Guest Internet access in the Enterprise

We have set up guest internet access in our enterprise using GRE tunneling with a PIX. I'm trying to determine the best way to do authentication for users on this guest network.
I think I can do RADIUS (using ACS) with the PIX as an NAS. Question is can I use a different type of server (such as MS IAS)? Can I use either one to utilize an existing MS Active Directory database?
If I use radius on the pix for authentication, a login prompt pops up when a user tries to use the web. Is there a way to redirect users to a web page first and have the login embedded on the page? This is done in hotels now and I don't know if there's a Cisco solution for this.

The following documents lists all the supported Databases,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

Similar Messages

  • Internet access to the guest system for Host-Only configuration

    Hello,
    I have a windows host linux guest vBox environment and it's configured as host-only. How can I enable internet access within the guest? I am towards the end of a RAC installation and upon running buildcluster.sh, it says the recommended RPM "oracle-validated" not installed or has unsatisfied dependencies. It seems i have quite a few RPMs need to download and thus prefer to be able to connect to the internet within the guest so i can do it from the Oracle yum server.
    Thanks,
    Harry

    Hi,
    this won't work so easiliy with a "Host Only" network.
    You either need a bridges network or a NAT network.
    Easiest thing probably will be to add another interface (network) to the VM and assigned it as bridged.
    Then download/update oracle-validated and remove the interface again.
    This way, you don't need to change anything on the server.
    Regards
    Sebastian

  • EA6100 AC1200 Blocking Guest internet access during specific times?

    I see that you can disable guest internet access for specific times but only for specific devices. What I want to do is turn off Guest access for all devices during specific times. 
    I am using this in an environment  where I will have different guests at different times with different devices and can't go in to block each one each time. 

    I think your only option at this time is to manually disable the Guest Wireless network when wanted.
    Please remember to Kudo those that help you.
    Linksys
    Communities Technical Support

  • Load Balance guest Internet access via two different DMZ zones at two sites

    Hi Sir,
    My customer has the following unified wireless guest access requirement:
    - There are 2 internet links and dmz zones at two different locations, Site A and Site B
    - Data centre is at Site A
    - WiSM is proposed to be installed at the Cat 6500 in Site A
    - Lightweight AP are distributed across Site A, Site B and other branches
    - Only one anchor WLC is proposed at Site A, DMZ zone to provide guest internet access
    My customer would like to load balance the guest via the two internet link at Site A and Site B but with the same SSID across all locations. Can it be done since only one anchor at Site A? How about puttting another anchor WLC at Site B, DMZ zone? But how can i establish two EoIP tunnel to two different anchor WLC from a single WiSM?
    Thanks for your help
    Delon

    You can... but you can't control where the traffic will flow. The wlc will determine which DMZ wlc it will use. The wlc will load balance, but traffic in site A might go to site B. I currently have deployed that senerio in multiple client installations....

  • Corporate responsibility for logging guest Internet access

    Hi all
    Can anyone tell me what the requirement is in the uk for logging guest Internet access for guest users at my co
    Company ? Is it lawful requirement ?

    The following documents lists all the supported Databases,
    http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

  • Can anyone tell me how I keep everything I had in my old photoshop, now I've updated to Photoshop CC 2014.  It did give me the option to transport over all my presets, but because I didn't have internet access at the time, it couldn't do it.  Now I'm not

    Can anyone tell me how I keep everything I had in my old photoshop, now I've updated to Photoshop CC 2014.  It did give me the option to transport over all my presets, but because I didn't have internet access at the time, it couldn't do it.  Now I'm not getting the option.  Please help.

    Migrating Presets does not require a network connection and you can still migrate your cc presets if you still have CC installed.  Use Photoshop menu Edit>Presets>Migrate Presets...  Migrating presets only migrates presets.  It does not migrate Plugins, settings, extensions and scripts.  CC 2014 is also not completely backwards compatible with CC.  Support for Flash Panels and Oil Painter filter have been removed.  So extensions like mini bridge no longer work in CC 2014

  • Can I use my iPhone to have internet access on the iPad?

    Can I use my iPhone to have internet access on the iPad?

    Yes, but you have to have your phone set up for tethering. Depending on your carrier that might require a special plan.

  • Is there a difference between the LG EnV3 and the LG EnV3 VX9200 is this the same phone. the reason I ask is because one says it has internet access and the other one doesn't

    is there a difference between the LG EnV3 and the LG EnV3 VX9200 is this the same phone. the reason I ask is because one says it has internet access and the other one doesn't

    It the same phone but you don't have to have data on it if you don't want since they are older phones.  We had these phones without data as I didn't think they would be good for surfing the net compared to a smart phone.  Mary

  • Guest Internet Access

    Hi
    Looking for input on Guest Vlan subject.
    How can I avoid routing of Guess VLAN traffic to DATA VLAN, any traffic from Guest VLAN should be routed to Internet directly.
    Looking for similar setup as in Hotels, Guest are provided with username/password with time duration to access internet and limit the download speed.
    Do I need to create another SSID on the WLC and how the guest users will acquire ip, from WLC DHCP or Windows DHCP.
    If its Windows DHCP then Guest traffic reaches my Data VLAN
    Any Help

    We got WLC 4420 ----- Do you mean a 4402-xx
    AP 1200 series ( 5 in quantity )
    I am new to WLC, can you help me to understand
    How many SSID we can configure on WLC, does each ssid can have different config parameters.
    The AP's and the Code you might have will only support 8-16.  You don't want to configure too many (best practice is around 4) because of all the beacons that needs to be sent might cause issues with certain devices.  You can configure eash ssid the same of different, it is up to you.  Follow best practices on this.
    can we broadcast specific SSID on AP configured with WLC ( AP#1 can be used for SSID DATA & SSID Guest ) ( AP#2 can be SSID Guest & SSID Partners )
    You can create WLAN Override (depends on code - http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807669af.shtml) to specify what AP's will braodcast what SSID's.  This can be messy if you have gaps for roaming, unless that is not an issues.
    For Guest SSID is it recommended to connect to a seprate port on WLC
    You have different options:
    You can use a guest anchor controller in you DMZ
    You can use one port on the WLC connected to your internal network and the other port to the DMZ
    You can trunk vlans and use ACL's to block guest traffic from inside networks.
    All this depends on you current infrastructure and if you plan on buying more equipment or use the existing.
    Instead of creating Guest Users on WLC with time restriction, can this be done third party with ease of management. ( Office secretary can give access to internet to guest )
    You can use a NAC Guest Server... if you want to spend a lot of money.  You can configure a Lobby Admin account on the WLC so that the secretary has only read/write to add guest accounts.  This would be the same if you have WCS with a lobby admin account.
    http://www.cisco.com/en/US/docs/wireless/wcs/4.2/configuration/guide/wcsmanag.html#wp1078208
    How to have bandwidth control on WLC, restrict users with bandwidth limit
    You would need to use a 3rd party tool for this like ZoneCD or again you can use the NAC Guest Server.
    http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns787/data_sheet_c78-456124.html
    http://www.google.com/url?q=http://cisco.com/application/pdf/paws/107630/WLC_NGS.pdf&ei=WtSTS9HpN43OM_WnkYoN&sa=X&oi=nshc&resnum=1&ct=result&cd=1&ved=0CAgQzgQoAA&usg=AFQjCNF0eA-Z8nss7WzgpPRnFjtSdZnvWQ
    http://www.google.com/url?q=http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns787/DeployingGuestAccess_051308.pdf&ei=WtSTS9HpN43OM_WnkYoN&sa=X&oi=nshc&resnum=1&ct=result&cd=2&ved=0CAkQzgQoAQ&usg=AFQjCNGKgF_wWKQaI8lqHoFfwbg0iztVFg
    Any configuration sample link with one Internet connection having DATA and Guest VLAN  using ACL to restrict  the traffic.
    I put some links above... hope this helps.  Again, it will come down to your existing environment and how much more you want to spend.  You also have to look at the time it might take to setup, will the secertary want to do this, etc?  How I see guest access..... well.... they go out a seperate internet pipe, so I don't really care about bandwidth.  Its guests so they would have to deal with that anywhere the go, even hotspost or even worse hotels:)  Make it simple and make it work... then you can add to that later when you get more familiar to configuration and troubleshooting.

  • Advice regarding house guest internet access through Airport Express

    I would like to set up trouble-free (on my part and my house guests) access to the internet. Any thoughts or suggestions? It seems to me that if folks may have reasonable access to cable/satellite TV and telephone, or what have you, it is also reasonable to make available to them the internet. What is the best way to go about doing this? I have an existing home wireless system using Airport Express (may also work in a Netgear WG614 wireless router). Mostly, I am concerned with the technical aspects but would also like to hear from anyone regarding the legal/social ramifications. Any such solutions must take into account both Windows and Mac environments. Thanks.
    17 in. iMac G5 ALS (1.8 GHz)   Mac OS X (10.4.5)   iMac G3 DV (400 MHz), Airport Express, 3rd gen iPod

    Meme,
    A nice touch, and one that made me choose one small hotel over another when I used to travel a lot.
    I can't give a complete solution, but I can give you bits of info, which others will also do.
    One thing that probably is a must, is to set Wireless Isolation. That is that although all the wireless clients can see the internet, they can't see each other. I'm not sure that the AE supports this, I honestly thought it did, but now I can't find it. The Netgear will support it.
    Wireless encryption will be a must too, you may even want to make it a "closed network", so that the network does not advertise it's presence. Clients wishing to connect must specify ("key in") the network name and connect. That may be just a little too difficult for some business travellers. Back to wireless encryption, some may say to use some ultra-modern hi-tech secure encryption algorithm to be really safe, but these are enormous long passwords that your clients will have to key. Those with older computers may not support the latest encryption methods. Some may recommend WPA, I'd say WEP (more compatability) and a simple (non-dictionary) password, like "@pple" or "@irPortXPr3ss" or any easy to communicate word(s) with a few letters replaced by vowels or (printable) symbols. It is up to you how often you change the password.

  • Restrict Wireless Guest Internet Access

    I am implementing a wireless guest solution for Internet access. I would like to restrict these users to Internet access only. I undestand the concept of configuring a seperate vlan for them but how can I restrict them to Internet only. I also have remote campuses that I would like to setup as well. I have an ASA 5520 for my firewall and am using metro ethernet from the main campus to the remote campuses. Thanks for any help.

    Hello,
    I have found the simplest way of doing this is to apply an access list to the radio sub-interface for the vsitor vlan.
    Set the access-list to allow any dhcp requests, deny any to a private network and permit any.
    You could do it back at the ASA but there is a chance of the traffic getting onto the network first.
    HTH.
    Andy.

  • I am using a verizion jetpack to wireless connect to an airport express next i want to connect a Airport extreme wired from toe express to create a second private network that has internet access via the jetpack

    Thanks for the help after looking over your sugesstion I did some additional troubleshooting which i should have done in the beginning and heres what i found
    Airport express is joined to and existing wireless network and i have internet access....all good
    I set up my Airport Extreme as follows:
                        Connect using :ethernet
                  Ethernet Wan Port : automatic
                  Connetion Sharing : Share a public IP address
    Tcpip      Configue IPv4: Using DHCP
    DHCP                   Begin address: 172.16.22.200
                               Ending address:  172.16.22.254
    Wireless    Create a wireless network
                             Wireless network name Test1
                              wpa2 security
    This is needed due to set ip address of device on this private network did not address NAT
    Conneted Express ethernet port to Extreme wan port
    All wired devices have internet access and i get a double nat status which ignore
    however my wireless device will not connect.... sometimes they will they want
    any suggestions

    Here are sceeen shots of the Express

  • Problems in Internet access in the middle being a modem and Linksys RV016

    Good afternoon, I have another problem with Cisco Linksys RV016 Router, the router used to connect to ADSL Internet 3 links which these in turn give direct service to a server right now each of them, the idea is to connect the 3 modems LAN router and connect the server, this is no problem so far. The point is that here at my work people access to Remote Access Servers for Windows and VNC TightVNC or my servers with Linux (ask why not login at TeamViewer or LogMeIn, but it is another matter), the idea is to leave as they are, that everything is apparent and improve systems with load balancing (Router). The modem has ports open for remote access the 3389, are accessed without nigun problem, but when connecting the router and can not, I opened the same ports in Router and name and works.
    Servers handle the no-ip.org for access and name resolution on DNS and so with that name assigned by the no-ip is where remote access from the Internet.
    I do not know if you understand, but I hope someone help me with this.
    In advance thank you very much and greetings.

    Look, the first phase of my work to be done is to try a single server and it has Windows Server 2008, you explain:
    1. This ADSL modem connected directly to a single server (Windows).
    2. It is accessed without any problem by remotely from another network and / or from the Internet via remote access.
    3. The modem has port 3389 open to allow remote access from another network or Internet (up to here is my current scheme and there is no problem).
    4. Connect between the modem and Linksys RV016 router server.
    5. I open the same ports with the modem for remote access.
    6. If I have Internet server.
    7. Remote access is not working.
    As time??? something can be done to solve this problem. The server as you mentioned earlier is running as a service no-ip.org for publication DNS name and not have to be constantly changing the IP by automatic changes made ​​by the supplier (eg server name and for which so is taken from the internet: servidorwin.no-ip-org).
    See if you explain me better.
    Thanks in advance and greetings.

  • ASA 5510 Guest Internet Access

    I have a subnet for guest network access, both wired and wireless.  We have a Netgear ProSafe that is trunked to a Cisco 2901 performing 'Router-on-a-Stick'.  For most internal traffic, it all stays behind the ASA.  But for guest traffic, I have a route-map that sets the next-hop address as the outside interface of the ASA.  The question is, how can I still permit those users to access our internal DNS servers?  Do I need any particular NAT translations, exemptions, DNS doctoring, hairpinning, etc.?  I have an ACL on the inside interface that permits traffic from the guest networks to our internal DNS servers, and then the next ACL line denies any other traffic from the guest networks to any of our internal networks.
    Regards,
    Scott

    Hello Scott,
    Your ASA will need to have a route for both networks
    You also will need the following command:
              -same-security-traffic permit intra-interface
    The thing is that the packets from the guest vlan will go directly to the ASA as its default gateway, then packets will be routed to the Router on stick and finally to the DNS server, the reply will go from the DNS to the Router on stick and then directly to the Guest user.
    Nat exemption will look like this:
    access-list nonat permit ip 192.168.14.0 255.255.255.0  host 192.168.11.6
    access-list nonat permit ip 192.168.14.0 255.255.255.0  host 192.168.11.4
    nat (inside) 0 access-list nonat
    Please give it a try, also please provide packet tracer
    packet-tracer input inside udp 192.168.14.10 1025 192.168.11.4 53
    Regards,
    Julio
    Rate helpful posts

  • Internet access to the SolMan

    Hi,
    I want to know if it is possible to reach the SolMan via Internet access?
    We want to give the project members access to the project documentation in the Roadmap.
    Until now I could not find any practical links. But I have heard that´s possible via cFolders.
    Can somebody help, please?
    Thanks a lot.
    Cheers

    Hello,
    If you want to have access to documents which are located on the project documentation tab, one possible work around is to display the document attributes dialog.
    From this dialog, you can generate an URL by using the push button with title Create.
    This will generate a URL and put it in the clipboard. Then you can send this URL to your project members.
    If you want to access the whole project documentation tab, I don't think that there is any functionnality.
    Best regards,
    Thierry

Maybe you are looking for