https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15176#M79 Ronaldo,<BR /> <BR /> this is quite specific design question, but in general - yes, it is possible.<BR /> <BR /> AP is capable of both roles - authenticator and authentication server. You may either use LDAP to query user, or forward EAP-TLS requests to NPS<BR /> All depends on a required desing.<BR /> <BR /> Let us know if you need more details.<BR /> <BR /> Regards,<BR /> Ondrej Wed, 24 May 2017 00:37:00 GMT Ondrej_Lepa 2017-05-24T00:37:00Z https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15172#M75 Hi. Is this setup possible? I need help setting this up if this is a possible setup. TIA. Tue, 23 May 2017 10:32:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15172#M75 Ronaldo_Asimao 2017-05-23T10:32:00Z https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15173#M76 Hi,<BR /> what do you mean with "integrated with AD"? I think you'll do 802.1x with EAP-MSCHAPv2 or do you will use the AD to get CLI/GUI access?<BR /> <BR /> I prefer to use a Windows NPS instead of internal AAA. But you can use also the internal AAA and refer to a AD group to get access. Is this what you are looking for?<BR /> <BR /> BR,<BR /> Timo Tue, 23 May 2017 11:30:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15173#M76 Timo1 2017-05-23T11:30:00Z https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15174#M77 The setup goes like this, when the user logged in his/her AD account, he will be automatically be connected to the wireless network. The AP will use the user's AD login credential as authentication. Will this be okay? Tue, 23 May 2017 11:30:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15174#M77 Ronaldo_Asimao 2017-05-23T11:30:00Z https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15175#M78 Hi,<BR /> that will work. Search for "WiNG 5.X How-To - Active Directory Authentication". This PDF include all descriptions for the scenario.<BR /> <BR /> Do you have a PKI? I prefer to provide a private certificate for every AP to secure the authentication. Biggest problem with MSCHAPv2 is, that most people disable the certificate validation. Use a trusted certificate or publish the AP certificate to every computer via GPO. <U>Do <B>not disable</B> certificate validation!<BR /> </U><BR /> Tue, 23 May 2017 11:30:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15175#M78 Timo1 2017-05-23T11:30:00Z https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15176#M79 Ronaldo,<BR /> <BR /> this is quite specific design question, but in general - yes, it is possible.<BR /> <BR /> AP is capable of both roles - authenticator and authentication server. You may either use LDAP to query user, or forward EAP-TLS requests to NPS<BR /> All depends on a required desing.<BR /> <BR /> Let us know if you need more details.<BR /> <BR /> Regards,<BR /> Ondrej Wed, 24 May 2017 00:37:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/7522-ap-as-a-controller-to-be-integrated-with-windows-active/m-p/15176#M79 Ondrej_Lepa 2017-05-24T00:37:00Z