Configure Windows server for RADIUS
1. Install NPS and CA authority roles if you have not already
2. Go to Computer Management. Roles – Network Policy and Access – NPS (Local) – RADIUS Clients
3. Create new RADIUS client
- Friendly name: Name of AP (Example: corp-ap-1141-il)
- IP Address: IP of AP
- Shared Secret – Manual (Generate a random 12+ digit key with no special chars)
- Under “Advanced” tab, Vendor name: Cisco and check “RADIUS client is NAP capable”
4. Under NPS – Policies – Network Policies create a new Policy called ‘Cisco AP Radius’
- Condition Tab: Windows Groups (Domain Users)
- Constraints Tab
- Auth Methods: Add all three auth methods. Check MS-CHAPv2, MS-CHAP, CHAP and PAP/SPAP
- NAS Port Type: Select Wireless 802.11 under Common 802.1x types and “Wireless Other” under “Others”
- Settings Tab
- Standard: add Service-Type Login
5. When done, move the Cisco AP Radius policy to the #1 position
Configure Cisco AP for RADIUS
1. Enter in RADIUS group information
aaa new-modelaaa group server radius rad_eapserver 10.0.0.3 auth-port 1812 acct-port 1813aaa authentication login eap_methods group rad_eapaaa session-id commonradius-server host 10.0.0.3 auth-port 1812 acct-port 1813 key KEYYOUGENERATEDEARILERdot11 ssid CompanyWifino authentication openno wpa-psk asciiauthentication open eap eap_methodsauthentication network-eap eap_methods
2. Try to connect with a client computer. Debug on AP with: debug radius authentication