Prerequisite: must enable your Radius method for you authentication: https://iiwanblog.wordpress.com/2013/04/10/enable-radius-authentication-and-accounting-for-cisco-router/
Router Config:
———————————————————————————————————————————————————
hostname iwan-router
// I’ll setup my SSID as iwan-ssid
dot11 syslog
dot11 ssid iwan-ssid
authentication open eap iwan-radius-method
authentication key-management wpa version 2
aacounting iwan-radius-method
guest–mode
// Enabling IRB: allowing bridging of traffic
bridge irb
// The wireless config (channel 6, bridge group 1)
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid iwan-ssid
antenna gain 0
channel 6
station-role root
no dot11 extension aironet
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
// Associate my bridge-group into one of actual interface
interface Fa0
no ip address
no ip route-cache
no keepalive
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
// The interface for my wireless (address: 172.16.10.1 /24)
interface BVI1
ip address 172.16.10.1 255.255.255.0
no ip route-cache
// Allowing to route mode
bridge 1 route ip