802.1x auth fail through WLC but OK on autonomous APs

Question

Hello,
I migrate 1310 APs from Autonomous to Lightweight. Migration is OK with Cisco Upgrade Tool, and AP are registered on my 2504 WLC.
Previously, a 802.1x network was broadcasted by autonomous APs, supplicants were identified on a freeradius server with MSCHAPv2/PEAP method.
I send you in attachement a AP config which is OK.
But on the WLC, supplicants can't auth on Radius server.
I configured a WLAN with WPA/TKIP/802.1x with my radius server in AAA tab.
When clients try to authenticate, I get these messages where xxx is login:
AAA Authentication Failure for UserName:821 User Type: WLAN USER
AAA Authentication Failure for UserName:200 User Type: WLAN USER
AAA Authentication Failure for UserName:209 User Type: WLAN USER
Security info on client page is:
Security Policy Completed
No
Policy Type
WPA
Encryption Cipher
TKIP-MIC
EAP Type
PEAP
SNMP NAC State
Access
Radius NAC State
8021X_REQD
What is strange, there are some clients which are OK in RUN State, and 50 other % which are not.
In attachment there is a debug client "mac-address" on a device which cannot authenticate through WLC.
Thank you,
Clement

Answer 1

Hi Amjad,
I'm not using NAC.
Clients makes a MSCHAPv2/PEAP auth on a FreeRadius server through the WLC.
Because network is critical, I do a rollback so I passed the light APs into their autonomous original state.
Now all clients can successfully auth on the network. I don't understand what happens when APs are in lightweight mode :/
I have more information about the WLAN clients  :
- Each client is an infrastructure which have a AXIS wireless modem in bridge mode, which is client of the WLAN. This modem have login/password for MSCHAPv2 auth.
- Behind the AXIS, there is a switch on which 4 devices in static IP are connected.
- If the AXIS is successfully authenticated on the WLAN, only one device of four is able to ping servers on the LAN. The others cannot, it seems to be a "token ring" like ?!
The WLAN clients infrastructures are very proprietary, it's very difficult to debug.
What I know, is all clients are OK on autonomous AP (auth 100% successfull, ping 100% successfull for 4 devices) and when the clients join a lightweight AP it is (auth 50% successfull, ping 100% successfull for 1 device, 0% successfull for 3 others devices)
Tell me if you need specific debug logs.
Clement