Enterprise networks that support both wired and wireless access need to provide guest services that are consistent across the two access media, from a perspective of both client experience and manageability. For wireless networks, guest traffic from a mobility anchor device is directed typically through a Control And Provisioning of Wireless Access Points (CAPWAP) tunnel to an array of controllers in the demilitarized zone (DMZ), where either web-authenticated access or open access is provided. Wired guest traffic can also be backhauled to the DMZ using more traditional tunneling mechanisms like Generic Routing Encapsulation (GRE). The Converged Access platforms, with converged wired and wireless access, can extend CAPWAP tunneling to wired guests also, allowing for very similar handling at the controller platform (in the DMZ) and reducing the provisioning overhead.

However, security remains an issue because it is not possible to determine, prior to authentication, whether a wired client is a guest or requires access to the corporate network. Consequently, the decision to tunnel a wired client’s traffic to the DMZ cannot be made with the certain knowledge that the client is a guest.

Due to the lack of network selection for wired clients, open mode cannot be supported with guest tunneling. Open mode is when an IP address is allocated as soon as a client connects to the access switch. Once the client is connected via a tunnel, it must be reassigned an IP address from a subnet provisioned at the DMZ, before web authentication can be attempted.

Figure 1. Converged Guest Access Solution

In the preceding figure, the Converged Access device forms the attachment point for both wired and wireless sessions and provides Layer 2 authentication, where applicable. Wired session guests on a mobility agent (a foreign device) are directed through a Control And Provisioning of Wireless Access Points (CAPWAP) tunnel to the wireless controller (the anchor device) in the demilitarized zone (DMZ). The wired session guests are provided open or web-authenticated access from the wireless controller. This approach simplifies the management of guest access because only one network device is provisioned to manage HTTP traffic and serve web pages.

Tunneling wired guest traffic to the DMZ allows the same controller platform to provide web-authenticated and open access to wired guests also, further simplifying the management of guest access and ensuring a consistent experience for end users. To activate the CAPWAP tunnel, matching guest LAN profiles must be configured on foreign and anchor devices.

Authentication, authorization, and accounting (AAA) services are required at the access layer for Layer 2 authentication and, optionally, to direct the device to open a tunnel for a wired client. A DMZ uses AAA for client guest authentication. The Mobility Controller/Mobility Tunnel Endpoint (MC/MTE) allows the CAPWAP tunnel to the DMZ to be load-balanced across an array of wireless controllers.

In an enterprise Edge (eEdge) implementation of wired guest access, Control And Provisioning of Wireless Access Points (CAPWAP) tunneling is implemented as an Enterprise Policy Manager (EPM) plug-in.

When a tunnel is specified within a user profile or a service template, the EPM invokes the CAPWAP tunnel. The EPM requests that the Wireless Controller Module (WCM) establish a CAPWAP tunnel for the session on which the EPM is installed. If the WCM returns an error or indicates unsolicited tunnel termination at any subsequent point, the CAPWAP tunnel notifies the EPM of failure. The failure results in an authorization-failure event at the session manager, and a control policy rule can be specified to determine the failure handling.

The Session Manager is responsible for creating and managing wired sessions in the eEdge framework. It assigns an audit-session-id at session creation and stores client identity data in a session entry in the database. It also manages the authentication of connecting endpoints where authentication is specified under a control policy.

Based on requests, the WCM is responsible for the CAPWAP tunneling of wired clients at an Converged Access switch. The WCM also provides identical handling of tunneled wireless and wired guest sessions at the controller.

Note	A new tunnel is established only if it does not exist between the access switch and the relevant controller. If a tunnel exists, a client is added to it.

Note	The Vendor-specific attribute (VSA) for activating CAPWAP tunneling using user profiles is “subscriber:capwap-tunnel-profile-name= name”.

1.    enable


2.    configure terminal


3.    guest-lan profile-name [lan-id]


4.    shutdown


5.    client {association limit [max-connections] | vlan [vlan-id]}


6.    security web-auth [parameter-map parameter-name]


7.    mobility anchor [ip-address | mac-address]


8.    no shutdown


9.    end

Device> enable

Device# configure terminal

Device(config)# guest-lan guest-lan-name 1

Device(config-guest-lan)# shutdown

Device(config-guest-lan)# client vlan VLAN100

Device(config-guest-lan)# security web-auth

Device(config-guest-lan)# mobility anchor

Device(config-guest-lan)# no shutdown

Device(config-guest-lan)# end

1.    enable


2.    configure terminal


3.    service-template template-name


4.    tunnel type capwap name tunnel-name


5.    exit


6.    policy-map type control subscriber control-policy-name


7.    event session-started [match-all | match-any]


8.    priority-number class {control-class-name | always} [do-all | do-until-failure | do-until-success]


9.    action-number authenticate using {dot1x | mab | webauth}


10.    exit


11.    exit


12.    event authentication-failure [match-all | match-any]


13.    priority-number class {control-class-name | always} [do-all | do-until-failure | do-until-success]


14.    action-number activate {policy type control subscriber control-policy-name | service-template template-name [aaa-list list-name] [precedence [replace-all]]}


15.    end

Device> enable

Device# configure terminal

Device(config)# service-template GUEST-TUNNEL

Device(config-service-template)# tunnel type capwap name TUNNEL-CAPWAP

Device(config-service-template)# exit

Device(config)# policy-map type control subscriber TUNNELLED-GUEST

Device(config-event-control-policymap)# event session-started

Device(config-class-control-policymap)# 1 class always 

Device(config-action-control-policymap)# 1 authenticate using dot1x

Device(config-action-control-policymap)# exit

Device(config-class-control-policymap)# exit

Device(config-event-control-policymap)# event authentication-failure

Device(config-class-control-policymap)# 1 class DOT1X-NO-RESP

Device(config-action-control-policymap)# 1 activate service-template GUEST-TUNNEL

Device(config-action-control-policymap)# end

1.    enable


2.    configure terminal


3.    vlan vlan-id


4.    exit


5.    access-session tunnel vlan vlan-id


6.    end

Device> enable

Device# configure terminal

Device(config)# vlan 1755

Device(config-vlan)# exit

Device(config)# access-session tunnel vlan 1755

Device(config)# end