With web-based authentication, the devices in the network have these specific roles:

• Client—The device (workstation) that requests access to the LAN and the services and responds to requests from the switch. The workstation must be running an HTML browser with Java Script enabled.

• Authentication server—Authenticates the client. The authentication server validates the identity of the client and notifies the switch that the client is authorized to access the LAN and the switch services or that the client is denied.

• Switch—Controls the physical access to the network based on the authentication status of the client. The switch acts as an intermediary (proxy) between the client and the authentication server, requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client.

Figure 1. Web-Based Authentication Device Roles. This figure shows the roles of these devices in a network.

The switch maintains an IP device tracking table to store information about detected hosts.

Note	By default, the IP device tracking feature is disabled on a switch. You must enable the IP device tracking feature to use web-based authentication.

For Layer 2 interfaces, web-based authentication detects IP hosts by using these mechanisms:

• ARP based trigger—ARP redirect ACL allows web-based authentication to detect hosts with a static IP address or a dynamic IP address.

• Dynamic ARP inspection

• DHCP snooping—Web-based authentication is notified when the switch creates a DHCP-binding entry for the host.

When web-based authentication detects a new host, it creates a session as follows:

• Reviews the exception list.

  If the host IP is included in the exception list, the policy from the exception list entry is applied, and the session is established.

• Reviews for authorization bypass

  If the host IP is not on the exception list, web-based authentication sends a nonresponsive-host (NRH) request to the server.

  If the server response is access accepted, authorization is bypassed for this host. The session is established.

• Sets up the HTTP intercept ACL

  If the server response to the NRH request is access rejected, the HTTP intercept ACL is activated, and the session waits for HTTP traffic from the host.

When you enable web-based authentication, these events occur:

• The user initiates an HTTP session.

• The HTTP traffic is intercepted, and authorization is initiated. The switch sends the login page to the user. The user enters a username and password, and the switch sends the entries to the authentication server.

• If the authentication succeeds, the switch downloads and activates the user’s access policy from the authentication server. The login success page is sent to the user.

• If the authentication fails, the switch sends the login fail page. The user retries the login. If the maximum number of attempts fails, the switch sends the login expired page, and the host is placed in a watch list. After the watch list times out, the user can retry the authentication process.

• If the authentication server does not respond to the switch, and if an AAA fail policy is configured, the switch applies the failure access policy to the host. The login success page is sent to the user.

• The switch reauthenticates a client when the host does not respond to an ARP probe on a Layer 2 interface, or when the host does not send any traffic within the idle timeout on a Layer 3 interface.

• The feature applies the downloaded timeout or the locally configured session timeout.

• If the terminate action is RADIUS, the feature sends a nonresponsive host (NRH) request to the server. The terminate action is included in the response from the server.

• If the terminate action is default, the session is dismantled, and the applied policy is removed.

With Web Authentication, you can create a default and customized web-browser banners that appears when you log in to a switch.

The banner appears on both the login page and the authentication-result pop-up pages. The default banner messages are as follows:

• Authentication Successful

• Authentication Failed

• Authentication Expired

The Local Web Authentication Banner can be configured in legacy and new-style (Session-aware) CLIs as follows:

• Legacy mode—Use the ip admission auth-proxy-banner http global configuration command.

• New-style mode—Use the parameter-map type webauth global bannerglobal configuration command.

The default banner Cisco Systems and Switch host-name Authentication appear on the Login Page. Cisco Systems appears on the authentication result pop-up page.

Figure 2. Authentication Successful Banner

The banner can be customized as follows:

• Add a message, such as switch, router, or company name to the banner:

  • Legacy mode—Use the ip admission auth-proxy-banner http banner-textglobal configuration command.

  • New-style mode—Use the parameter-map type webauth global bannerglobal configuration command

• Add a logo or text file to the banner :

  • Legacy mode—Use the ip admission auth-proxy-banner http file-path global configuration command.

  • New-style mode—Use the parameter-map type webauth global banner global configuration command

  Figure 3. Customized Web Banner
  
  

If you do not enable a banner, only the username and password dialog boxes appear in the web authentication login screen, and no banner appears when you log into the switch.

Figure 4. Login Screen With No Banner

For more information, see the Session Aware Networking Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) Session Aware Networking Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) and the Web Authentication Enhancements - Customizing Authentication Proxy Web Pages.

During the web-based authentication process, the switch internal HTTP server hosts four HTML pages to deliver to an authenticating client. The server uses these pages to notify you of these four-authentication process states:

• Login—Your credentials are requested.

• Success—The login was successful.

• Fail—The login failed.

• Expire—The login session has expired because of excessive login failures.

1.    configure terminal


2.    ip admission proxy http login page file device:login-filename


3.    ip admission proxy http success page file device:success-filename


4.    ip admission proxy http failure page file device:fail-filename


5.    ip admission proxy http login expired page file device:expired-filename


6.    end

Switch# configure terminal

Switch(config)# ip admission proxy http login page file disk1:login.htm

Switch(config)# ip admission proxy http success page file disk1:success.htm

Switch(config)# ip admission proxy http fail page file disk1:fail.htm

Switch(config)# ip admission proxy http login expired page file disk1:expired.htm

Switch(config)# end

Switch# show ip admission status
IP admission status:
  Enabled interfaces            0
  Total sessions                0
  Init sessions                 0     Max init sessions allowed     100
    Limit reached               0     Hi watermark                  0
  TCP half-open connections     0     Hi watermark                  0
  TCP new connections           0     Hi watermark                  0
  TCP half-open + new           0     Hi watermark                  0
  HTTPD1 Contexts               0     Hi watermark                  0

  Parameter Map: Global
    Custom Pages
      Custom pages not configured
    Banner
      Banner not configured

1.    configure terminal


2.    ip admission proxy http success redirect url-string


3.    end

Switch# configure terminal

Switch(config)# ip admission proxy http success redirect www.example.com

Switch(config)# end

Switch# show ip admission status
 Enabled interfaces            0
 Total sessions                0
 Init sessions                 0     Max init sessions allowed     100
   Limit reached               0     Hi watermark                  0
 TCP half-open connections     0     Hi watermark                  0
 TCP new connections           0     Hi watermark                  0
 TCP half-open + new           0     Hi watermark                  0
 HTTPD1 Contexts               0     Hi watermark                  0

 Parameter Map: Global
   Custom Pages
     Custom pages not configured
   Banner
     Banner not configured