Guest Access - Layer 2 security WPA PSK - Layer 3 security web auth

I am not able to test this.
Has anybody configured the CUWN guest access with WPA PSK layer 2 and Web authentication layer 3
If so are there any problems that I should expect
Mark

Mark,
I have setup wireless in two other compainies related to Rail... The biggest issue will be who will support the guest users and will they take the responsibility. Their security team didn't want that and were fine with tunneling the users to either a dmz or seperate Internet connection. Will dhco release the address... Not right away. You can play around with the lease tim and see if your laptop keeps getting the same address or one higher. If the isue is with dhco being used up from association, then don't broadcast the ssid and have the receptionist hand out the ssid with username and password. My clients use a default username and passowrd but changes that every week. They seem to prefer that over changing it every day or have a username passeor for every guest user. They use wcs to print out the guest credentials. Again, the network team has the recepionist doing this, so they made sure that they are not making too much extra work for them or else they would have to be responsible for guest users.
Hope this helps.

Similar Messages

I have a 3rd generation iPod Touch and just did the update to IOS 5. Now I can't connect to my Netgear wifi router. My iPhone connects fine along with all of my other laptops etc. I have the router set with WPA-PSK [TKIP] security and an access list.

I have a 3rd generation iPod Touch and just did the update to IOS 5. Now I can't connect to my Netgear wifi router. My iPhone connects fine along with all of my other laptops etc. I have the router set with WPA-PSK [TKIP] security and an access list. I've confirmed the mac address is included on that list and that the password is correct. Under choses netwrok I select the network and it just goes into a spin. I have tried removing the password and the access list settings and it still will not complete the connection to the router thus no internet access. The routers firmware is also up to date. This thing worked fine before this update and I've already tried to restore from backup. Any ideas or is the wifi nic bad in this thing with the new apple firmware update? Any fix?

Thanks Bob, I don't know why but it all of a sudden worked a few days later. It's a mystery but at least problem solved.

Satellite L40-14N: Does WLan support WPA PSK encryption security

Could someone please help?
Does the satellite L40-14N Wireless LAN Card support WPA PSK encryption security?
Thank you.

What WLan card was installed in your notebook?
You can check this in the device manager.
Then simply Google for this WLan card or visit the WLan card manufacture info site!
Simply ;)

Voucher based guest access for vWLC (time restricted pre created user auth codes)

Hi all,
Is it possible to create voucher based user auth tickets for guest wireless on the Cisco WLC?
We are running the vWLC latest version
Cheers, Simon

No you can not create voucher using vWLC But you can create guest access using vWLC.
For the Guest access deployment ,plesae refer to the document below.
http://www.cisco.com/c/en/us/td/docs/wireless/technology/guest_access/technical/reference/4-1/GAccess_41.html#wp1000477

LWA Guest Access with ISE and WLC

Hi guys,
Our Company try to implement Guest Access with ISE dan WLC with Local Web Auth Method. But there is problem that comes up with the certificate. This is the scenario :
1. Guests try to connect wifi with SSID Guest
2. Once it connect, guests open the browser and try to open a webpage (example: cisco.com)
3. Because, guests didn't login, so it redirect to "ISE Guest Login Page" (url became :
https://ise-hostname:8443/guestportal/Login.action?switch_url=https://1.1.1.1/login.html&wlan=Guest&redirect=www.cisco.com/
4. If there is no ISE Guest Login Page installed, message Untrusted Connection message will appear, but it will be fine if they "Add Exception and install the certificate"
5. After that the Guest Login Page will appear, and guests input their username and password.
6. Login success and they will be redirected to www.cisco.com and there is pop up from 1.1.1.1 (WLC Virtual Interface IP) with logout button.
The problem happen in scenario 6, after login success, the webpage with ISE IP address and message certificate error for 1.1.1.1 is appear.
I know it happened when guests didn't have the WLC Login Page Certificate...
My Question is, is there a way to tunneling WLC Certificate on ISE ? Or what can we do to make ISE validate WLC Certificate, so guests doesn't need to install WLC Certificate/ Root Certificate before connect to Wifi ?
Thx 4 your answer and sorry for my bad English....

Thx for your reply Peter, your solution is right,
i don't choose CWA, because their DNS is not stable...
i've found the problem...
the third-party CA is revoked, so there is no way it will success until it fixed...
and there is no guarantee, they will fix it soon..
so solution that we choose is by disable "HTTPS" on WLC...
"config network web-auth secureweb disable".
"config network web-auth secureweb disable".
"config network web-auth secureweb disable".
"config network web-auth secureweb disable".
"config network web-auth secureweb disable"
thank you all...

Wired guest access - Unable to access network

Hello,
I've configured two WLC's with the exact same config one of them has working Wired guest network the other one does not.
The only difference in the two I know of is that the one that does not work is connected to a Cisco 3550 switch, the one that works is connected to a Cisco 7600.
The problem is when I connect a computer to the wired guest network I am able to get an IP address from the Internal DHCP server but unable to access the network.
I've tried pinging the gateway's IP and I get no answer.
The Port-channel interface has the correct VLans and the vlans exist on all switches.
If anyone see an error there or might have an idea why this is not working I would appreciate the feedback.
Config follows below..
regards,
Gk

(Cisco Controller) >show running-config
802.11a cac voice tspec-inactivity-timeout ignore
802.11a cac voice stream-size 84000 max-streams 2
802.11b cac voice tspec-inactivity-timeout ignore
802.11b cac voice stream-size 84000 max-streams 2
location rssi-half-life tags 0
location rssi-half-life client 0
location rssi-half-life rogue-aps 0
location expiry tags 5
location expiry client 5
location expiry calibrating-client 5
location expiry rogue-aps 5
Cisco Public Safety is not allowed to set in thisdomain
ap syslog host global 255.255.255.255
auth-list ap-policy ssc enable
custom-web ext-webserver add 1 217.28.176.114
dhcp create-scope guestnetwork
dhcp address-pool guestnetwork 192.168.34.2 192.168.34.200
dhcp default-router guestnetwork 192.168.34.254
dhcp enable guestnetwork
dhcp dns-servers guestnetwork 212.30.200.200 212.30.200.199
dhcp network guestnetwork 192.168.34.0 255.255.255.0
local-auth method fast server-key *****
interface create guestnetwork 331
interface create guestnetwork-wired 332
interface address ap-manager 10.255.255.90 255.255.255.248 10.255.255.94
interface address dynamic-interface guestnetwork 192.168.34.1 255.255.255.0 192.168.34.254
interface address dynamic-interface guestnetwork-wired 192.168.35.1 255.255.255.0 192.168.35.254
interface address management 10.255.255.89 255.255.255.248 10.255.255.94
interface address service-port 10.60.4.200 255.255.255.0
interface address virtual 1.1.1.1
interface dhcp ap-manager primary 10.255.255.89
interface dhcp dynamic-interface guestnetwork primary 10.255.255.89
interface dhcp management primary 10.255.255.89
interface dhcp service-port disable
interface vlan ap-manager 226
interface vlan guestnetwork 331
interface vlan guestnetwork-wired 332
interface vlan management 226
interface port ap-manager 29
interface port guestnetwork 29
interface port guestnetwork-wired 29
interface port management 29
lag enable
load-balancing window 5
mesh security eap
mgmtuser add root **** read-write
mobility group domain XXXXXXX
mobility symmetric-tunneling enable
network otap-mode disable
network rf-network-name XXXXXXX
radius acct add 1 XXXXXXX 1813 ascii ****
radius auth add 1 XXXXXXX 1812 ascii ****
radius auth management 1 disable
spanningtree port mode off 1
spanningtree port mode off 2
sysname XXXXXXX
time ntp interval 3600
time ntp server 1 XXXXXXX
wlan create 1 hotspot hotspot
guest-lan create 1 hotspot-wired
wlan interface 1 guestnetwork
guest-lan interface 1 guestnetwork
wlan custom-web webauth-type external 1
wlan custom-web ext-webauth-url https://XXXXXXX
wlan session-timeout 1 disable
wlan wmm allow 1
wlan wmm allow 18
wlan security wpa disable 1
wlan security wpa disable 18
wlan radius_server auth add 1 1
wlan radius_server acct add 1 1
guest-lan radius_server auth add 1 1
guest-lan radius_server acct add 1 1
wlan dhcp_server 1 0.0.0.0 required required
wlan enable 1
guest-lan enable 1

Any Best Practices for Guest Access?

Looking to create a guest access WLan so that Vendors can have internet access along with vpn into their own network while disallowing access to our internal systems.
I have created a Guest WLan and configured it on the WLC side. I think all I have to do now is to configure the core switch with athe New 99 Vlan along with configuring the trunk ports connected to the WLC's.
My question is, am I missing anything in the setup? and are there any "best practices" wen it comes to Guest access? I am hoping to use web-passthru authentication. I dont believe this requires any AAA or Radius servers which we dont have set up. I will probably just want a single "guest" account which will provide internet access without allowing access to the internal lan. Am I on the right track here?

***************Guest WLC****************** (Cisco Controller) >show mobility summary Symmetric Mobility Tunneling (current) .......... Enabled Symmetric Mobility Tunneling (after reboot) ..... Enabled Mobility Protocol Port........................... 16666 Default Mobility Domain.......................... DMZ Multicast Mode .................................. Disabled Mobility Domain ID for 802.11r................... 0x43cd Mobility Keepalive Interval...................... 10 Mobility Keepalive Count......................... 3 Mobility Group Members Configured................ 2 Mobility Control Message DSCP Value.............. 0 Controllers configured in the Mobility Group MAC Address IP Address Group Name Multicast 00:19:aa:72:2e:e0 10.192.60.44 Champion Corp 0.0.0.0 00:19:aa:72:39:80 10.100.100.20 DMZ 0.0.0.0 (Cisco Controller) > ***************Corp WLC***************** (Cisco Controller) >show mobility summary Symmetric Mobility Tunneling (current) .......... Enabled Symmetric Mobility Tunneling (after reboot) ..... Enabled Mobility Protocol Port........................... 16666 Default Mobility Domain.......................... Champion Corp Multicast Mode .................................. Disabled Mobility Domain ID for 802.11r................... 0x46d5 Mobility Keepalive Interval...................... 10 Mobility Keepalive Count......................... 3 Mobility Group Members Configured................ 2 Mobility Control Message DSCP Value.............. 0 Controllers configured in the Mobility Group MAC Address IP Address Group Name Multicast IP Status 00:19:aa:72:2e:e0 10.192.60.44 Champion Corp 0.0.0.0 Up 00:19:aa:72:39:80 10.100.100.20 DMZ 0.0.0.0 Up (Cisco Controller) >

Simplified guest access

Reading the Cisco Guest access deployment senarios again becomes a little unclear.
Lets assume 3 scenarios.
1 Small office
4 access points
1 2106 controller
This will give simpl guest access terminate the guest vlan in an adsl router and a web auth page and use the wlc to manage guest client access
2 Multiple small offices
2 offices each with 2 APs
2106 in each och office
The guest access woul have to be terminatin a 4402 12 as I cant use 3rd 2106 to terminate and originate the guest access? The 2106s locally will pass the guest access through.
3 Large enterprise.
5 4404 controllers
Would I simply use a 4402 to terminate and distribute the guest acccess as a central guest database.
I have deliberately not mentioned DMZ as to simp[lify the scenarios.
Thanks

First look at the traffic flow. If you have a decent conection back to the central location and this is the only internet connection, then tunneling traffic back via local or h-reap would be the best bet. If the offices have thier own internet dsl, adsl, etc, then maybe sending the traffic out at the local sites would be your best choice. It also goes hand in hand with how you will desing the wlan for their internal users and devices not including guest. You can design this many ways, but it will come down to if you place wlc's in each location vs. centralized deployment.

WLC2112 with Guest / Web-Auth and vlan

Hi
I'm trying to configure my WLC with guest SSID and vlan 10.
The security is only set to Web-auth, and it is all working if the guest network is set to nativ vlan (1) But it seems that the http(s)://1.1.1.1/login.html is not reacheble from the guest SSID/VLAN??
Please help.
Management IP Address 192.168.14.252
Software Version 6.0.182.0
Emergency Image Version
I have tried with ver. 5.2 also -

I think that 1.1.1.1 is only reachable from a wireless client during webauth. They should not be able to reach that address once they have passed through the web auth page.
Don't know if that helps, or not.

Secure Guest Access with AP541's

My customer would like to have a secure guest wireless environment using AP541N's. When a guest laptop connects to the wireless I need the user to be redirected to a guest secure zone where they can only access the Internet after entering a password. I read in the AP541 docuemntation that this device is suitable for customers who plan to have secure guest access "in the future" - does this mean the feature is not available today but planned for the future ? If it is available today is there a config guide ?
Thanks

to George Stefanick
Could you provide url of documentation how to implement third solution -
Take one of the ports from the WLC and plug it into the FW,
especialy configuration of WLC.

Guest Access Security

We have two wireless controllers in the DMZ that we use for guest access only. Right now the management, ap-management and dhcp addresses for users are all on the same IP segment. I know that's not the most secure way to deploy and wondered what the best practice is for this situation.
Thanks!

It would be better if you were to seperate out the guest users into their own wlan/vlan/subnet. Assuming that the dmz endpoint allows for multiple subnets and/or vlan/subintefaces (PIX or IOS) You could then drop the guests into a subnet that can only access the internet and not any other local networks. This can also be acheived or aided by ACLs the wlan(s) as well.

WiSM ::: secure guest-access

All,
I wonder what I need to do if I want to make a guest-netork, guest-vlan with the WiSM. What I do not understand is that the WiSM needs an interface in the guest-vlan. In our case the WiSM if will NOT be the default-gw of the clients.
How is the WiSM if secured? Is it with ACLs only? Or do I need CPU ACLs? How can I make sure that the WiSM does not route between different interfaces if i.e. one smart visitor inserts the WiSM vlan if IP address as her default-gw?
Thanks,
--Joerg

You will need a mobility anchor controller outside the DMZ to tunnel the guest access traffic to. This is achieved via EOIP tunneling. This controller can be any 4402 model. Please see this link.
http://www.cisco.com/en/US/docs/wireless/technology/guest_access/technical/reference/4.1/GAccess_41.html

WPA.PSK security on Mac and encrytion key

I am trying to connect to a network at a new office. They tell me to select WPA and enter the password to connect. I think I am connecting to the router just fine but no internet. Another user says he has settings like this -- Network - WPA.PSK and encryption - TKIP. I am not finding any settings like this.
Can you help?
Thanks,

The firewall is already off... I guess we will need to get the admins involved that set up the network. I have never been able to connect to a router with the incorrect password before. But, it seems as though I can connect to it even if I try to modify the password to try different options. It is very possible I have the wrong password - only because the owner knows nothing about networks/computers.
Thanks for your help!

Where is my ipad security wpa key

Hi,
I am beginner... and trying to connect my Sony Blu Ray player to the hotspot from my Ipad Mini which has 3g data plan. The player asks for
WPA Key?
Can anyone enlighten me as to the whereabouts of this 'key' so that I can satisfy the player requirements, and use it's onboard Iplayer app to
download TV programs via the Ipad's data plan.
Many thanks,
Laddie_1

Hi Daniel,
My old Samsung netbook (this one) is connected to the Ipad using the hotspot WiFi Password, I do input
the same password into the BluRay Player correctly, however the players 'status' page shows:
Connection method: Wireless
Wireless Connection: OK
Internet Access: Failed
Network (SSID): My Ipad
Signal Strength: 100%
Security: WPA/WPA2-PSK
IP addr setting: Auto
IP addr: 172.20.10.6
Subnet mask: 255.255.255.240
Default Gateway: 172.20.10.1
DNS Settings: Auto
Primary DNS: 217.171.132.1
Secondary DNS: 217.171.132.1
MAC addr: xxxxxxx
Proxy Server: Not Used.
so it sees the network and connects, just can get out onto the Internet with it.
Many thanks,
Laddie_1

1st gen MBP won't connect to WiFi when WPA2-PSK [AES] security is enabled

Hi all,
I've got a pretty vexing problem involving my old MacBook Pro and my WiFi, and I'm hoping to find an explanation or solution to it. Recently, my husband purchased a brand-spanking new (PC) laptop with n wireless capabilities, and I've been trying to reconfigure my home network so that the router is broadcasting in 2.4 gHz b/g/n mode. When I set the router (a Netgear N600 dual band) to broadcast in "up to 300Mbps" mode, it tells me that "WPA-PSK [TKIP] may only operate at "Up to 54Mbps" (legacy G) rate, not N rate. NETGEAR recommends that you use WPA2-PSK [AES] to get full N rate support."
So, naturally I go and set the security to WPA2, and my 1st gen MacBook Pro (it only has a CoreDuo, and hence, a b/g card) promptly proceeds to spazz out. Sometimes it sees the network, sometimes it doesn't. When it does see the network, the connection times out, and I can never successfully establish a connection. Right now, I've got the Wifi broadcasting up to 300Mbps, but the security is set to mixed WPA-PSK [TKIP] + WPA2-PSK [AES], so I'm not even sure if my husband is getting Wireless-N functionality on his end of things.
Has anyone else had a problem like this, and is there any solution for it? Should I upgrade my wireless card (Can I even upgrade my wireless card???), is it a software issue, etc. I'm aware that there have been a number of issues with wireless connectivity in Mac laptops over the past few years, and I really hope this isn't one of them.
Thanks in advance for your help!

I believe the issue is the fact that the Netgear router supports wide-channel operation in the 2.4 GHz band. This is how they are able to advertize that you can get up to 300 Mbps. Apple computers/routers only support narrow-channels on this band.
What I would suggest is that if the Netgear has an option to both use narrow-channels and WPA2/AES security, to use this combination. Your Mac should be able to connect and his PC should get at least 120-130 Mbps. Note: Although not broadcasting at 300 Mbps, the Netgear will still be operating in the 802.11n radio mode.

Guest Access - Layer 2 security WPA PSK - Layer 3 security web auth

Similar Messages

Maybe you are looking for