Explains external web authentication mechanisms for WLAN clients, providing instructions to configure single or multiple WebAuth servers and wired guest EWA using CLI procedures.

Configure EWA with single WebAuth server address and default ports (80/443) (CLI)

Configure External Web Authentication (EWA) on your device to use a single WebAuth server address with default ports (80 or 443).

Use this procedure to redirect guest WLAN clients to a specific WebAuth portal using default HTTP or HTTPS ports.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```

Define the authentication method at login.

Example:

Device(config)# aaa authentication login WEBAUTH local

Create the parameter map using the parameter-map type webauth parameter-map-name command.
Example:
```
Device(config)# parameter-map type webauth ISE-Ext-Webauth_IP
```
The parameter-map-name must not exceed 99 characters.

Configure the webauth type parameter.

Example:

Device(config-params-parameter-map)# type webauth

Configure the URL string for redirect during login using the redirect for-login URL-String command.

Example:

Device(config-params-parameter-map)#  redirect for-login https://192.168.0.98:443/portal/PortalSetup.action?portal=ad64b062-1098-11e7-8591-005056891b52

Configure the external portal IPv4 address.

Example:

Device(config-params-parameter-map)# redirect portal ipv4 192.168.0.98

Return to global configuration mode.
Example:
```
Device(config-params-parameter-map)# exit
```
Configure a WLAN using the wlan wlan-name wlan-id SSID-name command.
Example:
```
Device(config)#  wlan EWLC3-GUEST 3 EWLC3-GUEST
```

Disable adaptive 11r.

Example:

Device(config-wlan)# no security ft adaptive

Disable WPA security.
Example:
```
Device(config-wlan)# no security wpa
```

Disable WPA2 security.

Example:

Device(config-wlan)# no security wpa wpa2

Disable WPA2 ciphers for AES.

Example:

Device(config-wlan)# no security wpa wpa2 ciphers aes

Disable security AKM for dot1x.

Example:

Device(config-wlan)# no security wpa akm dot1x

Enable web authentication for WLAN.
Example:
```
Device(config-wlan)# security web-auth
```
Enable authentication list for dot1x security using the security web-auth authentication-list authenticate-list-name command.
Example:
```
Device(config-wlan)# security web-auth authentication-list WEBAUTH
```
Configure the parameter map using the security web-auth parameter-map parameter-map-name command.
Example:
```
Device(config-wlan)# security web-auth parameter-map ISE-Ext-Webauth_IP
```
Note

If parameter map is not associated with a WLAN, the configuration uses the global parameter map.
Return to privileged EXEC mode.
Example:
```
Device(config-wlan)# end
```

Once enabled for the configured WLAN, web authentication redirects clients to the specified WebAuth portal using default ports.

Configure EWA with multiple web servers and/or ports different than default (80/443)

Configure an External Web Authentication (EWA) workflow to support multiple web servers and custom port numbers using CLI.

Enable guest access using EWA if there are multiple external web servers or if web authentication must use ports other than the default ports of 80 or 443.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Define an extended IPv4 access list using a name, and enters access-list configuration mode.
Example:
```
Device(config)# ip access-list extended preauth_ISE_Ext_WA
```

Permit access from any host to the first external web server port number 8443.

Example:

Device(config)# access-list-number permit tcp any host external_web_server_ip_address1 eq port-number

Example:

Device(config)# 10 permit tcp any host 192.168.0.98 eq 8443

Permit access from any host to the second external web server port number 8443.

Example:

Device(config)# access-list-number permit tcp any host external_web_server_ip_address2 eq port-number

Example:

Device(config)# 10 permit tcp any host 192.168.0.99 eq 8443

Permit DNS UDP traffic.

Example:

Device(config)# access-list-number permit udp any eq domain

Example:

Device(config)# 20 permit udp any any eq domain

Permit DHCP traffic using the bootpc .

Example:

Device(config)# 30 permit udp any any eq bootpc

Example:

Device(config)# access-list-number permit udp any any eq bootpc

Permit DHCP traffic using bootps .

Example:

Device(config)# access-list-number permit udp any any eq bootps

Example:

Device(config)# 40 permit udp any any eq bootps

Permit the access from the first external web server port 8443 to any host.

Example:

Device(config)# access-list-number permit tcp any host external_web_server_ip_address1 eq port-number any

Example:

Device(config)# 50 permit tcp host 192.168.0.98 eq 8443 any

Permit the access from the second external web server port 8443 to any host.

Example:

Device(config)# access-list-number permit tcp any host external_web_server_ip_address2 eq port-number any

Example:

Device(config)# 50 permit tcp host 192.168.0.99 eq 8443 any

Permit DNS TCP traffic.

Example:

Device(config)# access-list-number permit tcp any eq domain

Example:

Device(config)# 60 permit tcp any any eq domain

Deny all the other traffic.

Example:

Device(config)# access-list-number deny ip any any

Example:

Device(config)# 70 deny ip any any

Create the WLAN using the wlan wlan-name wlan-id ssid command.

Example:

Device(config)# wlan wlan-name wlan-id ssid

Example:

Device(config)# wlan EWLC3-GUEST 3 EWLC3-GUEST

Configure the IPv4 WLAN web ACL
Example:
```
Device(config-wlan)# ip access-group web name
```
The variable name specifies the user-defined IPv4 ACL name
Return to privileged EXEC mode.
Example:
```
Device(config-wlan)# end
```

This configuration allows EWA with multiple external web servers and ports. It supports DNS or DHCP traffic and blocks unauthorized traffic.

Configure wired guest EWA with multiple web servers, ports different than default (80/443)

Configure Wired Guest External Web Authentication (EWA) when using multiple web servers or ports other than the default ports of 80 or 443 using CLI.

Wired Guest LAN profiles do not allow manual ACL assignment directly. To support multiple web servers or custom ports, use the bypass ACL in the global parameter map.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Define an extended IPv4 access list using a name, and enter access-list configuration mode.
Example:
```
Device(config)# ip access-list extended BYPASS_ACL
```

Allow the traffic to switch centrally.

Example:

Device(config)# 10 deny ip any host 192.168.0.45

Allow the traffic to switch centrally

Example:

Device(config)# access-list-number  deny ip any host hostname

Example:

Device(config)# 20 deny ip any host 4.0.0.1

Creates a parameter map and enter parameter-map webauth configuration mode.
Example:
```
Device(config)# parameter-map type webauth global
```
Create a WebAuth bypass intercept using the ACL name.
Example:
```
Device(config-params-parameter-map)# webauth-bypass-intercept BYPASS_ACL
```
Note

You cannot manually apply an ACL to the wired guest profile to configure external web authentication with multiple IP addresses or different ports. To work around this, use the bypass ACL in the wired guest profile.

Return to privileged EXEC mode.

Example:

Device(config-params-parameter-map)# end

The wired guest profile uses the bypass ACL, enabling external web authentication with multiple web servers or custom ports.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.