enable

Device> enable

configure terminal

Device# configure terminal

To configure LDAP server, do the following:

1. ldap server server-name

   Example:

    
   Device(config)#ldap server WEBAUTHSERVER

   Defines a LDAP server and enters LDAP server configuration mode.

2. ipv4 ipv4-address

   Example:

   Device(config-ldap-server)# ipv4 192.168.1.192

   Specifies the LDAP server IP address using IPv4.

3. bind authenticate root-dn password [0 string | 7 string] string

   Example:

   Device(config-ldap-server)#bind authenticate root-dn admin password 6 Cisco12345

   Use 0 line option to configure an unencrypted shared secret. Use 7 line option to configure an encrypted shared secret.

   Specifies a shared secret text string used between the controller and LDAP server.

4. base-dn string

   Example:

   Device(config-ldap-server)#base-dn CN=Users,DC=lab,DC=com

   Specifies the base Distinguished Name (DN) of the search.

To configure RADIUS server, do the following:

1. radius server server-name

   Example:

   
   Device(config)#radius server WEBAUTHSERVER
   

   Configures a RADIUS server.

2. address ipv4 address auth-port auth_port_number acct-port acct_port_number

   Example:

   
   Device(config-radius-server)address ipv4 10.48.71.92 auth-port 1812 acct-port 1813
   

   Specifies the RADIUS server IP address using IPv4.

3. key key

   Example:

   
   Device(config-radius-server)#key cisco
   

To configure TACACS+ server, do the following:

1. tacacs server server-name

   Example:

   
   Device(config)#tacacs server WEBAUTHSERVER
   

2. address ipv4 address

   Example:

   
   Device(config-server-tacacs)address ipv4 9.2.62.56
   

   The list-name is a character string used to name the list you are creating. The list-name should not exceed 255 characters.

   Specifies the TACACS+ server IP address using IPv4.

3. key key

   Example:

   
   Device(config-server-tacacs)#key cisco
   

exit

Device(config-ldap-server)#exit
OR
Device(config-radius-server)#exit
OR
Device(config-server-tacacs+)#exit

aaa group server {ldap | radius | tacacs+} server-group

Device(config-ldap-sg)#aaa group server ldap LDAPGROUP
OR
Device(config-sg-radius)#aaa group server radius RADGROUP
OR
Device(config-sg-tacacs+)#aaa group server tacacs+ TACGROUP

server name server-name

Device(config-ldap-sg)#server name WEBAUTHSERVER
OR
Device(config-sg-radius)#server name WEBAUTHSERVER
OR
Device(config-sg-tacacs+)#server name WEBAUTHSERVER

end

Device(config-ldap-sg)#end
OR
Device(config-sg-radius)#end
OR
Device(config-sg-tacacs+)#end

enable

Device> enable

configure terminal

Device# configure terminal

aaa new-model

Device(config)# aaa new-model

aaa authentication login {default | list-name} local group AAA-server-group

Device(config)#aaa authentication login WIRELESS_LWA_AUTHENTICATION local

aaa authorization network {default | list-name} local group AAA_server_group

Device(config)#aaa authorization network WIRELESS_LWA_AUTHORIZATION local

user-name user name

Device(config)#username guest

password {encryption-type | password}

Device(config-user-name)#password cisco123

end

Device(config-user-name)# end

enable

Device> enable

configure terminal

Device# configure terminal

ip access-list extended access-list-name

Device(config)#ip access-list extended EWA_ACL

{permit | deny} protocol {source [source-wildcard] | host source | any} {destination [destination-wildcard] | host destination | any}

Device(config-ext-nacl)# permit ip any host 193.43.158.111

end

Device(config-wlan)#end

enable

Device> enable

configure terminal

Device#configure terminal

Configure the global parameter map as follows:

1. parameter-map type webauth global

   Example:

   
   Device(config)#parameter-map type webauth global
   
   

   The parameter-map-name must not exceed 99 characters.

   Creates the global parameter map.

2. virtual-ip {ipv4 | ipv6} virtual-ip-address virtual-host virtual-host-name

   Example:

   
   Device(config-params-parameter-map)#virtual-ip ipv4 192.0.2.1 virtual-host wlc.dnasapaces.com
   
   

   Note that you can configure virtual IP address only using the global parameter map. It is mandatory to configure a virtual ip address while configuring external web authentication. Otherwise, the clients will be redirected to the internal web authentication login page of the controller.

   The Virtual IP address for the WLC must be configured as a non-routable IP address. You must ensure it does not overlap with the network infrastructure. The address can be configured to use an IP address from the internal allocated networks. Defined on RFC1918.

   Specifies the virtual IP address of the external web server to which the guest users are redirected.

3. webauth-http-enable

   Example:

   
   Device(config-params-parameter-map)#webauth-http-enable
   
   

   Enables HTTP server for web authentication.

4. intercept-https-enable

   Example:

   
   Device(config-params-parameter-map)#intercept-https-enable
   
   

   Note	This command is applicable only if you have configured virtual-ip and(or) ip http secure-server commands.

   Enables the clients to redirect to the webauthentication login page when trying to manually access an HTTPS website.

5. trustpoint trustpoint-name

   Example:

   Device(config-params-parameter-map)#trustpoint trustpoint-name 

   Configures the trustpoint for HTTPS login page. The trustpoint corresponds to the device certificate the WLC will use in conjunction with the virtual IP and hostname.

(Optional) sleeping-client timeout timeout-in-minutes

Device(config-params-parameter-map)#sleeping-client timeout  

Configure the named parameter map as follows:

1. parameter-map type webauth {parameter-map-name | global }

   Example:

   
   Device(config)#parameter-map type webauth ewa_parameter_map
   
   

   Creates a parameter map and enters parameter-map webauth configuration mode.

2. type {authbypass | consent | webauth | webconsent}

   Example:

   
   Device(config-params-parameter-map)#type webauth
   
   

   Note	Note that authbypass is not supported on wireless web authentication.

   Configures the type of web authentication, such as authentication bypass, consent, webauth, or webconsent.

3. redirect {{for-login | on-failure | on-success} url | portal {ipv4 ipv4-address | ipv6 ipv6-address}}

   Example:

   
   Device(config-params-parameter-map)#redirect for-login https://cisco.wifi-mx.com/p2/polarisred
   Device(config-params-parameter-map)#redirect portal ipv6 9:1:1::100
   

   portal {ipv4 ipv4-address | ipv6 ipv6-address}} : Specify the IP address of the web server in the ipv4-address or ipv6-address variables, when using external web server for redirection.

   Note	If you are trying to access IPv6 URL and you have an IPv4 web server, the controller redirects the client to an internal page as domain redirection is not supported. It is recommended to have a dual-stack web server and configure virtual IPv6 address in the global parameter map.

   Configures the redirect URL for the login, failure, and success pages. If the login page has any resource that needs to be fetched from the server, you will need to include those resource URLs in URL filtering.

4. (Optional) timeout init-state sec seconds

   Example:

   Device(config-params-parameter-map)#timeout init-state sec 60

   Sets the timeout period for a user to complete the authentication.

5. (Optional) redirect append { ap-mac | client-mac | wlan-ssid} tag tag-name

   Example:

   Device(config-params-parameter-map)#redirect append ap-mac tag ap_mac
    Device(config-params-parameter-map)#redirect append wlan-ssid tag wlan
    Device(config-params-parameter-map)#redirect append client-mac tag client_mac

   Note	If you are migrating from AireOS, you must run these commands explicitly.

   Appends the client MAC address, access point MAC address and the WLAN SSID to the redirect URL. External web server uses this domain specific information to provide location-based portal.

enable

Device>enable

configure terminal

Device#configure terminal

wlan profile-name wlan-id ssid-name

Device(config)#wlan WLAN_EWA_LOCAL 34 WLAN_EWA_LOCAL

Depending on your configuration, enter one of the following commands:

• ip access-group web access-list-name
• ipv6 traffic-filter webaccess-list-name

Device(config-wlan)# ip access-group EWA_ACL

Device(config-wlan)# ipv6 traffic-filter web EWA_ACL

(Optional) no security wpa

Device(config-wlan)#no security wpa

Configure layer 2 security, as required. You can configure open authentication or a combination of any of the following supported security methods.

security web-auth

Device(config-wlan)#security web-auth

security web-auth {authentication-list authentication-list-name}

Device(config-wlan)#security web-auth authentication-list WIRELESS_EWA_AUTHENTICATION

security web-auth {authorization-list authorization-list-name}

Device(config-wlan)#security web-auth authorization-list WIRELESS_EWA_AUTHORIZATION

security web-auth parameter-map parameter-map-name

Device(config-wlan)#security web-auth parameter-map EWA_PARAMETER_MAP

no shutdown

Device(config-wlan)# no shutdown 

end

Device(config-wlan)#end

configure terminal

Device# configure terminal

urlfilter list url-filterlist-name

Device(config)# urlfilter list urllist_local_preauth

action permit

Device(config-urlfilter-params)#action permit

url url

Device(config-urlfilter-params)#url url1.dns.com

enable

Device> enable

configure terminal

Device# configure terminal

wireless profile policy profile-name

Device(config)#wireless profile policy EWA_POLICY_PROFILE

urlfilter list pre-auth-filter name

Device(config-wireless-policy)#urlfilter list pre-auth-filter urllist_local_preauth

vlan vlan-name

Device(config-wireless-policy)#vlan 100

no shutdown

Device(config-wireless-policy)# no shutdown

end

Device(config)# end

configure terminal

Device#configure terminal

wireless tag policy policy-tag-name

Device(config)#wireless tag policy lwa_policy_tag

wlan wlan-name policy profile-policy-name

Device(config-policy-tag)#wlan wlan_lwa_local policy wlan_lwa_local

end

Device(config-policy-tag)# end

configure terminal

Device#configure terminal

wireless tag site site-tag

Device(config)#wireless tag site site_lwa

description description

Device(config-site-tag)# description default site tag

end

Device(config-site-tag)# end

configure terminal

Device#configure terminal

ap mac-address

Device (config)#ap 28ac.9eb7.7220

policy-tag policy-tag-name

Device (config-ap-tag)#policy-tag lwa_policy_tag

site-tag site-tag-name

Device (config-ap-tag)#site-tag site_lwa

end

Device (config-ap-tag)#end

configure terminal

Device#configure terminal

ip http server

Device(config)#ip http server

ip http secure-server

Device(config)#ip http secure-server

end

Device(config)# end

Choose Configuration > Security > AAA and click Servers/Groups.

To create a new RADIUS server, go to the Servers tab, click RADIUS and click + Add.

1. In the Name field, enter the name of the RADIUS server.

2. In the Server Address field, enter the IPv4 or IPv6 address, or hostname.

3. To enable the Protected Access Credential (PAC) authentication key, check the PAC Key check box.

4. From the Key Type drop-down list, choose the authentication key type.

   The key types are Clear Text, Encrypted, and Hidden.

5. In the Key and Confirm Key fields, enter the authentication key.

6. In the Auth Port field, enter the authorization port number.

7. the Acct Port field, enter the accounting port number.

8. In the Server Timeout field, enter the timeout duration, in seconds.

9. In the Retry Count field, enter the number of retries.

10. Use the Support for CoA toggle button to enable or disable change of authorization (CoA).

11. Click Apply to Device.

To create a new TACACS+ server, go to the Servers tab, click TACACS+ and click + Add.

1. In the Name field, enter the name of the TACACS+ server.

2. In the Server Address field, enter the IPv4 or IPv6 address, or hostname.

3. In the Key and Confirm Key fields, enter the authentication key.

4. In the Port field, enter the port number.

5. In the Server Timeout field, enter the timeout duration, in seconds.

6. Click Apply to Device.

To create a new LDAP server, go to the Servers tab, click LDAP and click + Add.

1. In the Server Name field, enter the LDAP server name.

2. In the Server Address field, enter the IPv4 or IPv6 address, or hostname.

3. In the Port Number field, enter the port number to use.

4. From the Simple Bind drop-down list, choose the authentication key type.

5. In the User Base DN field, enter the details.

6. From the User Attribute drop-down list, choose the user attribute.

7. In the User Object Type field, enter the object type details and click the + icon.

   The objects that have been added are listed in the area below. Use the x mark adjacent to each object to remove it.

8. In the Server Timeout field, enter the timeout duration, in seconds.

9. Check the Secure Mode check box to enable secure mode.

   Checking this enables the Trustpoint Name drop-down list.

10. From the Trustpoint Name drop-down list, choose the trustpoint.

11. Click Apply to Device.

Choose Configuration > Security > AAA > Server Groups.

To create a new RADIUS server, go to the Server Groups tab, click RADIUS and click + Add.

1. In the Name field, enter the name of the RADIUS server group.

2. From the MAC-Delimiter drop-down list, choose the delimiter to be used in the MAC addresses that are sent to the RADIUS servers.

3. From the MAC Filtering drop-down list, choose a value based on which to filter MAC addresses.

4. To configure the dead time for the server group and direct AAA traffic to alternative groups of servers that have different operational characteristics, in the Dead-Time field, enter the amount of time, in minutes, after which a server is assumed to be dead.

5. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

6. Click Apply to Device.

To create a new TACACS+ server, go to the Server Groups tab, click TACACS+ and click + Add.

1. In the Name field, enter the name of the TACACS+ server group.

2. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

3. Click Apply to Device.

To create a new LDAP server, go to the Server Groups tab, click LDAP and click + Add.

1. In the Name field, enter the name of the LDAP server group.

2. Choose the servers that you want to include in the server group from the Available Servers list and move them to the Assigned Servers list.

3. Click Apply to Device.

Configure authentication method list as follows. Authentication is the process by which a system or network verifies the identity of a user who wishes to access it.

1. Choose Configuration > Security > AAA.

2. Go to AAA Method List tab, click Authentication on the left side and then click + Add.

3. In the Quick Setup: AAA Authentication window that is displayed, enter a name for your method list in the Method List Name field.

   The name can contain alphanumeric characters including underscores and hyphens. Do not include space.

4. From the Type drop-down list, choose login to enable web authentication.

5. From the Group Type drop-down list, choose local to enable local authentication.

   The options are group and local. You have to choose group to enable authentication on an AAA server. To enable authentication locally on the controller, choose local.

6. If you want to configure a local server as a fallback method when the servers in the groups are unavailable, check the Fallback to local checkbox.

   The Fallback to local checkbox is enabled only if you select the group type as group.

7. From the Available Server Groups box, select the server groups that you have created in Step 1.

8. Click Apply to Device.

To provide access to system or network resources based on their identity, configure authorization method list as follows:

1. Choose Configuration > Security > AAA.

2. Go to AAA Method List tab, click Authorization on the left side and then click + Add.

3. In the Quick Setup: AAA Authorization window that is displayed, enter a name for your method list in the Method List Name field.

   The name can contain alphanumeric characters including underscores and hyphens. Do not include space.

4. From the Type drop-down list, choose login to enable web authentication.

5. From the Group Type drop-down list, choose login to enable local authentication.

   The options are group and local. You have to choose group to enable authentication on an AAA server. To enable authentication locally on the controller, choose local.

6. If you want to configure a local server as a fallback method when the servers in the groups are unavailable, check the Fallback to local checkbox.

   The Fallback to local checkbox is enabled only if you select the group type as group.

7. From the Available Server Groups box, select the server groups that you have created in Step 1.

8. Click Apply to Device.

Choose Configuration > Security > ACL.

In the ACL Name field, enter a name for the ACL that you are configuring.

In the ACL Type drop-down list, choose IPV4 Extended.

In the Sequence field, enter a sequence value to specify the sequence number for the access list statement.

In the Action drop-down list, choose Premit or Deny, as applicable.

In the Source Type drop-down list, choose the required source type. The options available are any, Host and Network.

In the Destination Type drop-down list, choose the required destination type. The options available are any, Host and Network.

In the Protocol drop-down list, choose a protocol.

Click Add.

Add all the rules, as applicable and click Apply to Device.

Choose Administration > User Administration.

To create a new guest user account, click + Add.

In the Create User Administration window that is displayed, configure the following mandatory fields, as required.

1. User Name: Enter a unique user name.

   It can contain alphanumeric characters including underscores and hyphens. Space is not allowed.

2. Choose the privilege level for the guest user from the Privilege drop-down list.

   The options are Admin, Read Only, No Access and Lobby Admin.

   Click Go to Advanced Mode to view the privilege level number assgined to a particular user.

3. Type the password in the Password and Confirm Password fields.

   The password must contain a mininum of 6 characters and a maximum of 127 characters.

Click Apply to Device.

Configure the Global parameter map as follows:

1. On the Web Auth page, in the list of parameter maps displayed, click global.

2. To set the redirect address for web authentication login page, enter the virtual IP address in the Virtual IPv4 Address. If the client uses an IPv6 address, enter the IPv6 address in the Virtual IPv6 Address field.

   It is recommended that you configure a nonroutable IP address for the virtual interface, ideally not overlapping with the network infrastructure addresses.

3. To specify the hostname for the Virtual IP address used for web authentication, enter the hostname in the Virtual IPv4 Hostname field.

   Configures hostname for the virtual IP address for web authetication.

   Note	For web authentication, ensure you configure a hostname that is different from the hostname configured for the management IP address of the WLC, if configured already.

4. To use third party certificates for secure communication, in the Trustpoint drop-down list, choose the trustpoint label that you have generated for web authentication.

   Maps the third party certificate that you have imported in to the controller to the parameter map. A trustpoint contains the device identity certificate along with the corresponding CA certificate. For information about configuring a trustpoint for web authentication, see "Trustpoint Configuration on 9800" section in Configuring Trustpoints on Cisco Catalyst 9800 Series Wireless Controllers.

5. To enable secure authentication for the login page, check Web Auth intercept HTTPs checkbox.

   Intercepts HTTPS requests and passes credentials over an encrypted link.

6. To configure settings for failed login attempts, check Watch List Enable checkbox and enter the watch list timeout period in the Watch List Expiry Timeout field.

   If watch list is enabled, the host is added to the watch list if a user fails to authenticate after the maximum number of login attempts. After the host's IP address is on the watch list, the controller does not intercept HTTP packets from that host or perform WebAuth processing until the expiry timer has expired.

7. Click Update & Apply.

Create a named parameter map as follows:

1. Choose Configuration > Security > Web Auth.

2. On the Web Auth page, click Add.

3. In the Create Web Auth Parameter window that is displayed, enter a name for the parameter map in the Parameter-map name field.

4. In the Maximum HTTP connections field, enter the maximum number of HTTP connections that you want to allow. The range of value is 1-200.

5. In the Init-State Timeout field, enter the time after which the init state timer should expire due to the user’s failure to enter valid credentials on the login page. The range is 60-3932100.

6. In the Type drop-down list, choose the type of Web Authentication page that is displayed during the login process.

   The following are the options available:

   • Webauth: The controller presents a policy page with the user name and password. You need to enter the correct credentials to access the network.

   • Consent: The controller redirects you to a usage policy page with Accept button. You need to click accept the policy to access the network.

   • Webconsent: The controller redirects you to a usage policy page with Accept or Deny buttons along with user name or password. You need to enter the correct credentials and accept the usage policy to access the network.

   • Authbypass: This is not supported.

7. Click Apply to Device.

   The newly created named parameter map appears in the list of parameter maps in the Web Auth page.

Edit a named parameter map as follows:

1. On the Web Auth page, click the name of the parameter map that you created in step 2.

2. In the Edit Web Auth Parameter window that is displayed, choose the required Banner Type.

   The banner types available are:

   • None

   • Banner Text: Click the radio button and enter the required banner text to be displayed in the Banner Text field.

   • File Name: Click the radio button and in the File Name field, specify the path of the file from which the banner text has to be fetched.

3. To set the maximum number of HTTP connections allowed, enter the number in Maximum HTTP connections field.

4. To enable authentication of sleeping clients and then specify the sleeping client timeout, check the Sleeping Client Status checkbox and enter the timeout period in the Sleeping Client Timeuot field.

   Allows successfully authenticated host devices to stay logged in for a configured period without re-authentication.

   The valid range is between 10 minutes and 43200 minutes.

5. Click Update & Apply.

   A pop-up with Configuration Successfully Applied message appears.

Configure an external server for authentication as follows:

1. On the Web Auth page, click the name of the parameter map that you created in step 2.

2. In the Edit Web Auth Parameter window that is displayed, go to the Advanced tab.

3. Under Redirect to external server, enter the URL of the external server that will host the authentication pages for the login, succesful login and login failure pages.

   • Redirect for log-in

   • Redirect On-Success

   • Redirect On-Failure

4. In the Portal IPV4 Address field, enter the IPv4 address of the external server to send redirects.

5. If the external server uses an IPv6 address, in the Portal IPV6 Address field, enter the IPv6 address of the portal to send redirects.

6. Click Update & Apply.

   A pop-up with Configuration Successfully Applied message appears.

Configure custom authentication pages on the controller as follows:

1. On the Web Auth page, click the name of the parameter map that you created in step 2.

2. In the Edit Web Auth Parameter window that is displayed, go to the Advanced tab.

3. Under Customized page, configure the following custom pages, as required. Ensure you have copied all the customized HTML pages to the to the disk or flash of the controller.

   • Login Failed Page

   • Login Page

   • Logout Page

   • Login Successful Page

4. Choose the HTML pages that you have copied to the flash drive of the controller for each of the options.

5. Click Update & Apply.

   A pop-up with Configuration Successfully Applied message appears.

Choose Configuration > Tags and Profiles > WLANs.

Click Add to add a new WLAN Profile.

Enter a profile name in the Profile Name field.

In the SSID field, enter the SSID name.

In the WLAN ID field, enter a valid ID between 1 and 4096.

Click the Status toggle button to enable the WLAN.

If the Broadcast SSID is disabled, click the toggle button to enable the SSID for broadcast, so that it is visible to all wireless clients within the range.

Go to the Security tab and then under Layer2 tab, in the Layer 2 Security Mode list, choose None.

Under Layer3, check the Web Policy checkbox.

In the Web Auth Parameter drop-down list, choose the parameter map that you have created earlier.

In the Authentication List drop-down list, choose the authentication list that you have created earlier.

Click Show Advanced Settings, under Preauthentication ACL, choose the preauthentication ACL that you have created for guest users, if any.

Click Apply to Device.

Choose Configuration > Security > URL Filters.

Click the Add button.

In the List Name box, type a name for the URL Filter list that you are creating.

From the Type drop-down list, choose either PRE-AUTH or POST-AUTH.

1. POST-AUTH: Specify the Redirect Servers for IPv4 and IPv6.

In the Action field, use the slider to Permit or Deny the URLs.

Specify the URLs in the URLs box. Enter every URL on a new line.

Click Apply to Device.

Choose Configuration > Tags & Profiles > Policy.

On the Policy Profile page, click Add.

In the Add Policy Profile window, in General tab, enter a name and description for the policy profile.

To enable the policy profile, set Status as Enabled.

Go to the Access Policies tab and

1. In the VLAN section, choose the VLAN that you have created for assigning the wireless guest clients in the VLAN/VLAN Group drop-down list.

2. In the WLAN ACL section, choose the URL filters from the IPv4 ACL and IPv6 ACL drop-down lists.

3. In the URL Filters section, choose the URL filters from the Pre Auth and Post Auth drop-down lists.

Click Apply to Device.

Configure a Policy Tag as follows:

Choose Configuration > Tags & Profiles > Tags.

On the Policy tab, click + Add.

On the Add Policy Tag dialog box, enter a name for the policy tag in the Name field.

Expand WLAN-POLICY Maps, click + Add.

In the WLAN Profile drop-down list, choose the WLAN profile that you have configured for web authentication clients.

In the Policy Profile drop-down list, choose the policy profile that you have configured for web authentication WLAN.

Click the button with a tick mark to save the settings.

Click Apply to Device.

Choose Configuration > Wireless > Access Points.

To edit the configuration details of an AP, click the row for that AP.

In the General tab and Tags section, in the Policy drop-down list, choose the policy tag that you created.

If you have configured a site tag and an RF tag, in the Site and RF drop-down lists, choose the tags that you have created.

Click Update & Apply to Device.

To apply the tags to multiple APs, in the Advanced tab, select the access points by checking the checkboxes for the APs and click + Tag APs.

In the Tag APs dialog box, choose the policy tag, site tag and RF tag that you want to assign to the access points and click Apply to Device.