  

Choose WLANs to open the WLANs page.

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Choose the Advanced tab to open the WLANs > Edit (Advanced) page.

Select the RADIUS NAI-Realm check box to enable realm on the WLAN.

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Enable or disable realm on a WLAN by entering this command:

View the realm configuration on a WLAN by entering this command:

Choose Security > AAA > RADIUS > Authentication to open RADIUS Authentication Servers > Edit page.

Click the Realm List link to open the Authentication Server Index page.

Enter the realm name in the Realm Name text box.

Click Add.

Add realm to a RADIUS authentication server by entering this command:

Delete realm from a RADIUS authentication server by entering this command:

View RADIUS authentication server information by entering this command:

Choose Security > AAA > RADIUS > Accounting to open RADIUS Accounting Servers > Edit page.

Click the Realm List link to open the Accounting Server Index page.

Enter the realm name in the Realm Name text box.

Click Add.

Add realm to a RADIUS accounting server by entering this command:

Delete realm from a RADIUS accounting server by entering this command:

View RADIUS accounting server information by entering this command:

Choose WLANs to open the WLANs page.

Click the WLAN ID.

Click the Security tab, and then click the AAA Servers tab.

Check the RADIUS Server Overwrite interface check box to enable the per-WLAN RADIUS source support.

From the Interface Priority drop-down list, select either AP Group or WLAN as the interface for RADIUS packet routing.

Ensure that the Interim Interval for RADIUS Server Accounting is within the valid range.

Save the configuration.

Enter the config wlan disable wlan-id command to disable the WLAN.

Enter the following command to enable or disable the per-WLAN RADIUS source support:

Enable either an AP group's interface or a WLAN's interface for RADIUS packet routing by entering these commands:

• AP group's interface—config wlan radius_server overwrite-interface apgroup wlan-id
• WLAN's interface—config wlan radius_server overwrite-interface wlan wlan-id

Enter the config wlan enable wlan-id command to enable the WLAN.

Choose Commands > Upload File to open the Upload File from Controller page.

From the File Type drop-down list, choose PAC (Protected Access Credential).

In the User text box, enter the name of the user who will use the PAC.

In the Validity text box, enter the number of days for the PAC to remain valid. The default setting is zero (0).

In the Password and Confirm Password text boxes, enter a password to protect the PAC.

From the Transfer Mode drop-down list, choose from the following options:

• TFTP
• FTP
• SFTP (available in 7.4 and later releases)

In the IP Address (IPv4/IPv6) text box, enter the IPv4/IPv6 address of the server.

In the File Path text box, enter the directory path of the PAC.

In the File Name text box, enter the name of the PAC file. PAC files have a .pac extension.

If you are using an FTP server, follow these steps:

1. In the Server Login Username text box, enter the username to log into the FTP server.

2. In the Server Login Password text box, enter the password to log into the FTP server.

3. In the Server Port Number text box, enter the port number on the FTP server through which the upload occurs. The default value is 21.

Click Upload to upload the PAC from the controller. A message appears indicating the status of the upload.

Follow the instructions for your wireless client to load the PAC on your client devices. Make sure to use the password that you entered above.

Log on to the controller CLI.

Specify the transfer mode used to upload the config file by entering this command:

Upload a Protected Access Credential (PAC) by entering this command:

Specify the identification of the user by entering this command:

Specify the IP address of the TFTP or FTP server by entering this command:

Specify the directory path of the config file by entering this command:

Specify the name of the config file to be uploaded by entering this command:

If you are using an FTP server, enter these commands:

View the updated settings by entering the transfer upload start command. Answer y when prompted to confirm the current settings and start the upload process.

Follow the instructions for your wireless client to load the PAC on your client devices. Make sure to use the password that you entered above.

Choose Security > AAA > Local Net Users to open the Local Net Users page.

Perform one of the following:

• To edit an existing local network user, click the username for that user. The Local Net Users > Edit page appears.

• To add a local network user, click New. The Local Net Users > New page appears.

If you are adding a new user, enter a username for the local user in the User Name text box. You can enter up to 49 alphanumeric characters.

In the Password and Confirm Password text boxes, enter a password for the local user. You can enter up to 49 alphanumeric characters.

If you are adding a new user, select the Guest User check box if you want to limit the amount of time that the user has access to the local network. The default setting is unselected.

If you are adding a new user and you selected the Guest User check box, enter the amount of time (in seconds) that the guest user account is to remain active in the Lifetime text box. The valid range is 60 to 2,592,000 seconds (30 days) inclusive, and the default setting is 86,400 seconds.

If you are adding a new user, you selected the Guest User check box, and you want to assign a QoS role to this guest user, select the Guest User Role check box. The default setting is unselected.

If you are adding a new user and you selected the Guest User Role check box, choose the QoS role that you want to assign to this guest user from the Role drop-down list.

From the WLAN Profile drop-down list, choose the name of the WLAN that is to be accessed by the local user. If you choose Any WLAN, which is the default setting, the user can access any of the configured WLANs.

In the Description text box, enter a descriptive title for the local user (such as “User 1”).

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Choose WLANs to open the WLANs page.

Click the ID number of the WLAN that you want to configure. The WLANs > Edit page appears.

Choose the Advanced tab.

Select the Allow AAA Override check box to enable AAA override or unselect it to disable this feature. The default value is disabled.

Click Apply.

Click Save Configuration.

Choose WLANs to open the WLANs page.

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Choose the Advanced tab.

Select the Aironet IE check box to enable Aironet IEs for this WLAN and click Apply.

Choose the General tab.

Unselect the Status check box, if selected, to disable this WLAN and click Apply.

Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page.

Choose CKIP from the Layer 2 Security drop-down list.

Under CKIP Parameters, choose the length of the CKIP encryption key from the Key Size drop-down list.The range is Not Set, 40 bits, or 104 bits and the default is Not Set.

Choose the number to be assigned to this key from the Key Index drop-down list. You can configure up to four keys.

From the Key Format drop-down list, choose ASCII or HEX and then enter an encryption key in the Encryption Key text box. 40-bit keys must contain 5 ASCII text characters or 10 hexadecimal characters. 104-bit keys must contain 13 ASCII text characters or 26 hexadecimal characters.

Select the MMH Mode check box to enable MMH MIC data protection for this WLAN. The default value is disabled (or unselected).

Select the Key Permutation check box to enable this form of CKIP data protection. The default value is disabled (or unselected).

Click Apply to commit your changes.

Choose the General tab.

Select the Status check box to enable this WLAN.

Click Apply to commit your changes.

Click Save Configuration to save your changes.

Disable the WLAN by entering this command:

Enable Aironet IEs for this WLAN by entering this command:

Enable or disable CKIP for the WLAN by entering this command:

Specify a CKIP encryption key for the WLAN by entering this command:

Enable or disable CKIP MMH MIC for the WLAN by entering this command:

Enable or disable CKIP key permutation for the WLAN by entering this command:

Enable the WLAN by entering this command:

Save your settings by entering this command:

Configure the quarantine VLAN for a dynamic interface as follows:

1. Choose Controller > Interfaces to open the Interfaces page.

2. Click New to create a new dynamic interface.

3. In the Interface Name text box, enter a name for this interface, such as “quarantine.”

4. In the VLAN ID text box, enter a nonzero value for the access VLAN ID, such as “10.”

5. Click Apply to commit your changes. The Interfaces > Edit page appears.

6. Select the Quarantine check box and enter a nonzero value for the quarantine VLAN ID, such as “110.”

   Note

   We recommend that you configure unique quarantine VLANs throughout your network. If multiple controllers are configured in the same mobility group and access interfaces on all controllers are in the same subnet, it is mandatory to have the same quarantine VLAN if there is only one NAC appliance in the network. If multiple controllers are configured in the same mobility group and access interfaces on all controllers are in different subnets, it is mandatory to have different quarantine VLANs if there is only one NAC appliance in the network.

7. Configure any remaining text boxes for this interface, such as the IP address, netmask, and default gateway.

8. Click Apply to save your changes.

Configure NAC out-of-band support on a WLAN or guest LAN as follows:

1. Choose WLANs to open the WLANs page.

2. Click the ID number of the desired WLAN or guest LAN. The WLANs > Edit page appears.

3. Choose the Advanced tab to open the WLANs > Edit (Advanced) page.

4. Configure NAC out-of-band support for this WLAN or guest LAN by selecting the NAC State check box. To disable NAC out-of-band support, leave the check box unselected, which is the default value.

5. Click Apply to commit your changes.

Configure NAC out-of-band support for a specific access point group as follows:

1. Choose WLANs > Advanced > AP Groups to open the AP Groups page.

2. Click the name of the desired access point group.

3. Choose the WLANs tab to open the AP Groups > Edit (WLANs) page.

4. Click Add New to assign a WLAN to this access point group. The Add New section appears at the top of the page.

5. From the WLAN SSID drop-down list, choose the SSID of the WLAN.

6. From the Interface Name drop-down list, choose the interface to which you want to map the access point group. Choose the quarantine VLAN if you plan to enable NAC out-of-band support.

7. To enable NAC out-of-band support for this access point group, select the NAC State check box. To disable NAC out-of-band support, leave the check box unselected, which is the default value.

8. Click Add to add this WLAN to the access point group. This WLAN appears in the list of WLANs assigned to this access point group.

   Note	If you ever want to remove this WLAN from the access point group, hover your cursor over the blue drop-down arrow for the WLAN and choose Remove.

Click Save Configuration to save your changes.

See the current state of the client (Quarantine or Access) as follows:

1. Choose Monitor > Clients to open the Clients page.

2. Click the MAC address of the desired client to open the Clients > Detail page. The NAC state appears under the Security Information section.

   Note	The client state appears as “Invalid” if the client is probing, has not yet associated to a WLAN, or cannot complete Layer 2 authentication.

Configure the quarantine VLAN for a dynamic interface by entering this command:

Enable or disable NAC out-of-band support for a WLAN or guest LAN by entering this command:

Enable or disable NAC out-of-band support for a specific access point group by entering this command:

Save your changes by entering this command:

See the configuration of a WLAN or guest LAN, including the NAC state by entering this command:

WLAN Identifier.................................. 1
Profile Name..................................... wlan
Network Name (SSID).............................. wlan
Status........................................... Disabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control

  NAC-State...................................... Enabled
  Quarantine VLAN............................. 110
...


See the current state of the client (either Quarantine or Access) by entering this command:

Client’s NAC state.................................. QUARANTINE

Choose WLANs.

Click the WLAN ID.

Click the Advanced tab.

From the NAC State drop-down list, choose from the following options:

• None
• SNMP NAC—Uses SNMP NAC for the WLAN.
• ISE NAC—Uses ISE NAC for the WLAN.

  Note	AAA override is automatically enabled when you use ISE NAC on a WLAN.

Save the configuration.

Configure Cisco WLC:

1. Add Cisco ISE as RADIUS server in Cisco WLC with change of authorization (CoA) in Enabled state.

2. Configure a WLAN with Layer 2 security type set to WPA+WPA2, MAC filtering in Enabled state, Authentication Key Management set to PSK, and NAC state set to ISE NAC:

   1. Choose WLANs and click the WLAN ID.

   2. On the WLANs > Edit page, choose Security > Layer 2 tab.

   3. Set Layer 2 Security to WPA+WPA2.

   4. Enable MAC Filtering.

   5. Under Authentication Key Management, enable PSK and set the PSK format.

   6. In the Advanced tab, set the NAC State to ISE NAC.

3. Create a preauthentication ACL to communicate with only the Cisco ISE server. For instructions on how to create an ACL, see (Link to be provided to the Configuring Access Control Lists chapter).

   Note	In addition to ISE traffic, allow other necessary traffic such as DNS, DHCP to be specified to permit DNS and DHCP traffic on the redirect ACL. If the APs are in FlexConnect mode, a preauth ACL is irrelevant. FlexConnect ACLs can be used to allow access for clients that have not been authenticated.

Configure Cisco ISE:

1. Ensure that Cisco WLC is in Cisco ISE.

2. Add an authentication profile.

3. Add an authorization profile.

4. Add postauthentication policies.

5. Add authorization policy.

   Note

   The first instance is when a user associates with the SSID and when the central web authentication profile is returned (unknown MAC address; therefore, you must set the user for redirection). The second instance is when a user authenticated on the web portal, such that it matches the default rule (internal users) in this configuration (it can be configured to meet your requirements). It is important that the authorization part does not match the central web authentication profile again. Otherwise, there will be a redirection loop.