Outlines captive portal implementation concepts and provides comprehensive configuration procedures through GUI and CLI, with verification commands to confirm portal functionality.

A captive portal is a network authentication mechanism that

intercepts and redirects user web requests to a designated login or acceptance page,
allows administrators to enforce authentication or policy acceptance before granting network access, and
supports configuration of multiple web authentication URLs based on access point (AP), WLAN, or global scope.

Order of precedence

Captive portal configurations let you define different web authentication URLs—including external URLs—for the same SSID, based on the specific access point or WLAN. By default, the system uses a global URL for user authentication, but administrators may override this at the WLAN or AP level to customize user experience.

Order of precedence

AP-level configuration (highest priority)
WLAN-level configuration
Global configuration (default)

Restrictions

This feature is supported on standalone controllers only.
Export-Anchor configurations are not supported.

Configure captive portal (GUI)

Configure a secure WLAN that uses captive portal authentication for guest or user access.

Configure a captive portal when you require user authentication on your Wi-Fi network for guests or employees.

Before you begin

Confirm the web authentication parameter map and necessary authentication lists are already created.

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name, the SSID, and the WLAN ID.
	4.	In the Security > Layer2 tab, uncheck the WPA Policy, AES and 802.1x check boxes.
	5.	In the Security > Layer3 tab, choose the parameter map from the Web Auth Parameter Map drop-down list and authentication list from the Authentication List drop-down list.
	6.	In the Security > AAA tab, choose the Authentication list from the Authentication List drop-down list.
	7.	Click Apply to Device.
	8.	Choose Configuration > Security > Web Auth.
	9.	Choose a Web Auth Parameter Map.
	10.	In the General tab, enter the Maximum HTTP connections, Init-State Timeout(secs) and choose webauth from the Type drop-down list.
	11.	In the Advanced tab, under the Redirect to external server settings, enter the Redirect for log-in server.
	12.	Click Update & Apply.

The captive portal WLAN is available, and users associating with this SSID will be redirected for authentication as defined in the parameter map.

Configure captive portal

Set up a captive portal to manage user access to the network.

The captive portal is used to authenticate users before granting them access to the network, typically in public Wi-Fi environments.

Before you begin

Ensure that the WLAN is properly configured and that you have the necessary access rights.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal` Enters global configuration mode.
	2.	Configure the WLAN profile. Example: `Device(config)# wlan profile-name` Enables or disables all WLANs and creates the WLAN identifier. The profile-name and the SSID network name should be up to 32 alphanumeric characters.
	3.	Configure the WLAN web ACL. Example: `Device(config-wlan)# ip access-group web IPv4-ACL-Name` WLAN needs to be disabled before performing this operation.
	4.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	5.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x` Disables security AKM for dot1x.
	6.	Disable WPA2 ciphers for AES. Example: `Device(config-wlan)# no security wpa wpa2 ciphers aes` Disables WPA2 ciphers for AES.
	7.	Enable web authentication for WLAN. Example: `Device(config-wlan)# security web-auth authentication-list authentication-list-name` `Device(config-wlan)# security web-auth parameter-map parameter-map-name` Enables web authentication for WLAN. Here, authentication-list authentication-list-name : Sets the authentication list for IEEE 802.1x. authorization-list authorization-list-name : Sets the override-authorization list for IEEE 802.1x. on-macfilter-failure : Enables Web authentication on MAC filter failure. parameter-map parameter-map-name : Configures the parameter map. Note When security web-auth is enabled, you get to map the default authentication-list and global parameter-map . This is applicable for authentication-list and parameter-map that are not explicitly mentioned.
	8.	(Optional) Enable the WLAN. Example: `Device(config-wlan)# no shutdown`
	9.	Exit from the WLAN configuration. Example: `Device(config-wlan)# exit`
	10.	Create a parameter map and enter parameter-map webauth configuration mode. Example: `Device(config)# parameter-map type webauth parameter-map-name` Creates a parameter map and enters parameter-map webauth configuration mode.
	11.	Configure the webauth type parameter. Example: `Device(config-params-parameter-map)# type webauth parameter-map-name`
	12.	Configure the WEBAUTH timeout in seconds. Example: `Device(config-params-parameter-map)# timeout init-state sec <timeout-seconds>` Valid range for the time in sec parameter is 60 seconds to 3932100 seconds.
	13.	Configure the URL string for redirect during login. Example: `Device(config-params-parameter-map)# redirect for-login <URL-String>` Example: `Device(config-params-parameter-map)# redirect for-login https://172.16.100.157/portal/login.html` Configures the URL string for redirect during login.
	14.	Exit the parameters configuration. Example: `Device(config-params-parameter-map)# exit`
	15.	Configure policy tag and enter policy tag configuration mode. Example: `Device(config)# wireless tag policy policy-tag-name`
	16.	Attach a policy profile to a WLAN profile. Example: `Device(config-policy-tag)# wlan wlan-profile-name policy policy-profile-name`
	17.	Save the configuration and exit configuration mode. Example: `Device(config-policy-tag)# end`

The captive portal is now configured and ready to manage user access to the network.

Example: Captive portal configuration

The example shows how you can have APs at different locations, broadcasting the same SSID but redirecting clients to different redirect portals:

Configuring multiple parameter maps pointing to different redirect portal:

parameter-map type webauth parMap1
type webauth
timeout init-state sec 21600
redirect for-login https://172.16.12.3:8080/portal/PortalSetup.action?portal=cfdbce00-2ce2-11e8-b83c-005056a06b27
redirect portal ipv4 172.16.12.3
!
!
parameter-map type webauth parMap11
type webauth
timeout init-state sec 21600
redirect for-login https://172.16.12.4:8443/portal/PortalSetup.action?portal=094e7270-3808-11e8-9797-02421e4cae0c
redirect portal ipv4 172.16.12.4
!

Associating these parameter maps to different WLANs:

wlan edc1 1 edc
ip access-group web CPWebauth
no security wpa
no security wpa akm dot1x
no security wpa wpa2 ciphers aes
security web-auth
security web-auth authentication-list cp-webauth
security web-auth parameter-map parMap11
no shutdown
wlan edc2 2 edc
ip access-group web CPWebauth
no security wpa
no security wpa akm dot1x
no security wpa wpa2 ciphers aes
security web-auth
security web-auth authentication-list cp-webauth
security web-auth parameter-map parMap1
no shutdown

Note

All WLANs have identical SSIDs.

Associating WLANs to different policy tags:

wireless tag policy policy_tag_edc1
wlan edc1 policy policy_profile_flex
wireless tag policy policy_tag_edc2
wlan edc2 policy policy_profile_flex

Assigning these policy tags to the desired APs:

ap E4AA.5D13.14DC
policy-tag policy_tag_edc1
site-tag site_tag_flex
ap E4AA.5D2C.3CAC
policy-tag policy_tag_edc2
site-tag site_tag_flex

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.