Automatic PAC Provisioning

If you use automatic PAC provisioning, badges automatically download a PAC from the Cisco ACS, and the ACS periodically refreshes the PAC to ensure it does not expire.

When the badge retrieves the PAC for the first time, the provisioning stage takes up to 10 seconds. This delay should occur only once in the lifetime of a regularly used badge.

You must increase the EAP Request Timeout to 15 seconds on the wireless access points, because of this initial delay in PAC provisioning.

For Cisco CAPWAP access points, use the following Cisco WLC Command Line Interface (CLI) commands to configure the EAP Request Timeout on Cisco controllers.

controller> configure advanced eap request-timeout 15
controller> save config
controller> show advanced eap

Note: The setting is not available in the Cisco WCS or Cisco WLC Web User Interface.

Important: Automatic PAC provisioning does not work if you do not set the EAP Request Timeout to 15 seconds on your access points. Either the ACS or the badge send an error during PAC provisioning.