Help with configuring AP-1240AG as local authenticator for EAP-FAST client

Question

Hi,
I am trying to configure an AP-1240AG as a local authenticator for a Windows XP client with no success. Here is a part of the AP configuration:
dot11 lab_test
   authentication open eap eap_methods
   authentication network-eap eap_methods
   guest-mode
   infrastructure-ssid
radius-server local
  eapfast authority id 0102030405060708090A0B0C0D0E0F10
  eapfast authority info lab
  eapfast server-key primary 7 211C7F85F2A6056FB6DC70BE66090DE351
  user georges nthash 7 115C41544E4A535E2072797D096466723124425253707D0901755A5B3A370F7A05
Here is the Windows XP client configuration:
Authentication: Open
Encrpytion WEP
Disable Cisco ccxV4 improvements
username: georges
password: georges
Results: The show radius local-server statistics does not show any activity for the user georges and the debug messages are showing the following:
*Mar  4 01:15:58.887: %DOT11-7-AUTH_FAILED: Station 0016.6f68.b13b Authentication failed
*Mar  4 01:16:28.914: %DOT11-7-AUTH_FAILED: Station 0016.6f68.b13b Authentication failed
*Mar  4 01:16:56.700: RADIUS/ENCODE(00001F5C):Orig. component type = DOT11
*Mar  4 01:16:56.701: RADIUS:  AAA Unsupported Attr: ssid              [263] 19
*Mar  4 01:16:56.701: RADIUS:    [lab_test]
*Mar  4 01:16:56.701: RADIUS:   65                                               [e]
*Mar  4 01:16:56.701: RADIUS:  AAA Unsupported Attr: interface         [156] 4
*Mar  4 01:16:56.701: RADIUS:   38 32                                            [82]
*Mar  4 01:16:56.701: RADIUS(00001F5C): Storing nasport 8275 in rad_db
*Mar  4 01:16:56.702: RADIUS(00001F5C): Config NAS IP: 10.5.104.22
*Mar  4 01:16:56.702: RADIUS/ENCODE(00001F5C): acct_session_id: 8026
*Mar  4 01:16:56.702: RADIUS(00001F5C): sending
*Mar  4 01:16:56.702: RADIUS/DECODE: parse response no app start; FAIL
*Mar  4 01:16:56.702: RADIUS/DECODE: parse response; FAIL
It seems that the radius packet that the AP receive is not what is expected. Do not know if the problem is with the client or with the AP configuration. Try many things but running out of ideas. Any suggestions would be welcome
Thanks

Answer 1

Hi Stephen,
I do not want to create a workgroup bridge, just want to have the wireless radio bridge with the Ethernet port. I will remove the infrastructure command.
Thanks for your help
Stephane
Here is the complete configuration:
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname Lab
ip subnet-zero
aaa new-model
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 lab_test
   authentication open eap eap_methods
   authentication network-eap eap_methods
   guest-mode
   infrastructure-ssid
power inline negotiation prestandard source
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
ssid lab_test
traffic-metrics aggregate-report
speed basic-54.0
no power client local
channel 2462
station-role root
antenna receive right
antenna transmit right
no dot11 extension aironet
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
dfs band 3 block
  speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
channel dfs
station-role root
no dot11 extension aironet
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
hold-queue 160 in
interface BVI1
ip address 10.5.104.22 255.255.255.0
ip default-gateway 10.5.104.254
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server local
  eapfast authority id 000102030405060708090A0B0C0D0E0F
  eapfast authority info LAB
  eapfast server-key primary 7 C7AC67E296DF3437EB018F73BE00D822B8
  user georges nthash 7 14424A5A555C72790070616C03445446212202080A75705F513942017A76057007
control-plane
bridge 1 route ip
line con 0
line vty 0 4
end