Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Configure guest access using different security methods

Updated: April 10, 2026

Want to summarize with AI?

Describes how to configure guest access using various security methods and provides detailed information about different configuration options and implementation approaches.

These sections provide information about:

Open authentication

To configure the guest access with open authentication, follow the steps:

Configure the WLAN Profile
Configure access policy profile

Note
No tag is required unless AVC is enabled.

Configure a WLAN profile for guest access with open authentication (GUI)

Create a WLAN profile that allows guest users to connect to the wireless network without requiring authentication credentials, providing open access for temporary or visitor use.

Guest access with open authentication is commonly used in public areas, visitor networks, or temporary access scenarios where security requirements are minimal and ease of access is prioritized.

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name, the SSID and the WLAN ID. Choose the radio policy from the Radio Policy drop-down list. Enable or disable the Status and Broadcast SSID toggle buttons.
	4.	Choose Security > Layer2 tab. Uncheck the WPA Policy, WPA2 Policy, AES and 802.1x check boxes.
	5.	Click Apply to Device.

The WLAN profile is created and configured for guest access with open authentication. Guest users can now connect to the wireless network without providing authentication credentials.

Configure a WLAN profile for guest access with open authentication (CLI)

Establish a guest access WLAN that allows users to connect without authentication credentials.

Open authentication WLANs are commonly used for guest networks where ease of access is prioritized over security. This configuration removes all security barriers, making it suitable for public or temporary access scenarios.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device(config)# wlan profile-name wlan-id ssid-name` Example: `Device(config)# wlan mywlan 34 mywlan-ssid`
	3.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	4.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	5.	Disable WPA2 security. Example: `Device(config-wlan)# no security wpa wpa2`
	6.	Disable WPA2 ciphers for AES. Example: `Device(config-wlan)# no security wpa wpa2 ciphers aes`
	7.	Save the configuration. Example: `Device(config-wlan)# no shutdown`

The WLAN profile is now configured with open authentication, allowing guest users to connect without any security credentials.

Configure a policy profile (CLI)

Create a policy profile that establishes WLAN connectivity rules and mobility configurations for wireless network access.

Policy profiles define how wireless clients connect to and interact with the network, including VLAN assignments, mobility settings, and switching behavior. Configure these profiles to control client access and network segmentation.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure WLAN policy profile and enter the wireless policy configuration mode. Example: `Device(config)# wireless profile policy wlan-policy-profile` Example: `Device(config)# wireless profile policy open_it`
	3.	Configure Guest Foreign or Guest Anchor. Choose the first option to configure a Guest Foreign or second option to configure a Guest Anchor: mobility anchor anchor-ip-address mobility anchor Example: For Guest Foreign: `Device (config-wireless-policy)# mobility anchor anchor-ip-address` For Guest Anchor: `Device (config-wireless-policy)# mobility anchor` Example: For Guest Foreign: `Device (config-wireless-policy)# mobility anchor 19.0.2.1` For Guest Anchor: `Device (config-wireless-policy)# mobility anchor`
	4.	Enable Central switching. Example: `Device(config-wireless-policy)# central switching`
	5.	Configure a VLAN name or VLAN ID. Example: `Device(config-wireless-policy)# vlan id` Example: `Device(config-wireless-policy)# vlan 16` Note VLAN is optional for a Guest Foreign controller.
	6.	Enable the policy profile. Example: `Device(config-wireless-policy)# no shutdown`

The policy profile is now configured and enabled, ready to be applied to WLAN configurations for wireless client connectivity.

Local web authentication

To configure LWA, follow these steps:

Configure a parameter map (GUI)

Configure a parameter map to define web authentication settings including connection limits and timeout values.

Parameter maps are used to configure web authentication parameters that control how users authenticate through the web interface. This configuration is performed through the device's graphical user interface.

Procedure

	1.	Choose Configuration > Security > Web Auth.
	2.	Click Add.
	3.	Enter the Parameter-map name, Maximum HTTP connections,Init-State Timeout(secs) and choose webauth in the Type drop-down list.
	4.	Click Apply to Device.

The parameter map is configured and applied to the device with the specified web authentication settings.

Configure a parameter map (CLI)

Define web authentication parameters and timeout settings to control client authentication behavior.

Parameter maps are used to configure global web authentication settings that control how clients authenticate and how long they remain in various authentication states.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create a parameter map and enter parameter-map WEBAUTH configuration mode. Example: `Device(config)# parameter-map type webauth global`
	3.	Configure the WEBAUTH type parameter. Example: `Device(config-params-parameter-map)# type webauth`
	4.	Configure the WEBAUTH timeout in seconds. Example: `Device(config-params-parameter-map)# timeout init-state sec timeout-seconds` Example: `Device(config-params-parameter-map)# timeout init-state sec 3600` Valid range for time is from 60 to 3932100 seconds.
	5.	Configure a virtual IP address. Example: `Device(config-params-parameter-map)# virtual-ip ipv4 virtual-IP-address` Example: `Device(config-params-parameter-map)# virtual-ip ipv4 209.165.201.1`

The parameter map is configured with web authentication settings, timeout values, and virtual IP address for client authentication.

Configure a WLAN profile for guest access with local web authentication (GUI)

Configure a WLAN profile to enable guest access with local web authentication, allowing temporary network access for visitors while maintaining security controls.

Use this procedure when you need to provide internet access to guests through a web-based authentication portal. This configuration enables controlled access for users who do not have permanent network credentials.

Follow these steps to configure a WLAN profile for guest access with local web authentication:

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click on the WLAN name.
	3.	Choose Security > Layer3.
	4.	Check the Web Policy check box.
	5.	Choose a parameter map from the Web Auth Parameter Map drop-down list.
	6.	Choose an authentication list from the Authentication List drop-down list.
	7.	Click Update & Apply to Device.

The WLAN profile is configured with local web authentication for guest access. Guest users connecting to this WLAN will be redirected to a web authentication portal where they can obtain network access.

Configure a WLAN profile for guest access with local web AUTHENTICATION (CLI)

This task configures a WLAN profile with local web AUTHENTICATION to provide secure guest access to the wireless network.

Local web AUTHENTICATION allows guest users to access the network through a web-based AUTHENTICATION portal. This configuration is typically used in guest access scenarios where users need to authenticate via a web interface before gaining network access.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device# Device(config)# wlan mywlan 38 mywlan-ssid1`
	3.	Enable web authentication for a WLAN. Example: `Device(config-wlan)# security web-auth`
	4.	Configure the default parameter map. Example: `Device(config-wlan)# security web-auth parameter-map default` Note When security web-auth is enabled, you get to map the default authentication-list and global parameter-map . This is applicable for authentication-list and parameter-map that are not explicitly mentioned.
	5.	Configure the global parameter map. Example: `Device(config-wlan)# security web-auth parameter-map global`
	6.	Set the authentication list for IEEE 802.1x. Example: `Device(config-wlan)# security web-auth authentication-list lwa-authentication`

The WLAN profile is configured with local web AUTHENTICATION for guest access. Guest users will now be prompted to authenticate through a web interface when connecting to the wireless network.

Configure an AAA server for local web authentication (GUI)

This task allows you to set up AAA server configuration for local web authentication using the graphical user interface.

Use this procedure when you need to configure authentication and authorization settings for local web authentication through the device's web interface.

Procedure

	1.	Choose Configuration > Security > AAA > AAA Advanced > Global Config.
	2.	Choose the options from the Local Authentication, Authentication Method List, Local Authorization and Authorization Method List drop-down lists.
	3.	Enable or Disable the Radius Server Load Balance using toggle button.
	4.	Check the Interim Update check box.
	5.	Click Apply.

The AAA server configuration for local web authentication is now configured with your selected settings.

Configure an AAA server for local web authentication (CLI)

Configure Authentication, Authorization, and Accounting (AAA) server settings to enable local web authentication on the device.

Use this procedure when you need to set up local authentication and authorization for web-based user access on your device.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	aaa authentication login lwa-authentication local Example: `Device(config)#aaa authentication login lwa-authentication local` Defines the authentication method at login.
	3.	aaa authorization network default local if-authenticated Example: `Device(config)#aaa authorization network default local if-authenticated` Sets the authorization method to local if the user has authenticated.

The AAA server is configured for local web authentication. Users can now authenticate locally when accessing the device through web interface.

Configure global settings (CLI)

Establish basic global configuration settings for system access and HTTP server functionality.

Global configuration sets system-wide parameters that affect device operation and user access methods.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Set the clear text password for the user. Example: `Device(config)# username name password 0 clear-text-password` Example: `Device(config)# username base password 0 pass1`
	3.	Enable the HTTP server. Example: `Device(config)# ip http server`
	4.	Set the HTTP server authentication method to local. Example: `Device(config)# ip http authentication local` Note You will get the admin access rights regardless of the user privilege, if the ip http authentication local is disabled and username is the same as enable password.

Global configuration settings are now applied, enabling HTTP server access with local authentication and user password configuration.

Central web authentication

Configure WLAN profile for guest access with central web authentication (GUI)

Configure a WLAN profile that enables guest access using central web authentication to provide secure network access for guest users.

Guest access with central web authentication allows visitors to access the network through a web-based authentication portal while maintaining security controls through MAC filtering and authorization lists.

Before you begin

Follow these steps to configure a WLAN profile for guest access with central web authentication:

Procedure

	1.	Choose Configuration > Tags & Profiles > WLANs.
	2.	Click Add.
	3.	In the General tab, enter the Profile Name, the SSID, and the WLAN ID.
	4.	To enable the WLAN, set Status as Enabled.
	5.	From the Radio Policy drop-down list, select the radio policy.
	6.	To enable the Broadcast SSID, set the status as Enabled.
	7.	Choose Security > Layer2 tab. Uncheck the WPA Policy, WPA2 Policy, AES and 802.1x check boxes.
	8.	Check the MAC Filtering check box to enable the feature. With MAC Filtering enabled, choose the Authorization list from the Authorization List drop-down list.
	9.	Click Apply to Device.

The WLAN profile is configured for guest access with central web authentication. The profile is now available for guest users to connect through the web authentication portal.

Configure a WLAN profile for guest access with central web authentication (CLI)

Set up a WLAN profile that allows guest users to access the network through central web authentication, providing controlled access while maintaining security.

Guest access with central web authentication is used when you need to provide network access to temporary users while maintaining control and security through web-based authentication portals.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device(config)# wlan wlan-name wlan-id ssid-name` Example: `Device(config)# wlan mywlan 38 mywlan-ssid1`
	3.	Enable MAB authentication for the remote RADIUS server. Example: `Device(config-wlan)# mac-filtering remote-authorization-list-name` Example: `Device(config-wlan)# mac-filtering auth-list`
	4.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	5.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	6.	Disable WPA2 security. Example: `Device(config-wlan)# no security wpa wpa2`
	7.	Disable WPA2 ciphers for AES. Example: `Device(config-wlan)# no security wpa wpa2 ciphers aes`
	8.	Save the configuration and activate the WLAN. Example: `Device(config-wlan)# no shutdown`

The WLAN profile is configured for guest access with central web authentication, allowing guest users to connect and authenticate through the web portal.

Configure AAA server (GUI)

Configure RADIUS server groups and individual RADIUS servers to enable AAA authentication for network access control and user authentication.

AAA (Authentication, Authorization, and Accounting) servers provide centralized authentication services for network devices. RADIUS servers must be properly configured with server groups to ensure reliable authentication services.

Procedure

	1.	Choose Configuration > Security > AAA > Servers/Groups > RADIUS > Server Groups.
	2.	Click the RADIUS server group.
	3.	From the MAC-Delimiter drop-down list, choose an option.
	4.	From the MAC-Filtering drop-down list, choose an option.
	5.	Enter the Dead-Time (mins).
	6.	From the Available Servers on the left, move the servers you need to Assigned Servers on the right.
	7.	Click Update & Apply to Device.
	8.	Choose Configuration > Security > AAA > Servers/Groups > RADIUS > Servers.
	9.	Click the RADIUS server.
	10.	Enter the IPv4/IPv6 Server Address, Auth Port, Acct Port, Server Timeout (seconds) and Retry Count.
	11.	Check or uncheck the PAC Key checkbox and choose the Key Type from the Key Type drop-down list. Enter the Key and Confirm Key.
	12.	Enable or disable the Support for CoA toggle button.
	13.	Click Update & Apply to Device.

The RADIUS server groups and servers are configured and applied to the device. AAA authentication is now available using the configured RADIUS servers.

Configure AAA server (CLI)

Set up AAA server configuration to enable authentication and authorization for network access control.

Configure AAA server for Guest Foreign only. This configuration establishes RADIUS server groups and authorization methods for network access control.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Set the authorization method to local. Example: `Device(config)# aaa authorization network authorization-list local group server-group-name` Example: `Device(config)# aaa authorization network cwa local group ise`
	3.	Configure RADIUS server group definition. Example: `Device(config)# aaa group server radius server-group-name` Example: `Device(config)# aaa group server radius ise` Note server-group-name refers to the server group name. The valid range is from 1 to 32 alphanumeric characters.
	4.	Configure the RADIUS server name. Example: `Device(config-sg-radius)# server name radius-server-name` Example: `Device(config-sg-radius)# server name ise1`
	5.	Set the MAC address as the password. Example: `Device(config-sg-radius)# subscriber mac-filtering security-mode mac`
	6.	Set the MAC address delimiter to colon. Example: `Device(config-sg-radius)# mac-delimiter colon`
	7.	Save the configuration, exit configuration mode, and return to privileged EXEC mode. Example: `Device(config-sg-radius)# end`
	8.	Set the RADIUS server name. Example: `Device(config)# radius server name` Example: `Device(config)# radius server ISE1`
	9.	Configure the RADIUS server IP address authentication and accounting ports. Example: `Device(config-radius-server)# address ipv4 radius-server-ipaddress auth-port port-number acct-port port-number` Example: `Device(config-radius-server)# address ipv4 209.165.201.1 auth-port 1635 acct-port 33`

The AAA server configuration is now complete with RADIUS server group settings, authentication methods, and MAC filtering parameters established for Guest Foreign access control.

Configure 802.1x with local web authentication

Configure dual authentication mechanism using 802.1x and local web authentication for comprehensive WLAN security.

This configuration combines 802.1x network access control with local web authentication, providing layered security for wireless clients. This is typically used when both network-level and user-level authentication are required.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device(config)# wlan wlan-profile wlan-id ssid` Example: `Device(config)# wlan testwprofile 22 ssid-3`
	3.	Configure 802.1X for the WLAN. Example: `Device(config-wlan)# security dot1x authentication-list authentication-list-name` Example: `Device(config-wlan)# security dot1x authentication-list default`
	4.	Enable authentication list for web authentication security on the WLAN. Example: `Device(config-wlan)# security web-auth authentication-list authentication-list-name` Example: `Device(config-wlan)# security web-auth authentication-list default`
	5.	Configure the global parameter map for web authentication. Example: `Device(config-wlan)# security web-auth parameter-map global`
	6.	Enable the WLAN. Example: `Device(config-wlan)# no shutdown`

The WLAN is configured with both 802.1x and local web authentication, providing dual-layer security for wireless clients.

Configure local web authentication with PSK protocol (CLI)

Enable secure wireless network access using both PSK encryption and web-based authentication for enhanced security.

Local web authentication with PSK protocol combines pre-shared key security with web-based user authentication, providing a dual-layer security approach for wireless networks where traditional enterprise authentication methods are not required.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device(config)# wlan wlan-profile wlan-id ssid` Example: `Device(config)# wlan psksec-profile 22 ssid-4`
	3.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	4.	Disable WPA2 security. Example: `Device(config-wlan)# no security wpa wpa2`
	5.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	6.	Enable the security type as PSK. Example: `Device(config-wlan)# security wpa akm psk`
	7.	Configure the PSK shared key. Example: `Device(config-wlan)# security wpa akm psk set-key {ascii \| hex} key` Example: `Device(config-wlan)# security wpa akm psk set-key asci 0`
	8.	Enable the web authentication for the WLAN. Example: `Device(config-wlan)# security web-auth`
	9.	Enable authentication list for the WLAN. Example: `Device(config-wlan)# security web-auth authentication-list default`
	10.	Configure the global parameter map. Example: `Device(config-wlan)# security web-auth parameter-map global`

The WLAN is now configured with local web authentication using PSK protocol, requiring users to authenticate through a web portal while maintaining PSK encryption for wireless traffic.

Central web authentication with PSK protocol

To configure the CWA with PSK security protocol, follow the steps:

Configure WLAN profile for central web authentication with PSK protocol (CLI)

Set up central web authentication with PSK to provide secure wireless access with web-based client authentication.

Central web authentication with PSK allows wireless clients to connect using a shared key and then authenticate through a web portal. This configuration is useful in guest networks or environments requiring web-based user authentication while maintaining PSK connectivity.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN and SSID. Example: `Device(config)# wlan wlan-profile wlan-id ssid` Example: `Device(config)# wlan cwasec-profile 27 ssid-5`
	3.	Disable WPA security. Example: `Device(config-wlan)# no security wpa`
	4.	Disable WPA2 security. Example: `Device(config-wlan)# no security wpa wpa2`
	5.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	6.	Enable the security type as PSK. Example: `Device(config-wlan)# security wpa psk`
	7.	Configure the PSK shared key. Example: `Device(config-wlan)# security wpa psk set-key {ascii \| hex} key` Example: `Device(config-wlan)# security wpa psk set-key asci 0`
	8.	Enable MAC filtering for PSK web authentication. Example: `Device(config-wlan)# mac-filtering authorization-list-name` Example: `Device(config-wlan)# mac-filtering cwa-list`

The WLAN profile is configured for central web authentication with PSK protocol, allowing clients to connect using the shared key and authenticate via web portal.

Central web authentication with iPSK protocol

To configure the CWA with iPSK security protocol, follow the steps:

Configure the WLAN Profile.

Configure WLAN profile for central web authentication with iPSK protocol

This task configures a WLAN profile that enables central web authentication with iPSK (Identity Pre-Shared Key) protocol, providing secure guest access while maintaining centralized authentication control.

Use this configuration when you need to provide guest wireless access with pre-shared key authentication combined with central web authentication. This approach allows for individualized keys per device while maintaining centralized authentication oversight.

Procedure

	1.	Configure guest WLAN. Example: `config# wlan guest-wlan-name wlan-id ssid` `config# wlan ipsk-cwa-profile 28 ssid-6`
	2.	Disable security AKM for 802.1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	3.	Configure the PSK AKM shared key. Example: `Device(config-wlan)# security wpa akm psk set-key {asci \| hex} key` `Device(config-wlan)# security wpa akm psk set-key asci 0`
	4.	Enable MAC filtering for iPSK authentication. Example: `Device(config-wlan)# mac-filtering authorization_list_name` `Device(config-wlan)# mac-filtering cwa-list`

The WLAN profile is configured for central web authentication with iPSK protocol. Guest devices can now connect using pre-shared keys while being subject to centralized web authentication control and MAC filtering.

Configure web authentication on MAC address bypass failure (GUI)

This task configures Web Authentication to handle situations where MAC address filtering fails, providing an alternative authentication method for network access.

When MAC filtering is enabled but a device's MAC address is not in the authorization list, you can configure the system to fall back to Web Authentication instead of denying access completely.

Procedure

Click Configuration > Tags and Profiles > WLANs.

Click Add to add a new WLAN Profile or click the one you want to edit.

In the Edit WLAN window, complete the following steps:

Choose Security > Layer2 and check the MAC Filtering check box to enable MAC filtering.
From the Authorization List drop-down list, select a value.
Choose the Layer3 tab.
Click Show Advanced Settings and check the On MAC Filter Failure checkbox.

Web Authentication is now configured to activate when MAC address filtering fails, allowing devices not on the authorization list to authenticate through the web interface.

Configure web authentication on MAC address bypass failure (CLI)

Enable web authentication fallback when MAC filter authentication fails to avoid client disassociations due to MAC filter authentication failures.

You can configure authentication to fall back to web authentication, if a client cannot authenticate using MAC filter (Local or RADIUS), while trying to connect to a WLAN. To enable this feature, configure both MAC filtering and Web Authentication on the device. This can also avoid disassociations that happen only because of MAC filter authentication failure.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure WLAN policy profile and enter the wireless policy configuration mode. Example: `Device(config)# wireless profile policy policy-name` Example: `Device(config)# wireless profile policy cwa`
	3.	Enable Central switching. Example: `Device(config-wireless-policy)# central switching`
	4.	Configure Guest Foreign or Guest Anchor. mobility anchor anchor-ip-address mobility anchor Example: For Guests Foreign: `Device (config-wireless-policy)# mobility anchor anchor-ip-address` For Guest Anchor: `Device (config-wireless-policy)# mobility anchor` Example: For Guests Foreign: `Device (config-wireless-policy)# mobility anchor 19.0.2.1` For Guest Anchor: `Device (config-wireless-policy)# mobility anchor`
	5.	Configure a VLAN name or VLAN ID. Example: `Device(config-wireless-policy)# vlan name` Example: `Device(config-wireless-policy)# vlan 16` Note VLAN is optional for a Guest Foreign controller.
	6.	Enable the policy profile. Example: `Device(config-wireless-policy)# no shutdown`
	7.	Configure guest WLAN. Example: `config# wlan guest-wlan-name wlan-id ssid` Example: `config# wlan test-wlan-guest 10 wlan-ssid`
	8.	Configure MAC filtering support on WLAN. Example: `config-wlan# mac-filtering mac-auth-listname authorization-override`
	9.	Enable web authentication. Example: `config-wlan# security web-auth`
	10.	Enable web authentication if MAC filter authentication fails. Example: `config-wlan# security web-auth on-macfilter-failure`

Web authentication fallback is now configured for MAC filter authentication failures, preventing client disconnections when MAC authentication fails.

Configure WLAN for web authentication on MAC authentication bypass failure with pre-shared key (CLI)

Enable web authentication for clients who fail MAC authentication bypass on a WLAN, using a pre-shared key, through the CLI.

Use this configuration to ensure clients who do not pass MAC authentication bypass are redirected to a web authentication portal with a secure pre-shared key.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN. Example: `Device(config)# wlan wlan-name wland-id SSID-name` wlan-name is the name of the configured WLAN. wlan-id is the WLAN identifier. The range is one to 512. SSID-name is the SSID name which can have up to 32 alphanumeric characters. If you have already created and configured the WLAN, use the wlan wlan-name command.
	3.	Set the MAC filtering parameters. Example: `Device(config-wlan)# mac-filtering test-auth-list`
	4.	Configure the PSK AKM shared key using the command. Example: `Device(config-wlan)# ecurity wpa psk set-key {ascii \| hex} key password` `Device(config-wlan)# security wpa psk set-key ascii 0 PASSWORD`
	5.	Disable the security AKM for 802.1X. Example: `Device(config-wlan)# no security wpa akm dot1x`
	6.	Configure PSK support. Example: `Device(config-wlan)# security wpa akm psk`
	7.	Enable the authentication list for 802.1X security. Example: `Device(config-wlan)# security web-auth authentication-list authenticate-list-name`
	8.	Enable the authorization list for 802.1X security. Example: `Device(config-wlan)# security web-auth authorization-list authorize-list-name`
	9.	Enable web authentication on MAC filter failure. Example: `Device(config-wlan)# security web-auth on-macfilter-failure`
	10.	Configure the parameter map. Example: `Device(config-wlan)# security web-auth parameter-map parameter-map-name` Note If a parameter map is not associated with a WLAN, the configuration is considered from the global parameter map.
	11.	Enable the WLAN. Example: `Device(config-wlan)# no shutdown`

The WLAN is configured to perform web authentication for clients failing MAC authentication bypass, securing access with a pre-shared key.

Configure WLAN with web authentication for MAB failures using a pre-shared key (CLI)

Enable web authentication for clients who fail MAC authentication bypass (MAB) on a WLAN, using a pre-shared key through the CLI.

Use this configuration to ensure that clients who do not pass MAC authentication bypass are redirected to a web authentication portal protected by a secure pre-shared key.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN. Example: `Device(config)# wlan wlan-name wland-id SSID-name` wlan-name is the name of the configured WLAN. wlan-id is the WLAN identifier. The range is one to 512. SSID-name is the SSID name which can have up to 32 alphanumeric characters. If you have already created and configured the WLAN, use the wlan wlan-name command.
	3.	Set the MAC filtering parameters. Example: `Device(config-wlan)# mac-filtering auth-list-name`
	4.	Disable security AKM for dot1x. Example: `Device(config-wlan)# no security wpa akm dot1x`
	5.	Enable WPA3 support. Example: `Device(config-wlan)# security wpa wpa3`
	6.	Enable WPA3 OWE support. Example: `Device(config-wlan)# security wpa akm owe`
	7.	Enable authentication list for 802.1X security. Example: `Device(config-wlan)# security web-auth authentication-list authenticate-list-name`
	8.	Enable authorization list for 802.1X security. Example: `Device(config-wlan)# security web-auth authorization-list authorize-list-name`
	9.	Enable web authentication on MAC filter failure. Example: `Device(config-wlan)# security web-auth on-macfilter-failure`
	10.	Configure the parameter map. Example: `Device(config-wlan)# security web-auth parameter-map parameter-map-name` If a parameter map is not associated with a WLAN, the system uses the configuration from the global parameter map.
	11.	Enable the WLAN. Example: `Device(config-wlan)# no shutdown`

The WLAN now performs web authentication for clients who fail MAC authentication bypass and secures access with a pre-shared key.

Configure WLAN for web authentication on MAB failure with SAE (CLI)

Configure a WLAN using the CLI. If MAC Authentication Bypass (MAB) fails, users are directed to web authentication with Simultaneous Authentication of Equals (SAE) enabled.

Use this task when you require a WLAN that supports MAC authentication. If MAC authentication fails, the controller falls back to web authentication with SAE.

This setup strengthens security by ensuring that only authorized users can access the network. It also supports modern authentication protocols.

Before you begin

Prepare the names of the authentication and authorization lists and the parameter map, if needed.

Procedure

	1.	Configure the WLAN. Example: `Device(config)# wlan wlan-name wland-id SSID-name` wlan-name is the name of the configured WLAN. wlan-id is the WLAN identifier. The range is one to 512. SSID-name is the SSID name which can have up to 32 alphanumeric characters. If you have already created and configured the WLAN, use the wlan wlan-name command.
	2.	Set the MAC filtering parameters. Example: `Device(config-wlan)# mac-filtering test-auth-list`
	3.	Disable security AKM for 802.1X. Example: `Device(config-wlan)# no security wpa akm dot1x`
	4.	Enable WPA3 support. Example: `Device(config-wlan)# security wpa wpa3`
	5.	Enable AKM SAE support. Example: `Device(config-wlan)# security wpa akm sae`
	6.	Enable authentication list for 802.1X security. Example: `Device(config-wlan)# security web-auth authentication-list authenticate-list-name`
	7.	Enable authorization list for 802.1X security. Example: `Device(config-wlan)# security web-auth authorization-list authorize-list-name`
	8.	Enable web authentication on MAC filter failure. Example: `Device(config-wlan)# security web-auth on-macfilter-failure`
	9.	Configure the parameter map. Example: `Device(config-wlan)# security web-auth parameter-map parameter-map-name` If a parameter map is not associated with a WLAN, the configuration is considered from the global parameter map.

The WLAN is configured to use MAC authentication. If MAC authentication fails, users are redirected to web authentication, with WPA3 and SAE enabled.

Configure WLAN for web authentication on MAC authentication failure with Dot1x (CLI)

Enable web authentication fallback for clients that fail MAC filtering on a WLAN configured with 802.1x authentication.

This configuration allows clients to authenticate via a web portal when they cannot pass MAC filtering, providing a secondary authentication path while maintaining 802.1x as the primary security mechanism.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create or enter WLAN configuration submode. Example: `Device(config)# wlan profile-name wlan-id ssid-name` Example: `Device(config)# wlan wlan-test 3 ssid-test` profile-name: Profile name of the configured WLAN. WLAN-id: Wireless LAN identifier. Range is from 1 to 512. SSID_Name: SSID that can contain 32 alphanumeric characters. Note If you have already configured a WLAN, enter the profile name of the configured WLAN in the command (WLAN profile-name) and continue with the rest of the configuration steps.
	3.	Configure MAC filtering parameters. Example: `Device(config-wlan)# mac-filtering auth-list-name` Example: `Device(config-wlan)# mac-filtering test-auth-list`
	4.	Configure 802.1x authentication. Example: `Device(config-wlan)# security dot1x authentication-list dot1x-authentication-list`
	5.	Enable the web authentication list. Example: `Device(config-wlan)# security web-auth authentication-list authenticate-list-name` Example: `Device(config-wlan)# security web-auth authentication-list default`
	6.	Enable web authentication on MAC filter failure. Example: `Device(config-wlan)# security web-auth on-macfilter-failure`
	7.	Configure the web authentication parameter map. Example: `Device(config-wlan)# security web-auth parameter-map parameter-map-name` Example: `Device(config-wlan)# security web-auth parameter-map WLAN1_MAP` Note If a parameter map is not associated with a WLAN, the configuration is considered from the global parameter map.
	8.	Enable the WLAN. Example: `Device(config-wlan)# no shutdown`

The WLAN is configured to use 802.1x as the primary authentication method, with web authentication as a fallback for clients that fail MAC filtering.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Configure guest access using different security methods

Open authentication

Configure a WLAN profile for guest access with open authentication (GUI)

Procedure

Configure a WLAN profile for guest access with open authentication (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure a policy profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Local web authentication

Configure a parameter map (GUI)

Procedure

Configure a parameter map (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure a WLAN profile for guest access with local web authentication (GUI)

Procedure

Configure a WLAN profile for guest access with local web AUTHENTICATION (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Configure an AAA server for local web authentication (GUI)

Procedure

Configure an AAA server for local web authentication (CLI)

Procedure

Example:

Example:

Example:

Configure global settings (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Central web authentication

Configure WLAN profile for guest access with central web authentication (GUI)

Before you begin

Procedure

Configure a WLAN profile for guest access with central web authentication (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure AAA server (GUI)

Procedure

Configure AAA server (CLI)