WLC-4402 with PEAP-TLS

Question

Hi,
I need to set a WLAN with the following requirements
laptops must be configured  via Active Directory, with the following parameters:
WPA2-Enterprise
AES Encryption
Authentication with EAP type "Protected EAP-TLS (PEAP-TLS)”
Validating Certificate Authority for the RADIUS server certificate is ACME Corporate Internal Root CA
Authentication
Device security and user authentication must take place through Active Directory (AD).
The AD infrastructure must be configured for auto-enrolment of ACME devices into the integral AD internal Public Key Infrastructure (PKI).
The local site wireless controller must directly authenticate both the user and the device using a standard Microsoft RADIUS server enabled
on the local AD controller.
Connection must be authenticated authorised using both the AD machine objectcertificate, confirming that the device is in AD and is a valid ACME device and the user cached Kerberos (AD) credentials, confirming a valid ACME user is logged in to that device.
I have already configured WLAN security options ;Layer2  and AAA servers (authentication server, and LDAP server)
Based on the requirements I do not know how to set the option for certificates.
Should I load to WLC a CA certificate and Device certificate?
I don´t manage the RADIUS and AD controller so I don´t know If the administration staff have already set all the things in order to support PEAP-TLS
Which questions should I ask them in order to be sure all the things necessary are set on their side??
What additional setting are necesary if the requirements is for EAP- TTLS
Regards,

Answer 1

OK so basically what you need to do is doing EAP-TLS with Machince authentication.
Yes, that can be done. However WHO is it going to be authenticating both? IAS? or ACS?
Here it is a configuration example on how you can do this using ACS, doing it with IAS would be basically the same.
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0ea.shtml