Overview

The Cisco WLC acts as the 802.1X Authenticator (NAS). When a wireless client connects, the WLC forwards authentication to XEOX PNAC, which validates the device against the MAC database — the same database used for wired 802.1X on Cisco Catalyst switches.

[Wireless Client]
       │  802.1X / EAP over Air
       ▼
[Cisco WLC] ──── RADIUS (UDP 1812/1813) ────► [XEOX PNAC (FreeRADIUS)]
 (Authenticator / NAS)                        │
                                              MAC Database
                                         (same as wired NAC)

XEOX PNAC — Add WLC as RADIUS Client

The WLC is added as a RADIUS NAS client automatically by the XEOX PNAC tool via the GUI — no manual editing of clients.conf is required.

For reference, the tool registers the WLC with the following parameters:

Important

The WLC sends:

NAS-Port-Type = Wireless-802.11

If your existing XEOX PNAC policy filters on:

NAS-Port-Type = Ethernet

(which is common in wired-only setups), remove or extend that condition so wireless clients are not rejected.

XEOX PNAC — VLAN Assignment (Optional)

To assign wireless clients to a VLAN via RADIUS, return the following attributes in your XEOX PNAC device profile or SQL/LDAP response.

XEOX PNAC stores these as numeric values — this is fully equivalent to the named constants.

Example device profile / FreeRADIUS users file:

AA:BB:CC:DD:EE:FF   Cleartext-Password := "AA:BB:CC:DD:EE:FF"
                    Tunnel-Type = 13,
                    Tunnel-Medium-Type = 6,
                    Tunnel-Private-Group-Id = 25

These are identical to the named form:

Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802

XEOX PNAC and the WLC interpret them the same way. The WLC will place the authenticated client into the specified VLAN regardless of whether names or numbers are used.

Option A — Cisco AireOS WLC

1. Add RADIUS Authentication Server

GUI

Security → AAA → RADIUS → Authentication → New

Repeat for a second XEOX PNAC server if applicable:

192.168.128.246

CLI

WLC(config)# config radius auth add 1 192.168.128.245 1812 ascii PRESHAREDKEY
WLC(config)# config radius auth enable 1
WLC(config)# config radius auth network 1 enable
WLC(config)# config radius auth rfc3576 enable 1
WLC(config)# config radius auth add 2 192.168.128.246 1812 ascii PRESHAREDKEY
WLC(config)# config radius auth enable 2
WLC(config)# config radius auth network 2 enable
WLC(config)# config radius auth rfc3576 enable 2

2. Add RADIUS Accounting Server

GUI

Security → AAA → RADIUS → Accounting → New

CLI

WLC(config)# config radius acct add 1 192.168.128.245 1813 ascii PRESHAREDKEY
WLC(config)# config radius acct enable 1
WLC(config)# config radius acct network 1 enable

3. Create the WLAN

GUI

WLANs → Create New

Security tab

AAA Servers tab

CLI

WLC(config)# config wlan create 1 Corporate-8021X Corporate-WiFi
WLC(config)# config wlan security wpa enable 1
WLC(config)# config wlan security wpa wpa2 enable 1
WLC(config)# config wlan security wpa wpa2 ciphers aes enable 1
WLC(config)# config wlan security wpa akm 802.1x enable 1
WLC(config)# config wlan radius_server auth add 1 1
WLC(config)# config wlan radius_server auth add 1 2
WLC(config)# config wlan radius_server acct add 1 1
WLC(config)# config wlan enable 1

4. VLAN Assignment (Dynamic — RADIUS Override)

If FreeRADIUS returns VLAN attributes, the WLC will honour them automatically.

Ensure:

• The WLAN is mapped to any valid interface.

• The RADIUS-supplied VLAN overrides it per client at association time.

The VLAN must:

• Exist as a Dynamic Interface on the WLC, or

• Be trunked between the AP and the WLC.

5. Guest / Fallback VLAN Behaviour

Option B — Cisco Catalyst 9800 (IOS-XE)

1. Enable AAA

aaa new-model
aaa authentication dot1x WIRELESS-DOT1X group WIRELESS-RADIUS
aaa authorization network WIRELESS-AUTHZ group WIRELESS-RADIUS
aaa accounting dot1x WIRELESS-ACCT start-stop group WIRELESS-RADIUS

2. Configure RADIUS Servers

radius server XEOX-PNAC-PRIMARY
 address ipv4 192.168.128.245 auth-port 1812 acct-port 1813
 key PRESHAREDKEY
 timeout 5
 retransmit 3
radius server XEOX-PNAC-SECONDARY
 address ipv4 192.168.128.246 auth-port 1812 acct-port 1813
 key PRESHAREDKEY
 timeout 5
 retransmit 3

aaa group server radius WIRELESS-RADIUS
 server name XEOX-PNAC-PRIMARY
 server name XEOX-PNAC-SECONDARY
 ip radius source-interface Vlan10

3. WLAN Profile (SSID)

wlan Corporate-WiFi 1 Corporate-WiFi
 security wpa wpa2
 no security wpa wpa2 ciphers tkip
 security wpa wpa2 ciphers aes
 no security wpa akm psk
 security wpa akm dot1x
 security dot1x authentication-list WIRELESS-DOT1X
 no shutdown

4. Policy Profile

wireless profile policy CORP-POLICY
 aaa-override
 accounting-list WIRELESS-ACCT
 vlan 1
 no shutdown

aaa-override is required for RADIUS-supplied VLAN, ACL, and QoS attributes to be applied per client.

5. Policy Tag

wireless tag policy CORP-POLICY-TAG
 wlan Corporate-WiFi policy CORP-POLICY

6. Apply Policy Tag to APs

ap <AP-MAC-address>
 policy-tag CORP-POLICY-TAG
 site-tag default-site-tag
 rf-tag default-rf-tag

MAC Authentication Bypass (MAB) — Fallback for Non-Supplicant Devices

When a device does not have an 802.1X supplicant, the WLC can send the device’s MAC address as the RADIUS username and password (identical to wired MAB on Catalyst switches).

AireOS

WLC(config)# config wlan mac-filtering enable 1

Catalyst 9800

wlan Corporate-WiFi 1 Corporate-WiFi
 mac-filtering WIRELESS-DOT1X

XEOX PNAC receives the MAC address as User-Name and User-Password and validates it against the existing MAC database — no changes are required on the RADIUS side.

Verification

AireOS

show radius summary
show wlan 1
show client summary
show client detail <client-mac>
debug dot1x events enable
debug aaa events enable

Catalyst 9800

show wireless client summary
show wireless client detail mac-address <client-mac>
show aaa servers
show radius server-group WIRELESS-RADIUS
show radius statistics
debug radius authentication

XEOX PNAC / FreeRADIUS (Live Debug)

Stop the service and run FreeRADIUS in the foreground to observe authentication exchanges.

systemctl stop freeradius
freeradius -X

Key Differences vs Wired (Catalyst 3750 / 9200 / 9300)

Configuration validated with:

• XEOX PNAC (FreeRADIUS 3.0)

• Cisco AireOS 8.10

• Cisco IOS-XE 17.9