Configuring Layer 3 Security

Configuring Layer 3 Security Using Web Authentication

Prerequisites for Configuring Web Authentication on a WLAN

  • To initiate HTTP/HTTPS web authentication redirection, use HTTP URL or HTTPS URL.

  • If the CPU ACLs are configured to block HTTP / HTTPS traffic, after the successful web login authentication, there could be a failure in the redirection page.

  • Before enabling web authentication, make sure that all proxy servers are configured for ports other than port 53.

  • When you enable web authentication for a WLAN, a message appears indicating that the controller forwards DNS traffic to and from wireless clients prior to authentication. We recommend that you have a firewall or intrusion detection system (IDS) behind your guest VLAN to regulate DNS traffic and to prevent and detect any DNS tunneling attacks.

  • If the web authentication is enabled on the WLAN and you also have the CPU ACL rules, the client-based web authentication rules take higher precedence as long as the client is unauthenticated (in the webAuth_Reqd state). Once the client goes to the RUN state, the CPU ACL rules get applied. Therefore, if the CPU ACL rules are enabled in the controller, an allow rule for the virtual interface IP is required (in any direction) with the following conditions:

    • When the CPU ACL does not have an allow ACL rule for both directions.

    • When an allow ALL rule exists, but also a DENY rule for port 443 or 80 of higher precedence.

  • The allow rule for the virtual IP should be for TCP protocol and port 80 (if secureweb is disabled) or port 443 (if secureweb is enabled). This process is required to allow client’s access to the virtual interface IP address, post successful authentication when the CPU ACL rules are in place.

Restrictions for Configuring Web Authentication on a WLAN

  • Web authentication is supported only with these Layer 2 security policies: open authentication, open authentication+WEP, and WPA-PSK.

  • Special charecters are not supported in the username field for web-authentication.

  • When clients connect to a WebAuth SSID and a preauthorization ACL configured to allow VPN users, the clients will get disconnected from the SSID every few minutes. Webauth SSIDs must not connect without authenticating on the web page.

    You can select the following identity stores to authenticate web-auth user, under WLANs > Security > AAA servers > Authentication priority order for web-auth user section:

    • Local

    • RADIUS

    • LDAP

    If multiple identity stores are selected, then the controller checks each identity store in the list, in the order specified, from top to bottom, until authentication for the user succeeds. The authentication fails, if the controller reaches the end of the list and user remains un-authenticated in any of the identity stores.

Configuring Web Authentication

Configuring Web Authentication (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the WLAN for which you want to configure web authentication. The WLANs > Edit page appears.

Step 3

Choose the Security and Layer 3 tabs to open the WLANs > Edit (Security > Layer 3) page.

Step 4

Select the Web Policy check box.

Step 5

Make sure that the Authentication option is selected.

Step 6

Click Apply to commit your changes.

Step 7

Click Save Configuration to save your settings.

Configuring Web Authentication (CLI)

Procedure

Step 1

Enable or disable web authentication on a particular WLAN by entering this command:

config wlan security web-auth {enable | disable} wlan_id

Step 2

Release the guest user IP address when the web authentication policy timer expires and prevent the guest user from acquiring an IP address for 3 minutes by entering this command:

config wlan webauth-exclude wlan_id {enable | disable}

The default value is disabled. This command is applicable when you configure the internal DHCP scope on the controller. By default, when the web authentication timer expires for a guest user, the user can immediately reassociate to the same IP address before another guest user can acquire it. If there are many guest users or limited IP addresses in the DHCP pool, some guest users might not be able to acquire an IP address.

When you enable this feature on the guest WLAN, the guest user’s IP address is released when the web authentication policy timer expires and the guest user is excluded from acquiring an IP address for 3 minutes. The IP address is available for another guest user to use. After 3 minutes, the excluded guest user can reassociate and acquire an IP address, if available.

Step 3

See the status of web authentication by entering this command:

show wlan wlan_id