Explains external web authentication mechanisms for WLAN clients, providing instructions to configure single or multiple WebAuth servers and wired guest EWA using CLI procedures.

Configure EWA with single WebAuth server address and default ports (80/443) (CLI)

Configure External Web Authentication (EWA) on your device to use a single WebAuth server address with default ports (80 or 443).

Use this procedure to redirect guest WLAN clients to a specific WebAuth portal using default HTTP or HTTPS ports.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Define the authentication method at login. Example: `Device(config)# aaa authentication login WEBAUTH local`
	3.	Create the parameter map using the parameter-map type webauth parameter-map-name command. Example: `Device(config)# parameter-map type webauth ISE-Ext-Webauth_IP` The parameter-map-name must not exceed 99 characters.
	4.	Configure the webauth type parameter. Example: `Device(config-params-parameter-map)# type webauth`
	5.	Configure the URL string for redirect during login using the redirect for-login URL-String command. Example: `Device(config-params-parameter-map)# redirect for-login https://192.168.0.98:443/portal/PortalSetup.action?portal=ad64b062-1098-11e7-8591-005056891b52`
	6.	Configure the external portal IPv4 address. Example: `Device(config-params-parameter-map)# redirect portal ipv4 192.168.0.98`
	7.	Return to global configuration mode. Example: `Device(config-params-parameter-map)# exit`
	8.	Configure a WLAN using the wlan wlan-name wlan-id SSID-name command. Example: `Device(config)# wlan EWLC3-GUEST 3 EWLC3-GUEST`
	9.	Disable adaptive 11r. Example: `Device(config-wlan)# no security ft adaptive`
	10.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	11.	Disable WPA2 security. Example: `Device(config-wlan)# no security wpa wpa2`
	12.	Disable WPA2 ciphers for AES. Example: `Device(config-wlan)# no security wpa wpa2 ciphers aes`
	13.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	14.	Enable web authentication for WLAN. Example: `Device(config-wlan)# security web-auth`
	15.	Enable authentication list for dot1x security using the security web-auth authentication-list authenticate-list-name command. Example: `Device(config-wlan)# security web-auth authentication-list WEBAUTH`
	16.	Configure the parameter map using the security web-auth parameter-map parameter-map-name command. Example: `Device(config-wlan)# security web-auth parameter-map ISE-Ext-Webauth_IP` Note If parameter map is not associated with a WLAN, the configuration uses the global parameter map.
	17.	Return to privileged EXEC mode. Example: `Device(config-wlan)# end`

Once enabled for the configured WLAN, web authentication redirects clients to the specified WebAuth portal using default ports.

Configure EWA with multiple web servers and/or ports different than default (80/443)

Configure an External Web Authentication (EWA) workflow to support multiple web servers and custom port numbers using CLI.

Enable guest access using EWA if there are multiple external web servers or if web authentication must use ports other than the default ports of 80 or 443.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Define an extended IPv4 access list using a name, and enters access-list configuration mode. Example: `Device(config)# ip access-list extended preauth_ISE_Ext_WA`
	3.	Permit access from any host to the first external web server port number 8443. Example: `Device(config)# access-list-number permit tcp any host external_web_server_ip_address1 eq port-number` Example: `Device(config)# 10 permit tcp any host 192.168.0.98 eq 8443`
	4.	Permit access from any host to the second external web server port number 8443. Example: `Device(config)# access-list-number permit tcp any host external_web_server_ip_address2 eq port-number` Example: `Device(config)# 10 permit tcp any host 192.168.0.99 eq 8443`
	5.	Permit DNS UDP traffic. Example: `Device(config)# access-list-number permit udp any eq domain` Example: `Device(config)# 20 permit udp any any eq domain`
	6.	Permit DHCP traffic using the bootpc . Example: `Device(config)# 30 permit udp any any eq bootpc` Example: `Device(config)# access-list-number permit udp any any eq bootpc`
	7.	Permit DHCP traffic using bootps . Example: `Device(config)# access-list-number permit udp any any eq bootps` Example: `Device(config)# 40 permit udp any any eq bootps`
	8.	Permit the access from the first external web server port 8443 to any host. Example: `Device(config)# access-list-number permit tcp any host external_web_server_ip_address1 eq port-number any` Example: `Device(config)# 50 permit tcp host 192.168.0.98 eq 8443 any`
	9.	Permit the access from the second external web server port 8443 to any host. Example: `Device(config)# access-list-number permit tcp any host external_web_server_ip_address2 eq port-number any` Example: `Device(config)# 50 permit tcp host 192.168.0.99 eq 8443 any`
	10.	Permit DNS TCP traffic. Example: `Device(config)# access-list-number permit tcp any eq domain` Example: `Device(config)# 60 permit tcp any any eq domain`
	11.	Deny all the other traffic. Example: `Device(config)# access-list-number deny ip any any` Example: `Device(config)# 70 deny ip any any`
	12.	Create the WLAN using the wlan wlan-name wlan-id ssid command. Example: `Device(config)# wlan wlan-name wlan-id ssid` Example: `Device(config)# wlan EWLC3-GUEST 3 EWLC3-GUEST`
	13.	Configure the IPv4 WLAN web ACL Example: `Device(config-wlan)# ip access-group web name` The variable name specifies the user-defined IPv4 ACL name
	14.	Return to privileged EXEC mode. Example: `Device(config-wlan)# end`

This configuration allows EWA with multiple external web servers and ports. It supports DNS or DHCP traffic and blocks unauthorized traffic.

Configure wired guest EWA with multiple web servers, ports different than default (80/443)

Configure Wired Guest External Web Authentication (EWA) when using multiple web servers or ports other than the default ports of 80 or 443 using CLI.

Wired Guest LAN profiles do not allow manual ACL assignment directly. To support multiple web servers or custom ports, use the bypass ACL in the global parameter map.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Define an extended IPv4 access list using a name, and enter access-list configuration mode. Example: `Device(config)# ip access-list extended BYPASS_ACL`
	3.	Allow the traffic to switch centrally. Example: `Device(config)# 10 deny ip any host 192.168.0.45`
	4.	Allow the traffic to switch centrally Example: `Device(config)# access-list-number deny ip any host hostname` Example: `Device(config)# 20 deny ip any host 4.0.0.1`
	5.	Creates a parameter map and enter parameter-map webauth configuration mode. Example: `Device(config)# parameter-map type webauth global`
	6.	Create a WebAuth bypass intercept using the ACL name. Example: `Device(config-params-parameter-map)# webauth-bypass-intercept BYPASS_ACL` Note You cannot manually apply an ACL to the wired guest profile to configure external web authentication with multiple IP addresses or different ports. To work around this, use the bypass ACL in the wired guest profile.
	7.	Return to privileged EXEC mode. Example: `Device(config-params-parameter-map)# end`

The wired guest profile uses the bypass ACL, enabling external web authentication with multiple web servers or custom ports.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

External Web Authentication

Configure EWA with single WebAuth server address and default ports (80/443) (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure EWA with multiple web servers and/or ports different than default (80/443)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure wired guest EWA with multiple web servers, ports different than default (80/443)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example: