When using EAP-FAST you want to insure you give the client enough time to obtain the PAC. By default the WLC is set to only 2 seconds. However I noticed with code 6.0.188.0 it is set to 30 seconds by default. This command can only be configed from the CLI of the WLC.
When using EAP-FAST, the IEEE 802.1X timeout on the controller must be increased (default = 2 seconds) in order for the client to obtain the PAC via automatic provisioning. The default timeout on the
Cisco ACS server is 20 seconds, which is the recommended value.
Cisco ACS server is 20 seconds, which is the recommended value.To change the IEEE 802.1X timeout on the Cisco Wireless LAN controller, connect using Telnet or SSH to the controller and enter the following command:
(Cisco Controller)> config advanced eap request-timeout 20
(Cisco Controller)> show advanced eap
EAP-Identity-Request Timeout (seconds)........... 1
EAP-Identity-Request Max Retries................ 20
EAP Key-Index for Dynamic WEP.................... 0
EAP-Request Timeout (seconds)................... 20
EAP-Request Max Retries.......................... 2