WPA2-Enterprise — RADIUS auth before traffic flows
- Services & wireless
- Advanced
- 12 min
- 1 steps
- Cisco IOS-XE-style
A WLAN with securityMode: wpa2-enterprise requires a RADIUS Access-Accept before client traffic flows. PHONE has eapIdentity: alice and the AAA server has simulatedUsers: [{ username: alice, ... }] — auth succeeds, traffic flows. PHONE2 has eapIdentity: mallory (not in users list) — Access-Reject lands, authState: rejected, all uplink traffic is dropped at the AP with a wlan-auth: ... reason. Pcap shows the RADIUS Access-Request / Accept / Reject frames.
Open this lab in your browser →
Free · no install · no account
Scenario
Slice N wires the existing securityMode: wpa2-enterprise field into a real RADIUS exchange. At AP-join time: 1. The WLC walks each wifi-client associated with the joining AP. 2. For clients on a wpa2-enterprise WLAN, the WLC emits a RADIUS Access-Request (UDP/1812) toward the first server in device.radiusServers with the client's eapIdentity as User-Name. 3. The RADIUS server (anywhere reachable in the topology) matches the username against its simulatedUsers list and replies Access-Accept or Access-Reject. 4. The wireless-EAP piggyback hook on the WLC (in aaa/wire.ts) updates the client's authState to accepted / rejected. 5. The CAPWAP data path gates on authState: rejected clients have all uplink and downlink traffic dropped at the AP / WLC respectively, with PacketDropped events tagged wlan-auth: …. Open / WPA2-PSK clients skip this entirely — authState stays idle, treated as permit. Forward work: - Per-client password matching (today the simulator only checks username presence). - Full EAP-PEAP/EAP-TLS frame emulation (today we use the simulator's structured RADIUS payload, same pattern as DNS/NTP/TACACS+). - Accounting Start/Stop frames (the IR exists; the wireless-EAP path doesn't fire them yet). - Re-auth / session timeout.
Topology
2 × router, 1 × wireless controller, 1 × switch, 1 × access point, 1 × wifi client · Cisco IOS-XE-style
ROUTER— routerWLC1— wireless controllerHUB— switchAP1— access pointPHONE— wifi clientaaa— router
What you will do
After convergence, PHONE.wifiClient.authState should be
accepted. Pcap should show a RADIUS Access-Request from WLC1 → 10.40.0.5 (User-Name: alice) and an Access-Accept from AAA back to WLC1.
Open this lab in your browser →
More labs on this topic
- Configure a DHCP serverBeginner · 12 min
- WLAN — broadcast a basic SSIDBeginner · 10 min
- HSRP: configure first-hop redundancyIntermediate · 12 min
- NAT: PAT (overload) for an inside LANIntermediate · 14 min
- HSRP — interface tracking with priority decrementIntermediate · 12 min
- VRF-Lite — two customers on one routerIntermediate · 12 min
This lab in other languages
WPA2-Enterprise – RADIUS-Authentifizierung, bevor der Datenverkehr fließtWPA2-Enterprise: autenticación RADIUS antes de que fluya el tráficoWPA2-Enterprise — Autenticação RADIUS antes do fluxo de tráfegoWPA2-Enterprise — Authentification RADIUS avant la circulation du traficWPA2-एंटरप्राइज़ - ट्रैफ़िक प्रवाह से पहले RADIUS प्रमाणीकरणWPA2-Enterprise — 流量之前进行 RADIUS 身份验证WPA2-Enterprise: autenticazione RADIUS prima dei flussi di trafficoWPA2-Enterprise — トラフィックが流れる前の RADIUS 認証WPA2-Enterprise — 트래픽 흐름 전 RADIUS 인증WPA2-Enterprise — аутентификация RADIUS перед потоком трафикаWPA2-Enterprise — Trafik akışlarından önce RADIUS kimlik doğrulamasıWPA2-Enterprise - Xác thực RADIUS trước luồng lưu lượng