GUEST User gets disconnected on Guest Wlan on 2602 ap in Flexconnect mode

Hey guys,
I have configured a guest Wlan for guest users in remote site. The Ap's are in flexvonnect mode and authentication is web authentication where a lobby user generates and distributes passwords to guest. The guest devices however gets disconnected after 10-15 minutes and needs to be reauthenticated.
I have disabled session timeout feature but still no relief.
Any comments ???
Thanks

HI Sandeep,
I think, it's a expected. client has to re-login/reauth after session timeout or deauth.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008067489f.shtml
Note: If clients are active after successful login, they will get           de-authenticated and entry can still be removed from the controller after the           session timeout period configured on that WLAN (for example,1800 seconds by           default and can be changed using this CLI command: config wlan           session-timeout ). When this           occurs, client entry is removed from the controller. If the client associates           again, it will move back in a Webauth_Reqd state.
If clients are in Webauth_Reqd state, no matter if they are active or       idle, the clients will get de-authenticated after a web-auth required       timeout period (for example, 300 seconds and this time is non-user       configurable). All traffic from the client (allowed via Pre-Auth ACL) will be       disrupted. If the client associates again, it will move back to the       Webauth_Reqd state.
There is an enhancement request filed esp. for your situation with Pre-auth ACL.
CSCtj32812    DHCP Option to mitigate the problem of guest client rejoining network
Regards
Dont forget to rate helpful posts

Similar Messages

Users getting disconnected when the sap cluster group failover happens.

Hello all,
We have done the HA installation on mysaperp2005(ecc6.0).
The failover groups are sapcluster group(ascs+scs instance) and the Database(DB group).The central and the dialog instances are installed locally and do not form the part of the cluster.
When ever the sapcluster group failover to the second node.The users gets disconnected and need to login again.
How can we configure the nodes so that the users do not get disconnected during the failover of the sap groups and the users are not disturbed.
thanks
satyajit

Hi Satyajit,
This is exactly the reason why it is called High Availability and not Full Availability.
When the node where Database runs fails, the memory structure (Instance) associated with the Database is lost and needs to be restarted on the other node. This means that all the transactions which have not been commited to the database needs to be rolled back. Hence the users doing insert/updates into the database will be disconnected from the System.
While the database is unavailable the Work processes go into a restart mode wherein they wait for the DB to come up again and keep pining it.
Database becomes available again after the Instance is started on the other node with Instance recovery and the users can connect back. Work processes recognize that the database is available and everything is back to normal.
In case of Central Instance (enqueue) failover, the lock information is lost and hence again the transactions need to be rolled back hence the users will be disconnected if they are doing an Insert/Update into the System. System becomes available once the Enqueue service is made available again after the failover.
So in either case there will be user disconnects as HA doesnot cover the memory structure failovers.
Hope this clears it up for you.
Thanks and Best Regards,
Sunil.

User getting disconnected everyday at 02:30 AM sharp

All,
We've been having an issue where users are getting disconnected from vpn everyday sharlpy at 02:30 AM. We have two ASA's but this issue is happening with only one of them. Also we do have a call center which is open 24/7 and during this time the agents are getting international calls. Please if anyone has any idea why, let me know.
Thanks,
Thiago Henriques

Further to what Raj has requested, let me know if we're authenticating these users via any external authentication server like ACS or NPS. If yes, I'd also like to see if there is any "time & date" based condition configured for this specific user.
~BR
Jatin Katyal
**Do rate helpful posts**

AFP users getting disconnected "because the volume could not be found"

We have a Leopard server which is mostly used for its file sharing services (AFP for the office Macs and SMB for the PCs).
The PCs never seem to have a problem with SMB, but the Macs using AFP regularly get kicked off with the message, "Volume "....." can not be used and will be ejected because it is no longer available."
Some days it doesn't happen at all, while other days (like today!) it happens constantly.
What I've tried so far:
- Restarting AFP
- Restricting the number of users that can connect
Not a big list, but I can't think of anything else to try.
By the way, the problem happens both inside the LAN and when connecting via the Internet.
Any ideas for where to start troubleshooting?

Thanks for the reply, Leif.
Strange characters in the share name: No, just regular roman characters
Share folders/whole volume: Yes, certain folders only on the volume
Shared volume on external FW drive: Yes (or USB 2.0 - I will have to check when I'm back at the office tomorrow), but definitely not set to sleep.
Hope this gives some possible clues.
Thanks again --

NAC High Availability: Users getting disconnected during failover

Hi,
We have a pair of CAS in in-band virtual-gateway mode in high availability mode.
We are still running some tests but we have noticed that the clients are losing connectivity during the failover.
* The service ip is always active (never stops responding pings).
* The stand-by CAS becomes active immediatly after we shut down the primary, we see it on the CAM.
* The client however looses connectivity with the internal network for almost two minutes.
I'm guessing this isn't normal, but would like to know what is the expected behaviour on this.
Thanks and regards,

We configured another pair today and we are noticing the same behaviour, however it seems random... sometimes the user barely looses connection, other times it will take from 2-5 minutes for it to come back.
We are only using eth2 for the failover link since we only have one serial port.
When we test we make sure both servers are up and then we reboot the primary. The secondary becomes active immediately. When both are up again we repeat the process.
any other ideas? something we should check?
Thanks!

Guest Portal Using ISE with Flexconnect Mode

Folks,
I have configured my guest web authentication using ISE with flexconnect mode like this:
http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bcb905.shtml
After done, I connect the SSID but cannot log in. I cannot get IP address and in the ISE I can see that my device has already hit my authorization profile and the status is pending. Can anyone help me with this?

As Richard says, check to see if you have an IP address. If not check the AP settings for FlexConnect. Is the mode on the AP set right? Please confirm that you are using FC local switching and not centralised switching?
Is the VLAN tagging enabled on the AP, and/or the VLANs on the AP switchport set right?

Using AD to authenticate BYOD users on Guest WLAN

First off, I have several WLANs -- one is a "Guest" that is anchored to our corporate WiSMv1 running 7.0.240.0 code. We have many 5508s running 8.0.100.0 -- the "guest" is tunneled back to the core WiSMv1.   Right now, the Guest splashes a web page that a user just has to click through to get n the Guest WLAN. I currently have a production WLAN set up to use 802.1x and pass credentials through Win 2012R2 NPS (Radius) so that our employees can log on using their AD credentials.
We are looking to avoid the complexity and cost of ISE.   We want to build a basic self-subscription process. I'd like to set up a separate "test" Guest network that will splash a web page that will basically have 2 sections -- the top section will display a phone number for the user to call. Basically the system will generate a random ID/PW which will be spoken or sent in a text message to the caller. Behind the scene, we will load these credentials into an AD OU.   The bottom of this web page will be the fields for the user to enter the ID / PW which in turn will be validated to the AD.
I can't mess with the current Guest "anchored" in the corporate WiSM.   We already have a custom web page and it appears you can only have one. So I was thinking of setting it up at one of the remote 5508 sites.... I can download a custom web page there and I believe I can still use the "management" interface to grab IPs out of the Guest Subnet that resides in our HQ.
My uncertainty revolves around the WLC / WLAN setup to use AD (via Radius if necessary) to validate the user -- and since it is BYOD, I have no idea what the client device will be and do not want the user to be required to do any setup.
I have gone through a lot of docs --- many talk about ISE. Others are really old -- and of course there is difference between WLC web pages simply due to the 8.0 code on the 5508s!
I am hoping this is a fairly straight forward setup.
TIA - Perry

Hi,
Your starting 3 Paragraphs say that you want to modify Guest page only.But after that You talk about the BYOD.BYOD involves device registration , supplicant provisioning etc and is entirely for different use. If you think , you are asking about that , Please go through this Tech-Talk by me to understand BYOD (Video as well Brief note )along with PPT having all the required configuration on WLC side,AD side,CA server and ISE side.
"We want to build a basic self-subscription process. I'd like to set up a separate "test" Guest network that will splash a web page that will basically have 2 sections -- the top section will display a phone number for the user to call. Basically the system will generate a random ID/PW which will be spoken or sent in a text message to the caller. "
If the requirement is the above i.e display Phone number which user would call to get credentials , it can be done via simply modifying the HTML web-page to show that number and load in to the WLC or else host that page on some external server.Infact , you can modify the Internal web page of the WLC via Security>Web-authentciation and write a header and message to be displayed on the web-page which WLC displays which can have your Mobile number to call.Once credentials are submitted , WLCcan do radius authentication.
Also 8.0 simply brings Redirection over HTTPS feature in to the WLC and there is no change in anything else i.e the concept via which web-authentciation/works.
Regards
Dhiresh
**Please rate helpful posts**

GUEST WLANs ::: user self regsitration

I would like to share a few thoughts about guest WLAN access.
- if you have a lot of guests this means a lot of work in terms of account & password generation plus changing the credentials after a certain time.
Now you can offload this to lobbyadmin / "Ambassadors" but still it means work. Further on it is hard to do if you get 500 visitors. Is there any way of secure user sellf enrollment / self regiostration?
- normally, if you print the credentials on badges the credentials can be shared. Is there any way to do a mac locking in a way so that only the first MAC address which successfully loged on with this credentials can use them?
- Is there a thermal / label printer which would work with the WiSM so that the generated password can be printed on a small note/receipt once the lobbyadmin registered the guest?
Thanks,
--Joerg

Howdy,
We deployed Guest Internet Access (GIA) a year ago, before our LWAPP migration began across 30 hospital systems. Our business requirements were:
1) No charge to guests
2) Minimize have VS have not's issues (no using credit cards, etc for validation)
3) Centralized ISP(s)
4) Some form of self-reg as NONE of the hospitals wanted staff to have to do anything
We ended up doing an Advanced Services engagement with Cisco. Looked at BBSM & SSG. Settled on BBSM. GRE + VRF overlay network. The main part of the CAES engagement was to 'adapt' their existing custom 'sponsor' app to accomodate self-reg. Bottom line is we were underwhelmed with the sponsor app, although I heard @ Networkers last year from a Cisco internal IT manager that they've enhanced it considerably so YMMV.
We dropped the sponsor app & I dug in to the BBSM's SDK docs. I built a simple web form that folks get re-directed to in the BBSM's 'walled garden'. They choose Dr, Guest of Patient or business partner and based on this selection have to provide add'l info such as contact within our company. Bear in mind that there's no way to check any of this so we do have some 'donald ducks' show up in registration. Once they fill in the info, we replay their info & IP to them visually along w/ the AU policy. They click accept & it posts a string back to the BBSM that calls a pageset to initiate their session. For the doctors personal devices we BBSM auth them against radius so that they can use existing novell credentials & not have to 'sign up' each time.
This has worked pretty well for > 1yr. The BBSM unfortunately is not the most stable platform. Appliance, Win2k w/ MS ISA & some fancy cisco nat code is what it amounts to. I have 2 of them. One died already (HDD/controller) and both have had to be rebooted (hung) probably 5-6 times in 1yr.
Sooo. We are excited about GIA via LWAPP. Removes the complexities of the overlay network, gets rid of BBSMs (potentially) and has the capability to provide some redundancy where the BBSMs do not.
As far as self-reg under GIA-over-LWAPP... Since there is no way to enforce truthful registration, it is, in my opinion, of dubious value. Our previous 'extremest' security officer that insisted on it has left the building and I am exploring forgoing it completely with mgt as it's the one major complaint we get amongst otherwise raving reviews of the service (we survey the guests, etc).
One other complaint we've had is "We don't like having to (completely) re-register every 8 hours. Couldn't we just set up our own userid/password & reuse @ session expiry?"
Considering all of this, if push comes to shove & I'm forced to keep self reg as we migrate to LWAPP then here is my plan & what I think you'll want to explore:
1) Redirect the guest users to a (offbox) webform. Collect info including chosen userID/pass.
2) On post, write to sql backend. Mysql should work fine on the cheap.
3) Use ACS (or freeradius) to radius auth the user against this external (to ACS) database, just need a second or two delay to make sure form post data makes it into DB prior to posting url back to anchor controller.
Benefits:
1) Easier reporting then old reg form-post text file
2) Ability to do sql replication to alt datacenter where redundant anchors live
3) Upon user's session expiration, they can re-login using credentials they chose instead of having to completely re-register.
4) Radius server can still look @ novell via sldap for our docs.
Obviously you have to determine what the ultimate life of the user account in radius is before it's auto-purged.
Still have some details to flesh out but that should give you some ideas. Also, don't be afraid to survey your guests, even using free or cheap online survey tools (surveymonkey). Link to it @ top of selfreg form. Our users have NO problem filling out the survey & telling us what they like & don't. Good info.
Hope it helps.

Client unable to get IP address on guest wlan

Hi all, I recently setup a 2504 WLC that has two primary WLANs (internal and guest) which get their IP addresses from a central DHCP server using the local router's broadcast forwarding. Things seem to be working well for the internal wlan, but clients on the guest wlan don't seem to be getting IP addresses. If I give the client a static IP they are able to communicate across the wlan okay.
It is worth noting that I am using LAG between the controller and router and this guest wlan is really just a regular wlan (with PSK) that has an access-list applied to force it to the internet only. The access-list should be allowing dhcp requests through, but in any case, I removed the access-list and it made no difference.
Here is a debug client for a machine connected to the guest vlan (vlan 33). The internal wlan is on the 10.10.10.0/24 network (same as wired and same that the AP's are connected to) and the guest wlan is 10.33.0.0/16.     I don't understand why I am seeing the dhcp request come from the internal vlan/wlan first and it gets an IP address on this network. I then see a request on the guest wlan/vlan at which point it appears to get a valid IP address on the guest network (10.33.0.0), but the client never sees this.
Thoughts?
Thanks,
Bryan
(Cisco Controller) >debug client 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:32.991: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREQUEST (1) (len 308,vlan 1, port 13, encap 0xec03)
*DHCP Socket Task: Feb 25 00:49:32.991: 8c:2d:aa:36:ca:a3 DHCP processing DHCP DISCOVER (1)
*DHCP Socket Task: Feb 25 00:49:32.991: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:32.991: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 0, flags: 0
*DHCP Socket Task: Feb 25 00:49:32.991: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:32.992: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:32.992: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 0.0.0.0, giaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:32.992: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to DS
*DHCP Socket Task: Feb 25 00:49:32.992: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREPLY (2) (len 331,vlan 1, port 13, encap 0xec00)
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP processing DHCP OFFER (2)
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 0, flags: 0
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 10.10.10.165
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 10.10.10.246, giaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP   server id: 10.10.10.246 rcvd server id: 10.10.10.246
*DHCP Socket Task: Feb 25 00:49:32.993: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to STA
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREPLY (2) (len 308,vlan 33, port 13, encap 0xec00)
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP processing DHCP OFFER (2)
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 0, flags: 0
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:32.994: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 10.33.1.1
*DHCP Socket Task: Feb 25 00:49:32.995: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 10.10.10.246, giaddr: 10.33.0.1
*DHCP Socket Task: Feb 25 00:49:32.995: 8c:2d:aa:36:ca:a3 DHCP   server id: 10.10.10.246 rcvd server id: 10.10.10.246
*DHCP Socket Task: Feb 25 00:49:32.995: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to STA
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREQUEST (1) (len 308,vlan 1, port 13, encap 0xec03)
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP processing DHCP REQUEST (3)
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 1, flags: 0
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 0.0.0.0, giaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   requested ip: 10.10.10.165
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP   server id: 10.10.10.246 rcvd server id: 10.10.10.246
*DHCP Socket Task: Feb 25 00:49:33.997: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to DS
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREPLY (2) (len 308,vlan 1, port 13, encap 0xec00)
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP processing DHCP NAK (6)
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 0, flags: 8000
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 0.0.0.0, giaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP   server id: 10.10.10.246 rcvd server id: 10.10.10.246
*DHCP Socket Task: Feb 25 00:49:33.998: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to STA
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP received op BOOTREPLY (2) (len 308,vlan 33, port 13, encap 0xec00)
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP processing DHCP NAK (6)
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   xid: 0xbcf5ea3c (3170232892), secs: 0, flags: 8000
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   chaddr: 8c:2d:aa:36:ca:a3
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   siaddr: 0.0.0.0, giaddr: 10.33.0.1
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP   server id: 10.10.10.246 rcvd server id: 10.10.10.246
*DHCP Socket Task: Feb 25 00:49:34.000: 8c:2d:aa:36:ca:a3 DHCP successfully bridged packet to STA
*apfMsConnTask_1: Feb 25 00:49:35.320: Stats update: Non Zero value

One way to test also is to connect a laptop to a port assigned for the guest vlan. If the device gets an IP, then it's something on the WLC you have to configure. If the device doesn't, then it's a network issue or dhcp server issue.
Sent from Cisco Technical Support iPhone App

Guest WLAN need to re-authenticate for each new tab

Hi,
We installed recently a new WLC 2504 with 22 AP's.
We use web authentication for the guest WLAN.
The porblem is : users can login and authenticate but whenever the open a new webbrowser tab they need to re-authenticate again.
And this for each new tab they open.
Anybody knows how to solve this?

No, the user shouldn't have to reauthenticate for every tab they open, once the clients entry is built in the MSCB they should stay in a RUN state until either the reauth timer or the user idle timer expire.
First I'd upgrade to 7.0.220.0 and see if that resolves the issue. If it doens't get a TAC case open.
Steve

Guest WLAN and Web Auth?

Hi Guys,
Maybe someone can help me out?
I just finished setting up a trial "Cisco Virtual Wireless Controller" with nearly the same configuration as our Physical
"Cisco Wireless Controller" with the exception of having 2 ports. Anyhow, I managed to get everything working except for the WEB AUTH on the Guest WLAN. When a client connects, he gets a DHCP address from our ASA but when we try to get to a website, we never reach the WEB AUTH page.
What I tried so far is..
add a DNS Host Name to the virtual interface and assign it to our internal DNS server.dns name was resolving but we were unable to ping 1.1.1.1
changed the virtual ip from 1.1.1.1 to 2.2.2.2 and modified the DNS entrydns name resoved but still could not ping 2.2.2.2(I think this is normal)
changed the virtual IP to a private address of 192.168.102.1 and modified the dns entrysame result
I've attached some screenshots of our configuration.

Troubleshooting Web Authentication
After you configure web authentication, if the feature does not work as expected, complete these
troubleshooting steps:
Check if the client gets an IP address. If not, users can uncheck
DHCP Required
on the WLAN and
give the wireless client a static IP address. This assumes association with the access point. Refer to
the
IP addressing issues
section of
Troubleshooting Client Issues in the Cisco Unified Wireless
Network for troubleshooting DHCP related issues
1.
On WLC versions earlier than 3.2.150.10, you must manually enter
https://1.1.1.1/login.html
in
order to navigate to the web authentication window.
The next step in the process is DNS resolution of the URL in the web browser. When a WLAN client
connects to a WLAN configured for web authentication, the client obtains an IP address from the
DHCP server. The user opens a web browser and enters a website address. The client then performs
the DNS resolution to obtain the IP address of the website. Now, when the client tries to reach the
website, the WLC intercepts the HTTP Get session of the client and redirects the user to the web
authentication login page.
2.
Therefore, ensure that the client is able to perform DNS resolution for the redirection to work. On
Windows, choose
Start > Run
, enter
CMD
in order to open a command window, and do a nslookup
www.cisco.com" and see if the IP address comes back.
On Macs/Linux: open a terminal window and do a nslookup www.cisco.com" and see if the IP
address comes back.
If you believe the client is not getting DNS resolution, you can either:
Enter either the IP address of the URL (for example, http://www.cisco.com is
http://198.133.219.25)
♦
Try to directly reach the controller's webauth page with
https:///login.html. Typically this is http://1.1.1.1/login.html.
♦
Does entering this URL bring up the web page? If yes, it is most likely a DNS problem. It might also
be a certificate problem. The controller, by default, uses a self−signed certificate and most web
browsers warn against using them.
3.
For web authentication using customized web page, ensure that the HTML code for the customized
web page is appropriate.
You can download a sample Web Authentication script from Cisco Software Downloads. For
example, for the 4400 controllers, choose
Products > Wireless > Wireless LAN Controller >
Standalone Controllers > Cisco 4400 Series Wireless LAN Controllers > Cisco 4404 Wireless
LAN Controller > Software on Chassis > Wireless Lan Controller Web Authentication
Bundle−1.0.1
and download the
webauth_bundle.zip
file.
These parameters are added to the URL when the user's Internet browser is redirected to the
customized login page:
4.
ap_mac The MAC address of the access point to which the wireless user is associated.
♦
switch_url The URL of the controller to which the user credentials should be posted.
♦
redirect The URL to which the user is redirected after authentication is successful.
♦
statusCode The status code returned from the controller's web authentication server.
♦
wlan The WLAN SSID to which the wireless user is associated.
♦
These are the available status codes:
Status Code 1: "You are already logged in. No further action is required on your part."
♦
Status Code 2: "You are not configured to authenticate against web portal. No further action
is required on your part."
♦
Status Code 3: "The username specified cannot be used at this time. Perhaps the username is
already logged into the system?"
♦
Status Code 4: "You have been excluded."
♦
Status Code 5: "The User Name and Password combination you have entered is invalid.
Please try again."
♦
All the files and pictures that need to appear on the Customized web page should be bundled into a
.tar file before uploading to the WLC. Ensure that one of the files included in the tar bundle is
login.html. You receive this error message if you do not include the login.html file:
Refer to the Guidelines for Customized Web Authentication section of Wireless LAN Controller Web
Authentication Configuration Example for more information on how to create a customized web
authentication window.
Note:
Files that are large and files that have long names will result in an extraction error. It is
recommended that pictures are in .jpg format.
5.
Internet Explorer 6.0 SP1 or later is the browser recommended for the use of web authentication.
Other browsers may or may not work.
6.
Ensure that the
Scripting
option is not blocked on the client browser as the customized web page on
the WLC is basically an HTML script. On IE 6.0, this is disabled by default for security purposes.
7.
Note:
The Pop Up blocker needs to be disabled on the browser if you have configured any Pop Up
messages for the user.
Note:
If you browse to an
https
site, redirection does not work. Refer to Cisco bug ID CSCar04580
(registered customers only) for more information.
If you have a
host name
configured for the
virtual interface
of the WLC, make sure that the DNS
resolution is available for the host name of the virtual interface.
Note:
Navigate to the
Controller > Interfaces
menu from the WLC GUI in order to assign a
DNS
hostname
to the virtual interface.
8.
Sometimes the firewall installed on the client computer blocks the web authentication login page.
Disable the firewall before you try to access the login page. The firewall can be enabled again once
the web authentication is completed.
9.
Topology/solution firewall can be placed between the client and web−auth server, which depends on
the network. As for each network design/solution implemented, the end user should make sure these
ports are allowed on the network firewall.
Protocol
Port
HTTP/HTTPS Traffic
TCP port 80/443
CAPWAP Data/Control Traffic
UDP port 5247/5246
LWAPP Data/Control Traffic
(before rel 5.0)
UDP port 12222/12223
EOIP packets
IP protocol 97
Mobility
UDP port 16666 (non
secured) UDP port 16667
(secured IPSEC tunnel)
10.
For web authentication to occur, the client should first associate to the appropriate WLAN on the
WLC. Navigate to the
Monitor > Clients
menu on the WLC GUI in order to see if the client is
associated to the WLC. Check if the client has a valid IP address.
11.
Disable the Proxy Settings on the client browser until web authentication is completed.
12.
The default web authentication method is PAP. Ensure that PAP authentication is allowed on the
RADIUS server for this to work. In order to check the status of client authentication, check the
debugs and log messages from the RADIUS server. You can use the
debug aaa all
command on the
WLC to view the debugs from the RADIUS server.
13.
Update the hardware driver on the computer to the latest code from manufacturer's website.
14.
Verify settings in the supplicant (program on laptop).
15.
When you use the Windows Zero Config supplicant built into Windows:
Verify user has latest patches installed.
♦
Run debugs on supplicant.
♦
16.
On the client, turn on the EAPOL (WPA+WPA2) and RASTLS logs from a command window, Start
> Run > CMD:
netsh ras set tracing eapol enable
netsh ras set tracing rastls enable
In order to disable the logs, run the same command but replace enable with disable. For XP, all logs
will be located in C:\Windows\tracing.
17.
If you still have no login web page, collect and analyze this output from a single client:
debug client
debug dhcp message enable
18.
debug aaa all enable
debug dot1x aaa enable
debug mobility handoff enable
If the issue is not resolved after you complete these steps, collect these debugs and use the TAC
Service Request Tool (registered customers only) in order to open a Service Request.
debug pm ssh−appgw enable
debug pm ssh−tcp enable
debug pm rules enable
debug emweb server enable
debug pm ssh−engine enable packet

How to print guest WLAN account password?

When a guest wlan user is created (by the LobbyAdmn function) there I get back a pop-up box with her autogenerated password. This is normally a rather complex password. Is there any way to print this with e.g. a label printer so that I can give it to people and wish them good luck rather than writing it down, making errors, joking about my hand writing etc. etc.. I think that looks rather unprofessional.

Hi Joerg,
This capability (sadly) is only available when creating Guest accounts
using the WCS,as shown in the attached doc. With WCS you have the
option to Print or email this info;
http://cisco.biz/en/US/docs/wireless/technology/guest_access/technical/reference/4.1/GAccess_41.html
Cheers!
Rob

Throttling Guest WLAN on WLC 8500

What is the best practise to throttle the Guest WLAN, which is only used for Internet access?

I agree with Steve. The situation is really going to depend on your bandwidth and just how important you feel your guest traffic is. You also have to run a higher version of code at least 7.4 to get more granular with limiting.
But here's something to consider. My deployments are pretty much a controller per facility. I tend to bandwidth limit by (guest) SSID and just provide a 10mbps DOWN and 5mbps UP. Of course depends on the size of the facility and the number of guests. That said my guests users are typically email and browsers but there are more and more video streamers coming online but for now I use 10M and 5m and run about 300 connections with no problems.
***I don't like to modify the Qos profile and limit because that requires that you shut down the radios. I like to modify the override section on the WLAN / Qos settings.
Good luck.

Guest WLAN accounts

I am working on Guest WLAN deployment using a anchor WLC and NAC Guest Access server for authentication. I now have a requirement to prevent Guest machines from logging in with the same set of credentials. I already have concurrent connections set to 1, but can I easily tie the user credentials to a Guest Machine when they login the 1st time.

I won't claim to be the expert, but I'm pretty sure that Guest login is a different "security" from your WLAN security. Whatever settings you use on your WLAN (WPA/WEP/etc.) must be configured in advance on the client in order for the user to connect to your wireless network and get an IP address. Once connected, the user will open up a browser (which will get redirected) to the guest logon page. At this point, the client can only resolve DNS and get to your guest logon web page. Once logged on, the user will be able to actually get somewhere on your wireless network, but the WLAN settings remain the same before, during, and after guest logon.
Also - if you can implement WCS, WCS will allow you to print or email the credentials.

Guest wlan design questions

I need to setup a guest wlan on a single 5508 controller. Currently all of my ap's are in h-reap mode and all in remote buildings connected via a high speed wireless wan.
The guest network could consist of 500 users in the near future, so i'm wondering what is the best way to configure the guest wlan so I don't have one big broadcast domain across my entire network?

Ok. I already have my ap's in ap groups (per building) and I have different vlans in each building with the same ssid company wide. I'm doing this via h-reap.
My question is how do I accomplish the same thing with the guest wlan, but without h-reap. Or do i use h-reap and just setup acl's to block the traffic? But then does web authentication work the same?
The confusion for me comes in at the controller level with the guest-wlan interface I created having to be attached to a vlan. Is this not needed to do web authentication?
Thanks,
Dan.

GUEST User gets disconnected on Guest Wlan on 2602 ap in Flexconnect mode

Similar Messages

Maybe you are looking for