Configure Verify and Troubleshoot Web Auth on Mac Filter Failure

Available Languages

Download Options

  • PDF     (3.2 MB)
    View with Adobe Reader on a variety of devices
Updated:July 25, 2024
Document ID:222209

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes to Configure, Troubleshoot and Verify Local Web Auth on “Mac Filter Failure” feature using ISE for external authentication.

    Prerequisites

    Configure ISE for MAC Authentication

    Valid user credentials configured on ISE/Active Directory

    Requirements

    Cisco recommends that you have knowledge of these topics:

    Basic understanding to navigate through controller Web UI

    Policy, WLAN profile and Policy Tags configuration

    Service policy configuration on ISE

    Components Used

    9800 WLC version 17.12.2

    C9120 AXI AP

    9300 switch

    ISE version version 3.1.0.518

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Background Information

    The Web Auth "On Mac Failure Filter" feature serves as a fallback mechanism in WLAN environments that use both MAC Authentication and Web Authentication.

    • Fallback Mechanism: When a client attempts to connect to a WLAN with MAC Filter against an external RADIUS server (ISE) or local server and fails to authenticate, this feature automatically initiates a Layer 3 Web Authentication.
    • Successful Authentication: If a client successfully authenticates through the MAC Filter, Web Authentication is bypassed, allowing the client to connect directly to the WLAN.
    • Avoiding Disassociations: This feature helps prevent disassociations that can otherwise occur due to MAC filter authentication failures.

    Web Auth FlowWeb Auth Flow

    Configure

    Network Diagram

    Network TopologyNetwork Topology

    Configurations

    Configure Web Parameters

    Navigate to Configuration > Security > Web Auth and select the Global parameter map

    Verify the Virtual IP and Trustpoint configuration from the Global Parameter Map. All custom Web Auth parameter profiles inherit the Virtual IP and Trustpoint configuration from the Global Parameter Map.

    Global Web Auth Parameter ProfileGlobal Web Auth Parameter Profile

    Step1: Select "Add" to create a custom web authentication parameter map. Enter Profile name and choose Type as "Webauth".

    Web Auth Parameter ProfileWeb Auth Parameter Profile

    If your clients are also getting an IPv6 address, you must also add a Virtual IPv6 address in the parameter map. Use an IP in the documentation range 2001:db8::/32

    If your clients obtained an IPv6 address, there is a good chance they try to get the HTTP web auth redirection in V6 and not V4, which is why you need the Virrtual IPv6 to be set also.

    CLI Configuration:

    parameter-map type webauth Web-Filter
 type webauth

    Configure Policy Profile

    Step1: Create a Policy Profile

    Navigate to Configuration > Tags & Profiles > Policy. Select "Add". In the General tab, specify a name for the profile and enable the status toggle.

    Policy ProfilePolicy Profile

    Step2:

    Under the Access Policies tab, choose the client VLAN from the VLAN section dropdown list.

    Access Policy tabAccess Policy tab

    CLI Configuration:

    wireless profile policy Web-Filter-Policy
 vlan VLAN2074
 no shutdown

    Configure WLAN Profile

    Step1: Navigate to Configuration > Tags and Profiles > WLANs. Select "Add" to create a new profile. Define a profile name and SSID name, and enable the status field.

    WLAN ProfileWLAN Profile

    Step2: Under the Security tab, enable the "Mac Filtering" checkbox and configure the RADIUS server in the Authorization List (ISE or local server). This setup utilizes ISE for both Mac Authentication and Web Authentication.

    WLAN Layer 2 securityWLAN Layer 2 security

    Step3: Navigate to Security > Layer3. Enable Web Policy and associate it with the Web Authentication Parameter Map profile. Check the "On Mac Filter Failure" checkbox and choose the RADIUS server from the Authentication list dropdown.

    WLAN Layer3 security tabWLAN Layer3 security tab

    CLI Configuration

    wlan Mac_Filtering_Wlan 9 Mac_Filtering_Wlan
 mac-filtering network
 radio policy dot11 24ghz
 radio policy dot11 5ghz
 no security ft adaptive
 no security wpa
 no security wpa wpa2
 no security wpa wpa2 ciphers aes
 no security wpa akm dot1x
 security web-auth
 security web-auth authentication-list ISE-List
 security web-auth on-macfilter-failure
 security web-auth parameter-map Web-Filter
 no shutdown

    Step4: Configure Policy Tags, Create WLAN Profile, and Policy Profile Mapping

    Navigate to Configuration > Tags & Profiles > Tags > Policy. Click "Add" to define a name for the Policy Tag. Under WLAN-Policy Maps, select "Add" to map the previously created WLAN and Policy profile.

    Policy TAG mapPolicy TAG map

    CLI Configuration:

    wireless tag policy default-policy-tag
 description "default policy-tag"
wlan Mac_Filtering_Wlan policy Web-Filter-Policy

    Step 5: Navigate to Configuration > Wireless > Access Point. Select the access point responsible for broadcasting this SSID. Within the Edit AP menu, assign the created Policy Tag. 

    Mapping policy TAG to APMapping policy TAG to AP

    Configure AAA Settings:

    Step1: Create a Radius Server:

    Navigate to Configuration > Security > AAA. Click the "Add" option under the Server/Group section. On the "Create AAA Radius Server" page, enter the server name, IP address, and Shared Secret.

    Server ConfigurationServer Configuration

    CLI Configuration

    radius server ISE-Auth
 address ipv4 10.197.224.122 auth-port 1812 acct-port 1813
 key *****
 server name ISE-Auth

    Step2: Create a Radius Server Group:

    Select the "Add" option under the Server Groups section to define a server group. Toggle the servers to be included within the same group configuration.

    It is not required to set the source interface. By default, the 9800 uses its routing table to figure out the interface to use to reach the RADIUS server and typically uses the default gateway.

    Server GroupServer Group

    CLI Configuration

    aaa group server radius ISE-Group
 server name ISE-Auth
 ip radius source-interface Vlan2074
 deadtime 5

    Step3: Configure AAA Method List:

    Navigate to the AAA Method List tab. Under Authentication, click Add. Define a method list name with Type as "login" and Group type as "Group". Map the configured authentication server group under the Assigned Server Group section.

    Authentication Method listAuthentication Method list

    CLI Configuration

    aaa authentication login ISE-List group ISE-Group

    Navigate to the Authorization Method List section and click "Add". Define a method list name and set the type to "network" with Group type as "Group". Toggle the configured RADIUS server to the Assigned Server Groups section.

    Authorization method listAuthorization method list

    CLI Configuration

    aaa authorization network network group ISE-Group

    ISE configuration:

    Add WLC as a network device on ISE

    Step1: Navigate to Administration > Network Devices and click Add. Enter the controller IP address, Hostname and shared secret under the Radius Authentication Settings

    Add Network deviceAdd Network device

    Shared SecretShared Secret

    Step2: Create User entry

    Under the Identity Management > Identities, select the Add option.

    Configure the username and password which the client must use to web authentication

    Add user credentialsAdd user credentials

    Step3: Navigate to Administration > Identity Management > Groups > Registered Devices and click Add.

    Enter device mac address to create an entry on the server.

    Add device mac addressAdd device mac address

    Step4: Create Service Policy

    Navigate to Policy > Policy sets and select “+” sign to create a new policy set

    This policy set is for user web authentication, where a username and password for the client is created in Identity Management

    Web Authentication Service policyWeb Authentication Service policy

    Similarly, create a MAB service policy and map internal endpoints under authentication policy.

    MAB Authentication service policyMAB Authentication service policy

    Verify

    Controller configuration

    show wireless tag policy detailed default-policy-tag
Policy Tag Name : default-policy-tag
Description     : default policy-tag
Number of WLAN-POLICY maps: 1
WLAN Profile Name                 Policy Name                            
------------------------------------------------------------------------
Mac_Filtering_Wlan                Web-Filter-Policy



    show wireless profile policy detailed Web-Filter-Policy

Policy Profile Name                 : Web-Filter-Policy
Description                         :
Status                              : ENABLED
VLAN                                : 2074
Multicast VLAN                      : 0

    show wlan name Mac_Filtering_Wlan

WLAN Profile Name     : Mac_Filtering_Wlan
================================================
Identifier                                     : 9
Description                                    :
Network Name (SSID)                            : Mac_Filtering_Wlan
Status                                         : Enabled
Broadcast SSID                                 : Enabled
Mac Filter Authorization list name             : network
Webauth On-mac-filter Failure              : Enabled
    Webauth Authentication List Name           : ISE-List
    Webauth Authorization List Name            : Disabled
    Webauth Parameter Map                      : Web-Filter

    show parameter-map type webauth name Web-Filter
Parameter Map Name               : Web-Filter
  Type                           : webauth
  Auth-proxy Init State time     : 120 sec
  Webauth max-http connection    : 100
  Webauth logout-window          : Enabled
  Webauth success-window         : Enabled
  Consent Email                  : Disabled
  Activation Mode                : Replace
  Sleeping-Client                : Disabled
  Webauth login-auth-bypass:

    show ip http server status

HTTP server status: Enabled
HTTP server port: 80
HTTP server active supplementary listener ports: 21111 
HTTP server authentication method: local
HTTP server auth-retry 0 time-window 0
HTTP server digest algorithm: md5
HTTP server access class: 0
HTTP server IPv4 access class: None
HTTP server IPv6 access class: None
HTTP server base path:
HTTP File Upload status: Disabled
HTTP server upload path:
HTTP server help root:
Maximum number of concurrent server connections allowed: 300
Maximum number of secondary server connections allowed: 50
Server idle time-out: 180 seconds
Server life time-out: 180 seconds
Server session idle time-out: 600 seconds
Maximum number of requests allowed on a connection: 25
Server linger time : 60 seconds
HTTP server active session modules: ALL
HTTP secure server capability: Present
HTTP secure server status: Enabled
HTTP secure server port: 443

    show ap name AP2-AIR-AP3802I-D-K9-2 tag detail

Policy tag mapping
------------------
WLAN Profile Name                Policy Name                      VLAN                             Flex Central Switching           IPv4 ACL                         IPv6 ACL
---------------------------------------------------------------------------------------------------------------------------------------------
Mac_Filtering_Wlan               Web-Filter-Policy                2074                             ENABLED                          Not Configured                   Not Configured

    Client policy state on controller

    Navigate to the Dashboard > Clients section to confirm the status of connected clients.
    Client is currently in Web Auth pending state

    Client detailClient detail

    show wireless client summary 
Number of Clients: 1
MAC Address    AP Name                                        Type ID   State             Protocol Method     Role
-------------------------------------------------------------------------------------------------------------------------
6c7e.67e3.6db9 AP2-AIR-AP3802I-D-K9-2                         WLAN 9    Webauth Pending   11ac     Web Auth   Local

    show wireless client mac-address 6c7e.67e3.6db9 detail
Client MAC Address : 6c7e.67e3.6db9
Client MAC Type : Universally Administered Address
Client DUID: NA
Client IPv4 Address : 10.76.6.150
Client IPv6 Addresses : fe80::10eb:ede2:23fe:75c3
Client Username : 6c7e67e36db9
AP MAC Address : 1880.902b.05e0
AP Name: AP2-AIR-AP3802I-D-K9-2
AP slot : 1
Client State : Associated
Policy Profile : Web-Filter-Policy
Flex Profile : N/A
Wireless LAN Id: 9
WLAN Profile Name: Mac_Filtering_Wlan
Wireless LAN Network Name (SSID): Mac_Filtering_Wlan
BSSID : 1880.902b.05eb

Client ACLs : None
Mac authentication : Failed
Policy Manager State: Webauth Pending
Last Policy Manager State : IP Learn Complete
Client Entry Create Time : 88 seconds
Policy Type : N/A
Encryption Cipher : None

Auth Method Status List
        Method : Web Auth
                Webauth State    : Get Redirect
                Webauth Method   : Webauth

    After successful Web-Authentication, client policy manager state transitions to RUN

    show wireless client mac-address 6c7e.67e3.6db9 detail

Client ACLs : None
Mac authentication : Failed
Policy Manager State: Run
Last Policy Manager State : Webauth Pending
Client Entry Create Time : 131 seconds
Policy Type : N/A

    Troubleshoot

    The functionality of the Web Auth on MAC Failure feature relies on the controller capability to trigger web authentication upon MAB failure. Our primary aim is to gather RA traces efficiently from the controller for troubleshooting and analysis.

    Collecting Radioactive trace

    Activate Radio Active Tracing to generate client debug traces for the specified MAC address in the CLI.

    Steps to enable Radioactive Tracing:

    Ensure all the conditional debugs are disabled

    clear platform condition all

    Enable debug for specified mac address

    debug wireless mac <H.H.H> monitor-time <Time is seconds>

    After reproducing the issue, disable debugging to halt the RA trace collection.

    no debug wireless mac <H.H.H>

    Once the RA trace is stopped, the debug file is generated in the controller bootflash.

    show bootflash: | include ra_trace
2728        179 Jul 17 2024 15:13:54.0000000000 +00:00 ra_trace_MAC_aaaabbbbcccc_HHMMSS.XXX_timezone_DayWeek_Month_Day_year.log

    Copy the file to an external server.

    copy bootflash:ra_trace_MAC_aaaabbbbcccc_HHMMSS.XXX_timezone_DayWeek_Month_Day_year.log tftp://<IP address>/ra-FILENAME.txt

    Display the debug log:

    more bootflash:ra_trace_MAC_aaaabbbbcccc_HHMMSS.XXX_timezone_DayWeek_Month_Day_year.log

    Enable RA trace in GUI,

    Step1: Navigate to Troubleshooting > Radioactive Trace. Select the option to add a new entry, then enter the client MAC address in the designated Add MAC/IP Address tab.

    Radioactive traceRadioactive trace

    Embedded Packet Captures:

    Navigate to Troubleshooting > Packet Capture. Enter the capture name and specify the client MAC address as the inner filter MAC. Set the buffer size to 100 and choose the uplink interface to monitor incoming and outgoing packets.

    Embedded packet captureEmbedded packet capture

    note-icon

    Note: Select the "Monitor Control Traffic" option to view traffic redirected to the system CPU and reinjected into the data plane.

    Select Start to capture packets

    Start captureStart capture

    CLI configuration

    monitor capture TestPCap inner mac <H.H.H>
monitor capture TestPCap buffer size 100
monitor capture TestPCap interface twoGigabitEthernet 0/0/0 both
monitor capture TestPCap start

    <Reporduce the issue>
    
monitor capture TestPCap stop
    show monitor capture TestPCap

    Status Information for Capture TestPCap
  Target Type:
 Interface: TwoGigabitEthernet0/0/0, Direction: BOTH
  Status : Inactive
  Filter Details:
  Capture all packets
      Inner Filter Details:
      Mac: 6c7e.67e3.6db9
  Continuous capture: disabled
  Buffer Details:
  Buffer Type: LINEAR (default)
  Buffer Size (in MB): 100
  Limit Details:
  Number of Packets to capture: 0 (no limit)
  Packet Capture duration: 3600
  Packet Size to capture: 0 (no limit)
  Maximum number of packets to capture per second: 1000
  Packet sampling rate: 0 (no sampling)

    Export packet capture to external TFTP server

    monitor capture TestPCap export tftp://<IP address>/ TestPCap.pcap

    Export packet captureExport packet capture

    Example scenario during successful MAC authentication, a client device connects to the network, its MAC address is validated by the RADIUS server through configured policies, and upon verification, access is granted by the network access device, allowing network connectivity.

    Once client associates, controller sends a Access-Request to ISE server, 

    User name is the mac address of the client as this is MAB authentication

    2024/07/16 21:12:52.711298748 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS: Send Access-Request to 10.197.224.122:1812 id 0/0, len 422
2024/07/16 21:12:52.711310730 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  authenticator 19 c6 63 56 33 a7 e6 b6 - f3 00 70 b0 2a 7f 75 3c
2024/07/16 21:12:52.711326401 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  User-Name           [1]     14  "6c7e67b72d29"
2024/07/16 21:12:52.711329615 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  User-Password       [2]     18  *
2024/07/16 21:12:52.711337331 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Service-Type        [6]      6  Call Check                [10]
2024/07/16 21:12:52.711340443 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Vendor, Cisco       [26]    31
2024/07/16 21:12:52.711344513 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:   Cisco AVpair       [1]     25  "service-type=Call Check"
2024/07/16 21:12:52.711349087 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Framed-MTU          [12]     6  1485                      
2024/07/16 21:12:52.711351935 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Message-Authenticator[80]    18  ...
2024/07/16 21:12:52.711377387 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  EAP-Key-Name        [102]    2  *
2024/07/16 21:12:52.711382613 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Vendor, Cisco       [26]    49
2024/07/16 21:12:52.711385989 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:   Cisco AVpair       [1]     43  "audit-session-id=9C064C0A0000227ABE923CE6

    ISE sends Access-Accept as we have a valid user entry 

    2024/07/16 21:12:52.779147404 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS: Received from id 1812/0 10.197.224.122:0, Access-Accept, len 115
2024/07/16 21:12:52.779156117 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  authenticator 5d dc 1c e6 d3 82 a3 75 - 07 a1 86 0a 37 e2 e7 65
2024/07/16 21:12:52.779161793 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  User-Name           [1]     19  "6C-7E-67-B7-2D-29"
2024/07/16 21:12:52.779165183 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Class               [25]    58  ...
2024/07/16 21:12:52.779219803 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Message-Authenticator[80]    18  ...

    2024/07/16 21:12:52.779417578 {wncd_x_R0-0}{1}: [mab] [17765]: (info): [6c7e.67b7.2d29:capwap_90000005] MAB received an Access-Accept for (6c7e.67b7.2d29)
2024/07/16 21:12:52.779436247 {wncd_x_R0-0}{1}: [mab] [17765]: (info): [6c7e.67b7.2d29:capwap_90000005] Received event 'MAB_RESULT' on (6c7e.67b7.2d29)

    Client policy state transistioned to Mac Auth completed

    2024/07/16 21:12:52.780181486 {wncd_x_R0-0}{1}: [client-auth] [17765]: (info): MAC: 6c7e.67b7.2d29  Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_DONE
2024/07/16 21:12:52.780238297 {wncd_x_R0-0}{1}: [client-orch-sm] [17765]: (debug): MAC: 6c7e.67b7.2d29  Processing MAB authentication result status: 0, CO_AUTH_STATUS_SUCCESS

     Client is in IP learn state after successful MAB authentication

    2024/07/16 21:12:55.791404789 {wncd_x_R0-0}{1}: [client-orch-state] [17765]: (note): MAC: 6c7e.67b7.2d29  Client state transition: S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
2024/07/16 21:12:55.791739386 {wncd_x_R0-0}{1}: [client-iplearn] [17765]: (info): MAC: 6c7e.67b7.2d29  IP-learn state transition: S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS

    2024/07/16 21:12:55.794130301 {iosrp_R0-0}{1}: [buginf] [4440]: (debug): AUTH-FEAT-SISF-EVENT: IP update for MAC f4bd.9e58.424b. New IP 10.76.6.147

    Client policy manager state updated to RUN, Web Authentication is skipped for the client which completes MAB authentication

    2024/07/16 21:13:11.210786952 {wncd_x_R0-0}{1}: [errmsg] [17765]: (info): %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: R0/0: wncd: Username entry (6C-7E-67-B7-2D-29) joined with ssid (Mac_Filtering_Wlan) for device with MAC: 6c7e.67b7.2d29 on channel (136)

    Verification using Embedded Packet Capture

    Radius PacketRadius Packet

    Example where MAC authentication failure for a client device

    Mac Authentication initaited for a client after successful association

    2024/07/17 03:20:59.842211775 {wncd_x_R0-0}{1}: [mab] [17765]: (info): [6c7e.67e3.6db9:capwap_90000005] MAB authentication started for 6c7e.67e3.6db9
2024/07/17 03:20:59.842280253 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [17765]: (note): Authentication Success. Resolved Policy bitmap:11 for client 6c7e.67e3.6db9 
2024/07/17 03:20:59.842284313 {wncd_x_R0-0}{1}: [client-auth] [17765]: (info): MAC: 6c7e.67e3.6db9  Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_PENDING
2024/07/17 03:20:59.842320572 {wncd_x_R0-0}{1}: [mab] [17765]: (info): [6c7e.67e3.6db9:capwap_90000005] Received event 'MAB_CONTINUE' on (6c7e.67e3.6db9)

    ISE would send Access-Reject as this device entry is not present in ISE

    2024/07/17 03:20:59.842678322 {wncd_x_R0-0}{1}: [mab] [17765]: (info): [6c7e.67e3.6db9:capwap_90000005] MAB received an Access-Reject for 0xFE00001C (6c7e.67e3.6db9)
2024/07/17 03:20:59.842877636 {wncd_x_R0-0}{1}: [auth-mgr] [17765]: (info): [6c7e.67e3.6db9:capwap_90000005] Method mab changing state from 'Running' to 'Authc Failed'

    Web-Auth initiated for client device as MAB failed

    2024/07/17 03:20:59.843728206 {wncd_x_R0-0}{1}: [client-auth] [17765]: (info): MAC: 6c7e.67e3.6db9  Client auth-interface state transition: S_AUTHIF_MAB_AUTH_FAILED -> S_AUTHIF_L2_WEBAUTH_PENDING

    Once the Client initiates a HTTP GET request, Redirect URL is pushed to the client device as the corresponding TCP session is spoofed by the controller.

    2024/07/17 03:21:37.817434046 {wncd_x_R0-0}{1}: [webauth-httpd] [17765]: (info): capwap_90000005[6c7e.67e3.6db9][    10.76.6.150]Parse GET, src [10.76.6.150] dst [10.76.6.145] url [http://10.76.6.145/auth/discovery?architecture=9]
2024/07/17 03:21:37.817459639 {wncd_x_R0-0}{1}: [webauth-httpd] [17765]: (debug): capwap_90000005[6c7e.67e3.6db9][    10.76.6.150]Parse GET, Redirect to VIP/login.html
2024/07/17 03:21:37.817466483 {wncd_x_R0-0}{1}: [webauth-httpd] [17765]: (debug): capwap_90000005[6c7e.67e3.6db9][    10.76.6.150]Parse GET, Redirect to Virtual IP url [https://192.0.2.1/login.html?redirect=http://10.76.6.145/auth/discovery?architecture=9]
2024/07/17 03:21:37.817482231 {wncd_x_R0-0}{1}: [webauth-state] [17765]: (info): capwap_90000005[6c7e.67e3.6db9][    10.76.6.150]State INIT -> GET_REDIRECT

    Client initiates a HTTP Get to the redirect URL and once the page loads the login credentials is submitted.

    The controller sends a Access Request to ISE

    This is a web autnentication as a valid user name is observed in Access-Accept packet

    2024/07/17 03:22:51.132347799 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS: Send Access-Request to 10.197.224.122:1812 id 0/3, len 457
2024/07/17 03:22:51.132362949 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  authenticator fd 40 0f 7e 35 67 dc 5a - 63 cf ef ae f3 79 ee aa
2024/07/17 03:22:51.132368737 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Calling-Station-Id  [31]    19  "6c-7e-67-e3-6d-b9"
2024/07/17 03:22:51.132372791 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  User-Name           [1]     10  "testuser"
2024/07/17 03:22:51.132376569 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Vendor, Cisco       [26]    49

    Access-Accept received from ISE

    2024/07/17 03:22:51.187040709 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS: Received from id 1812/3 10.197.224.122:0, Access-Accept, len 106
2024/07/17 03:22:51.187050061 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  authenticator d3 ac 6c f7 a2 a2 17 ca - b4 0f 00 a7 f6 51 0a a4
2024/07/17 03:22:51.187055731 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  User-Name           [1]     10  "testuser"
2024/07/17 03:22:51.187059053 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Class               [25]    58  ...
2024/07/17 03:22:51.187102553 {wncd_x_R0-0}{1}: [radius] [17765]: (info): RADIUS:  Message-Authenticator[80]    18  ...

    Web Authentication is successful and client state transistion to RUN state

    2024/07/17 03:22:51.193775717 {wncd_x_R0-0}{1}: [errmsg] [17765]: (info): %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: R0/0: wncd: Username entry (testuser) joined with ssid (Mac_Filtering_Wlan) for device with MAC: 6c7e.67e3.6db9 on channel (136)
2024/07/17 03:22:51.194009423 {wncd_x_R0-0}{1}: [client-orch-state] [17765]: (note): MAC: 6c7e.67e3.6db9  Client state transition: S_CO_L3_AUTH_IN_PROGRESS -> S_CO_RUN

    Verification through EPC captures

    The client completes TCP handshake with the controller virtual IP address and the client loads the redirect portal page. Once the user submits username and password, we can observe a radius access-request from the controller management IP address.

    After successful authentication, the client TCP session is closed and on the controller the client transitions into RUN state.

    TCP flow with radius packetTCP flow with radius packet

    Radius packet sent to ISE with user credentialsRadius packet sent to ISE with user credentials

    Client-side wireshark capture to validate the client traffic is getting redirected to the portal page and validate the TCP handshake to controller virtual ip address/ web server

    Client side capture to validate the redirect urlClient side capture to validate the redirect url

    Client establishes TCP handshake to the virtual IP address of the controller

    TCP handshake between the client and webserverTCP handshake between the client and webserver

    Session is closed after successful web authentication,

    TCP session closed after client completes web authenticationTCP session closed after client completes web authentication

      

    Related Article

    Understand Wireless Debugs and Log Collection on Catalyst 9800 Wireless LAN Controllers

    Web based authentication on 9800

    Configure local web authentication on 9800

    Revision History

    Revision Publish Date Comments
    1.0
    25-Jul-2024
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Vinesh Veerarasu
      Cisco TAC

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products