Layer 3 Web Authentication

I'm using a WLC and on my SSID I'm using Layer 3 Security with Web Auth and having a guest user enter there email address to gain access to the network. The user connects to the network enters there email address and then has access to the network. Can anyone tell me where I can find which users logged into my network by showing there email address on the WLC. Thanks in advance

Choose Monitor and then choose clients from the GUI interface of the WLC and type the Mac address of the client. To monitor the client by username you need WCS

Similar Messages

  • WLC 4402 Web Authentication, Mac Filtering and Layer 2 Seciruty

    Hi All,
    I have configured web authentication and Mac filtering on WLC 4402 for my wireless network and its working fine. I wants to configure layer 2 security for the same Wireless network without pre shared key. Could you please advice how to configure layer 2 security with web authentication withour preshare key.
    Is there any security issue with web authentication and Mac FIltering only? My concern in my wireless network shows open.
    Thanks,
    Kashif

    Hi,
    if you have a ACS, then you can do Web auth Splash page!!! Please refer to the below doc!!
    http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080956185.shtml
    Lemme know if this answered ur question!!
    Regards
    Surendra

  • Web Authentication on Layer 3 interface with Cat 3750 - doc is wrong?

    Cisco 3750 with IP Service Image 12.2.55
    Trying to enable Web Authentication on Layer 3 interface:
    ip auth-proxy name bp_auth_proxy http inactivity-time 60
    interface GigabitEthernet1/0/5
    no switchport
    ip address 192.168.1.27 255.255.255.0
    ip access-group 101 in
    ip admission bp_auth_proxy
    last line fails:
    % This config is not supported on this platform. Try configuring a new rule.
    I also tried to set this on vlan interface, same result.
    The line works on layer 2 interface, but this is not what I need.
    Doc says everything must work with Layer 3 i/f, since 12.2.52:
    http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/swwebauth.html#wp1104204
    Am I doing something wrong?
    Thanks a lot for help!
    Sergey

    Hi, I'm having the same issue issue in 12.2(55)SE6 IP services, did you ever get it working or find a work around?
    Web-Auth-TestSW1(config-if)#int fa3/0/1
    Web-Auth-TestSW1(config-if)#no sw
    Web-Auth-TestSW1(config-if)# ip address 10.x.x.x 255.255.255.128
    Web-Auth-TestSW1(config-if)# ip admission webauth1
    % This config is not supported on this platform. Try configuring a new rule

  • 4400 WLC Layer 3 Authentication Status for WLAN Clients

    We have 3 4400 series WLC's(wireless LAN controllers). Two 4404 WLC's are on the "inside" of our network and all AP's (access points) on our network use these two WLC's as the primary or secondary controller.  The 4402 WLC Anchor controller resides in our DMZ and is used for WLANs that are more oriented for guest usage.  These guest WLANs are configured on the inside controllers also, but are "anchored" to the 4402.  On the anchor controller we are using layer 3 Web Authentication for the WLAN "Guest".  This WLAN uses the internal web-auth page within the anchor controller and a username/password combo that is locally defined on the anchor controller.
    Functionally there is no issue.  Users connecting to the WLAN are presented with the web-auth page upon connecting to the WLAN and opening a web browser.  The issue is how the layer 3 authentication information is presented on the Monitor Clients page of the "inside" WLC's management screen as compared to the "anchor" WLC.
    For example, if we log in to the anchor controller and then click Monitor, then Client, then Change Filter and choose any WLAN requiring layer 3 authentication on the Anchor controller, there will be a list of all clients currently associated.  In the Column with the "Auth" heading it shows the Layer 3 Authentication status of the clients.  For example, if there are 15 clients associated to WLAN SSID "Guest", but only 5 of them have opened their web browsers and correctly logged in, then this will be correctly displayed.  The 5 who have logged in will show "Yes" and the other 10 will show "No" in the Auth column.
    Now...the problem...on the inside controllers...if we do the same thing (monitor, clients, filter for WLAN SSID "Guest"), all 15 will show "Yes" under the Auth column. In most cases the 15 clients will be distributed accross both controllers (maybe 6 on one, and 9 on the other WLC), but both inside controllers will display all clients as having a layer 3 authentication status of "Yes".  We have proven over and over that this is not accurate.  This is very inconvenient because the "Client Count" reports we run on the WCS server reflect the same information as the "inside" controllers.  The WSC reports will show all 15 as Authenticated and they are not.  We have proven many times that the anchor WLC is the only controller accuratly conveying this info.
    Also, the engineers who helped with our network install have reproduced the same behavior in a lab with an anchor and inside controller directly connected.  They suggested it may be a code bug with the 4400 series WLC.  We are running controller Software Version 6.0.188.0 on all 3 controllers.
    Please let me know what you think may be causing this issue.  Any help or advice is greatly appreciated!

    Hi,
    We run version 7.0 on the WCS and WLCs but I thought I'd try the report and see what I got. The result is a line graph with the number of associated and authenticated clients superimposed. I'm not sure how useful a report of this nature is.
    It doesn't inspire confidence: when I specifiy the guest wireless SSID I get zero clients! I know there have been guest clients authenticated during the report period I spec'd.
    Scott

  • Problems with re authentications in a wireless with WLC working with web authentication and a radius server

    Hi everyone, im having problems in a wireless network, the SSID has security layer 2 WPA, layer 3 web authentication (internal default page), and external RADIUS.
    When a client makes a roaming from one AP to another one or when he has a idle time, he needs to re authenticate in the web login page. Somebody knows a solution to avoid this behavior?. Or somebody has a troubleshooting way to determine why the clients have this problems??

    A few things I can share that might help .. Your actually feet on the ground will be importnat to see this issue for yourself.
    I know when a client or if the AP sends a DEAUTH frame the client will need to reestablish its connection and it will 100% of the time require a new web auth. If a client loses connection while roaming and a DEAUTH is sent on either side you will get the page. If youre client isnt romaing cleanly this can be a problem.
    Another problem is your using EAP. Are you using CCK or a device that supports OKC. What does your radius server say when a client roams ?
    You could also simply your config and then reapply your security and see where it breaks. By this I mean. For testing, create a SSID turn off security and leave layer 3 web auth on. Roam and see what happens. If it works, then start to apply the security and see where it breaks.
    "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
    ‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

  • 802.1x & Web Authentication

    Dear All, Can any one help me to understand concept of web authentication. Can it be used for Guest users authentication whose pcs are not 802.1x capable. Can they be groupd ina vlan based on user name & password via web-authentication. My requirement is to use 802.1x in network for coporate users & for guest users. If corporate users are authenticated then they will be placed in corporate vlan. which is working quite well. if guest users are from same company they should be placed in same vlan somehow & if guests are from different company then they should be placed in different vlans based on credentials remember guest laptops are not 802.1x enable/capable.
    any one has idea how to achieve this without NAC hardware.

    You can use the web-based authentication feature to authenticate end users on host systems that do not run the IEEE 802.1X supplicant. You can configure the web-based authentication feature on Layer 2 and Layer 3 interfaces.
    When a user initiates an HTTP session, the web-based authentication feature intercepts ingress HTTP packets from the host and sends an HTML login page to the user. The user keys in their credentials, which the web-based authentication feature sends to the AAA server for authentication. If the authentication succeeds, web-based authentication sends a Login-Successful HTML page to the host and applies the access policies returned by the AAA server.
    http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/webauth.html#wp1067205

  • Radius server web authentication using ISE

    Hi,
    Can anyone point me in the direction of a guide to implement radius server web authentication using ISE?
    I need this to be layer 3 Web Auth with all authentication requests coming from the wireless anchor controller, therefore don't think I can implement central web auth on ISE as detailed in the user guide as its layer 2 and auth requests come from the foreign controller.
    The following link explains "Radius Server Web Authentication" using ACS.  I need to find something similar for ISE - http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/69340-web-auth-config.html  
    Thanks,

    Hi,
    Please check these:
    Central Web Authentication on the WLC and ISE Configuration Example
    http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
    Regards
    Dont forget to rate helpful posts

  • Question about dot1x & Web Authentication

    I'm not sure if what I want to do is possible so hopefully someone can set me straight.
    Right now when a user doesn't have a 802.1x capable machine, they are assigned to the guest VLAN. Then using the dot1x fallback command we could force them to use authenticate using the web if we so choose. At least this is how I understand web-auth to work. Please correct me if I'm wrong.
    But what about when someone is using an 802.1x capable machine but fails auth? Like say a user logging in locally on a domain machine or a vendor using his companies laptop. Currently those ports go into an unauthorized state and are not active. If I use the dot1x auth-fail-vlan command, it authorizes the ports for that vlan just fine.
    What I'd like to do in those cases is to put them in a restricted vlan and then force them to use web authentication to gain access to the network.
    Is that possible? I can't seem to find a way to use web authentication after a failed dot1x auth. Or is that it, a failure is a failure and there is no way to try and reauthenticate a different way?

    Hi,
    dot1x authentication and mac-authentication bypass are layer 2 authentication mechanism and webauth is a layer 3 authentication mechanism.
    u can set multiple authentication profiles and set the priority as well.
    like u can have dot1x authentication first and second webauth and third as mac-authentication bypass.
    remember the other authentication mechanism will only come into place if the first authentication is not possible that is the client is not having a suplicant for dot1x.
    if a user doesn;t have dot1x supplicant and u have configured guest vlan then the user will be put into the guest vlan otherwise the user will be in the access vlan in which the port is configured.
    if u have configured auth-fail vlan and the user gives wrong credentials the user will be put into the auth-fail vlan.
    if a user is a dot1x client and dot1x is configured then the user must pass the dot1x authentication .
    the fallback mechanism is only when the dot1x authentication cannot be executed because the client is not having dot21x supplicant. then the next mode of authentication will be triggered that is either webauth or MAB.
    if a user fails the dot1x authentication dues to wrong credentials then he cannot be prompted for a another authentication mechanism. this is to avoid security breaches.
    hope this helps.
    regards
    Sushil

  • Local Web Authentication Started after Central Web Authentication

    Hi everyone,
    We have a DMZ based anchor WLC for a guest WLAN. I have this WLAN configured for central web authentication using ISE 1.2, this works correctly and can login using the guest portal.
    However, after logging when browsing to a website everything is redirected to the local web authentication page and the policy manager state for the client goes in to a WEBAUTH_REQD state. I currently don't have any layer 3 security configured for this WLAN, so from my understanding it should just be using the central authentication provided by ISE.
    Thanks for your help.
    Mark

    Hi Mark,
    Thanks - that looks very similar to ours, though I'm doing the 3850 via the CLI as the web UI keeps dying when I click into things.
    I've realsed that I unticked the Authentication servers box instead of the Accounting as I miss-read the WLC page, however while the LWA no-longer kicks in, I'm unable to pass anything except DNS traffic.  The Anchor says that the client is in "Webauth" state so it looks like it's expecting something, but ISE says it's all ok and I can see the 3850 traffic going through the process flow.
    If I attach an AP to the WLC directly and have the accounting box ticked, then it all works exactly as I'd expect - this is just, well, odd....
    Warmest
    Kev

  • Is local EAP + Web Authentication possible in Auto Anchor Configuration

    Hi,
    I have a wireless network setup in an auto-anchor configuration with the foreign and anchor controllers. Due to the foreign controller being owned and managed by another company, I have an interesting authentication scenerio I would like to acheive. We can't implement full EAP-TLS as we would have to allow authentications from the foreign controller which is owned and managed by another company.
    Currently Web Authentication is working correctly for the Wireless Network. As another layer of security, I want to know if its possible for the wireless clients to trust a certificate installed on the foreign controller?  If so, are you able to point me in the direction of a user guide to implement.
    I found the following document which describes local EAP configuration . Would this work with Web Authentication?
    Thanks

    so, kinda but no.  EAP is a layer 2 authentication that uses encryption as well.
    WebAuth is a layer3 authentication only.
    Now the kinda....you can create guest/network users on the WLC local database, and if someone logins to the webauth portal with those credentials they will be able to get on.
    I'm not really sure what you are looking to do based on your post.
    Personally, if I had users that were going to roam to this controller, I'd work with that companies IT and get it linked to my AAA server and keep the EAP-TLS that I had working already going. Just because that WLC would be able to communicate to your AAA doesn't mean their users would be able to get on, as they wouldn't have the machine or client certificate nor the Root CA cert on their machines.
    HTH,
    Steve

  • Web Authentication on HTTP Instead of HTTPS in WLC 5700 and WS-C3650-48PD (IOS XE)

    Hello,
    I have configured a Guest SSID with web authentication (captive portal).
    wlan XXXXXXX 2 Guest
     aaa-override
     client vlan YYYYYYYYY
     no exclusionlist
     ip access-group ACL-Usuarios-WIFI
     ip flow monitor wireless-avc-basic input
     ip flow monitor wireless-avc-basic output
     mobility anchor 10.181.8.219
     no security wpa
     no security wpa akm dot1x
     no security wpa wpa2
     no security wpa wpa2 ciphers aes
     security web-auth
     security web-auth parameter-map global
     session-timeout 65535
     no shutdown
    The configuration of webauth parameter map  is :
    service-template webauth-global-inactive
     inactivity-timer 3600 
    service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
     voice vlan
    parameter-map type webauth global
     type webauth
     virtual-ip ipv4 1.1.1.1
     redirect on-success http://www.google.es
    I need to  login on web authentication on HTTP instead of HTTPS.
    If I  login on HTTP, I will not receive certificate alerts that prevent the users connections.
    I saw how to configure it with 7.x relesae but I have IOS XE Version 03.03.05SE and I don´t know how to configure it.
    Web Authentication on HTTP Instead of HTTPS
    You can login on web authentication on HTTP instead of HTTPS. If you login on HTTP, you do not receive certificate alerts.
    For earlier than WLC Release 7.2 code, you must disable HTTPS management of the WLC and leave HTTP management. However, this only allows the web management of the WLC over HTTP.
    For WLC Release 7.2 code, use the config network web-auth secureweb disable command to disable. This only disables HTTPS for the web authentication and not the management. Note that this requires a reboot of the controller !
    On WLC Release 7.3 and later code, you can enable/disable HTTPS for WebAuth only via GUI and CLI.
    Can anyone tell me how to configure web authentication on HTTP instead of HTTPS with IOS XE?
    Thanks in advance.
    Regards.

    The documentation doesn't provide very clear direction, does it?
    To download the WLC's default webauth page, browse to the controller's Security > Web Login Page. Make sure the web authentication type is Internal (Default). Hit the Preview button. Then use your browser's File > Save As... menu item to save the HTML into a file. Edit this to your liking and bundle it and any graphics images up into a TAR archive, then upload via the controller's COMMAND page.

  • ISE 1.2 web authentication problem with wired clients

    Hello,
    i am having problems with centralized web authentication using a Catalyst 3650X with IOS 15.0.2 SE01 and ISE 1.2.
    Redirecting the client works fine, but as soon the client opens a web browser and ISE websites open to authenticate the client, the switch port resets, the authentication process restarts and the session ID changes. After the client enters the credentials a session expired messages appears on the client and i get an 86017 Session Missing message in ISE.
    here the output form the debug aaa coa log.
    Any ideas
    thanks in advanced
    Alex
    ! CLIENT CONNECT TO SWITCHPORT
    ISE-TEST-SWITCH#show authentication sessions interface gi0/3
                Interface:  GigabitEthernet0/3
              MAC Address:  001f.297b.bd82
               IP Address:  10.2.12.45
                User-Name:  00-1F-29-7B-BD-82
                   Status:  Authz Success
                   Domain:  DATA
          Security Policy:  Should Secure
          Security Status:  Unsecure
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
                  ACS ACL:  xACSACLx-IP-PERMIT_ALL_TRAFFIC-537cb1d6
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://nos-ch-wbn-ise1.nosergroup.lan:8443/guestportal/gateway?sessionId=AC1484640000026B28C02CDC&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC1484640000026B28C02CDC
          Acct Session ID:  0x0000029C
                   Handle:  0x8C00026C
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success
    ! CLIENT OPENS INTERNETEXPLORER -> REDIRECTS TO ISE 
    ! SWITCHPORT GOES IN ADMINISTRATIVE DOWN STARTS AUTHENTICATION AGAIN
    ISE-TEST-SWITCH#
    191526: .Jun 24 10:42:24.340 UTC: COA: 10.0.128.38 request queued
    191527: .Jun 24 10:42:24.340 UTC: RADIUS:  authenticator 7F A9 85 AB F6 4A D0 F3 - B4 E6 F2 56 74 C6 2D 33
    191528: .Jun 24 10:42:24.340 UTC: RADIUS:  NAS-IP-Address      [4]   6   172.20.132.100
    191529: .Jun 24 10:42:24.340 UTC: RADIUS:  Calling-Station-Id  [31]  19  "00:1F:29:7B:BD:82"
    191530: .Jun 24 10:42:24.340 UTC: RADIUS:  Acct-Terminate-Cause[49]  6   admin-reset               [6]
    191531: .Jun 24 10:42:24.340 UTC: RADIUS:  Event-Timestamp     [55]  6   1403606529
    191532: .Jun 24 10:42:24.340 UTC: RADIUS:  Message-Authenticato[80]  18
    191533: .Jun 24 10:42:24.340 UTC: RADIUS:   E0 3C B2 8C 89 47 67 A8 69 F5 3D 08 61 FF 53 6E          [ <Ggi=aSn]
    191534: .Jun 24 10:42:24.340 UTC: RADIUS:  Vendor, Cisco       [26]  43
    191535: .Jun 24 10:42:24.340 UTC: RADIUS:   Cisco AVpair       [1]   37  "subscriber:command=bounce-host-port"
    191536: .Jun 24 10:42:24.340 UTC: COA: Message Authenticator decode passed
    191537: .Jun 24 10:42:24.340 UTC:  ++++++ CoA Attribute List ++++++
    191538: .Jun 24 10:42:24.340 UTC: 06D96C58 0 00000001 nas-ip-address(600) 4 172.20.132.100
    191539: .Jun 24 10:42:24.349 UTC: 06D9AC18 0 00000081 formatted-clid(37) 17 00:1F:29:7B:BD:82
    191540: .Jun 24 10:42:24.349 UTC: 06D9AC4C 0 00000001 disc-cause(434) 4 admin-reset
    191541: .Jun 24 10:42:24.349 UTC: 06D9AC80 0 00000001 Event-Timestamp(445) 4 1403606529(53A95601)
    191542: .Jun 24 10:42:24.349 UTC: 06D9ACB4 0 00000081 ssg-command-code(490) 1 33
    191543: .Jun 24 10:42:24.349 UTC:
    191544: .Jun 24 2014 10:42:24.365 UTC: %EPM-6-IPEVENT: IP 10.2.12.45| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT IP-RELEASE
    191545: .Jun 24 2014 10:42:24.382 UTC: %EPM-6-IPEVENT: IP 10.2.12.45| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT IP-WAIT
    191546: .Jun 24 2014 10:42:24.382 UTC: %EPM-6-POLICY_REQ: IP 0.0.0.0| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT REMOVE
    191547: .Jun 24 2014 10:42:24.390 UTC: %EPM-6-AUTH_ACL: POLICY Auth-Default-ACL-OPEN| EVENT DETACH-SUCCESS
    191548: .Jun 24 2014 10:42:26.353 UTC: %LINK-5-CHANGED: Interface GigabitEthernet0/3, changed state to administratively down
    191549: .Jun 24 2014 10:42:27.359 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/3, changed state to down
    ISE-TEST-SWITCH#
    191550: .Jun 24 2014 10:42:36.366 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to down
    191551: .Jun 24 10:42:40.592 UTC: AAA/BIND(000002A7): Bind i/f
    191552: .Jun 24 2014 10:42:41.129 UTC: %AUTHMGR-5-START: Starting 'dot1x' for client (001f.297b.bd82) on Interface Gi0/3 AuditSessionID AC1484640000026C28C2FA05
    191553: .Jun 24 2014 10:42:42.580 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to up
    191554: .Jun 24 2014 10:42:43.586 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/3, changed state to up
    ! SESSION ID CHANGES, USER ENTERS CREDENTIALS 
    ! ERROR MESSAGE AT CLIENT "YOUR SESSION HAS EXPIRED"
    ! ERROR MESSAGE IN ISE "86017 SESSION MISSING"
    ISE-TEST-SWITCH#show authentication sessions interface gi0/3
                Interface:  GigabitEthernet0/3
              MAC Address:  001f.297b.bd82
               IP Address:  10.2.12.45
                   Status:  Running
                   Domain:  UNKNOWN
          Security Policy:  Should Secure
          Security Status:  Unsecure
           Oper host mode:  multi-auth
         Oper control dir:  both
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC1484640000026C28C2FA05
          Acct Session ID:  0x0000029D
                   Handle:  0x2C00026D
    Runnable methods list:
           Method   State
           dot1x    Running
           mab      Not run

    Guest authentication failed: 86017: Session cache entry missing
    try adjusting the UTC timezone during the guest creation in the sponsor portal.
    86017
    Guest
    Session Missing
    Session ID missing. Please contact your System Administrator.
    Info

  • Not Working-central web-authentication with a switch and Identity Service Engine

    on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
    I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
    The interface configuration looks like this:
    interface FastEthernet0/24
    switchport access vlan 6
    switchport mode access
    switchport voice vlan 20
    ip access-group webauth in
    authentication event fail action next-method
    authentication event server dead action authorize
    authentication event server alive action reinitialize
    authentication order mab
    authentication priority mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    authentication violation restrict
    mab
    spanning-tree portfast
    end
    The ACL's
    Extended IP access list webauth
        10 permit ip any any
    Extended IP access list redirect
        10 deny ip any host 172.22.2.38
        20 permit tcp any any eq www
        30 permit tcp any any eq 443
    The ISE side configuration I follow it step by step...
    When I conect the XP client, e see the following Autenthication session...
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
               Interface:  FastEthernet0/24
              MAC Address:  0015.c549.5c99
               IP Address:  172.22.3.184
                User-Name:  00-15-C5-49-5C-99
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  single-host
         Oper control dir:  both
            Authorized By:  Authentication Server
               Vlan Group:  N/A
         URL Redirect ACL:  redirect
             URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC16011F000000490AC1A9E2
          Acct Session ID:  0x00000077
                   Handle:  0xB7000049
    Runnable methods list:
           Method   State
           mab      Authc Success
    But there is no redirection, and I get the the following message on switch console:
    756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
    756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    I have to mention I'm using an http proxy on port 8080...
    Any Ideas on what is going wrong?
    Regards
    Nuno

    OK, so I upgraded the IOS to version
    SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
    I tweak with ACL's to the following:
    Extended IP access list redirect
        10 permit ip any any (13 matches)
    and created a DACL that is downloaded along with the authentication
    Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
        10 permit ip any any
    I can see the epm session
    swlx0x0x#show epm session ip 172.22.3.74
         Admission feature:  DOT1X
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
    And authentication
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
         Interface:  FastEthernet0/24
         MAC Address:  0015.c549.5c99
         IP Address:  172.22.3.74
         User-Name:  00-15-C5-49-5C-99
         Status:  Authz Success
         Domain:  DATA
         Oper host mode:  multi-auth
         Oper control dir:  both
         Authorized By:  Authentication Server
         Vlan Group:  N/A
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
         Session timeout:  N/A
         Idle timeout:  N/A
         Common Session ID:  AC16011F000000160042BD98
         Acct Session ID:  0x0000001B
         Handle:  0x90000016
         Runnable methods list:
         Method   State
         mab      Authc Success
    on the logging, I get the following messages...
    017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
    017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
    017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
    017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
    017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
    017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
    What I'm I missing?

  • Having trouble with web authentication in 5504

    Hi everybody,
    We´re experiencing a trouble with our Wireles LAN solution. We have a WLC 5504, a ACS 4.2 and APs 1131AG.
    After deploying the solution and doing some tests we noticed when a user attempted to connect by wireless network there was too much delay since they clicked ie (internet explorer) until web authentication into WLC was shown. the delay was around 3 minutes. This issue also ocurrs despite of doing a test from my laptop that was next to one access point, then, I moved to another access point and the result was the same, a laptop problem is ruled out.
    Has anybody ever had this kind of trouble? , How could I reduce this time?, is it possible?, Which part of configuration shoud I check?
    Regards,
    Manuel

    Friends,
    I´ve made a mistake. Our WLC is a 4404.  
    Regards,
    Manuel

  • No Web Authentication - but excluded client with reason code 4

    Hello,
    we are using a WLC 4400 with Software Version 5.0.148.0 and WCS Version 5.0.56.2.
    Access Points are AIR-LAP1131AG-E-K9.
    We have problems with one client (Windows XP SP3). The computer loses the wireless connection all the time, but we don't know why. Duration of the connections are different.
    So there are a lot of minor alarms saying “Client which was associated with AP, interface '0' is excluded. The reason code is '4(Web Authentication failed 3 times.)'.”
    But the wireless lan which is used by the client is not configured with Web Authentication!! It is only using MACFilter. That's very strange! (There is another wireless lan configured with Web Authentication.)
    The minor alarms are created by different Access Points, amongst others by the Access Point where the client is connected to! (All Access Points radiate all wireless lans.)
    Regarding to this client the SyslogServer often says:
    Sep 17 16:01:57.187 1x_ptsm.c:404 DOT1X-3-MAX_EAPOL_KEY_RETRANS: Max EAPOL-key M1 retransmissions exceeded for client LOCAL USE 0 ERROR CONDITION
    Sep 17 16:02:07.885 1x_ptsm.c:511 DOT1X-3-PSK_CONFIG_ERR: Client may be using an incorrect PSK LOCAL USE 0 ERROR CONDITION
    Last week I tried the trouble shooting of the WCS with the following effect:
    Time :09/18/2009 19:01:39 Message :Controller association request message received.
    Time :09/18/2009 19:01:39 Message :Association request received from a client has an invalid RSN IE.(One reason could be mismatch in WPA2 algorithm).
    Time :09/18/2009 19:01:39 Message :Received reassociation request from client.
    Time :09/18/2009 19:01:39 Message :The wlan to which client is connecting requires 802 1x authentication.
    Time :09/18/2009 19:01:39 Message :Client moved to associated state successfully.
    Time :09/18/2009 19:01:39 Message :802.1x authentication message received, static dynamic wep supported.
    Time :09/18/2009 19:01:39 Message :802.1x authentication was completed successfully.
    Time :09/18/2009 19:01:39 Message :Client has got IP address, no L3 authentication required.
    I think the problem is hidden at the client but I don't know what it could be. The PSK can not be incorrect because the client is able to connect to the wireless lan but later loses the connection.
    Does somebody has an idea or knows the error messages?!
    Greetings lydia

    Hi,
    I'm exactly with the same problem! Can you please tell me if you were able to solve this?
    Thank you!
    Best regards,

  • Cisco Wireless AP 2602 - Web Authentication/Pass NOT working?

    Product/Model                                       Number:
    AIR-CAP2602E-A-K9
    Top                                       Assembly Serial Number:
    System                                       Software Filename:
    ap3g2-k9w7-xx.152-4.JB3a
    System                                       Software Version:
    15.2(4)JB3a
    Bootloader                                       Version:
    BOOTLDR: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
    When "Web Authentication/Pass" option checked, it is totally unaccessible to internal or external network, any clue/advice?
    Thanks in advance.

    Thanks, seems I missed the RADIUS part; after I done that it's still no luck, here are some tech support info, are you able to help?
    ------------------ show version ------------------
    Cisco IOS Software, C2600 Software (AP3G2-K9W7-M), Version 15.2(4)JB3a, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2013 by Cisco Systems, Inc.
    Compiled Mon 23-Dec-13 08:11 by prod_rel_team
    ROM: Bootstrap program is C2600 boot loader
    BOOTLDR: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
    WuGa-CiscoAP uptime is 3 days, 19 minutes
    System returned to ROM by power-on
    System restarted at 23:18:39 +0800 Mon Feb 10 2014
    System image file is "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-xx.152-4.JB3a"
    Last reload reason:
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    cisco AIR-SAP2602E-A-K9 (PowerPC) processor (revision A0) with 204790K/57344K bytes of memory.
    Processor board ID FGL1650Z5X3
    PowerPC CPU at 800Mhz, revision number 0x2151
    Last reset from power-on
    1 Gigabit Ethernet interface
    2 802.11 Radios
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: E0:2F:6D:A3:4D:0B
    Part Number                          : 73-14511-02
    PCA Assembly Number                  : 800-37898-01
    PCA Revision Number                  : A0
    PCB Serial Number                    : FOC164889AN
    Top Assembly Part Number             : 800-38357-01
    Top Assembly Serial Number           : FGL1650Z5X3
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-CAP2602E-A-K9  
    Configuration register is 0xF
    ------------------ show running-config ------------------
    Building configuration...
    Current configuration : 5276 bytes
    ! Last configuration change at 23:36:14 +0800 Thu Feb 13 2014
    ! NVRAM config last updated at 23:36:14 +0800 Thu Feb 13 2014
    ! NVRAM config last updated at 23:36:14 +0800 Thu Feb 13 2014
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    hostname WuGa-CiscoAP
    logging rate-limit console 9
    enable secret 5
    aaa new-model
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_eap
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login webauth group radius
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authentication login web_list group radius
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone +0800 8 0
    no ip cef
    ip admission name webpass consent
    ip admission name webauth proxy http
    ip admission name webauth method-list authentication web_list
    ip admission name web_auth proxy http
    ip admission name web_auth method-list authentication web_list
    ip admission name web-auth proxy http
    ip admission name web-auth method-list authentication web_list
    ip name-server 8.8.8.8
    dot11 syslog
    dot11 vlan-name GuestVLAN vlan 2
    dot11 vlan-name InternalVLAN vlan 1
    dot11 ssid Guest
       vlan 2
       web-auth
       authentication open
       mbssid guest-mode
    dot11 ssid WuGa-6
       vlan 1
       authentication open
       authentication key-management wpa
       mbssid guest-mode
       wpa-psk ascii 7 0211115C0A555C721F1D5A4A5644
    dot11 ssid WuGa-60
       vlan 1
       authentication open
       authentication key-management wpa
       guest-mode
       wpa-psk ascii 7 03084C070900721F1D5A4A56444158
    dot11 guest
      username wuga lifetime 360 password 7 030D5704100A36594908
    username Cisco privilege 15 password 7
    bridge irb
    interface Dot11Radio0
    no ip address
    encryption mode ciphers aes-ccm
    encryption vlan 1 mode ciphers aes-ccm
    ssid Guest
    ssid WuGa-6
    antenna gain 2
    stbc
    mbssid
    speed  basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23.
    channel 2452
    station-role root
    dot11 dot11r pre-authentication over-air
    dot11 dot11r reassociation-time value 500
    ip admission web-auth
    interface Dot11Radio0.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 spanning-disabled
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    interface Dot11Radio0.2
    encapsulation dot1Q 2
    bridge-group 2
    bridge-group 2 subscriber-loop-control
    bridge-group 2 spanning-disabled
    bridge-group 2 block-unknown-source
    no bridge-group 2 source-learning
    no bridge-group 2 unicast-flooding
    ip admission webauth
    interface Dot11Radio1
    no ip address
    encryption mode ciphers aes-ccm
    encryption vlan 1 mode ciphers aes-ccm
    ssid WuGa-60
    antenna gain 4
    peakdetect
    no dfs band block
    stbc
    speed  basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23.
    power local 5
    channel width 40-above
    channel dfs
    station-role root
    dot11 dot11r pre-authentication over-air
    dot11 dot11r reassociation-time value 500
    interface Dot11Radio1.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 spanning-disabled
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    interface GigabitEthernet0
    no ip address
    duplex auto
    speed 1000
    interface GigabitEthernet0.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 spanning-disabled
    no bridge-group 1 source-learning
    interface GigabitEthernet0.2
    encapsulation dot1Q 2
    bridge-group 2
    bridge-group 2 spanning-disabled
    no bridge-group 2 source-learning
    interface BVI1
    ip address 192.168.133.213 255.255.255.0
    ip default-gateway 192.168.133.200
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip route 0.0.0.0 0.0.0.0 192.168.133.200
    ip radius source-interface BVI1
    ip access-list extended ALL
    permit ip any host 0.0.0.0
    permit ip any any
    permit ip 0.0.0.0 255.255.255.0 any
    ip access-list extended All
    permit tcp any any established
    permit tcp any any eq www
    permit ip any any
    radius-server local
      nas 192.168.133.213 key 7 070C285F4D06
    radius-server attribute 32 include-in-access-req format %h
    radius-server vsa send accounting
    radius server 192.168.10.2
    address ipv4 192.168.10.2 auth-port 1812 acct-port 1646
    radius server local
    address ipv4 192.168.133.213 auth-port 1812 acct-port 1813
    key 7
    bridge 1 route ip
    line con 0
    terminal-type teletype
    line vty 0 4
    terminal-type teletype
    transport input all
    sntp server 128.138.141.172
    sntp broadcast client
    end

Maybe you are looking for