Guest access for Cisco WAP's...

Can someone recommend a solid 3rd party solution to offer granular guest access using Cisco 1241's and a WLAN controller? Something that is similiar to what is used in hotels.
I have a client considering BlueSocket/Aruba solutions and apparently both offer hotel-style guest access that is very granular. I realize Cisco's NAC management piece does this but it's outside of my client's budget.
Thanks in advance-

Yes we have. So I have been really digging on this and when you go to a external webauth it still looks to send the username password back to the WLC. I have an internal doc from Cisco that say
"Login request is sent back to the action URL of the controller web server."
By default when setting up the WLC i used the 1.1.1.1 ip for the virtual interface. Currently 1.1.1.1 is not advertised in my network so how the heck would the NAC send the request back to it?? (Sorry thinking outloud). According to my understanding the switch_url is what its looking to send the credentials back too...Sooo should I modify my virtual IP to be something that is routable on my network?
If your lookin in the below URL which is what id get redirected too and after filling out my self service.
https://nac.guestwifi.com/sites/Guest/selfservice.html?switch_url=https://1.1.1.1/login.html&ap_mac=00:22:90:93:25:80&wlan=MAS&redirect=www.google.com/
The switch_url part is what send the post to would need to be reached via the nac. Right now 1.1.1.1 is not..
Thoughts?

Similar Messages

I was clsoing Word and suddenly everything on my desktop opened - I had to close each one and then a page requesting guest access to Cisco appeared. I cannot access any of my websites or bookmarks now. What do I do - or what did I do?

I was closing Word, was on my desktop page when suddenly all my windows on the desktop opened at once. I had to close each one and then a page requesting guest access to Cisco appeared. It required a password ( ? ) which I do not have. Now I cannot access any of my webpages or bookmarks, including mail etc. I have no idea what I might have done to cause this problem. I am not particularly savvy and don't know where to begin.

daveynielsen wrote:
So my question is... if you took the time to read this.. why in the world did everything stop working with wi fi and out of nowhere asked me to use a blackberry data service plan?
Because, without THE BlackBerry Data Plan, you will only have use of your WiFi HotSpot browser, and that is that. No email, none of the RIM data application features like AppWorld or the BlackBerry Facebook application.
It worked at first, because you probably had leftover provisioning Service Books from the previous owner, I am guessing (you mentioned "checked with my seller).
To me, seems be working as suspected.
daveynielsen wrote:
Well, naturally i figured everything else would work on a wif connection.. like the iphone. Even though you dont have the 3G data plan one can still access email, web, and aps.
Not quite, you must still have a data plan for the iPhone.
1. If any post helps you please click the below the post(s) that helped you.
2. Please resolve your thread by marking the post "Solution?" which solved it for you!
3. Install free BlackBerry Protect today for backups of contacts and data.
4. Guide to Unlocking your BlackBerry & Unlock Codes
Join our BBM Channels (Beta)
BlackBerry Support Forums Channel
PIN: C0001B7B4 Display/Scan Bar Code
Knowledge Base Updates
PIN: C0005A9AA Display/Scan Bar Code

PIN-based guest access for airport express

how do I setup PIN-based guest access for airport express?
I have a 2010 iMac OS X 10.6.8 and an Airport Express of the same era.
Thanx in advanced...
Siegfried

Hello Bob,
Thank you for your time on this. I apologize for not giving you a more complete picture of what was going on.
I should have included that I had already performed the steps that you shared and had gotten to the place where I would enter the PIN.
The problem was that, after entering a PIN that I had come up with, the "continue" button never became active. I called Apple Care and ended up talking to 3 different people before I found someone that knew the answer. The answer is that the guest computer (client) MUST be present inorder for me to complete the setup. So, problem is now solved. Thanx...
Siegfried

ISE 1.2 Guest Access for EAP(Dot1x) Authentication

Hi.
I want to use encryption for guest access.
In order to use the "RADIUS-NAC" in the WLC, you can not use or "Open + MAC" only "WPA + dot1".
(Specification of the WLC)
When the "Open + MAC", return from the ISE at the time of the "Web Authentication" in the "Session-Timeout Attribute", I was able to forcibly disconnect the radio.
(Attribute is the same value as the (ISE TimeProfile) time the guest user can use)
If you connect to a wireless terminal to forced disconnect after screen of Web authentication is displayed, you can not login.
(Because the account has been revoked)
I want to make even dot1x this environment.
However, because it becomes the "re-authentication time" If dot1x, as long as the terminal is connected to the radio, it is not cut.
In addition, even in the setting of "Attribute Termination-Action = Default", does not return until the Web authentication.
(Status of the WLC remains "Auth Yes")
(Session of the ISE remains "Started")
Use the (EAP) Dot1x, Can I "is allowed to forcibly disconnected," "to match the time of TimeProfile" in the same way as "Open + MAC" thing?
Thank you.

Note：
Cisco ISE:Version1.2.0.899-8
Cisco WLC(5508):Version 7.6.120

Voucher based guest access for vWLC (time restricted pre created user auth codes)

Hi all,
Is it possible to create voucher based user auth tickets for guest wireless on the Cisco WLC?
We are running the vWLC latest version
Cheers, Simon

No you can not create voucher using vWLC But you can create guest access using vWLC.
For the Guest access deployment ,plesae refer to the document below.
http://www.cisco.com/c/en/us/td/docs/wireless/technology/guest_access/technical/reference/4-1/GAccess_41.html#wp1000477

Guest Access for Windows Services

Hi,
I need to access my shared files through a "Guest" access, without a password. I understand it is not a safe way to work, but I do not have a choice : I am using a device named mediagate, which is supposed to be able to read the shared files on my computer, and this device can only connect to my computer using a "Guest" access.
I understand OS X server could do that (refering to http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c4wn14.html), but I am using OS X tiger 10.4.4 workstation. Is there anyway for me to do that ? Otherwise, the mediagate I bough is totally useless...
Thanks for your help !
iMac G5 Mac OS X (10.4.4)

Hi Marco,
This behavior is a limitation that we are looking into providing a solution in a future update.
Thanks,
Robert
Robert Bruckner http://blogs.msdn.com/robertbruckner
This posting is provided "AS IS" with no warranties, and confers no rights.

No guest access for Windows clients

Since installing the 10.4.11 OS X Server update, Windows clients can no longer browse the list of shares. Guest access is allowed in the Windows service, and one of the shares does have Guest access enabled. I went so far as to allow R+W for the unknown and unprivileged groups.
The logs show the windows user account failing authentication, which shouldn't even be necessary since Guest access should give them explicit access anyway. The Windows client gets prompted for a user name and password, which does authenticate properly if an actual account is entered. For some reason, this client's IT department is adamant about allowing guest access. Any clues?

Hi,
I know it is a common issue, but the answer you link to is very old and for Windows NT4 and Windows 2000.
I should be possible to enable NAT on the VPN server as described here:
http://technet.microsoft.com/en-us/library/dd458971.aspx
But I cannot get it to Work.
Thomas Forsmark Soerensen

Guest access for vendors/clients

Hi,
I have a single AP setup using PEAP with MS Win2k3 IAS/RADIUS. I would like outside vendors and clients to be able to come in and be able to access the Internet as well as a printer. I believe in order to authenticate with PEAP the laptop must be a member of the domain which we can't do with vendors and clients. I'm new to wireless so I'm lost as how to set this up. If anyone is familiar with how to do this I would really appreciate some direction. Thanks in advance.
Riley

AP#sh ver
Cisco IOS Software, C1200 Software (C1200-K9W7-M), Version 12.3(8)JEA, RELEASE S
OFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Wed 23-Aug-06 16:42 by kellythw
ROM: Bootstrap program is C1200 boot loader
BOOTLDR: C1200 Boot Loader (C1200-BOOT-M) Version 12.2(8)JA, EARLY DEPLOYMENT RE
LEASE SOFTWARE (fc1)
Cairny-AP uptime is 3 weeks, 5 days, 23 hours, 18 minutes
System returned to ROM by power-on
System restarted at 09:13:49 est Tue Mar 4 2008
System image file is "flash:/c1200-k9w7-mx.123-8.JEA/c1200-k9w7-mx.123-8.JEA"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco AIR-AP1210 (PowerPC405GP) processor (revision A0) with 15138K/12
36K bytes of memory.
Processor board ID FOC074214X8
PowerPC405GP CPU at 196Mhz, revision number 0x00C4
Last reset from power-on
1 FastEthernet interface
2 802.11 Radio(s)
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0E:38:23:C8:E7
Part Number : 73-8704-05
PCA Assembly Number : 800-23211-06
PCA Revision Number : A0
PCB Serial Number : FOC074214X8
Top Assembly Part Number : 800-23304-03
Top Assembly Serial Number : FHK0744J2K6
Top Revision Number : A0
Product/Model Number : AIR-AP1210
Configuration register is 0xF
AP#

ISE version 1.0 - Unable to get management access for cisco devices

Hi All,
I want to manage all cisco devices with read and write privilege with ISE 1.0.
Is this functionality is available in this version?
I configured the 2960 switch. On switch redius test is successful. When I telnet to the switch, it ask for username and password. But message is authorization fail. But on ISE shows authentication is successful.
Is it configuration issue or this feature is not available in this version?
Regards,
Hanumant

Hanumant,
You will have to create an authorization profile to send back the privilege level for the user:
Here is the attribute (cisco-av-pair) you will have to send back:
shell:priv-lvl=xx

Wired Guest Access

Hi!
I enabled Wired Guest Access to connect Wired Ethernet Users to WLC. It doesn't explained on user guide how WLC does? If WLC strips 802.3 frame and encapsultes it with 802.11 or not. Any way, I couldn't redirect the ethernet flux to WLC and then to the external controller authenticator (Captive portal authentication). Need a help!
Cheers!

In order to provide the wired guest access, the designated ports in the layer-2 access layer switch need to be configured on the guest VLAN by the administrator. The guest VLAN must be separate from any other VLANs that are configured on this switch. The guest VLAN traffic is trunked to the nearest WLAN local controller. The local controller tunnels the guest traffic across a EoIP tunnel to a DMZ Anchor controller. This solution requires at least two controllers.
Here is the URL for the Wired Guest Access using Cisco WLAN Controllers Configuration
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808ed026.shtml#ancwlan

Guest Access Query

Hi All,
Suppose we have 50 x WAN sites and we have 5 APs per site.
If we to enable Guest Access for all sites, does that mean we need license of 250 for the anchor controller?
What is the best recommendation for provisioning licenses for guest anchor?
I have gone through the 7.0 config guide but apart from wired guest info not much help there.
Any help is very much appreciated.
Thanks,
Janesh

No. For guest anchoring you just need either a 4402-12 or 5508-12. Anything more is a waste. You see, the anchor doesn't manage any AP's just clients. The license are for ap count.
http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a00809ba482.shtml
http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob41dg/ch10GuAc.html
Sent from Cisco Technical Support iPhone App

E2000 Guest Access "Problematic"

I installed an E2000 some time ago for my Church office with Guest account enabled.
Lately they have complaints about Guest access not working.
No login page is presented to some users. Others are OK.
Secure access is fine.
The firmware is 1.0.03 and there is no upgrade available.
I assume it is a browser issue, but have no details.
For now I have suggested that
1) If there are problems, try another browser to access a web site. Insure the page is not cached in memory (press cntl-F5)..
2) Type in the login URL Manually (http://192.168.33.1/login.asp)
Any other suggestions?
Ed

Hey Ed, saw your post and I couldn't help but comment. I also used guest access for same router before and I found out that there are only limited numbers of guest that can connect at a time. For the model number that you have, it's a maximum of ten. That's probably the reason why others can't connect, because once the router detects ten different devices connected to it, it would no longer allow the 11th device. You might as well check the Linksys/Cisco Connect software in your computer because the default number of devices allowed to connect is 5. That could be the why it's happening on your end.
Some helpful links to check:
http://kb.linksys.com/Linksys/ukp.aspx?vw=1&docid=6e07a4fbdb904eec9c20eb1cecef6dd1_Guest_Access_Issu...
http://kb.linksys.com/Linksys/ukp.aspx?pid=80&vw=1&articleid=23671

Turning guest access on on my e2000

how do I reenable guest access on my e2000 without having cisco connect installed??
Thanks

It can only be done through the Cisco Connect software unfortunately. There are no updates also from the website of a new firmware for this router that includes a sub tab for Guest Network or Guest Access. If your router is up and running already, you’ll just have to run the software that you can download from the website on a wired computer and just let it install the software for you to be able to use Guest Access for the router.

Wired guest access with 5508

Hi
I have setup wireless guest access for a customer with a single 5508 and web authentication no problem at all. He then wanted to test wired guest access. The 5508 is currently connected to a single 3560 switch. The wired clients get a DHCP address OK but cannot reslove DNS and thus don't get redirected to teh guest login portal. I have even tried turning of all L3 security to no avail. The setup is as follows
VLAN 101 access points and 5508 management interface
VLAN 102 wired guest access dynamic ingress (L2 config only no SVI on 3560)
VLAN 103 wireless guest dynamic egress nterface L3 network with SVI on switch
VLAN 104 wired guest dynamic egress interface L3 network with SVI on switch
There are two DHCP pools setup on the WLC one for the VLAN 103 and one for the VLAN 104 subnets.
The internet router is also connected to the 3560 on a sepearte VLAN with an SVI. the 3560 has a default route to teh internet router and teh DHCP pools give the DHCP clients a default gateway of the IP address of dynamic interface 103 or 104. The Internet routre can ping the WLC on both these addresses.
LAG is enabled on teh WLC and VLANs 101-104 are trunked to it from the 3560.
I even tried making the wired guest egress interface the same one as for wireless. The wired clientys now got an IP address on the wireless range but still couldnt pass any traffic. It's like the intrenal bridging on teh WLC between VALN 102 and 104 (or 103) is broken. Tried both the lates 6.x and 7.x software on the WLC. Any ideas ? All the problems I can find with this seem to relate to not gettingas far as a DHCP address but that works fine.
Thanks
Pat

Hi
Yes got it resolved. It turns out that the connection from the wired guest access port to the WLC must be L2. That is the switch that the wired guest acces sport is connected and WLC are connected to must be L2 only. We were using a single switch to do the testing and it was also doing the routing for the test LAN. Even though there was no L3 VLAN interface configured for the VLAN that the guest access port was on for some reason this breaks it. Absolu Didnt have chance to work out the exact limitations of this as we simply made the switch L2 only and configured an 802.1Q trunk to the Internet router and made subinterfaces on the router for the wired and wireless egress ports and it worked then. No config change was needed on the WLC at all.
The only thing I can think of is that it's something about the way the WLC joins the wired guest access ingress VLAn and egress VLAN. The WLC isn't a reall router it says so in the documentation. I think the packet coming from the wired access port is being bridged to the egress VLAn not routed and this is what screws it up (remeber with a router the source and destination MAC addresses would be changed with a bridge they aren't). Got to be something along those lines. If you have a bigger newtork with a guest anchor WLC handling this function you dont run into this as the traffic is coming over an EOIP tunnle from the remote WLC so the switch with the guest anchor WLC doesnt see the MAC address of the wired guest PC.

WIRED GUEST ACCESS WLC 5508

Hi Guys,
I've just set up a wired guest access for my HQ but I'm wondering if it is possible to do the same in a branch office because We do not have another controller in this site, could this be accomplished using the wlc of the hq?
Any ideas please.
Regards
Oscar

If you have L2 communication between HQ & BR, this is possible (then you can extend your wired user vlan to your WLC).
Otherwise you have to have a WLC at your branch as well.
http://mrncciew.com/2013/03/26/wired-guest-access/
HTH
Rasika
**** Pls rate all useful responses ****

Guest access for Cisco WAP's...

Similar Messages

Maybe you are looking for