WCS 6.0 Web Authentication

Hello,
I have up loaded a custom web authenication page for my guest network. Is it possible to store mltiply custom web authication pages in the WCS? I can't seem to find any documenation that allow this, but when I configure a WLAN the drop down menu allows me to choose a logon page.
Could someone assist me on this?
Thank you
Mike

Not on the GUI.
I recommend you to store the webauth custom pages on the WCS server, in the TFTP folder, so that you can easilly push anyone you need from the controller template.
For the web auth template you have just to specify the filename, so store the custom web auth pages in that folder on the WCS server and then very quickly you can apply different custom web auth pages to your controllers.

Similar Messages

  • WCS and Guest account / limited usage web authentication

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    Here my problem I need to be able to limit my AD users to a 10min access to the WLAN.  I see you can do this for guest accounts, but you have to manually enter a username and password.  I would like the web authentication to use our ACS which is tied in to our AD.   Is there a way to do this? 

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    Weterry,
    Here the whole story.  I have a bookstore that going to have “Demo” pc for students to buy.  The want to show the internet on these devices, but our security guy require all users to logon.  I was hoping to find a way to let user logon quickly to test these devices.
    I have already figure out the web auth and that great feature, but you have to manually enter each user.   If I could get that to use AD and limit each to 10min that would be great. I would like to setup a SSID for the demo devices and limit users to 10 min.
    I have 2 WiSM controllers running 6.0 also have WCS .
    Thanks
    Chappy

  • WCS Web Authentication Template

    Customer does not want username/password, but a simple click OK to acceptable use policy.
    Can I do this with a Web Authentication Template in the WCS? They don't want a lobby ambassador, etc.

    You need to create a custome WebAuthpage that just has an Accept and or Decline. Here is one you can modify, just make sure you don't delete the hidden lines.

  • No Web Authentication - but excluded client with reason code 4

    Hello,
    we are using a WLC 4400 with Software Version 5.0.148.0 and WCS Version 5.0.56.2.
    Access Points are AIR-LAP1131AG-E-K9.
    We have problems with one client (Windows XP SP3). The computer loses the wireless connection all the time, but we don't know why. Duration of the connections are different.
    So there are a lot of minor alarms saying “Client which was associated with AP, interface '0' is excluded. The reason code is '4(Web Authentication failed 3 times.)'.”
    But the wireless lan which is used by the client is not configured with Web Authentication!! It is only using MACFilter. That's very strange! (There is another wireless lan configured with Web Authentication.)
    The minor alarms are created by different Access Points, amongst others by the Access Point where the client is connected to! (All Access Points radiate all wireless lans.)
    Regarding to this client the SyslogServer often says:
    Sep 17 16:01:57.187 1x_ptsm.c:404 DOT1X-3-MAX_EAPOL_KEY_RETRANS: Max EAPOL-key M1 retransmissions exceeded for client LOCAL USE 0 ERROR CONDITION
    Sep 17 16:02:07.885 1x_ptsm.c:511 DOT1X-3-PSK_CONFIG_ERR: Client may be using an incorrect PSK LOCAL USE 0 ERROR CONDITION
    Last week I tried the trouble shooting of the WCS with the following effect:
    Time :09/18/2009 19:01:39 Message :Controller association request message received.
    Time :09/18/2009 19:01:39 Message :Association request received from a client has an invalid RSN IE.(One reason could be mismatch in WPA2 algorithm).
    Time :09/18/2009 19:01:39 Message :Received reassociation request from client.
    Time :09/18/2009 19:01:39 Message :The wlan to which client is connecting requires 802 1x authentication.
    Time :09/18/2009 19:01:39 Message :Client moved to associated state successfully.
    Time :09/18/2009 19:01:39 Message :802.1x authentication message received, static dynamic wep supported.
    Time :09/18/2009 19:01:39 Message :802.1x authentication was completed successfully.
    Time :09/18/2009 19:01:39 Message :Client has got IP address, no L3 authentication required.
    I think the problem is hidden at the client but I don't know what it could be. The PSK can not be incorrect because the client is able to connect to the wireless lan but later loses the connection.
    Does somebody has an idea or knows the error messages?!
    Greetings lydia

    Hi,
    I'm exactly with the same problem! Can you please tell me if you were able to solve this?
    Thank you!
    Best regards,

  • Repeated wlc 5508 client web authentication

    I'm trying to troubleshoot a situation where many of our guest wireless users are repeatedly being prompted to reauthenticate via the web interface.  the session timeout is set to 4 hours, however, many times a client is presented with a web authentication screen right in the middle of browsing at random times.
    I do have several system log entries, but cannot find the specific entries in the Error code reference for the WLC.  For example, I don't find anything on %AAA-3-VALIDATE_GUEST_SESSION_FAILED: file_db.c:4022 Guest user session validation failed for guest1. Index provided is out of range..
    I'm running a WLC 5508 with 7.0.98.0 and have read through all of the release notes, error code references, etc., and don't see anything regarding this issue.
    The WCS screenshot shows a good example of how often this occurs!  Is the client actually re-associating with the AP (which in turn would require a web reauth)?  Not sure if I'm barking up the wrong tree - focusing on web auth when I may actually need to be focusing on AP association...
    I do have a TAC case opened up, but was wondering if anyone has experienced this before?
    Sorry for the rambling...

    Rene,
    I did several things and at least one of them seemed to resolve the issue:
    These notes are directly from my TAC case and I will try to provide a little more information [in brackets].
    1.       Upgrade WLC to 7.0.98.218 [self explanatory]
    2.       Upgrade WCS to 7.0.172.0 [current version, as of this note]
    3.       Increase DHCP scope time on ASA from default (30 minutes) to 4
    days [DHCP running external from the WLC]
    4.       Remove TKIP from the WLAN - only allow AES [had both configured but tech advised to only use AES]
    5.       Increased session timeout from 14400 seconds to 64800 seconds
    (4 hours to 18 hours) [don't think this helped resolve the issue, but it certainly was more convenient for our longer-term guests]
    I think that the TKIP and/or DHCP setting was integral as part of the resolution.  I upgraded the WLC because the version that I was running didn't have the web-auth debug option, so I'm not sure that that actually contributed to the resolution.
    Good Luck,
    Rob.

  • Guest Parameter for Web Authentication

    Hi Forum,
    Just to find out a little more detail in regards to the guest account created for web authentication using Ambassador account.
    1) If the authenticated guest did not perform a proper logout, what action will the WLC take?
    2) As such, is there any timeout involved?
    Where can i tune the timeout?
    Rdgs,
    Kelvin

    Hi I just wanted to add what I have found regarding WCS and the guest feature.
    -There are two ways to configure a "local net user". The first is a static guest ID that has the "guest" flag off. This means that the client's session will not timeout. The second is to specify the "guest" user checkbox and give it a timeout value in seconds.
    This should let you control how long a user is logged in.
    From the WLC login, go to SECURITY --> LOCAL NET USERS --> then click on NEW. From there you can specify a user ID and also set that optional guest user box. If you click on the Guest User box then you will see a timeout field.
    With my guest account set to not be a guest user (no timeout value), I have noticed the following.
    1. If a guest gets disconnected, usually they will reassociate and still be able to log in.
    2. If a guest has problems, I usually tell them to disable their wireless card, close all browser windows, and then reassociate to the network.
    The steps above have worked well for my setup...

  • WLC Client excluded - web authentication failed 3 times

    Is there any more I can do with the following? The customer only has 4400 controllers and WCS' both on the highest firmware currently available...
    An example of the alert generated in the event of an excessive authentication failure is as follows:
    Client '08:60:6e:35:7c:29 (172.16.235.133)' which was associated with interface '802.11b/g/n' of AP '25CS-AP21-24SE' is excluded. The reason code is '5(Web Authentication failed 3 times.)'.
    E-mail will be suppressed up to 30 minutes for these alarms.
    I need clarification of the following so that a process can be put in place to show if it is possible to deal with potential threats/attempts to hack into the network as the customers security are not accepting notification only. Therefore please advise:
    - What does ‘excluded’ mean in this scenario? Is the client permanently excluded or only temporarily?
    - If the client is not permanently excluded - if there are multiple occurrences of this alert for the same client can the client be disabled via the WCS console?
    - If necessary could e-mail suppression be turned off - for this alert only?
    Hope you can help but I think they need Prime and ISE to satisfy their security concerns myself!
    BR
    Rockford

    There is a command line syntax which will also allow you to export and import an IAS config to other IAS servers. Then you will be sure they are identical...
    http://support.microsoft.com/kb/883619

  • Web Authentication on HTTP Instead of HTTPS in WLC 5700 and WS-C3650-48PD (IOS XE)

    Hello,
    I have configured a Guest SSID with web authentication (captive portal).
    wlan XXXXXXX 2 Guest
     aaa-override
     client vlan YYYYYYYYY
     no exclusionlist
     ip access-group ACL-Usuarios-WIFI
     ip flow monitor wireless-avc-basic input
     ip flow monitor wireless-avc-basic output
     mobility anchor 10.181.8.219
     no security wpa
     no security wpa akm dot1x
     no security wpa wpa2
     no security wpa wpa2 ciphers aes
     security web-auth
     security web-auth parameter-map global
     session-timeout 65535
     no shutdown
    The configuration of webauth parameter map  is :
    service-template webauth-global-inactive
     inactivity-timer 3600 
    service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
     voice vlan
    parameter-map type webauth global
     type webauth
     virtual-ip ipv4 1.1.1.1
     redirect on-success http://www.google.es
    I need to  login on web authentication on HTTP instead of HTTPS.
    If I  login on HTTP, I will not receive certificate alerts that prevent the users connections.
    I saw how to configure it with 7.x relesae but I have IOS XE Version 03.03.05SE and I don´t know how to configure it.
    Web Authentication on HTTP Instead of HTTPS
    You can login on web authentication on HTTP instead of HTTPS. If you login on HTTP, you do not receive certificate alerts.
    For earlier than WLC Release 7.2 code, you must disable HTTPS management of the WLC and leave HTTP management. However, this only allows the web management of the WLC over HTTP.
    For WLC Release 7.2 code, use the config network web-auth secureweb disable command to disable. This only disables HTTPS for the web authentication and not the management. Note that this requires a reboot of the controller !
    On WLC Release 7.3 and later code, you can enable/disable HTTPS for WebAuth only via GUI and CLI.
    Can anyone tell me how to configure web authentication on HTTP instead of HTTPS with IOS XE?
    Thanks in advance.
    Regards.

    The documentation doesn't provide very clear direction, does it?
    To download the WLC's default webauth page, browse to the controller's Security > Web Login Page. Make sure the web authentication type is Internal (Default). Hit the Preview button. Then use your browser's File > Save As... menu item to save the HTML into a file. Edit this to your liking and bundle it and any graphics images up into a TAR archive, then upload via the controller's COMMAND page.

  • ISE 1.2 web authentication problem with wired clients

    Hello,
    i am having problems with centralized web authentication using a Catalyst 3650X with IOS 15.0.2 SE01 and ISE 1.2.
    Redirecting the client works fine, but as soon the client opens a web browser and ISE websites open to authenticate the client, the switch port resets, the authentication process restarts and the session ID changes. After the client enters the credentials a session expired messages appears on the client and i get an 86017 Session Missing message in ISE.
    here the output form the debug aaa coa log.
    Any ideas
    thanks in advanced
    Alex
    ! CLIENT CONNECT TO SWITCHPORT
    ISE-TEST-SWITCH#show authentication sessions interface gi0/3
                Interface:  GigabitEthernet0/3
              MAC Address:  001f.297b.bd82
               IP Address:  10.2.12.45
                User-Name:  00-1F-29-7B-BD-82
                   Status:  Authz Success
                   Domain:  DATA
          Security Policy:  Should Secure
          Security Status:  Unsecure
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
                  ACS ACL:  xACSACLx-IP-PERMIT_ALL_TRAFFIC-537cb1d6
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://nos-ch-wbn-ise1.nosergroup.lan:8443/guestportal/gateway?sessionId=AC1484640000026B28C02CDC&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC1484640000026B28C02CDC
          Acct Session ID:  0x0000029C
                   Handle:  0x8C00026C
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success
    ! CLIENT OPENS INTERNETEXPLORER -> REDIRECTS TO ISE 
    ! SWITCHPORT GOES IN ADMINISTRATIVE DOWN STARTS AUTHENTICATION AGAIN
    ISE-TEST-SWITCH#
    191526: .Jun 24 10:42:24.340 UTC: COA: 10.0.128.38 request queued
    191527: .Jun 24 10:42:24.340 UTC: RADIUS:  authenticator 7F A9 85 AB F6 4A D0 F3 - B4 E6 F2 56 74 C6 2D 33
    191528: .Jun 24 10:42:24.340 UTC: RADIUS:  NAS-IP-Address      [4]   6   172.20.132.100
    191529: .Jun 24 10:42:24.340 UTC: RADIUS:  Calling-Station-Id  [31]  19  "00:1F:29:7B:BD:82"
    191530: .Jun 24 10:42:24.340 UTC: RADIUS:  Acct-Terminate-Cause[49]  6   admin-reset               [6]
    191531: .Jun 24 10:42:24.340 UTC: RADIUS:  Event-Timestamp     [55]  6   1403606529
    191532: .Jun 24 10:42:24.340 UTC: RADIUS:  Message-Authenticato[80]  18
    191533: .Jun 24 10:42:24.340 UTC: RADIUS:   E0 3C B2 8C 89 47 67 A8 69 F5 3D 08 61 FF 53 6E          [ <Ggi=aSn]
    191534: .Jun 24 10:42:24.340 UTC: RADIUS:  Vendor, Cisco       [26]  43
    191535: .Jun 24 10:42:24.340 UTC: RADIUS:   Cisco AVpair       [1]   37  "subscriber:command=bounce-host-port"
    191536: .Jun 24 10:42:24.340 UTC: COA: Message Authenticator decode passed
    191537: .Jun 24 10:42:24.340 UTC:  ++++++ CoA Attribute List ++++++
    191538: .Jun 24 10:42:24.340 UTC: 06D96C58 0 00000001 nas-ip-address(600) 4 172.20.132.100
    191539: .Jun 24 10:42:24.349 UTC: 06D9AC18 0 00000081 formatted-clid(37) 17 00:1F:29:7B:BD:82
    191540: .Jun 24 10:42:24.349 UTC: 06D9AC4C 0 00000001 disc-cause(434) 4 admin-reset
    191541: .Jun 24 10:42:24.349 UTC: 06D9AC80 0 00000001 Event-Timestamp(445) 4 1403606529(53A95601)
    191542: .Jun 24 10:42:24.349 UTC: 06D9ACB4 0 00000081 ssg-command-code(490) 1 33
    191543: .Jun 24 10:42:24.349 UTC:
    191544: .Jun 24 2014 10:42:24.365 UTC: %EPM-6-IPEVENT: IP 10.2.12.45| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT IP-RELEASE
    191545: .Jun 24 2014 10:42:24.382 UTC: %EPM-6-IPEVENT: IP 10.2.12.45| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT IP-WAIT
    191546: .Jun 24 2014 10:42:24.382 UTC: %EPM-6-POLICY_REQ: IP 0.0.0.0| MAC 001f.297b.bd82| AuditSessionID AC1484640000026B28C02CDC| AUTHTYPE DOT1X| EVENT REMOVE
    191547: .Jun 24 2014 10:42:24.390 UTC: %EPM-6-AUTH_ACL: POLICY Auth-Default-ACL-OPEN| EVENT DETACH-SUCCESS
    191548: .Jun 24 2014 10:42:26.353 UTC: %LINK-5-CHANGED: Interface GigabitEthernet0/3, changed state to administratively down
    191549: .Jun 24 2014 10:42:27.359 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/3, changed state to down
    ISE-TEST-SWITCH#
    191550: .Jun 24 2014 10:42:36.366 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to down
    191551: .Jun 24 10:42:40.592 UTC: AAA/BIND(000002A7): Bind i/f
    191552: .Jun 24 2014 10:42:41.129 UTC: %AUTHMGR-5-START: Starting 'dot1x' for client (001f.297b.bd82) on Interface Gi0/3 AuditSessionID AC1484640000026C28C2FA05
    191553: .Jun 24 2014 10:42:42.580 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet0/3, changed state to up
    191554: .Jun 24 2014 10:42:43.586 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/3, changed state to up
    ! SESSION ID CHANGES, USER ENTERS CREDENTIALS 
    ! ERROR MESSAGE AT CLIENT "YOUR SESSION HAS EXPIRED"
    ! ERROR MESSAGE IN ISE "86017 SESSION MISSING"
    ISE-TEST-SWITCH#show authentication sessions interface gi0/3
                Interface:  GigabitEthernet0/3
              MAC Address:  001f.297b.bd82
               IP Address:  10.2.12.45
                   Status:  Running
                   Domain:  UNKNOWN
          Security Policy:  Should Secure
          Security Status:  Unsecure
           Oper host mode:  multi-auth
         Oper control dir:  both
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC1484640000026C28C2FA05
          Acct Session ID:  0x0000029D
                   Handle:  0x2C00026D
    Runnable methods list:
           Method   State
           dot1x    Running
           mab      Not run

    Guest authentication failed: 86017: Session cache entry missing
    try adjusting the UTC timezone during the guest creation in the sponsor portal.
    86017
    Guest
    Session Missing
    Session ID missing. Please contact your System Administrator.
    Info

  • Not Working-central web-authentication with a switch and Identity Service Engine

    on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
    I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
    The interface configuration looks like this:
    interface FastEthernet0/24
    switchport access vlan 6
    switchport mode access
    switchport voice vlan 20
    ip access-group webauth in
    authentication event fail action next-method
    authentication event server dead action authorize
    authentication event server alive action reinitialize
    authentication order mab
    authentication priority mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    authentication violation restrict
    mab
    spanning-tree portfast
    end
    The ACL's
    Extended IP access list webauth
        10 permit ip any any
    Extended IP access list redirect
        10 deny ip any host 172.22.2.38
        20 permit tcp any any eq www
        30 permit tcp any any eq 443
    The ISE side configuration I follow it step by step...
    When I conect the XP client, e see the following Autenthication session...
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
               Interface:  FastEthernet0/24
              MAC Address:  0015.c549.5c99
               IP Address:  172.22.3.184
                User-Name:  00-15-C5-49-5C-99
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  single-host
         Oper control dir:  both
            Authorized By:  Authentication Server
               Vlan Group:  N/A
         URL Redirect ACL:  redirect
             URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC16011F000000490AC1A9E2
          Acct Session ID:  0x00000077
                   Handle:  0xB7000049
    Runnable methods list:
           Method   State
           mab      Authc Success
    But there is no redirection, and I get the the following message on switch console:
    756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
    756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    I have to mention I'm using an http proxy on port 8080...
    Any Ideas on what is going wrong?
    Regards
    Nuno

    OK, so I upgraded the IOS to version
    SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
    I tweak with ACL's to the following:
    Extended IP access list redirect
        10 permit ip any any (13 matches)
    and created a DACL that is downloaded along with the authentication
    Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
        10 permit ip any any
    I can see the epm session
    swlx0x0x#show epm session ip 172.22.3.74
         Admission feature:  DOT1X
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
    And authentication
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
         Interface:  FastEthernet0/24
         MAC Address:  0015.c549.5c99
         IP Address:  172.22.3.74
         User-Name:  00-15-C5-49-5C-99
         Status:  Authz Success
         Domain:  DATA
         Oper host mode:  multi-auth
         Oper control dir:  both
         Authorized By:  Authentication Server
         Vlan Group:  N/A
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
         Session timeout:  N/A
         Idle timeout:  N/A
         Common Session ID:  AC16011F000000160042BD98
         Acct Session ID:  0x0000001B
         Handle:  0x90000016
         Runnable methods list:
         Method   State
         mab      Authc Success
    on the logging, I get the following messages...
    017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
    017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
    017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
    017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
    017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
    017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
    What I'm I missing?

  • Having trouble with web authentication in 5504

    Hi everybody,
    We´re experiencing a trouble with our Wireles LAN solution. We have a WLC 5504, a ACS 4.2 and APs 1131AG.
    After deploying the solution and doing some tests we noticed when a user attempted to connect by wireless network there was too much delay since they clicked ie (internet explorer) until web authentication into WLC was shown. the delay was around 3 minutes. This issue also ocurrs despite of doing a test from my laptop that was next to one access point, then, I moved to another access point and the result was the same, a laptop problem is ruled out.
    Has anybody ever had this kind of trouble? , How could I reduce this time?, is it possible?, Which part of configuration shoud I check?
    Regards,
    Manuel

    Friends,
    I´ve made a mistake. Our WLC is a 4404.  
    Regards,
    Manuel

  • Cisco Wireless AP 2602 - Web Authentication/Pass NOT working?

    Product/Model                                       Number:
    AIR-CAP2602E-A-K9
    Top                                       Assembly Serial Number:
    System                                       Software Filename:
    ap3g2-k9w7-xx.152-4.JB3a
    System                                       Software Version:
    15.2(4)JB3a
    Bootloader                                       Version:
    BOOTLDR: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
    When "Web Authentication/Pass" option checked, it is totally unaccessible to internal or external network, any clue/advice?
    Thanks in advance.

    Thanks, seems I missed the RADIUS part; after I done that it's still no luck, here are some tech support info, are you able to help?
    ------------------ show version ------------------
    Cisco IOS Software, C2600 Software (AP3G2-K9W7-M), Version 15.2(4)JB3a, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2013 by Cisco Systems, Inc.
    Compiled Mon 23-Dec-13 08:11 by prod_rel_team
    ROM: Bootstrap program is C2600 boot loader
    BOOTLDR: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
    WuGa-CiscoAP uptime is 3 days, 19 minutes
    System returned to ROM by power-on
    System restarted at 23:18:39 +0800 Mon Feb 10 2014
    System image file is "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-xx.152-4.JB3a"
    Last reload reason:
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    cisco AIR-SAP2602E-A-K9 (PowerPC) processor (revision A0) with 204790K/57344K bytes of memory.
    Processor board ID FGL1650Z5X3
    PowerPC CPU at 800Mhz, revision number 0x2151
    Last reset from power-on
    1 Gigabit Ethernet interface
    2 802.11 Radios
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: E0:2F:6D:A3:4D:0B
    Part Number                          : 73-14511-02
    PCA Assembly Number                  : 800-37898-01
    PCA Revision Number                  : A0
    PCB Serial Number                    : FOC164889AN
    Top Assembly Part Number             : 800-38357-01
    Top Assembly Serial Number           : FGL1650Z5X3
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-CAP2602E-A-K9  
    Configuration register is 0xF
    ------------------ show running-config ------------------
    Building configuration...
    Current configuration : 5276 bytes
    ! Last configuration change at 23:36:14 +0800 Thu Feb 13 2014
    ! NVRAM config last updated at 23:36:14 +0800 Thu Feb 13 2014
    ! NVRAM config last updated at 23:36:14 +0800 Thu Feb 13 2014
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    hostname WuGa-CiscoAP
    logging rate-limit console 9
    enable secret 5
    aaa new-model
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_eap
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login webauth group radius
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authentication login web_list group radius
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone +0800 8 0
    no ip cef
    ip admission name webpass consent
    ip admission name webauth proxy http
    ip admission name webauth method-list authentication web_list
    ip admission name web_auth proxy http
    ip admission name web_auth method-list authentication web_list
    ip admission name web-auth proxy http
    ip admission name web-auth method-list authentication web_list
    ip name-server 8.8.8.8
    dot11 syslog
    dot11 vlan-name GuestVLAN vlan 2
    dot11 vlan-name InternalVLAN vlan 1
    dot11 ssid Guest
       vlan 2
       web-auth
       authentication open
       mbssid guest-mode
    dot11 ssid WuGa-6
       vlan 1
       authentication open
       authentication key-management wpa
       mbssid guest-mode
       wpa-psk ascii 7 0211115C0A555C721F1D5A4A5644
    dot11 ssid WuGa-60
       vlan 1
       authentication open
       authentication key-management wpa
       guest-mode
       wpa-psk ascii 7 03084C070900721F1D5A4A56444158
    dot11 guest
      username wuga lifetime 360 password 7 030D5704100A36594908
    username Cisco privilege 15 password 7
    bridge irb
    interface Dot11Radio0
    no ip address
    encryption mode ciphers aes-ccm
    encryption vlan 1 mode ciphers aes-ccm
    ssid Guest
    ssid WuGa-6
    antenna gain 2
    stbc
    mbssid
    speed  basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23.
    channel 2452
    station-role root
    dot11 dot11r pre-authentication over-air
    dot11 dot11r reassociation-time value 500
    ip admission web-auth
    interface Dot11Radio0.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 spanning-disabled
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    interface Dot11Radio0.2
    encapsulation dot1Q 2
    bridge-group 2
    bridge-group 2 subscriber-loop-control
    bridge-group 2 spanning-disabled
    bridge-group 2 block-unknown-source
    no bridge-group 2 source-learning
    no bridge-group 2 unicast-flooding
    ip admission webauth
    interface Dot11Radio1
    no ip address
    encryption mode ciphers aes-ccm
    encryption vlan 1 mode ciphers aes-ccm
    ssid WuGa-60
    antenna gain 4
    peakdetect
    no dfs band block
    stbc
    speed  basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23.
    power local 5
    channel width 40-above
    channel dfs
    station-role root
    dot11 dot11r pre-authentication over-air
    dot11 dot11r reassociation-time value 500
    interface Dot11Radio1.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 spanning-disabled
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    interface GigabitEthernet0
    no ip address
    duplex auto
    speed 1000
    interface GigabitEthernet0.1
    encapsulation dot1Q 1 native
    bridge-group 1
    bridge-group 1 spanning-disabled
    no bridge-group 1 source-learning
    interface GigabitEthernet0.2
    encapsulation dot1Q 2
    bridge-group 2
    bridge-group 2 spanning-disabled
    no bridge-group 2 source-learning
    interface BVI1
    ip address 192.168.133.213 255.255.255.0
    ip default-gateway 192.168.133.200
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip route 0.0.0.0 0.0.0.0 192.168.133.200
    ip radius source-interface BVI1
    ip access-list extended ALL
    permit ip any host 0.0.0.0
    permit ip any any
    permit ip 0.0.0.0 255.255.255.0 any
    ip access-list extended All
    permit tcp any any established
    permit tcp any any eq www
    permit ip any any
    radius-server local
      nas 192.168.133.213 key 7 070C285F4D06
    radius-server attribute 32 include-in-access-req format %h
    radius-server vsa send accounting
    radius server 192.168.10.2
    address ipv4 192.168.10.2 auth-port 1812 acct-port 1646
    radius server local
    address ipv4 192.168.133.213 auth-port 1812 acct-port 1813
    key 7
    bridge 1 route ip
    line con 0
    terminal-type teletype
    line vty 0 4
    terminal-type teletype
    transport input all
    sntp server 128.138.141.172
    sntp broadcast client
    end

  • Wlc5760 web authentication custom page

    I have installed custom web pages with our company logo on the autentication pages. 
    everything is fine, users are able to access the pages and autenticate but the logo image is not showing.
    instead of the logo *some text missing * is appearing on the webpage.
    my logo file is .gif having a size of 211KB.

    Downloading a Customized Web Authentication Login Page
    You can compress the page and image files used for displaying a web authentication login page into a.tar file for download to a controller. These files are known as the webauth bundle. The maximum allowed size of the files in their uncompressed state is 1 MB. When the .tar file is downloaded from a local TFTP server, it enters the controller's file system as an untarred file.

  • Central web authentication

    I have downloaded the new Cisco ISE, I've managed to configure 802.1x and MAB succesfully but I want to configure wired centralized web authentication, but I cannot find any documentation how to configure ISE and Cisco Catalyst (IOS) switches to use this feature (I only find (limited) documentation about local web auth on the switch).
    I want to achieve the following authentication order on a switchport:
    802.1x
    MAB
    central web authentication
    So if a guest user comes with his laptop, 802.1x is not configured on his laptop and he's not in the Mac Bypass DB, he should "failover" to web auth and get the ISE guest portal webpage with his web browser. There he enters a guest username and password (which is of course already in the ISE DB) and he should get web access.
    I've configured the switchport with the following commands
    switchport access vlan 99
    switchport mode access
    switchport voice vlan 50
    authentication event no-response action authorize vlan 32
    authentication host-mode multi-domain
    authentication order dot1x mab webauth
    authentication port-control auto
    authentication violation protect
    authentication fallback webprofile
    mab
    dot1x pae authenticator
    dot1x timeout quiet-period 2
    dot1x timeout tx-period 2
    spanning-tree portfast
    spanning-tree bpduguard enable
    the web-profile with access-list to permit DHCP traffic between the attached device and any DHCP server in the vlan 99, and communications with ISE (also in vlan 99) at the moment "fallback webprofile" is triggered (I don't know if this should be configured with central webauth?)
    SW01T#sh fallback profile webprofile
    Profile Name: webprofile
    Description : webauth profile
    IP Admission Rule : NONE
    IP Access-Group IN: 133
    FYI, the access list:
    Extended IP access list 133
    10 permit ip any host 10.175.0.29
    30 permit udp any any eq bootps
    40 permit udp any eq bootpc any
    In the ISE, I configured DOT1x and MAB. In the MAB profile, I configured "continue" if user is unknown, and then an authorization profile for the web authentication:
    (attributes of the profile):
    Access Type = ACCESS_ACCEPT
    cisco-av-pair = url-redirect-acl=webauth
    cisco-av-pair = url-redirect=https://ip:8443/guestportal/gateway?sessionId=SessionIdValue&portal=https://10.175.0.29:8443/guestportal/gateway?sessionId=SessionIdValue&portal=http&action=cwa&action=cwa
    But it doesn't work. If I attach a device, it tries 802.1x, it tries MAB, then it fails over to "web authentication" but immediately fails with "no-response" message:
    001420: Jul 1 12:09:19: %AUTHMGR-5-START: Starting 'webauth' for client (0011.2
    5d7.6c6c) on Interface Fa1/0/3 AuditSessionID 0AAF003E000000582E866B69
    5d7.6c6c) on Interface Fa1/0/3 AuditSessionID 0AAF003E000000582E866B69
    from 'webauth' for client (0011.25d7.6c6c) on Interface Fa1/0/3 AuditSessionID 0
    AAF003E000000582E866B69
    001422: Jul 1 12:09:19: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for cl
    ient (0011.25d7.6c6c) on Interface Fa1/0/3 AuditSessionID 0AAF003E000000582E866B
    69
    001423: Jul 1 12:09:19: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication
    methods for client (0011.25d7.6c6c) on Interface Fa1/0/3 AuditSessionID 0AAF003 001420:
    Is there some configuration guide or steps available in order to make this work please?
    kind regards

    Hi Tarik,
    thank you for the fast reply.
    I've configuried the extra settings you told me (although I thought the ip admission configuration was only for local web authentication (where the switch acts as a http server).
    But it still doesn't work. The pc is getting the ip address from the dhcp server but if I open a browser session, I do not get redirected to the ISE portal in order to log me in with a Guest account.
    If I look at the authentication session of the port, it looks like the ISE has correctly sent the redirect acl and redirect url to the switchport:
    Switch# show auth sessions int fa 1/0/3
               Interface:  FastEthernet1/0/3
             MAC Address:  0011.25d7.6c6c
              IP Address:  10.175.0.229
               User-Name:  001125d76c6c
                  Status:  Authz Success
                  Domain:  DATA
         Security Policy:  Should Secure
         Security Status:  Unsecure
          Oper host mode:  multi-domain
        Oper control dir:  both
           Authorized By:  Authentication Server
              Vlan Group:  N/A
        URL Redirect ACL:  webauth
            URL Redirect:  https://ISE.onemrva.priv:8443/guestportal/gateway?session
    Id=0AAF003E0000175A43004FE3&action=cwa
         Session timeout:  N/A
            Idle timeout:  N/A
       Common Session ID:  0AAF003E0000175A43004FE3
         Acct Session ID:  0x000018CF
                  Handle:  0xEF00075B
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success
           webauth  Not run
    As you can see, the "web authentication" is the result of a "succesful MAB". This is because I had to configure ISE to continue on MAB if the user was not found (I found that somewhere in documentation). Then I have configured a default authorization profile where the "web authentication" is triggered. This is where I've configured the redirect-url and so on and this is of course sent to the switch as a succesfull MAB:
    authorization profile "webauthentication" with the "centralized web authentication" settings configured (see attributes output):
    Access Type = ACCESS_ACCEPT
    cisco-av-pair = url-redirect-acl=webauth
    cisco-av-pair = url-redirect=https://ip:8443/guestportal/gateway?sessionId=SessionIdValue&action=cwa
    Actually, I really have no idea if I have correctly configured ISE to handle central web authentication...
    If I check the "show ip admission cache", nothing is seen in there.

  • ISE Web Authentication with Profile

       Hi,
       I'm using Web Authentication with Cisco ISE 1.2.1 without problems.
       The Cisco ISE didn't find the endpoint in my internal endpoint store and continue with Web Authentication
       But when I enable the PSN with the Profile Server, the Cisco ISE populate dynamically the internal endpoint store and I cannot use
       the Web Authentication cause the endpoint is already in the internal endpoint store.
       What's the better way to solve this problem ?
       Thanks in Advanced
       Andre Gustavo Lomonaco

        Hi Neno, let me clarify my question
        I'm already using my internal endpoints to permit authenticate via MAB my IP Phones, Access Points and Printers.  I'm using Profile to be able to populate this ISE internet database.
        Now imagine that I wanna use the Web Authentication to permit authenticate guest workstations without 802.1x.If the profile put the guest workstation mac in the endpoints database, those workstation always will be authenticate using the MAC authentication and not the Web Authentication. Remember that for the Web authentication works we need to configure the continue options if the mac are not found in the endpoints database. But when the profile is on, the news (guest workstations) macs are inserted in endpoints database before I have chance to use the Web Authentication.

Maybe you are looking for

  • How do I accept a previously rejected security certificate?

    I am trying to use a site that has a security certificate. I accidentally refused it. I now get the error message " cannot connect to Citrix XenApp server SSL Error 61: You have not chosen to trust 'COMODO High Assurance Server CA' How do I set Firef

  • HT4759 How to sync if one has Snow Leopard

    I upgraded to Lion because I wanted to continue with the "cloud in the sky" access, syncing my calendar, contacts, photos, and especially my documents in iDisk. Lion was so unstable that I had it removed and the computer restored to Snow Leopard. Now

  • Startup Questions Issues (Again)

    I've read numerous discussions of startup issues but haven't been able to solve our problem. Maybe someone might have a suggestion. Thanks for any help you might be able to offer. We have a white 12" iBook 700 MHZ running OS 10.3 that startups very e

  • KDE Device Notifier command for specific Konqueror View Profile?

    Hi, I added a custom action in KDE device notifier widget for optical devices to be opened with Konqueror. However, is it possible to modify that command so that Konqueror opens with a specific view profile? Many thanks in advance.

  • HT4414 couldnt complete my update error 100 or 13

    i keep getting error when i am trying to update my software from the app store ??