Step 1

Choose Configuration > Security > AAA.

Step 2

Click + AAA Wizard.

Step 3

Go to the RADIUS tab.

1. In the Name field, enter the name of the RADIUS server.

2. In the IPv4 / IPv6 Server Address field, enter the IPv4 or IPv6 address, or hostname of the server.

3. Select the PAC Key check box to enable Protected Access Credential (PAC) authentication key option.

4. From the Key Type drop-down list, select the authentication key type.

5. In the Key field, enter the authentication key.

6. In the Confirm Key field, re-enter the authentication key.

7. Click Advanced radio button.

   This enables the advanced options.

8. In the Auth Port field, enter the authorization port number.

9. In the Acct Port field, enter the accounting port number.

10. In the Server Timeout field, enter the timeout duration, in seconds.

11. In the Retry Count field, enter the number of retries.

12. In the Support for CoA field, use the toggle button to enable or disable change-of-authorization (CoA).

Step 4

To enter TACACS+ options, check the TACACS+ check box.

1. In the Name field, enter the TACACS+ server name.

2. In the IPv4 / IPv6 Server Address field, enter the IPv4 or IPv6 address, or hostname.

3. In the Key field, enter the authentication key.

4. In the Confirm Key field, re-enter the authentication key.

5. Click Advanced radio button.

   This enables the advanced options.

6. In the Port field, enter the port number to use.

7. In the Server Timeout field, enter the timeout duration, in seconds.

Step 5

To enter LDAP options, check the LDAP check box.

1. In the Server Name field, enter the LDAP server name.

2. In the IPv4 / IPv6 Server Address field, enter the IPv4 or IPv6 address, or hostname.

3. In the Port Number field, enter the port number to use.

4. From the Simple Bind drop-down list, select the authentication key type.

5. In the User Base DN field, enter the user base distinguished name.

6. Click Advanced radio button.

   This enables the advanced options.

7. From the User Attribute drop-down list, select the user attribute.

8. In the User Object Type field, enter the details and click the + icon.

   The objects you add appear in the list, and you can use the x mark beside each object to remove it.

9. In the Server Timeout field, enter the timeout duration, in seconds.

10. Check the Secure Mode check box to enable secure mode.

    Selecting the Secure Mode option enables the Trustpoint Name drop-down list.

11. From the Trustpoint Name drop-down list, select the trustpoint.

12. Click Next.

    This enables the Server Group Association screen and RADIUS tab is selected by default.

Step 6

Go to the RADIUS tab.

1. In the Name field, enter the name of the RADIUS server group.

2. From the MAC-Delimiter drop-down list, choose the delimiter to be used in the MAC addresses that are sent to the RADIUS servers.

3. From the MAC Filtering drop-down list, choose a value based on which to filter MAC addresses.

4. To configure dead time for the server group and direct AAA traffic to alternative groups of servers that have different operational characteristics, in the Dead-Time field, enter the amount of time, in minutes, after which a server is assumed to be dead.

5. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

6. Click Next.

   The TACACS+ window is displayed, if you have selected TACACS+ in Server configuration.

Step 7

Use the TACACS+ window to enter details.

1. In the Name field, enter the name of the TACACS+ server group.

2. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

3. Click Next.

   The LDAP window is displayed, if you have selected LDAP in server configuration.

Step 8

Use the LDAP window to enter details.

1. In the Name field, enter the name of the LDAP server group.

2. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

Step 9

Click Next.

Step 10

Use the Authentication tab to enter authentication details.

1. In the Method List Name field, enter the name of the method list.

2. From the Type drop-down list, choose the type of accounting you want to perform before allowing access to the network.

3. From the Group Type drop-down list, choose if you want to assign a group of servers as your access server, or if you want to use a local server to authenticate access.

   If you choose local option, Fallback to local option is removed.

4. Check the Fallback to local check box to configure a local server to act as a fallback method when servers in the group are unavailable.

5. From the Available Server Groups list, choose the server groups you want to use to authenticate access to your network and click > icon to move them to the Assigned Server Groups list.

Step 11

Check the Authorization check box to configure authorization details.

1. In the Method List Name field, enter the name of the method list.

2. From the Type drop-down list, choose the type of authorization you want to perform before allowing access to the network.

3. From the Group Type drop-down list, choose if you want to assign a group of servers as your access server, or if you want to use a local server to authorize access.

   If you choose local option, Fallback to local option is removed.

4. Check the Fallback to local check box to configure a local server to act as a fallback method when servers in the group are unavailable.

5. From the Available Server Groups list, choose the server groups you want to use to authorize access to your network and click > icon to move them to the Assigned Server Groups list.

Step 12

Check the Accounting check box to configure accounting details.

1. In the Method List Name field, enter the name of the method list.

2. From the Type drop-down list, choose the type of accounting you want to perform.

3. From the Available Server Groups list, choose the server groups you want to use to authorize access to your network and click > icon to move them to the Assigned Server Groups list.

Step 13

Click Apply to Device.

Step 1

Choose Configuration > Security > AAA.

Step 2

In the Authentication section, click Add.

Step 3

In the Quick Setup: AAA Authentication window that is displayed, enter a name for your method list.

Step 4

Choose the type of authentication you want to perform before allowing access to the network, in the Type drop-down list.

Step 5

In the Group Type drop-down list, select either a group of servers as your access server or a local server to authenticate access.

Step 6

To configure a local server to act as a fallback method when servers in the group are unavailable, check the Fallback to local check box.

Step 7

Choose the server groups you want to use to authenticate access to your network, from the Available Server Groups list and click > icon to move them to the Assigned Server Groups list.

Step 8

Click Save & Apply to Device.

Step 1

Enable AAA functionality.

Device
(config)# aaa new-model

Step 2

Define the list of authentication methods at login using the aaa authentication login {default | named_authentication_list} group AAA_group_name command.

Device(config)# aaa authentication login default group AAA_group_name

Step 3

Create an authorization method list for web-based authorization using the aaa authorization network {default | named_authorization_list} group AAA_group_name command.

Device(config)# aaa authorization network default group group1

Step 4

Specify an AAA server.

Device(config)# tacacs server yourserver

Step 5

Configure the IP address for the TACACS server.

Device(config-server-tacacs)# address ipv4 10.0.1.12

Step 6

Specify a AAA server.

Device(config)# tacacs-server host 10.1.1.1

Step 1

Choose Administration > Management > HTTP/HTTPS/Netconf.

Step 2

In the HTTP/HTTPS Access Configuration section, enable HTTP Access and enter the port that will listen for HTTP requests. The default port is 80. Valid values are 80, and ports between 1025 and 65535.

Step 3

Enable HTTPS Access on the device and enter the designated port to listen for HTTPS requests. The default port is 1025. Valid values are 443 and ports between 1025 and 65535. Data exchanged over a secure HTTP connection is encrypted before transmission across the Internet. SSL encryption over HTTP enables secure configuration of the switch through a web browser.

Step 4

Choose the Personal Identity Verification as enabled or disabled.

Step 5

In the HTTP Trust Point Configuration section, enable Enable Trust Point to use Certificate Authority servers as trustpoints.

Step 6

From the Trust Points drop-down list, choose a trust point.

Step 7

In the Timeout Policy Configuration section, enter the HTTP timeout policy in seconds. Enter a value between one to 600 seconds.

Step 8

Enter the number of minutes of inactivity allowed before the session times out. Enter a value between 180 and 1200 seconds.

Step 9

Enter the server life time in seconds. Enter a value between one and 86400 seconds.

Step 10

Enter the maximum number of requests the device can accept. Valid values range from one and 86400 requests.

Step 11

Save the configuration.

Step 1

Enable the HTTP server. The local web authentication feature uses the HTTP server to communicate with the hosts for user authentication.

Device(config)# ip http server

Step 2

Enable HTTPS.

Device(config)# ip http secure-server

Step 3

Return to privileged EXEC mode.

Device(config)# end

Step 1

Choose Configuration > Security > Local Policy.

Step 2

Click Add.

Step 3

Click Policy Map.

Step 4

Enter Policy Map Name.

Step 5

In the Match Criteria List settings, click Add.

Step 6

In the Add Match Criteria settings, choose the service template from the Service Template drop-down list.

Step 7

Choose the filters from Device Type, User Role, User Name, OUI, and MAC Address drop-down lists.

Step 8

Click Add Criteria.

Step 9

Click Apply to Device.

Step 1

Choose Configuration > Security > Web Auth.

Step 2

On the Web Auth page, click Add.

Step 3

In the Create Web Auth Parameter window that is displayed, enter a name for the parameter map.

Step 4

In the Maximum HTTP Connections field, enter the maximum number of HTTP connections that you want to allow.

Step 5

In the Init-State Timeout field, enter the timeout duration. The timer expires if the user does not enter valid credentials on the login page

Step 6

Choose the type of Web Auth parameter.

Step 7

Click Apply to Device.

Step 8

On the Web Auth page, click the name of the parameter map.

Step 9

In the Edit WebAuth Parameter window that is displayed, choose the required Banner Type.

• If you choose Banner Text, enter the required banner text to be displayed.
• If you choose File Name, specify the path of the file from which the banner text has to be picked up.

Step 10

Enter the virtual IP addresses as required.

Step 11

Set the status of WebAuth Intercept HTTPS, Captive Bypass Portal, and Watch List Enable as required.

Step 12

In the Watch List Expiry Timeout field, enter the time in seconds after which the watch list should time out.

Step 13

Set the status for Disable Success Window, Disable Logout Window, and Login Auth Bypass for FQDN, as required.

Step 14

Check the Sleeping Client Status check box to enable authentication of sleeping clients. Specify the Sleeping Client Timeout in minutes. The valid range is 10 to 43,200 minutes.

Step 15

Click the Advanced tab.

Step 16

In the Redirect for log-in field, enter the name of the external server to which to send the login request.

Step 17

In the Redirect On-Success field, enter the name of the external server to redirect after a successful login.

Step 18

In the Redirect On-Failure field, enter the name of the external server to redirect after a login failure.

Step 19

To configure external local web authentication, perform these steps:

1. Under Redirect to External Server in the Redirect Append for AP MAC Address field, enter the AP MAC address.

2. In the Redirect Append for Client MAC Address field, enter the client MAC address.

3. In the Redirect Append for WLAN SSID field, enter the WLAN SSID.

4. In the Portal IPV4 Address field, enter the IPv4 address of the portal to send redirects.

5. In the Portal IPV6 Address field, enter the IPv6 address of the portal to send redirects if you are using an IPv6 address.

Step 20

To configure customized local web authentication, perform these steps:

1. Under Customized Page, specify the following pages:

   • Login Failed Page

   • Login Page

   • Logout Page

   • Login Successful Page

Step 21

Click Update & Apply.

In the global configuration mode, create a parameter map

Device(config)# parameter-map type webauth sample

Step 1

Configure the webauth type parameter.

Device(config)# parameter-map type webauth parameter-map-name
					

Step 2

Configures webauth sub-types using the type {authbypass | consent | webauth | webconsent} command.

Device(config-params-parameter-map)# type webauth
						
					

Step 3

Configure the customized login page using the custom-page login device html-filename command.

Device(config-params-parameter-map)# custom-page login device bootflash:login.html

Step 4

Configure the customized login expiry page using the custom-page login expired device html-filename command.

Device(config-params-parameter-map)# custom-page login expired device bootflash:loginexpired.html

Step 5

Configure the customized login success page using the custom-page success device html-filename command.

Device(config-params-parameter-map)# custom-page success device bootflash:loginsuccess.html

Step 6

Configure the customized login failure page using the custom-page failure device html-filename command.

Device(config-params-parameter-map)# custom-page failure device bootflash:loginfail.html

Step 1

Enter global configuration mode.

Device# configure terminal

Step 2

Configure the webauth type parameter.

Device(config)# parameter-map type webauth sample

Step 3

Configure web authentication subtypes by using the type {authbypass | consent | webauth | webconsent} command.

Device(config-params-parameter-map)# type webauth

Step 4

Configure the redirect URL for the login, failure, and success pages using the redirect [for-login | on-failure | on-success] URL command.

Device(config-params-parameter-map)# redirect for-login
http://www.cisco.com/login.html

Step 5

Configure the external portal IPv4 address using the redirect portal {ipv4 | ipv6} ip-address command.

Device(config-params-parameter-map)# redirect portal ipv4 23.0.0.1

Step 6

Return to privileged EXEC mode.

Device(config-params-parameter-map)# end

Step 1

Enter global configuration mode.

Device# configure terminal

Step 2

Enter the WLAN configuration sub-mode.

Device(config)# wlan wlan-name wlan-id SSID-name

Step 3

Disable WPA security.

Device(config-wlan)# no security wpa

Step 4

Enable web authentication for WLAN.

Device(config-wlan)# security web-auth

Step 5

Enable web authentication for WLAN using the security web-auth {authentication-list authentication-list-name | parameter-map parameter-map-name} command.

Device(config-wlan)# security web-auth authentication-list webauthlistlocal

Device(config-wlan)# security web-auth parameter-map sample

Step 6

Return to privileged EXEC mode.

Device(config-wlan)# end

Step 1

Choose Configuration > Tags & Profiles > WLANs.

Step 2

Click the name of the WLAN.

Step 3

In the Edit WLAN window, click the Security tab and then click the Layer3 tab.

Step 4

Click Show Advanced Settings.

Step 5

In the Preauthenticaion ACL section, choose the appropriate ACL to map to the WLAN.

Step 6

Click Update & Apply to Device.

Step 1

Enters global configuration mode.

Device# configure terminal

Step 2

Create an ACL list using the access-list access-list-number {deny | permit} hostname source-wildcard-bits command.

Device(config)# access-list 2 deny your_host 10.1.1.1 log

Step 3

Create the WLAN.

Device(config)# wlan mywlan 34 mywlan-ssid

Step 4

Map the ACL to the web auth WLAN.

Device(config-wlan)# ip access-group web name

Step 5

Return to privileged EXEC mode.

Device(config-wlan)# end

Step 1

Configure the maximum web authentication request retries.

Device(config)# wireless security web-auth retries  number

Step 2

Return to privileged EXEC mode.

Device(config)# end