i would suggest looking into (P)EAP if your Cisco based
Yes, this would be the cheapest thing to do since all you will need additionally is a shittly little linux box running free RADIUS. I have this in use now and I haven't had a single issue....yet.