Guest WiFi using Dot1x

Hi all,
I have been using the Guest functionality in ISE 1.1.4 (and previous versions) for a long time now and I've always been frustrated with it. I am now in the process of setting up an alternate Guest network that uses dot1x to reference the Internal Users ID source (where all registered guests are stored) in ISE to authenticate clients.
It seems to work perfectly for any activated guests, but any newly created account gets the following...
RADIUS Status:
Authentication failed : 24206 User disabled
Is there any way to circumnavigate the activation through the use of the CWP and thus make it possible for newly registered guests authenticate using dot1x?
Will changing the Guest Portal Policy Configuration (Not Used/First Logon/Every Logon) or Authentication Type (Guest/CWA/Both) solve this? Weary of changing it on the fly in production environment.
Thanks

Message Code
Message Class
Message Text
Message Description
Severity
24206
Local-user-DB
User disabled
User marked disabled in Internal database.
Info

Similar Messages

Secure Guest wifi using WPA2

A couple of years ago i asked if it was possible to connect 2 separate networks by using a guest anchor controller (https://supportforums.cisco.com/message/1309100)
The idea being we can replicate the other networks wifi settings over our wireless infrastructure without the need of installing a second wave of access point just to provide a new SSID, and allowing us the freedom and flexibility to deploy this 2nd network where needed.
We need to use WPA/WPA2 with radius authentication with the radius server living on the second network.
We already have a DMZ between the two networks and are planning to put the anchor controller on the DMZ.
Has anyone tried this sort of configuration and can offer any tips?
regards,
Adam

Correct me if i am wrong
As I can understand you are trying to have two controllers one with APs connected and the other without APs located in the DMZ. You want to define a WLAN on both controllers and have the traffic of clients connected to that certain WLAN to be tunneled back to the DMZ controller for further filteration .
Correct
You are talking about WPA with RADIUS , so you mean WPA Enterprise?
Correct
Which means you are talking about L2 security measures.
If you are thinking of having the DMZ controller responsible for L2 authentication described above that is not going to happen cause everything on L2 is handled on the internal Foriegn not the DMZ. Thats what i'm getting :<
IF you mean that you want to have WPA PSK with Web auth , in that case it will work and the web authentication will be handled on the DMZ as the web auth is L3 security measure. No it's L2 We are trying to achive
Regards
Many thanks for taking the time to reply. I think the solution might have to be somehow get our internal ACS radius server to proxy requests to the remote radius server, and do it that way.

Guest wifi using RV180 and Aironet 1130AG

How would I configure a "guest" wireless network, with a different key/password, that uses a different subnet than the existing network?
We have a simple 192.168.1.x subnet currently, with the Aironet as our only AP. The Aironet support a "guest" wireless function, but how do I make that work with the RV180?

Good morning
Hi Dave , thanks for using our forum, my name is Johnnatan and I am part of the Small business Support community. In order to configure different wireless subnets in your rv180, first at all you have to create different vlan (subnets) then associate these vlan to a specific SSID in your Aironet, you can configure each SSID with differents passwords, I could help you with the RV180 configuration, in order to configure your Aironet you can post your question in the wireless section so you can have more feedback on your case, in order to create your vlan you can follow these instructions:
http://www6.nohold.net/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=2902
http://www6.nohold.net/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=2165
http://www6.nohold.net/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=2152
I hope you find this answer useful,
*Please mark the question as Answered or rate it so other users can benefit from it"
Greetings,
Johnnatan Rodriguez Miranda.
Cisco Network Support Engineer.

How-do-i-configure-guest-wifi-access-using-2504-wlc-fortigate-utm-l3-device

Dear All
I have a 2504 Wireless Controller with multiple radios attached. I currently have a "private" WLAN configured (taking ip from windows server based DHCP of Range 192.1681.0/24 ) and working, but I need to add a Guest/Public WLAN which should take the IP from Other DHCP Configured on Fortigate UTM of range 172.16.0.0/24.
We have one SG300 switch in the office and the rest are basic switches.
Our firewall/router is a Fortigate UTM 240D
Find the attached network diagram for the issue.
Is there a SIMPLE way to enabling guest access that doesn't require VLANS (or are VLANS easier than I'm making them)?
Thanks.
- See more at: https://supportforums.cisco.com/discussion/12473186/how-do-i-configure-guest-wifi-access-using-2504-wlc-fortigate-utm-l3-device#sthash.aj1XcWI0.dpuf

Complete these steps in order to configure the devices for this network setup:
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/70937-guest-internal-wlan.html
Configure Dynamic Interfaces on the WLC for the Guest and Internal Users
Create WLANs for the Guest and Internal Users
Configure the Layer 2 Switch Port that Connects to the WLC as Trunk Port

Certificate error using webauth on guest wifi

I am trying to setup a guest wifi. We have our custom page package loaded and it looks great with our graphics, logo. Basically you have to check a box and click accept to the terms of service, and then it forwards you through to VLAN 12 in this case, which is directed to an untangle software based firewall / router with its own outside IP address.
The issue is that when you initially join the wireless network, the page at 1.1.1.1/login.htm throws a certificate error and you have to continue anyway (Internet Explorers language).
Does this mean we need to put our wildcard certificate on it for our *.domain.com (GoDaddy signed) or does it need another kind of certificate? What format would it need to be in (I have a pfx but can convert it if need be).
We are not passing any credentials, so it doesn't NEED to be https, so under Management > HTTP-HTTPS I changed WebAuth SecureWeb to Disabled. However when doing this, WebAuth is still putting https://1.1.1.1 and I get a page cannot be displayed. I take the s out of https and then the webauth page works.
So two things here, how could I just use it in http, or if preferred, what format and what kind of certificate needs to make https work in webauth? This is primarily for vendors that visit, or guests in our waiting lobby with their tablets or smartphones.
The WLC is a 5508 running 7.4.121.0.

I also tried this site as well:
http://www.packethead.net/2013/08/05/cisco-wlc-wireless-lan-controller-certificate-install-mac-os-x/
I tried it command line, and it tftp's fine in all instances above but I get:
TFTP Webauth cert transfer starting.
TFTP receive complete... Installing Certificate.
Error installing certificate.
Might have to open a case with tac if this doesn't work.
I have openssl 1.0.1j is that maybe a bad version? also every time I run it it says WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Well of course not, that is a *nix based bath and this is the 64-bit windows version.
What I can get is a download from go daddy and the wildcard cert is already generated. I cannot submit a new cert request. We have this key and I've tried different ways of converting it with OpenSSL, I've imported it to windows and in the mmc for certificates exported in various formats. Nothing will work with this WLC.

How can I set up a guest WiFi network using Time Capsule and Airport Express extension?

How can I set up a guest WiFi network using Time Capsule and Airport Express extension?

Sorry, but it is not possible to "extend" the Guest Network using either wireless or an Ethernet connection.

Using several Airport Extremes to create and extend corporate + guest wifi

hello all,
my office has purchased 6 airport extremes for our new office, AirPort Extreme 802.11ac (6th Generation), running version 7.73
the plan was to hard wire one extreme via the wan port and create both a corporate and guest network
then link to the others throughout the office by wirelessly extending to provide complete coverage
after moving around the location of one or two units my coverage is now complete across the office space
my setup is as follows:
my network is a windows active directory setup where one of my domain controllers is my DHCP server in the range 192.168.x.x
to enable the guest network on my extremes i need to have my first hard wired (wan port) extreme unit configured in DHCP mode
this airport extreme has pulled down an ip address from my windows server in the range 192.168.x.x
the extreme then uses its own dhcp range to provide connectivity to my clients, 172.16.x.x for corporate wifi and 10.0.x.x for guest wifi
my issue is
the dhcp range that the extreme uses for all my corporate wifi users is 172.16.x.x
i cannot access any servers on my windows network 192.168.x.x by drive maps/hostnames as they are challenged for authentication
I can only access by using ip addresses instead of hostnames
all of my shares and wired users are configured to use hostnames for file shares, printers etc on my servers
the first extreme gets its DNS info from my windows dhcp server correctly but these settings are not passed down to my wifi clients
is there a way to do this ?
I have tried using the 'domain name' field on the extreme dhcp config but this had made no difference
can anyone advise on this ?
do i need to use a different setup, maybe switch to wired config ?
what i'd like to have is the following:
2 wireless networks, one for corporate users and one for guests/visitors
my corporate users to have access to all my corporate servers as their permissions allow using hostnames for access
my guest users to have internet access only
my 6 access points to be connected to each other either wired or wirelessly to provide coverage throughout my office
i was told that the 6 airport extreme's would allow me to do this but now i'm not so sure
any help or suggestions would be gratefully accepted,
thanks

You are trying to use Apple domestic products in a business setup.. this is not what they were designed for.
Could you use 3 units to cover the offices.. please have a go as this simplifies things tremendously.. just use three units in bridge.. preferably all connected to your ethernet network and so operating as AP only.
If that works then use the other 3 units for your guest network.. these should then be placed on a different vlan via your main managed switch.. so they can get internet but have no connection at all to the office network.. but other ways around it could be found. As you have already discovered a simple double NAT might sufficiently block guest access.

Attempts to use public/guest wifi yields password prompt webpage

I've had my iPhone 4s for about a month and have been unable to connect to any guest wifi accounts. EVERY time I get a webpage prompting me to ask the business for a password, rather than the page requiring that I agree not to use their connection for any illegal activities. I have no trouble connecting to our home wifi, since I've already provided the password.
I previously had a Droid and never encountered such a page. I've googled and found not a single reference to this issue, either.

See...and this is what makes no sense. No one else is receiving this prompt in the same scenario at the same moment. I have received this very same prompt from every place with free/guest wifi service. I haven't once been able to access free wifi since purchasing this phone. I never before had to enter a password with my previous phone and no one sitting at the same table with me is being required to enter a password to utilize the same wifi connection. It has to be the phone. Nothing else makes any sense. Occam's Razor, and all.
I guess now I need to figure out if this is an issue to take up with Verizon or with Apple.

Can I use multiple E4200's in bridge mode, to enable a "guest wifi' mesh?

I have four E4200 units on my network, each with an unique IP address, in bridge mode to act as a wireless mesh across my entire building. They are all connected to my central L3 switch, via their Internet ports.
Is it possible to enable the Guest network on each unit, to create a 'Guest Wifi' mesh (providing that I allow the 192.168.33.0 network to route across my network fabric), or will this not work because each indivudual AP will be assigning IP address 192.168.33.1 as it's gateway address meaning that I would have four distinct MAC addresses within the network, each trying to claim that they are IP 192.168.33.1?

As soon as you enable guest access on the router, it will start providing the IP address 192.168.33.x to the clients connecting to the guest network and we cannot change the IP address range of guest network.
Since you have 4 units (E4200), you can enable guest wi-fi of each of them however cannot create a guest wi-fi mesh as all the 4 units have different IP address.

How to set up guest wifi network on 1200 series APs with disclaimer web portal?

I've been thinking about this one for awhile. I want to set up a guest wifi network without any security (AES / TKIP) that allows guests to connect. Ideally, their web browser would be redirected to a web portal containing legal disclaimers, and they would need to accept the terms and conditions to use the guest wifi. I would also like to have them be required to visit the web portal again every 8 hours after that to accept the terms and conditions again.
I have a Cisco 1240AG access point already. What else do I need to make this work?

I don't believe you can do this just with an AP running in autonomous mode you would need to have a WLC to configure the splash page.
Have a look here:
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-0/configuration/guide/c70/c70users.html#wp1049273
Alternatively you can use software running on a PC/Server. Something like http://www.antamedia.com/hotspot/
Hope that helps!
Matty

"No internet access" on Guest Wifi

We upgraded our router the other day, we made a backup as well as a txt copy of the config file for copying in various commands to the new router .
We have a Secure wifi for employees and a Guest wifi for visitors. We have a server doing the DHCP(10.27.131.8) for both the secure (10.27.131.0 network) and for the Guest (10.26.131.0 network). The Secure wifi is working as it should be - the Guest however is not. Visitors can connect and get a valid IP address from the 10.26.131.0 network but have no internet access. Everything else has stayed the same - no changes to the AP's.
Again we copied the config from the old to the new with a few minor changes but nothing that should effect the Guest wifi.
I did an ipconfig after connecting to the Guest Wifi and I can get a correct IP address 10.26.131.214, Default GW: 10.26.131.1.
I enclosed the config from my router is anybody could shed some light,
Thanks in advance.
Building configuration...
aaa new-model
aaa authentication login default line local
aaa authentication login vtymethod group tacacs+ line
aaa authentication login conmethod line
aaa authentication login httpmethod group tacacs+ local
aaa authentication enable default enable group tacacs+
aaa authentication ppp default none
aaa authorization config-commands
aaa authorization exec default local group tacacs+ none
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
aaa session-id common
resource policy
ip subnet-zero
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.26.131.1 10.26.131.100
ip dhcp pool guest
   network 10.26.131.0 255.255.255.0
   dns-server 208.67.222.222 208.67.220.220
   default-router 10.26.131.1
   domain-name guest.X.xxx
interface Tunnel3
ip address 172.17.3.2 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 19x.xx.xx.xx
interface Tunnel55
ip address 192.168.66.10 255.255.255.0
ip accounting output-packets
ip accounting access-violations
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 12.xx.xx.xx
interface FastEthernet0/0
ip address 12.xx.xx.xx 255.255.255.248
ip nat outside
ip route-cache flow
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1
description CONNECTION TO SW3
no ip address
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.27.131.254 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
no snmp trap link-status
interface FastEthernet0/1.20
description GUEST NETWORK
encapsulation dot1Q 20
ip address 10.26.131.1 255.255.255.0
ip access-group 101 in
ip helper-address 10.27.131.8
no snmp trap link-status
interface FastEthernet0/1.200
description Phone VLAN
encapsulation dot1Q 200
ip address 10.5.2.254 255.255.255.0
no snmp trap link-status
interface Serial0/0/0
no ip address
shutdown
interface Serial0/2/0
no ip address
shutdown
interface Serial0/3/0
no ip address
shutdown
ip classless
ip route 0.0.0.0 0.0.0.0 12.xx.xx.xx
ip route 10.5.5.0 255.255.255.0 10.5.2.1
ip route 10.10.0.0 255.255.255.0 172.17.3.5
ip route 10.10.200.0 255.255.255.0 172.17.3.5
ip route 10.25.131.0 255.255.255.0 192.168.66.20
ip route 10.27.129.0 255.255.255.0 172.17.3.5
ip route 10.27.130.0 255.255.255.0 172.17.3.5
ip route 140.xx.xx.xx 255.255.0.0 172.17.3.5
ip route 192.168.2.0 255.255.254.0 172.17.3.5
ip route 192.168.99.0 255.255.255.0 172.17.3.5
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 2 interface FastEthernet0/0 overload
access-list 2 permit 10.27.131.0 0.0.0.255
access-list 2 permit 10.25.131.0 0.0.0.255
access-list 2 permit 192.168.66.0 0.0.0.255
access-list 2 permit 10.14.0.0 0.0.0.255
access-list 2 permit 10.5.5.0 0.0.0.255
access-list 2 permit 10.5.2.0 0.0.0.255
access-list 5 deny   10.27.131.123
access-list 5 permit 192.168.2.0 0.0.0.255
access-list 5 permit 10.27.131.0 0.0.0.255
access-list 5 permit any
access-list 101 permit tcp any host 10.27.131.8 eq 67
access-list 101 permit udp any host 10.27.131.8 eq bootps
access-list 101 permit ip 10.26.131.0 0.0.0.255 host 10.14.0.6
access-list 101 deny   ip 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 10.26.131.0 0.0.0.255 any
access-list 102 permit icmp 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 192.168.66.0 0.0.0.255 any
access-list 102 permit ip 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 10.27.131.0 0.0.0.255 any

Hi,
I also apologize for my late answer.
I appears your ACL 101 that filters traffic entering the Fa0/1.20 is not correctly written to allow DHCP requests to be processed by the router. The attempt has been made - but it is not correct. In particular, check out the second entry in the ACL 101:
access-list 101 permit udp any host 10.27.131.8 eq bootps
It allows all DHCP messages that are already targeted to 10.27.131.8, the DHCP server. However, such targeted DHCP messages may be used by clients only after they know who the DHCP server is in the first place. Until then, the requests are targeted to 255.255.255.255 and sourced from 0.0.0.0. Such packets are not allowed by any entry in the ACL 101 and are therefore dropped even before the DHCP Relay Agent can process them. That would explain why your clients actually cannot obtain IP address via DHCP in VLAN 20.
We need to add the following entry immediately before or after the existing second entry in the ACL 101:
access-list 101 permit udp any host 255.255.255.255 eq bootps
You may accomplish this by the following sequence of commands directly pasted into the global configuration:
ip access-list resequence 101 10 10
ip access-list extended 101
15 permit udp any host 255.255.255.255 eq bootps
end
The first line will cause the individual entries of the ACL 101 to be internally numbered, starting with the sequence number 10 and incrementing by 10 for each subsequent entry. The second line enters the ACL 101, treating it as a named ACL, allowing us to use the extended editing features. Finally, the third line starting with the sequence number 15 will cause the entry to be added between the existing first (seq no 10) and second (seq no 20) entry. It must be entered including the sequence number, otherwise the line will be added at the end of the ACL.
Would you mind trying out this modification? The former corrections with the NAT I have described earlier must be applied as well.
Best regards,
Peter

Guest WiFi not working correctly

I just bought a new EA6300 router expecially for it's guest wifi functionality but i have problems with this feature.
weather i log in via my laptop/ macbook/ android or iphone i can connect to the guest wifi network but the guest wifi portal is not displayed and i cannot login as guest.
After a reset of the router the guest wifi works for a little while but fails within couple of hours.
Is this a firmware bug or does someone knows a workaround.
Hope Linksys can help me with this standard build in feature!!!
Thanks in advance.

blue_butterfly wrote:
Hey there, bramschats! Intermittent guest network connection may be caused by wireless interference. Try changing the wireless channel of your router to either 1, 6, 9, or 11. You may also want to change your security settings to WPA2 Personal. That should take care of the intermittent connection. If all else fails, update the router's firmware.
There is no "I"in the word Team.
(moxx)
hi blue_butterfly: I would kindly suggest a better way to do what you suggest. It would be best to troubleshoot the problem by looking first to see if there actually is congestion. there are apps available for free to see what channels are being used. By randomly moving to another channel you may cause others to then be interfered with causing them to move and the problem just continues to move around. Also, the only wifi channels that don't overlap (at least here in the USA) are channels 1, 6, and 11. All the other channels cause at the very least a small amount of signal degragation to the adjacent channel. So try to find the app for whatever device you can use, android or iPhone and see what is actually out there, select the channel with the lowest signals on it and see if that helps. The channels in between 1, 6 and 11 can certainly be tried but just be aware that they are the least advisable ones to use.
@ bramschats: if you are able to use the guest login at some times but then it doesn't work after a while try refreshing your browser before you re-boot the router. If that still doesn't work and the only way to fix it is to reboot the router complain to belkin about it. There seems to be a lot of bugs in their software lately and the only way we will get their attention is to complain, return deivces etc.

Extending Guest Wifi with Multiple Base Stations

The 7.6.3 firmware update reports this new feature:
"The ability to extend the Guest Wi-Fi network on a network that is configured with multiple AirPort Base Stations"
http://support.apple.com/kb/DL1617
I assumed that this meant that an Airport Express was able to "Extent" the guest wifi network. However, I am not able to get this to work. Having entered all the details I just get the orange light and the message that it was unable to extend the network - check the details. I have checked them multiple times and still not working. If I switch to extending the "main" network then it works first time, but does not extend the guest as far as I can see.
If I set up from scratch it picks up the guest network and tries to extend but then switches to the main wifi later in the process after claiming to extend the base station itself, not one of the wifi networks.
What does this update mean?! Has anyone managed to "extend the Guest Wi-Fi network" in any way?
All devices have been updated to 7.6.3 and all airport utilities have been updated to the latest version (6.2).
I am running an extreme as the main router then I have a number of expresses to extend round a large building, but it is the guest that needs extending!!
Any help would be much appreciated!
Adam

I am running an extreme as the main router then I have a number of expresses to extend round a large building
You need to have the "new" AirPort Express to be able to extend the Guest Network. The "new" Express looks like a miniature AirPort Extreme.
Check the Model No on the side of the AirPort Express devices that you have. If you see A1264 this is an older version of the Express that does not have Guest Network capabiltiy.
Using an AirPort Extreme and new AirPort Express here., the Guest Network "extends" just fine when I try this using wireless only. I also have another AirPort connected back to the main AirPort Extreme using a wired Ethernet connection. The Guest Network is extended on this device as well.

ISE Guest Wifi Portal Users restricted to 5 day account

Hi,
I have a custom Guest wifi portal configured in Mulit-Portal Configuration to do self service, Portal Type is default Portal.
I have the Guest Portal Policy configured to a time profile of 6 months which works ok for my other wifi profiles.
My users however are only getting a 5 day account to expiry.
I suspect the Guest Portal I have configured is not using the Default Guest Portal Policy as configured in "Web Portal Management\Settings\Guest\Portal Policy but I can't find any other option or settings
Please Any help gratefully recieved.
Thanks

There was a bug that caused a failure like this, think it was solved in 1.2 patch 8... could be worth a try to patch if you haven't done so....

Guest wifi with Airport Express

Is it possible to create a guest wifi hot spot using the Airport Express? I currently have a 2Wire modem/router which provides a wired and password protected wireless network. I'd like to use my Airporrt Express to add an additional password free wireless connection that would not have access to my main network. Is this possible with the equipment that I have?
Thanks!

You can configure the AirPort Express as a "bridge" to "Create a wireless network" and connect to another router using an ethernet cable. But, using an Apple device as the main router, guests connecting through the Express will be able to "see" other devices on the network, so you would probably want to password protect the AirPort Express network.
I don't know whether a 2Wire gateway could be configured to work as you desire. My guess would be no, but I may be wrong. In any case, it's probably a question for 2Wire support.
Instead of "AirPort Express", you could substitute the phrase "wireless access point" in your post and then post it on the 2Wire site.
Please let us know on your findings.

Guest WiFi using Dot1x

Similar Messages

Maybe you are looking for