Cisco WLC local net user - guest account

Hello,
We have a 2504 Cisco WLC. I am creating Local Net Users for one of the WLANs that uses Web Auth and the Local Database.
My one question is, what does a "guest account" do differently than a non guest account besides the ability to create the lifetime of the account? I mean, it seems both give access to the WLAN so I am failing to see the difference between the two.
Any help is greatly appreciated.

A guest acct can only login to a webauth WLAN. A normal netuser can login to any WLAN that you allow or all. Including 802.1x if that WLAN is allowed to chek the local db
Steve
Sent from Cisco Technical Support iPhone App

Similar Messages

Cisco WLC Local Net user Authentication

Hi,
I have a Controller configured with local net users. Web policy with authentication has been configured for Layer 3 security. When the user tries to access the Wireless, they will be redirected to a web authentication screen, where they need to enter the pre-configured credentials to gain access.
Now, the requirement is: users shall have to provide login credentials only upon initial access (one time) and shall not have to accept an Acceptable Use Agreement when their systems connect to the wireless network. The next time user tries, they should be provided access automatically.
We have configured the following setting on Windows 7 client:
1. Connect automatically when the network is in range is selected
2. Please refer the attached screenshots for further configuration for Windows 7 Clients.
On WLC: SSID --> Advanced Options --> We have disabled the “Enable Session Timeout” setting, but we still have "Client Exclusion" Enabled.
When a computer is shutdown and brought back up within a few minutes the wireless credentials seem to stick, however, when the computer is shutdown for a period of overnight, the credentials are no longer cached and we have to re-authenticate to the wireless.
Is this issue because of "Client Exclusion" Enabled on the SSID/WLAN ?
If not, can someone share the complete procedure to make sure that users local net user credentials will be cache.
Thanks,
Jagan

Well you only can keep it connected for an x number of minutes. You will not be able to set it longer than a day. This means, I can't configure the WLC/Client to cache the credentials permanently? And everyday, they have to enter the credentials to access SSID?You can extend it up to 30 days, but you have to run v7.5. After that, they will have to login again.Change the idle timer to about 2-4 hours and that should keep the client on the WLC DB. This will allow the client to go away for the number set and come back without having to login again. As you said, if I configure the WLC Idle Time for 2-4 hours, do the client have to provide credentials the next day when they access Wireless?Yes. See my previous answerIs there any other way via which this can be achieved? (The limitation is : client should be authenticated only with the WLC.)If you are looking for clients to login once and then never again, the answer is no. You have two choices, you can use the new v7.5 and use the sleeping client feature which gives you max of 720 hours (30 days), or you use th eidle timer and after the idle timer expires, the user will have to login.Thanks,Jagan
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

WLC- Local net user

Hi,
Normally in cisco WLC, we can create "local net user" , same user can able to access internet via captive portal authentication.
Query is : can we use "password policy " which was there on the same screen under security tab : as the Possword policy is only for "local management & AP User "
did "AP user" is same like "local net user"
Br'Subhojit

Hi,
I have exact the same issue to applying a password policy to local net users ? I am running version 7.6 on our 2504 ?
Thanks

CISCO WLC , connecting SSID with local net user

Dears,
Created Local Net User
created SSID and Broadcasted, users can connect to SSID with PSK
But not able to connect using Local net user created in WLC
Edwin

Hi,
What kind of Layer 2 Security are you using on your SSID?
You can't have both PSK and Local user database authentication on the same SSID.
Best regards,
Sebastian

Generate a Local net user Report from WLC or through WCS

Need advice regarding downloading the Local net user list from Anchor WLC or through WCS. In WCS I could not find any menu to generate a report on Local net users in other words Guest account list.
Please advice Thanks
Jacob

I don't know aobut using WCS, but you can always run a command through the cli:
show netuser summary

Import local net users to Cisco Prime 1.2

Hi,
We have 4400 WLC that has about 400 local users configured under local net users and we are deploying Cisco Prime 1.2 in our company. Does anyone know how to import these users to Cisco prime? I was told that it could only be done manually like re entering all 400 entries to Cisco Prime! if this is the case it 'll be tedious.
Thanks for any help.

Hello,
Complete the following steps to migrate data from WCS:
1. Place the WCS export ZIP file (for example, wcs.zip) in a repository or folder (for example, repositories).
2. Log in as the admin user and stop the Cisco Prime Infrastructure server by entering the ncs stop command. Configure the FTP repository on the Cisco Prime Infrastructure appliance using the repository command as shown in configuration snippet below:
pi-appliance/admin# configure
pi-appliance/admin(config)# repository pi-ftp-repo
pi-appliance/admin(config-Repository)# url ftp://209.165.200.227/backup
pi-appliance/admin(config-Repository)# user ftp-user password plain ftp-user
Note: Make sure the archived file is available with the show repository command.
3. Enter the ncs migrate command in order to restore the WCS database.
pi-appliance/admin# ncs migrate wcs-data wcs.zip repository pi-ftp-repo
4. By default, no WCS events are migrated. Enter the ncs start command in order to start the Cisco Prime Infrastructure server after the upgrade is completed. Log in to the Cisco Prime Infrastructure user interface with the root login and the root password.
For mmore information you can refer to the cisco prime infrastructure deployment guide:
http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/deployment_guide_c07-721232.html#wp9000654

Problem audit mismatch WCS/WLC for local net user

HI,
I have a problem in my WCS the audit status is mismatch for my two controllers. When I see the details of the mismatch, it is said that all my 400 users are "not present in controller".
However, I checked directly on my web interface of my controllers and my users are there (Security--> AAA--> Local Net Users). I've also checked on the WCS (ConfigureàControllersà controlerà Security à AAA -> local net user).
In both My users are present and are identical.
When i refresh config from controllers on the WCS it disappears but a week after the mismatch comes back.
If anyone can help, Thanks
Alex

Anyone able to answer this one?
We are having the same issue. We had WLC code 7.0.116.0 with WCS giving us mismatches on certain thresholds, despite the fact that the controller and the WCS configs were a match and no one made changes. We would refresh confgi from controller and a week later, the mismatch was back. It's as if there was something wrong with the WCS database. We upgraded to NCS 1.1 and are now on WLC code 7.0.230.0 and it worked for a while, but we are now randomly experiencing the same issues and then some with NCS.
We have a multi-tenant campus that has several of another organizations access points configured as friendly in NCS, but the controllers still had them as rogue and were containing them. We are also experiencing a max client count threshold that is set to 20 on the controller, but NCS is now reverting back to the default 12 value and giving off a mismatch. I don't know if there is a SQL issue with the database or not, but we service roughly 3000 users on a 5 million sq. ft. campus and some of these mismatches and failure to identify critical mismatches is starting to become a problem. Going to open a TAC case, but if anyone has any insight in the mean time, that would be helpful. Thanks!

WLC 7 on 5508 - 802.1x and Local Net Users or LDAP

Is it possible under the 7 version of the software to use LDAP or Local Net Users for authentication instead of RADIUS for doing 802.1x authentication, and if it is, is there any documentation around that has some configuration information? I've been doing some poking around and haven't had much luck yet.

Wireless users on 802.1x? We're in the midst of testing this with 6.X and 7.X firmware. So far, no complaints.

Internal Web Authentication + Local Net User

Hi all,
I'm trying to setup the WLC with internal web authentication + local net user account. I've setup a WLAN for this local net user configure the user profile map to this WLAN.
When the laptop get associated with the designated WLAN, and user tried to browse to the internet, the internal web authentication page doesn't appear on the browser.
I'm just curious is there any DNS server require in order to direct the user entered URL request to the virtual interface?
regards.

Well if you are using webauth for guest users, you really want to have an open ssid and wither have a username and password on the wlc or use a passthrough webauth where the guest users just have to click submit or accept. If you are using this for internal users, then you really shouldn't use webauth since this will not be single sign on. Again, you can if you want your internal users to sign on again. There is wpa/wpa2 PSK and then there is wpa/wpa2 8021.x in which this will require either using local EAP or a Radius Server. Ther radius server will either have the local user accounts or you can point this to AD. Depending on if you use EAP-PEAP (certificate on the radius server only) or EAP-TLS (certificate on both the radius and clinet) you will need a certificate.
For webauth only, you do not need a certificate on the user or radius server, a certificate will be required on the wlc if you don't want users to be promted with a certifcate error message. 5.1 supports unchained certificates, but I always use RapiddSSL for a root ca cert just to make deployment mush simpler for the client. So webauth and EAP will require certifcates with webauth being optional.

Local net users - usernames case sensitive

I am facing an annoying issue with our WLC's 5508.We have configured some local accounts - local net users and we found out that usernames are case sensitive.For example when i setup an account with username:TEST and the then try to login with username:test i get authentication failure..
I thought that only the admin accounts were case sensitive.
Has anyone else faced this problem?Is there any solution for this as i have already configured 60 local accounts.
Thank you in advance.

#Management Usernames are case sensitive.
#Local net user seem to be case sensitive per below bug, however it is a old one on 4.0.
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsg72444
*for local netuser, Does WLC allows to create same usernames like this - Apple, APPLE, AppLe. If allowed then at this point its considered that wlc allows to create case insensitive users for local netusers. Else if only Apple is allowed then it is case sensitive for user creation.
*Now try to login like - apple, aPPLE and also like Apple, APPLE, AppLe.
*Share the result along with the tested wlc code for conclusion. Let see what works and doesn't.

Local Authentication for Guest accounts created on WCS

I'm not sure this is technically possible but I have a requirement to set up an SSID on a WLC whereby I can provision guest user accounts from the WCS and have the WLC / SSID authenticate against the guest account created on the WCS. The SSID would not be a web-auth / layer 3 auth model but preferably be able to utilise layer 2 authentication (802.1x) against the account within WCS. Can anyone tell me if this is actually possible?
Thanks in advance for your help.
Cheers
Sent from Cisco Technical Support iPad App

Ok then .. Sounds like you are already very fimilar with the wlc..
Lets kick a few ideas around ..
If you want to use WCS lobby then you cant use radius, becuase WCS will not update radius accounts. But you could use the WLC as a radius server and store the guest account(s) on the WLC. Gives you 802.1X security, WCS loddy admin access and your guest accounts. You can also expire the accounts as well. So you would move the control from radius to the wlc. You can also apply your qos / bandwidth.
Another option would be to create radius accounts. Set up your guest wlan, point it to radius. You can still apply a global bandwith restriction within the qos profile on the wlc.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

WLC - guest account multiple users

Hi,
I have been looking at guest access features of the WLC and I can see the ability to specificy an account duration as a Lobby Ambassador but does the WLC support multiple logins per guest account?
I.e. I want to create a single guest account for use by 100 users. Is there any way to achieve this or would I need to create 100 individual guest user accounts?
Many thanks,
Paul.

Paul,
If you have WCS available, you can import a .csv file that contains the proper information for usernames/passwords:
http://www.cisco.com/en/US/docs/wireless/wcs/7.0/configuration/guide/7_0temp.html#wp1102820
Example file would look like:
Username   Password   Profile     Description
User1      Cisco      Any Profile Net User 1
User2      Cisco                  Net User 2
User3      Cisco      Internal    Net User 3
The other option I can think of would be to build a list of command line configurations for the WLC, and manipulate the list with your already created usernames/passwords in a text editor. The command to configure a guest user on the WLC CLI is:
config netuser add wlan userType [lifetime ] [description ]
Thanks,
-Patrick

Cisco WLC WebAuth Page Not Found

Hi All,
I'm using Cisco VWLC 7.4.100.60, I'm facing a problem of the internal web auth with Local Net User , any client access the guest SSID, which can re-direct to the virtual port ip http://1.1.1.1/login.html, but browser also show page not found.
May I know how can I fix it?
Many Thanks!
hang

Can be many things... first off, make sure DNS is working and that the guest homepage is not a secure web site (https). Also make sure you didn't add and DNS hostname in the VIP interface unless you installed a cert and the FQDN is resolving. Here is a good guide:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a0080bf7d89.shtml
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Local management users and Radiusproblem

I have created a wlan for guests and would like to only authenticate guestusers against Local Net Users database on the WLC.
My problem is that it is also possible to log on with usercredentials for radiusauthentication.
I have not enabled any AAAservers for the guestwlan.
Any tips how to stop the radiusauthentication for this wlan ?
JF

That is how it currently works, but here are two options:
You can either change the Web Radius Authentication to CHAP or MD5-CHAP which is located in the GUI... Controller | General
Or else you can create 3 fake radius servers on the wlc and then specify those three under the guest wlan radius servers.

Guest account on WCS doesn't work as expected

Hi,
I have scheduled a guest account on WCS (6.0), valid 180 days, generate password every day and email to myself, and applied to our WLCs( 5.1). The first day, guest account was created on all WLCs, and emailed me the password, worked fine, the second day, I received email with the new password, but the guest account has disappered from all WLCs, on WCS, this guest account still show as 'Active' but not apply to any WLC.
Thanks in advance for your help!

Our WLC version is 5.1.151.0 and WCS version was 6.0.132.0 but I just upgraded it to 6.0.170.0. Guest Account Sync option is enabled now ( once a day). I think I find something, one is the time on WCS and WLCs was different before (corrected this now), second, the guest account start time and end time was set to same time (1:00 Jan 1, 2010- 1:00 Jul 1, 2010) or from 8:30 Jan 1, 2010 to 8:00 Jul 1, 2010. I thought this time setting is the lifetime of the account, but actually it's the active time of the account on every scheduled day, so I change this to from 1:00 Jan 1, 2010 to 23:00 Jul 1, 2010, So far,it works fine - this guest account is created at 1:00 and removed at 23:00 everyday.
By the way, is there any documentation to tell how WCS works with WlC underneath the GUI?
Thanks for your help!

Cisco WLC local net user - guest account

Similar Messages

Maybe you are looking for