enables an access point to enforce web authentication policies for IPv6 client traffic
uses IOS IPv6 ACL definitions that are pushed to the AP in response to join events or policy changes, and
differentiates pre-authentication and post-authentication access by assigning default or custom ACLs.

A change in the ACL policies of the FlexConnect profile can include adding a new ACL, deleting an ACL, or modifying an existing ACL.

ACL definitions are pushed to AP when any of these events occur:

AP join.
New ACL mapping in a new FlexConnect profile.
Configuring IPv6 ACL definition in FlexConnect profile.

Default Local Web Authentication ACLs

The pre-defined default LWA IPv6 ACL is pushed to AP and assigned to the data plane.

Default External Web Authentication ACL

The default EWA ACLs are derived from the redirect portal address configured in the parameter map.

The types of default EWA ACLs include:

Security ACL which is pushed and assigned to the AP.
Intercept ACL which is pushed and assigned to the data plane.

FQDN ACL

FQDN ACL is encoded along with IPv6 ACL and sent to AP.
FQDN ACL is always a custom ACL.

These applies to FlexConnect and Local mode:

If you are migrating from AireOS, you would explicitly need to execute these commands:

redirect append ap-mac tag ap_mac

redirect append wlan-ssid tag wlan

redirect append client-mac tag client_mac

If the login page has any resource that needs to be fetched from the server, you will need to include those resource URLs in URL filtering.
If you are trying to access an IPv6 URL and you have an IPv4 web server, the controller redirects the client to an internal page. Domain redirection is not supported in this context. It is recommended to have a dual-stack web server and configure virtual IPv6 address in the global parameter map.

Enable pre-authentication ACL for LWA and EWA (GUI)

Allow or restrict traffic before authentication on specified WLANs using the GUI.

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name, the SSID and the WLAN ID.
	4.	Choose Security > Layer2 tab. Uncheck the WPAPolicy, AES and 802.1x check boxes.
	5.	Choose Security > Layer3 tab. Select the Web Auth Parameter Map from the Web Auth Parameter Map drop-down list and authentication list from the Authentication List drop-down list.
	6.	Click Show Advanced Settings and under the Preauthenticated ACL settings, and select the IPv6 ACL from the IPv6 drop-down list.
	7.	Choose Security > AAA tab. Select the authentication list from the Authentication List drop-down list.
	8.	Click Apply to Device.

Enable pre-authentication ACL for LWA and EWA (CLI)

Configure pre-authentication access control for WLAN client web authentication scenarios using commands.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Enter the WLAN configuration sub-mode. Example: `Device(config)# wlan wlan-demo 1 ssid-demo` wlan-name: Enter the profile name. The range is from 1 to 32 alphanumeric characters. wlan-id: Enter the WLAN ID. The range is from 1 to 512. SSID-name: Enter the Service Set Identifier (SSID) for this WLAN. If the SSID is not specified, the WLAN profile name is set as the SSID. Note If you have already configured WLAN, enter wlan wlan-name command.
	3.	Create a pre-authentication ACL for web authentication and disable the WPA security. Example: `Device(config-wlan)# ipv6 traffic-filter web preauth_v6_acl` `Device(config-wlan)# no security wpa`
	4.	Disable WPA2 ciphers for AES. Example: `Device(config-wlan)#no security wpa wpa2 ciphers aes`
	5.	Disable security AKM for dot1x. Example: `Device(config-wlan)#no security wpa akm dot1x`
	6.	Configure web authentication. Example: `Device(config-wlan)# security web-auth`
	7.	Enable authentication list for WLAN. Example: `Device(config-wlan)# security web-auth authentication-list wcm_dot1x`
	8.	Map the parameter map. Example: `Device(config-wlan)# security web-auth parameter-map param-custom-webconsent`
	9.	Shutdown the WLAN. Example: `Device(config-wlan)# no shutdown`

Enable post-authentication ACL for LWA and EWA (GUI)

Enable post-authentication access control for LWA and EWA WLANs to enforce security policies after successful user authentication using the GUI.

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name. The Profile Name is the profile name of the policy profile.
	4.	Enter the SSID and the WLAN ID.
	5.	Click Apply to Device.

Enable post-authentication ACL for LWA and EWA (CLI)

Configure security policies that restrict client access after authentication using commands.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Create policy profile for the WLAN. Example: `Device(config)# wireless profile policy test1` The profile-name is the profile name of the policy profile.
	3.	Create a named WLAN ACL. Example: `Device(config-wireless-policy)# ipv6 acl testacl`
	4.	Return to the privileged EXEC mode. Example: `Device(config-wireless-policy)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Enable DNS ACL for LWA and EWA (GUI)

Enable DNS-based access control for LWA and EWA WLANs by configuring the required settings using the GUI.

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name. The Profile Name is the profile name of the policy profile.
	4.	Enter the SSID and the WLAN ID.
	5.	Click Apply to Device.

Enable DNS ACL for LWA and EWA (CLI)

Enable DNS ACLs to control DNS access for WLAN policy profiles that use LWA or EWA using commands.

Note

Post-authentication DNS ACL is not supported.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Create policy profile for the WLAN. Example: `Device(config)# wireless profile policy test1` The profile-name is the profile name of the policy profile.
	3.	Return to the privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Verify FlexConnect client IPv6 support with WebAuth pre and post ACL

To verify the client state after L2 authentication, use this command:

Device# show wireless client summary
Number of Local Clients: 1                                                                                                          
MAC Address    AP Name                          WLAN  State             Protocol Method     Role
---------------------------------------------------------------------------------------------------
1491.82b8.f8c1 AP4001.7A03.544C                 4      Webauth Pending   11n(5)   None       Local             
Number of Excluded Clients: 0

To verify the IP state, discovery, and MAC, use this command:

Device# show wireless dev da ip
IP                                          STATE       DISCOVERY   MAC
----------------------------------------------------------------------------------
15.30.0.4                                   Reachable   ARP         1491.82b8.f8c1 
2001:15:30:0:d1d7:ecf3:7940:af60            Reachable   IPv6 Packet 1491.82b8.f8c1 
fe80::595e:7c29:d7c:3c84                    Reachable   IPv6 Packet 1491.82b8.f8c1

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

FlexConnect client IPv6 support with WebAuth pre and post ACL