1

Hi All,

I got Cisco WLC 9800, Cisco ISE, AD server. I want to implement 802.1X authentication (RADIUS) with AD cred for wireless clients with SSL cert.

Can someone share good step by step to achieve this task?

Also, I got wildcard pfx SSL cert & if i want to enable SSL cert for wireless authentication. What is the steps & where do i need to install(example AD server, Cisco ISE or wlc?

Appreciate your help.

8 Spice ups
2

SSL cert will go on WLC - it is the device the clients will communicate with to Auth,
configure an SSID to use WPA enterprise / 802.1x
Set ISE as the radius server (configure WLC as client in ISE).
In ISE you will need a policy creating to use for requests from this radius client.
Add ad as an ldap source.
in policy then define your criteria which may just be user auth from the ‘users’ OU of the ldap source.
You will need to read the manuals for each product and follow the steps. WLC docs for setting the SSID auth type, and adding ISE as a radius server. ISE docs for creating a policy.

3

Thank you m@ttshaw. while checking document Configure EAP-TLS Authentication with ISE - Cisco it says we need to install cert to Cisco ISE & not WLC.

Also, i have pfx cert & was looking a way to import it to Cico ISE for this 802.1x authentication for wireless clients. i dont want to create csr from Cisco ISE.

Appreciate your help

4

You are correct, ISE needs the server identity certificate for EAP-TLS. I found this doc Understand and Configure EAP-TLS with a WLC and ISE - Cisco which has a diagram.

The ISE manual only covers requesting a cert via a CSR. check out the CLI reference there may be a way to import an existing from pfx (assuming you have the private key).