Configuring Guest Access via Web Authentication Portal on a WLC

Understanding Guest Web Authentication

Before jumping into configuration, it's essential to understand the high-level architecture. When a guest user connects to a specific SSID, how is their traffic intercepted and redirected to a login portal? There are two primary methods to achieve this, and as a solutions engineer, choosing the right one depends on the scale and requirements of the deployment.

These methods are Local Web Authentication (LWA) and Central Web Authentication (CWA).

To get a clear overview of these two approaches, please review the following presentation slides.

Let's summarize the key differences based on what you just read:

• Local Web Authentication (LWA):

  • Intelligence on the WLC: The Wireless LAN Controller is responsible for intercepting the user's HTTP/HTTPS traffic and redirecting them to a web portal.
  • Local Configuration: The redirection URL and the pre-authentication Access Control List (ACL), which defines what traffic is allowed before login (like DHCP and DNS), are configured directly on the WLC.
  • Portal Hosting: The portal itself can be hosted internally on the WLC or on an external server. Even if external, the WLC initiates the redirect.
  • Authentication: The WLC handles the authentication, either against its own local user database or by proxying the credentials to an external RADIUS server.

• Central Web Authentication (CWA):

  • Intelligence on the Policy Server: This method offloads the logic to a central policy server, almost always Cisco Identity Services Engine (ISE).
  • RADIUS-driven: The process starts with a MAC Authentication Bypass (MAB) request from the WLC to ISE. ISE responds with RADIUS attributes, including a url-redirect attribute that tells the WLC where to send the client.
  • Dynamic and Scalable: Because ISE controls the policy, you can create much more sophisticated guest experiences (e.g., sponsored guest, self-registration, social login) and apply them dynamically across the entire network.

For the CCNP ENCOR exam and for building a foundational skill set, a solid understanding of LWA is crucial. We will focus our practical configuration on LWA, and then explore how CWA builds upon these concepts.

Configuring Local Web Authentication on a Catalyst 9800 WLC

Let's configure a guest WLAN that uses the WLC's internal web portal to authenticate users stored in its local database. The process on a modern Catalyst 9800 controller involves several logical components that work together.

The following video provides a practical walkthrough of this entire process using the controller's web interface (GUI).

As you saw in the video, the configuration can be broken down into these key steps:

1. Define the Authentication Method (AAA)

First, you need to tell the WLC how to authenticate the guest users. We create a named authentication method list that specifies using the local user database for login attempts.

• GUI Path: Configuration > Security > AAA > AAA Method List > Authentication
• CLI Command: aaa authentication login GUEST_LWA_METHOD local

2. Configure the Web Authentication Portal

This involves two parts: a global parameter map for system-wide settings and a specific parameter map for our guest portal.

• Global Parameter Map: This is where you configure the virtual IP address (e.g., 192.0.2.1) that the WLC uses to intercept and redirect client traffic. This IP should be a non-routable address that doesn't exist elsewhere in your network.
  • GUI Path: Configuration > Security > Web Auth > Web Auth Parameter Map (select the 'global' map)
• Named Parameter Map: Here, you can customize the portal's behavior, such as setting a banner or changing the authentication type. For our case, the type is webauth (username/password).
  • GUI Path: Configuration > Security > Web Auth > Web Auth Parameter Map (click 'Add' to create a new one)

3. Create the Guest WLAN

This is where you define the guest SSID and, most importantly, its security settings.

• Layer 2 Security: For a basic guest portal, this is set to None. The network is open, but no traffic can pass until Layer 3 web authentication is complete.
• Layer 3 Security:
  • Check the Web Policy box.
  • Select the Authentication List created in Step 1.
  • Select the Web Auth Parameter Map created in Step 2.
  • (Optional but recommended) Apply a Preauthentication ACL. This ACL permits essential services like DHCP and DNS before the user authenticates. All other traffic (like a user's attempt to browse to http://www.cisco.com) is denied by the ACL and is then intercepted by the WLC for redirection.

4. Create a Policy Profile and Tag

In the Catalyst 9800 architecture, the WLAN Profile (with the SSID and security) is tied to a Policy Profile (which defines the VLAN for guest clients). This combination is then placed in a Policy Tag, which is ultimately assigned to the Access Points that need to broadcast the guest SSID.

• Policy Profile: Defines the VLAN where guest clients will be placed after authentication. (Configuration > Tags & Profiles > Policy)
• Policy Tag: Maps the WLAN Profile to the Policy Profile. (Configuration > Tags & Profiles > Tags)

5. Create Guest User Credentials

Finally, since we are using the local database, we need to create a user account for our guests to use.

• GUI Path: Configuration > Security > Guest User (On newer versions, this might be under Administration > User Administration)

For a detailed, step-by-step guide covering both the WebUI and the CLI for all these components, the official Cisco configuration guide is an excellent resource to bookmark.

Central Web Authentication (CWA) with ISE

While LWA is effective, CWA provides far more flexibility and is the standard for large-scale enterprise guest deployments. The configuration is a partnership between the WLC and ISE.

The general flow, as you saw earlier, involves the WLC performing MAB and ISE returning redirect instructions. The configuration on the WLC is primarily focused on setting up RADIUS communication with ISE and enabling the necessary features to accept dynamic policy from ISE.

To get a sense of the CWA workflow and its components, please watch this overview from the comprehensive Cisco Community series on the topic.

As you can see, the configuration for CWA is more involved, requiring policy creation on ISE for authentication and authorization. However, this unlocks powerful features like guest self-registration, sponsor approvals, and posture assessment, which are beyond the scope of LWA alone.

Conclusion

In this lesson, we've configured one of the most common features in enterprise wireless networks: a guest access portal. You have learned how to differentiate between the two main architectural approaches, LWA and CWA, and you have walked through the practical steps to implement Local Web Authentication on a Cisco Catalyst 9800 WLC.

Key Takeaways:

• LWA vs. CWA: LWA places the redirection and authentication logic on the WLC, making it simpler for basic deployments. CWA offloads this intelligence to a central server like ISE, enabling greater scale, security, and features.
• LWA Configuration Flow: A successful LWA setup requires configuring AAA methods, a web auth parameter map (with a virtual IP), a WLAN with a web policy, policy profiles/tags, and a user database (local or external).
• The Role of the Pre-auth ACL: This ACL is critical for allowing essential services like DHCP and DNS to function before authentication, enabling the redirection process to work correctly.
• CWA as a Partnership: CWA configuration involves setting up the WLC to communicate with ISE via RADIUS and enabling it to dynamically accept policy attributes like redirect URLs.

Preview of the Next Lesson:

We've seen how Access Control Lists (ACLs) play a vital role in guest wireless, specifically with pre-authentication ACLs that control traffic before a user logs in. In our next lesson, we will shift from wireless to core network security and take a much deeper dive into ACLs. We will move to the "Network Security and VPNs" module to learn how to implement and verify standard, extended, and time-based IPv4 ACLs, a fundamental skill for securing any network infrastructure.