-
null
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter contains these sections:
This section contains the following topics:
The controller can provide guest user access on WLANs. The first step in creating guest user accounts is to create a lobby administrator user, also known as a lobby ambassador account. Once this account has been created, a lobby ambassador can create and manage guest user accounts on the controller. The lobby ambassador has limited configuration privileges and access only to the web pages used to manage the guest accounts.
The lobby ambassador can specify the amount of time that the guest user accounts remain active. After the specified time elapses, the guest user accounts expire automatically.
The local user database is limited to a maximum of 2048 entries, which is also the default value. This database is shared by local management users (including lobby ambassadors), local network users (including guest users), MAC filter entries, exclusion list entries, and access point authorization list entries. Together they cannot exceed the configured maximum value.
Step 1 Choose Management > Local Management Users to open the Local Management Users page.
Figure 12-1 Local Management Users Page
This page lists the names and access privileges of the local management users.
Note If you want to delete any of the user accounts from the controller, hover your cursor over the blue drop-down arrow and choose Remove. However, deleting the default administrative user prohibits both GUI and CLI access to the controller. Therefore, you must create a user with administrative privileges (ReadWrite) before you remove the default user.
Step 2 Click New to create a lobby ambassador account. The Local Management Users > New page appears.
Step 3 In the User Name text box, enter a username for the lobby ambassador account.
Note Management usernames must be unique because they are stored in a single database.
Step 4 In the Password and Confirm Password text boxes, enter a password for the lobby ambassador account.
Note Passwords are case sensitive. The settings for the management User Details parameters depends on the settings that you make in the Password Policy page. The following requirements are enforced on the password
Step 5 Choose LobbyAdmin from the User Access Mode drop-down list. This option enables the lobby ambassador to create guest user accounts.
Note The ReadOnly option creates an account with read-only privileges, and the ReadWrite option creates an administrative account with both read and write privileges.
Step 6 Click Apply to commit your changes. The new lobby ambassador account appears in the list of local management users.
Step 7 Click Save Configuration to save your changes.
To create a lobby ambassador account use the following command:
config mgmtuser add lobbyadmin_username lobbyadmin_pwd lobby-admin
Note Replacing lobby-admin with read-only creates an account with read-only privileges. Replacing lobby-admin with read-write creates an administrative account with both read and write privileges.
Step 1 Log into the controller as the lobby ambassador, using the username and password. The Lobby Ambassador Guest Management > Guest Users List page appears.
Figure 12-2 Lobby Ambassador Guest Management > Guest Users List Page
Step 2 Click New to create a guest user account. The Lobby Ambassador Guest Management > Guest Users List > New page appears.
Step 3 In the User Name text box, enter a name for the guest user. You can enter up to 24 characters.
Step 4 Perform one of the following:
Note Passwords can contain up to 24 characters and are case sensitive.
Step 5 From the Lifetime drop-down lists, choose the amount of time (in days, hours, minutes, and seconds) that this guest user account is to remain active. A value of zero (0) for all four text boxes creates a permanent account.
Note The smaller of this value or the session timeout for the guest WLAN, which is the WLAN on which the guest account is created, takes precedence. For example, if a WLAN session timeout is due to expire in 30 minutes but the guest account lifetime has 10 minutes remaining, the account is deleted in 10 minutes upon guest account expiry. Similarly, if the WLAN session timeout expires before the guest account lifetime, the client experiences a recurring session timeout that requires reauthentication.
Note You can change a guest user account with a nonzero lifetime to another lifetime value at any time while the account is active. However, to make a guest user account permanent using the controller GUI, you must delete the account and create it again. If desired, you can use the config netuser lifetime user_name 0 command to make a guest user account permanent without deleting and recreating it.
Step 6 From the WLAN SSID drop-down list, choose the SSID that will be used by the guest user. The only WLANs that are listed are those WLANs for which Layer 3 web authentication has been configured.
Note We recommend that you create a specific guest WLAN to prevent any potential conflicts. If a guest account expires and it has a name conflict with an account on the RADIUS server and both are on the same WLAN, the users associated with both accounts are disassociated before the guest account is deleted.
Step 7 In the Description text box, enter a description of the guest user account. You can enter up to 32 characters.
Step 8 Click Apply to commit your changes. The new guest user account appears in the list of guest users on the Guest Users List page.
From this page, you can see all of the guest user accounts, their WLAN SSID, and their lifetime. You can also edit or remove a guest user account. When you remove a guest user account, all of the clients that are using the guest WLAN and are logged in using that account’s username are deleted.
Step 9 Repeat this procedure to create any additional guest user accounts.
To view guest user accounts using the controller GUI, choose Security > AAA > Local Net Users . The Local Net Users page appears.
Figure 12-3 Local Net Users Page
From this page, you can see all of the local net user accounts (including guest user accounts) and can edit or remove them as desired. When you remove a guest user account, all of the clients that are using the guest WLAN and are logged in using that account’s username are deleted.
To see all of the local net user accounts (including guest user accounts) using the controller CLI, enter this command:
This section contains the following topics:
The controller’s operating system automatically generates a fully functional web authentication certificate, so you do not need to do anything in order to use certificates with Layer 3 web authentication. However, if desired, you can prompt the operating system to generate a new web authentication certificate, or you can download an externally generated SSL certificate.
In controller versions earlier than 5.1.151.0, web authentication certificates can be only device certificates and should not contain the CA roots chained to the device certificate (no chained certificates).
With controller version 5.1.151.0 and later, the controller allows for the device certificate to be downloaded as a chained certificate (up to a level of 2) for web authentication. Wildcard certificates are also supported. For more information about chained certificates, see the Generate CSR for Third-Party Certificates and Download Chained Certificates to the WLC document at http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml .
Step 1 Choose Security > Web Auth > Certificate to open the Web Authentication Certificate page.
Figure 12-4 Web Authentication Certificate Page
This page shows the details of the current web authentication certificate.
Step 2 If you want to use a new operating system-generated web authentication certificate, follow these steps:
a. Click Regenerate Certificate . The operating system generates a new web authentication certificate, and a successfully generated web authentication certificate message appears.
b. Reboot the controller to register the new certificate.
Step 3 If you prefer to use an externally generated web authentication certificate, follow these steps:
a. Verify that the controller can ping the TFTP server.
b. Select the Download SSL Certificate check box.
c. In the Server IP Address text box, enter the IP address of the TFTP server.
The default values of 10 retries and 6 seconds for the Maximum Retries and Timeout text boxes should work correctly without any adjustment. However, you can change these values.
d. Enter the maximum number of times that each download can be attempted in the Maximum Retries text box and the amount of time (in seconds) allowed for each download in the Timeout text box.
e. In the Certificate File Path text box, enter the directory path of the certificate.
f. In the Certificate File Name text box, enter the name of the certificate ( certname .pem).
g. In the Certificate Password text box, enter the password for the certificate.
h. Click Apply to commit your changes. The operating system downloads the new certificate from the TFTP server.
i. Reboot the controller to register the new certificate.
Step 1 See the current web authentication certificate by entering this command:
Information similar to the following appears:
Step 2 If you want the operating system to generate a new web authentication certificate, follow these steps:
a. To generate the new certificate, enter this command:
config certificate generate webauth
b. To reboot the controller to register the new certificate, enter this command:
Step 3 If you prefer to use an externally generated web authentication certificate, follow these steps:
Note We recommend that the Common Name (CN) of the externally generated web authentication certificate be 1.1.1.1 (or the equivalent virtual interface IP address) in order for the client’s browser to match the domains of the web authentication URL and the web authentication certificate.
a. Specify the name, path, and type of certificate to be downloaded by entering these commands:
transfer download datatype webauthcert
transfer download serverip server_ip_address
transfer download path server_path_to_file
transfer download filename certname .pem
transfer download certpassword password
transfer download tftpMaxRetries retries
transfer download tftpPktTimeout timeout
Note The default values of 10 retries and a 6-second timeout should work correctly without any adjustment. However, you can change these values. To do so, enter the maximum number of times that each download can be attempted for the retries parameter and the amount of time (in seconds) allowed for each download for the timeout parameter.
b. Start the download process by entering this command:
c. Reboot the controller to register the new certificate by entering this command:
This section contains the following topics:
Web authentication is a Layer 3 security feature that causes the controller to not allow IP traffic (except DHCP-related packets) from a particular client until that client has correctly supplied a valid username and password. When you use web authentication to authenticate clients, you must define a username and password for each client. When the clients attempt to join the wireless LAN, their users must enter the username and password when prompted by a login page.
When web authentication is enabled (under Layer 3 Security), users might receive a web-browser security alert the first time that they attempt to access a URL.
Figure 12-5 Typical Web-Browser Security Alert
Note When clients connect to a WebAuth SSID with a preauthorization ACL configured to allow VPN users, the clients will get disconnected from the SSID every few minutes. Webauth SSIDs must not connect without authenticating on the web page.
After the user clicks Yes to proceed (or if the client’s browser does not display a security alert), the web authentication system redirects the client to a login page (see Figure 12-6).
To prevent the security alert from appearing, follow these steps:
Step 1 Click View Certificate on the Security Alert page.
Step 2 Click Install Certificate .
Step 3 When the Certificate Import Wizard appears, click Next .
Step 4 Choose Place all certificates in the following store and click Browse .
Step 5 At the bottom of the Select Certificate Store page, select the Show Physical Stores check box.
Step 6 Expand the Trusted Root Certification Authorities folder and choose Local Computer .
Step 9 When the “The import was successful” message appears, click OK .
d. Because the issuer text box is blank on the controller self-signed certificate, open Internet Explorer, choose Tools > Internet Options > Advanced , unselect the Warn about Invalid Site Certificates check box under Security, and click OK .
Step 10 Reboot the PC. On the next web authentication attempt, the login page appears.
Figure 12-6 Default Web Authentication Login Page
The default login page contains a Cisco logo and Cisco-specific text. You can choose to have the web authentication system display one of the following:
The “Choosing the Default Web Authentication Login Page” section provides instructions for choosing how the web authentication login page appears.
When the user enters a valid username and password on the web authentication login page and clicks Submit , the web authentication system displays a successful login page and redirects the authenticated client to the requested URL.
Figure 12-7 Successful Login Page
The default successful login page contains a pointer to a virtual gateway address URL: https://1.1.1.1/logout.html. The IP address that you set for the controller virtual interface serves as the redirect address for the login page (see “Configuring Ports and Interfaces,” for more information on the virtual interface).
This section contains the following topics:
If you are using a custom web-auth bundle that is served by the internal controller web server, the page should not contain more than 5 elements (including HTML, CSS, and Images). This is because the internal controller web server implements a DoS protection mechanism that limits each client to open a maximum of 5 (five) concurrent TCP connections depending on the load. Some browsers may try to open more than 5 TCP sessions at the same time (For example Firefox 4) if the page contains more elements and this may result in the page loading slowly depending on how the browser handles the DoS protection.
If you have a complex custom web authentication module, it is recommended that you use an external web-auth config on the controller, where the full login page is hosted at an external web server.
If you do not want users to connect to a web page using a browser that is configured with SSLv2 only, you can disable SSLv2 for web authentication by entering the config network secureweb cipher-option sslv2 disable command . If you enter this command, users must use a browser that is configured to use a more secure protocol such as SSLv3 or later releases. The default value is enabled.
Step 1 Choose Security > Web Auth > Web Login Page to open the Web Login page.
Step 2 From the Web Authentication Type drop-down list, choose Internal (Default) .
Step 3 If you want to use the default web authentication login page as is, go to Step 8. If you want to modify the default login page, go to Step 4.
Step 4 If you want to hide the Cisco logo that appears in the top right corner of the default page, choose the Cisco Logo Hide option. Otherwise, click the Show option.
Step 5 If you want the user to be directed to a particular URL (such as the URL for your company) after login, enter the desired URL in the Redirect URL After Login text box. You can enter up to 254 characters.
Step 6 If you want to create your own headline on the login page, enter the desired text in the Headline text box. You can enter up to 127 characters. The default headline is “Welcome to the Cisco wireless network.”
Step 7 If you want to create your own message on the login page, enter the desired text in the Message text box. You can enter up to 2047 characters. The default message is “Cisco is pleased to provide the Wireless LAN infrastructure for your network. Please login and put your air space to work.”
Step 8 Click Apply to commit your changes.
Step 9 Click Preview to view the web authentication login page.
Step 10 If you are satisfied with the content and appearance of the login page, click Save Configuration to save your changes. Otherwise, repeat any of the previous steps as necessary to achieve your desired results.
Step 1 Specify the default web authentication type by entering this command:
config custom-web webauth_type internal
Step 2 If you want to use the default web authentication login page as is, go to Step 8. If you want to modify the default login page, go to Step 3.
Step 3 To show or hide the Cisco logo that appears in the top right corner of the default login page, enter this command:
config custom-web weblogo { enable | disable }
Step 4 If you want the user to be directed to a particular URL (such as the URL for your company) after login, enter this command:
config custom-web redirecturl url
You can enter up to 130 characters for the URL. To change the redirect back to the default setting, enter the clear redirecturl command.
Step 5 If you want to create your own headline on the login page, enter this command:
config custom-web webtitle title
You can enter up to 130 characters. The default headline is “Welcome to the Cisco wireless network.” To reset the headline to the default setting, enter the clear webtitle command.
Step 6 If you want to create your own message on the login page, enter this command:
config custom-web webmessage message
You can enter up to 130 characters. The default message is “Cisco is pleased to provide the Wireless LAN infrastructure for your network. Please login and put your air space to work.” To reset the message to the default setting, enter the clear webmessage command.
Step 7 To enable or disable the web authentication logout popup window, enter this command:
config custom-web logout-popup { enable | disable }
Step 8 Enter the save config command to save your settings.
Step 9 Import your own logo into the web authentication login page as follows:
a. Make sure that you have a Trivial File Transfer Protocol (TFTP) server available for the file download. Follow these guidelines when setting up a TFTP server:
– If you are downloading through the service port, the TFTP server must be on the same subnet as the service port because the service port is not routable, or you must create static routes on the controller.
– If you are downloading through the distribution system network port, the TFTP server can be on the same or a different subnet because the distribution system port is routable.
– A third-party TFTP server cannot run on the same computer as the Cisco WCS because the WCS built-in TFTP server and the third-party TFTP server require the same communication port.
b. Ensure that the controller can contact the TFTP server by entering this command:
c. Copy the logo file (in .jpg, .gif, or .png format) to the default directory on your TFTP server. The maximum file size is 30 kilobits. For an optimal fit, the logo should be approximately 180 pixels wide and 360 pixels high.
d. Specify the download mode by entering this command:
e. Specify the type of file to be downloaded by entering this command:
transfer download datatype image
f. Specify the IP address of the TFTP server by entering this command:
transfer download serverip tftp-server-ip-address
Note Some TFTP servers require only a forward slash (/) as the TFTP server IP address, and the TFTP server automatically determines the path to the correct directory.
g. Specify the download path by entering this command:
transfer download path absolute-tftp-server-path-to-file
h. Specify the file to be downloaded by entering this command:
transfer download filename { filename.jpg | filename.gif | filename.png }
i. View your updated settings and answer y to the prompt to confirm the current download settings and start the download by entering this command:
Information similar to the following appears:
j. Save your settings by entering this command:
Note If you ever want to remove this logo from the web authentication login page, enter the clear webimage command.
Step 10 Follow the instructions in the “Verifying the Web Authentication Login Page Settings (CLI)” section to verify your settings.
Figure 12-9 shows an example of a modified default web authentication login page.
Figure 12-9 Modified Default Web Authentication Login Page Example
These CLI commands were used to create this login page:
Information similar to the following appears:
This section provides information on creating a customized web authentication login page, which can then be accessed from an external web server.
Here is a web authentication login page template. It can be used as a model when creating your own customized page:
These parameters are added to the URL when the user’s Internet browser is redirected to the customized login page:
The available status codes are as follows:
Note For additional information, see the External Web Authentication with Wireless LAN Controllers Configuration Example at this URL: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076f974.shtml
This section contains the following topics:
You can customize the web authentication login page to redirect to an external web server. When you enable this feature, the user is directed to your customized login page on the external web server.
For Cisco 5500 Series Controllers, and controller network modules, you must configure a preauthentication access control list (ACL) on the WLAN for the external web server and then choose this ACL as the WLAN preauthentication ACL under Security Policies > Web Policy on the WLANs > Edit page.
Step 1 Choose Security > Web Auth > Web Login Page to open the Web Login page.
Step 2 From the Web Authentication Type drop-down list, choose External (Redirect to external server) .
Step 3 In the URL text box, enter the URL of the customized web authentication login page on your web server. You can enter up to 252 characters.
Step 4 In the Web Server IP Address text box, enter the IP address of your web server. Your web server should be on a different network from the controller service port network.
Step 5 Click Add Web Server . This server now appears in the list of external web servers.
Step 6 Click Apply to commit your changes.
Step 7 If you are satisfied with the content and appearance of the login page, click Save Configuration to save your changes.
Step 1 Specify the web authentication type by entering this command:
config custom-web webauth_type external
Step 2 Specify the URL of the customized web authentication login page on your web server by entering this command:
config custom-web ext-webauth-url url
You can enter up to 252 characters for the URL.
Step 3 Specify the IP address of your web server by entering this command:
config custom-web ext-webserver { add | delete } server_IP_address
Step 4 Enter the save config command to save your settings.
Step 5 Follow the instructions in the “Verifying the Web Authentication Login Page Settings (CLI)” section to verify your settings.
See “Configuring Security Solutions,” for more information on ACLs.
This section contains the following topics:
You can compress the page and image files used for displaying a web authentication login page into a.tar file for download to a controller. These files are known as the webauth bundle. The maximum allowed size of the files in their uncompressed state is 1 MB. When the .tar file is downloaded from a local TFTP server, it enters the controller’s file system as an untarred file.
Note If you load a webauth bundle with a .tar compression application that is not GNU compliant, the controller cannot extract the files in the bundle and the following error messages appear: “Extracting error” and “TFTP transfer failed.” Therefore, we recommend that you use an application that complies with GNU standards, such as PicoZip, to compress the .tar file for the webauth bundle.
Note Configuration backups do not include extra files or components, such as the webauth bundle or external licenses, that you download and store on your controller, so you should manually save external backup copies of those files or components.
Note If the customized webauth bundle has more than 3 separated elements, we advise you to use an external server to prevent page load issues that may be caused because of TCP rate-limiting policy on the controller.
You can download a login page example from Cisco WCS and use it as a starting point for your customized login page. See the “Downloading a Customized Web Auth Page” section in the Using Templates chapter of the Cisco Wireless Control System Configuration Guide, Release 7.0, for instructions.
Step 1 Make sure that you have a TFTP server available for the file download. See the guidelines for setting up a TFTP server in Step 9 of the “Choosing the Default Web Authentication Login Page (GUI)” section.
Step 2 Copy the .tar file containing your login page to the default directory on your TFTP server.
Step 3 Choose Commands > Download File to open the Download File to Controller page.
Figure 12-11 Download File to Controller Page
Step 4 From the File Type drop-down list, choose Webauth Bundle .
Step 5 From the Transfer Mode drop-down list, choose TFTP or FTP .
Step 6 In the IP Address text box, enter the IP address of the TFTP server.
Step 7 If you are using a TFTP server, enter the maximum number of times the controller should attempt to download the .tar file in the Maximum Retries text box.
Step 8 If you are using a TFTP server, enter the amount of time in seconds before the controller times out while attempting to download the *.tar file in the Timeout text box.
The range is 1 to 254 seconds.
Step 9 In the File Path text box, enter the path of the .tar file to be downloaded. The default value is “/.”
Step 10 In the File Name text box, enter the name of the .tar file to be downloaded.
Step 11 If you are using an FTP server, follow these steps:
a. In the Server Login Username text box, enter the username to log into the FTP server.
b. In the Server Login Password text box, enter the password to log into the FTP server.
c. In the Server Port Number text box, enter the port number on the FTP server through which the download occurs. The default value is 21.
Step 12 Click Download to download the .tar file to the controller.
Step 13 Choose Security > Web Auth > Web Login Page to open the Web Login page.
Step 14 From the Web Authentication Type drop-down list, choose Customized (Downloaded) .
Step 15 Click Apply to commit your changes.
Step 16 Click Preview to view your customized web authentication login page.
Step 17 If you are satisfied with the content and appearance of the login page, click Save Configuration to save your changes.
Step 1 Make sure that you have a TFTP server available for the file download. See the guidelines for setting up a TFTP server in Step 9 of the “Choosing the Default Web Authentication Login Page (CLI)” section.
Step 2 Copy the .tar file containing your login page to the default directory on your TFTP server.
Step 3 Specify the download mode by entering this command:
Step 4 Specify the type of file to be downloaded by entering this command:
transfer download datatype webauthbundle
Step 5 Specify the IP address of the TFTP server by entering this command:
transfer download serverip tftp-server-ip-address.
Note Some TFTP servers require only a forward slash (/) as the TFTP server IP address, and the TFTP server automatically determines the path to the correct directory.
Step 6 Specify the download path by entering this command:
transfer download path absolute-tftp-server-path-to-file
Step 7 Specify the file to be downloaded by entering this command:
transfer download filename filename.tar
Step 8 View your updated settings and answer y to the prompt to confirm the current download settings and start the download by entering this command:
Step 9 Specify the web authentication type by entering this command:
config custom-web webauth_type customized
Step 10 Enter the save config command to save your settings.
The following figure shows an example of a customized web authentication login page.
Figure 12-12 Customized Web Authentication Login Page Example
Enter the show custom-web command to verify your changes to the web authentication login page. This example shows the information that appears when the configuration settings are set to default values:
Information similar to the following appears:
This section contains the following topics:
You can display different web authentication login, login failure, and logout pages to users per WLAN. This feature enables user-specific web authentication pages to be displayed for a variety of network users, such as guest users or employees within different departments of an organization.
Different login pages are available for all web authentication types (internal, external, and customized). However, different login failure and logout pages can be specified only when you choose customized as the web authentication type.
Step 1 Choose WLANs to open the WLANs page.
Step 2 Click the ID number of the WLAN to which you want to assign a web login, login failure, or logout page.
Step 3 Choose Security > Layer 3 .
Step 4 Make sure that Web Policy and Authentication are selected.
Step 5 Select the Override Global Config check box to override the global authentication configuration web authentication pages, .
Step 6 When the Web Auth Type drop-down list appears, choose one of the following options to define the web authentication pages for wireless guest users:
Note These optional login, login failure, and logout pages are downloaded to the controller as webauth.tar files. For details on downloading custom pages, see the “Downloading a Customized Web Authentication Login Page” section.
You can choose specific RADIUS or LDAP servers to provide external authentication on the WLANs > Edit (Security > AAA Servers) page. Additionally, you can define the priority in which the servers provide authentication.
Step 7 If you chose External as the web authentication type in When the Web Auth Type drop-down list appears, choose one of the following options to define the web authentication pages for wireless guest users:, choose AAA Servers and choose up to three RADIUS and LDAP servers using the drop-down lists.
Note The RADIUS and LDAP external servers must already be configured in order to be selectable options on the WLANs > Edit (Security > AAA Servers) page. You can configure these servers on the RADIUS Authentication Servers page and LDAP Servers page.
Step 8 Establish the priority in which the servers are contacted to perform web authentication as follows:
Note The default order is local, RADIUS, LDAP.
a. Highlight the server type (local, RADIUS, or LDAP) that you want to be contacted first in the box next to the Up and Down buttons.
b. Click Up and Down until the desired server type is at the top of the box.
c. Click the < arrow to move the server type to the priority box on the left.
d. Repeat these steps to assign priority to the other servers.
Step 9 Click Apply to commit your changes.
Step 10 Click Save Configuration to save your changes.
Step 1 Determine the ID number of the WLAN to which you want to assign a web login, login failure, or logout page by entering this command:
Step 2 If you want wireless guest users to log into a customized web login, login failure, or logout page, enter these commands to specify the filename of the web authentication page and the WLAN for which it should display:
Note To use the controller’s default login failure page, enter the config wlan custom-web loginfailure-page none wlan_id command.
Note To use the controller’s default logout page, enter the config wlan custom-web logout-page none wlan_id command.
Step 3 Redirect wireless guess users to an external server before accessing the web login page by entering this command to specify the URL of the external server:
config wlan custom-web ext-webauth-url ext_web_url wlan_id
Step 4 Define the order in which web authentication servers are contacted by entering this command:
config wlan security web-auth server-precedence wlan_id { local | ldap | radius } { local | ldap | radius } { local | ldap | radius }
The default order of server web authentication is local, RADIUS and LDAP.
Note All external servers must be preconfigured on the controller. You can configure them on the RADIUS Authentication Servers page and the LDAP Servers page.
Step 5 Define which web authentication page displays for a wireless guest user by entering this command:
config wlan custom-web webauth-type { internal | customized | external } wlan_id
Note You do not need to define the web authentication type in Define which web authentication page displays for a wireless guest user by entering this command: for the login failure and logout pages as they are always customized.
Step 6 Use a WLAN-specific custom web configuration rather than a global custom web configuration by entering this command:
config wlan custom-web global disable wlan_id
Note If you enter the config wlan custom-web global enable wlan_id command, the custom web authentication configuration at the global level is used.
Step 7 Save your changes by entering this command:
This section contains the following topics:
Wired guest access enables guest users to connect to the guest access network from a wired Ethernet connection designated and configured for guest access. Wired guest access ports might be available in a guest office or through specific ports in a conference room. Like wireless guest user accounts, wired guest access ports are added to the network using the lobby ambassador feature.
Wired guest access can be configured in a standalone configuration or in a dual-controller configuration that uses both an anchor controller and a foreign controller. This latter configuration is used to further isolate wired guest access traffic but is not required for deployment of wired guest access.
Wired guest access ports initially terminate on a Layer 2 access switch or switch port configured with VLAN interfaces for wired guest access traffic. The wired guest traffic is then trunked from the access switch to a controller. This controller is configured with an interface that is mapped to a wired guest access VLAN on the access switch. See Figure 12-13.
Figure 12-13 Wired Guest Access Example with One Controller
If two controllers are being used, the foreign controller, which receives the wired guest traffic from the access switch, forwards it to the anchor controller. A bidirectional EoIP tunnel is established between the foreign and anchor controllers to handle this traffic. See Figure 12-14.
Figure 12-14 Wired Guest Access Example with Two Controllers
Note Although wired guest access is managed by anchor and foreign anchors when two controllers are deployed, mobility is not supported for wired guest access clients. In this case, DHCP and web authentication for the client are handled by the anchor controller.
Note You can specify the amount of bandwidth allocated to a wired guest user in the network by configuring a QoS role and a bandwidth contract. For details on configuring these features. See the “Configuring Quality of Service” section.
To configure wired guest access on a wireless network, you must perform the following:
1. Configure a dynamic interface (VLAN) for wired guest user access
2. Create a wired LAN for guest user access
4. Configure the anchor controller (if terminating traffic on another controller)
Step 1 Choose Controller > Interfaces to create a dynamic interface for wired guest user access. The Interfaces page appears.
Step 2 Click New to open the Interfaces > New page.
Step 3 Enter a name and VLAN ID for the new interface.
Step 4 Click Apply to commit your changes.
Step 5 In the Port Number text box, enter a valid port number. You can enter a number between 0 and 25 (inclusive).
Step 6 Select the Guest LAN check box.
Step 7 Click Apply to commit your changes.
Step 8 To create a wired LAN for guest user access, choose WLANs .
Step 9 Choose Create New from the drop-down list and click Go on the WLANs page. The WLANs > New page appears.
Step 10 From the Type drop-down list, choose Guest LAN .
Step 11 In the Profile Name text box, enter a name that identifies the guest LAN. Do not use any spaces.
Step 12 From the WLAN ID drop-down list, choose the ID number for this guest LAN.
Note You can create up to five guest LANs, so the WLAN ID options are 1 through 5 (inclusive).
Step 13 Click Apply to commit your changes. The WLANs > Edit page appears.
Figure 12-16 WLANs > Edit Page
Step 14 Select the Enabled check box for the Status parameter.
Step 15 Web authentication (Web-Auth) is the default security policy. If you want to change this to web passthrough, choose the Security tab after completing Step 16 and Step 17.
Step 16 From the Ingress Interface drop-down list, choose the VLAN that you created in Step 3. This VLAN provides a path between the wired guest client and the controller by way of the Layer 2 access switch.
Step 17 From the Egress Interface drop-down list, choose the name of the interface. This WLAN provides a path out of the controller for wired guest client traffic.
Step 18 If you want to change the authentication method (for example, from web authentication to web passthrough), choose Security > Layer 3 . The WLANs > Edit (Security > Layer 3) page appears.
Figure 12-17 WLANs > Edit (Security > Layer 3) Page
Step 19 From the Layer 3 Security drop-down list, choose one of the following:
Note There should not be a Layer 3 gateway on the guest wired VLAN, as this would bypass the web authentication done through the controller.
Step 20 If you choose the Web Passthrough option, an Email Input check box appears. Select this check box if you want users to be prompted for their e-mail address when attempting to connect to the network.
Step 21 To override the global authentication configuration set on the Web Login page, select the Override Global Config check box.
Step 22 When the Web Auth Type drop-down list appears, choose one of the following options to define the web authentication pages for wired guest users:
Note These optional login, login failure, and logout pages are downloaded to the controller as webauth.tar files.
You can choose specific RADIUS or LDAP servers to provide external authentication on the WLANs > Edit (Security > AAA Servers) page. Additionally, you can define the priority in which the servers provide authentication.
Step 23 If you chose External as the web authentication type in When the Web Auth Type drop-down list appears, choose one of the following options to define the web authentication pages for wired guest users:, choose AAA Servers and choose up to three RADIUS and LDAP servers using the drop-down lists.
Note The RADIUS and LDAP external servers must already be configured in order to be selectable options on the WLANs > Edit (Security > AAA Servers) page. You can configure these servers on the RADIUS Authentication Servers page and LDAP Servers page.
Step 24 To establish the priority in which the servers are contacted to perform web authentication as follows:
Note The default order is local, RADIUS, LDAP.
a. Highlight the server type (local, RADIUS, or LDAP) that you want to be contacted first in the box next to the Up and Down buttons.
b. Click Up and Down until the desired server type is at the top of the box.
c. Click the < arrow to move the server type to the priority box on the left.
d. Repeat these steps to assign priority to the other servers.
Step 25 Click Apply to commit your changes.
Step 26 Click Save Configuration to save your changes.
Step 27 Repeat this process if a second (anchor) controller is being used in the network.
Step 1 Create a dynamic interface (VLAN) for wired guest user access by entering this command:
config interface create interface_name vlan_id
Step 2 If link aggregation trunk is not configured, enter this command to map a physical port to the interface:
config interface port interface_name primary_port { secondary_port }
Step 3 Enable or disable the guest LAN VLAN by entering this command:
config interface guest-lan interface_name { enable | disablty5 save config
Note Information on the configured web authentication appears in both the show run-config and show running-config commands.
Step 4 Display the customized web authentication settings for a specific guest LAN by entering this command:
show custom-web {all | guest-lan guest_lan_id}
Note If internal web authentication is configured, the Web Authentication Type displays as internal rather than external (controller level) or customized (WLAN profile level).
Information similar to the following appears for the show custom-web all command:
Information similar to the following appears for the show custom-web guest-lan guest_lan_id command:
Step 5 Display a summary of the local interfaces by entering this command:
Information similar to the following appears:
Note The interface name of the wired guest LAN in this example is wired-guest and its VLAN ID is 236.
Display detailed interface information by entering this command:
show interface detailed interface_name
Information similar to the following appears:
Step 6 Display the configuration of a specific wired guest LAN by entering this command:
Information similar to the following appears:
Note Enter the show guest-lan summary command to see all wired guest LANs configured on the controller.
Step 7 Display the active wired guest LAN clients by entering this command:
Information similar to the following appears:
Step 8 Display detailed information for a specific client by entering this command:
Once a guest user associates, the user is placed in a run state until the client is authenticated. The controller intercepts both IPv4 and IPv6 traffic in this state and redirects it to the virtual IP address of the controller. Once the user is authenticated, the user’s MAC address is moved to the run state and both IPv4 traffic and IPv6 traffic are allowed to pass.
To support the redirection of IPv6-only clients, the controller automatically creates an IPv6 virtual address based on the IPv4 virtual address configured on the controller. The virtual IPv6 address follows the convention of [::ffff:<virtual IPv4 address>]. For example, a virtual IP address of 192.0.2.1 would translate into [::ffff:192.0.2.1]. For an IPv6 captive portal to be displayed, the user must request an IPv6 resolvable DNS entry such as ipv6.google.com, which returns a DNSv6 (AAAA) record.