Cisco 4400 Series Wireless LAN Controllers

This document provides information on the most frequently asked questions (FAQs) about the Wireless Guest Access feature, which is a part of the Cisco Unified Wireless network.

A. Cisco recommends the use of a controller dedicated to guest traffic. This controller is known as the guest anchor controller.

The guest anchor controller is usually located in an unsecured network area, often called the demilitarized zone (DMZ). Other internal WLAN controllers from where the traffic originates are located in the enterprise LAN. An EoIP tunnel is established between the internal WLAN controllers and the guest anchor controller in order to ensure path isolation of guest traffic from enterprise data traffic. Path isolation is a critical security management feature for guest access. It ensures that security and quality of service (QoS) policies can be separate, and are differentiated between guest traffic and corporate or internal traffic.

An important feature of the Cisco Unified Wireless Network architecture is the ability to use an EoIP tunnel to statically map one or more provisioned WLANs (that is, SSIDs) to a specific guest anchor controller within the network. All traffic—both to and from a mapped WLAN—traverses a static EoIP tunnel that is established between a remote controller and the guest anchor controller.

Using this technique, all associated guest traffic can be transported transparently across the enterprise network to a guest anchor controller that resides in the unsecured network area.

A. The selection of the guest anchor controller is a function of the amount of guest traffic as defined by the number of active guest client sessions, or as defined by the uplink interface capacity on the controller, or both.

Total throughput and client limitations per guest anchor controller are as follows:

• Cisco 4100 Series Wireless LAN Controller—One 1000 Mb interface and 1500 guest clients

• Cisco 4402 Wireless LAN Controller—Two 1000 Mb interfaces and 5000 guest clients

• Cisco 4404 Wireless LAN Controller—Four 1000 Mb interfaces and 5000 guest clients

• Cisco Catalyst 6500 Series Wireless Services Module (WiSM)—Eight 1000 Mb interfaces and 10,000 guest clients

A maximum of 2048 guest usernames and passwords can be stored on each controller’s database. Therefore, if the total number of active guest credentials is in excess of this number, more than one controller will be needed. Alternatively, guest credentials can be stored in an external RADIUS server.

The number of access points in the network does not impact the selection of the guest anchor controller.

A. One guest anchor controller can terminate up to 71 EoIP tunnels from internal WLAN controllers. This capacity is the same across any model of the Cisco Wireless LAN Controller. More than one guest anchor controller can be configured if additional tunnels are required.

EoIP tunnels are counted per WLAN controller, independently of the number of tunneled WLANs or Secure Set Identifiers (SSIDs) in each EoIP.

One EoIP tunnel is configured between the guest anchor controller and each internal controller that supports access points with guest client associations.

A. Not all Wireless LAN Controller software versions support this. In such cases the remote and anchor controller should run the same version of WLC software. However, the recent software versions do allow the remote and anchor controllers to have different versions.

This matrix lists the Wireless LAN Controller software versions with which you can create the EoIP tunnels.

A. No. The Cisco 2000/2100 Series Wireless LAN Controller cannot terminate guest traffic outside the firewall. The Cisco 2000 Series Wireless LAN Controller can only originate guest tunnels.

A. No. The WLCM cannot terminate guest tunnels. The WLCM can only originate guest tunnels.

A. The guest tunnel anchor function, which includes EoIP tunnel termination, Web authentication, and access control of guest clients, is supported in these Cisco Wireless LAN Controller platforms with Version 4.0 and later software images:

• Cisco 4400 Series Wireless LAN Controller (either the 4402 or the 4404)

• Cisco Catalyst 6500 Series Wireless Services Module (WiSM)

• Cisco Catalyst 3750G Integrated Wireless LAN Controller

A. On any firewall between the guest anchor controller and the remote controllers, these ports need to be open:

• IP Protocol 97 for user data traffic

• UDP Port 16666 (or 16667, if encrypted) for tunnel control traffic

For optional management, these firewall ports need to be open:

• SSH/Telnet—TCP Port 22/23

• TFTP—UDP Port 69

• NTP—UDP Port 123

• SNMP—UDP Ports 161 (gets and sets) and 162 (traps)

• HTTPS/HTTP—TCP Port 443/80

• Syslog—TCP Port 514

A. One to one NAT must be used on the EoIP tunnel going through a firewall.

A. In this scenario, authentication is always done by the anchor WLC. Therefore, RADIUS accounting is sent by the anchor WLC.

A. Guest traffic is transported within the enterprise at Layer 3 via EoIP. Therefore, the first point at which Dynamic Host Configuration Protocol (DHCP) services can be implemented is locally on the guest anchor controller, or the guest anchor controller can relay client DHCP requests to an external server. This is also the method by which Domain Name System (DNS) address resolution is handled.

A. Cisco Wireless LAN Controllers, software Version 3.2 or later, provide a built-in web portal that captures guest credentials for authentication and offers simple branding capabilities, along with the ability to display disclaimer and acceptable use policy information.

A. Yes. Guest authentication requests can be relayed to an external RADIUS server.

A. When a wireless guest logs in through the web portal, the guest anchor controller handles the authentication by performing these steps:

1. The guest anchor controller checks its local database for username and password, and if they are present, grants access.

2. If no user credentials are present locally on the guest anchor controller, the guest anchor controller checks WLAN configuration settings to see if an external RADIUS server(s) has been configured for the guest WLAN. If so, the controller creates a RADIUS access-request packet with the username and password and forwards it to the selected RADIUS server for authentication.

3. If no specific RADIUS servers have been configured for the WLAN, the controller checks its global RADIUS server configuration settings. Any external RADIUS servers configured with the option to authenticate “network user” will be queried with the guest user’s credentials. Otherwise, if no servers have “network user” selected, and the user has not been authenticated through steps 1 or 2, the authentication will fail.

A. Yes. Another configuration option of wireless guest access is to bypass user authentication altogether and allow open access. However, there might be a need to present an acceptable-use policy and disclaimer page to guests before granting access. In order to do this, a guest WLAN can be configured for web policy passthrough. In this scenario, a guest user is redirected to a web portal page which contains disclaimer information. In order to enable identification of the guest user, passthrough mode also has an option for a user to enter an email address before connecting.

A. No. The guest anchor controller and the remote controller can be on separate mobility groups.