Wired guest lan authentication through NGS

Hello Guys,
We have 5508 controller running ver 7.2.110.0.We have configured wireless guest and wired guest WLAN profiles and assosicated necessary dynamic interfaces to it. The authentication for both wireless and wired guest is through Cisco NGS[NAC]. I have configured Webauth and added the server in the security tab for authentication. I have guest user accounts created in NGS, if I use wirless guest the auth works perfect. But the same credentials is not working with wired guest. Any advice on this issue would be really helpful
Regards
Krishna

Hey Scott,
Yes NGS is working as Radius. However I haven't checked on WLC neither NGS log to see if there is any but let me look into that. No other names also doesn't work. I did run a debug on WLC while the user was authenticating below is the output
Output of debug for wireless user where I am getting Accept message for auth at the end
User IP ADDR - 172.22.207.157
*aaaQueueReader: Aug 20 09:44:29.940: 00:23:14:ec:3d:38 Successful transmission of Authentication Packet (id 190) to 194.156.169.111:1812, proxy state 00:23:14:ec:3d:38-00:01
*aaaQueueReader: Aug 20 09:44:29.940: 00000000: 01 be 00 a2 cd 8f 91 44 a2 4f 85 f1 04 f7 14 9a .......D.O......
*aaaQueueReader: Aug 20 09:44:29.940: 00000010: d0 3e 42 94 01 1b 6d 61 68 65 62 6f 6f 62 2e 6b .>B...maheboob.k
*aaaQueueReader: Aug 20 09:44:29.940: 00000020: 68 61 6e 40 61 6d 61 64 65 75 73 2e 63 6f 6d 02 [email protected].
*aaaQueueReader: Aug 20 09:44:29.940: 00000030: 12 34 fc 96 01 47 ed 5e d3 8d 08 4e 72 ce 1d b5 .4...G.^...Nr...
*aaaQueueReader: Aug 20 09:44:29.940: 00000040: da 06 06 00 00 00 01 04 06 ac 16 cf 83 05 06 00 ................
*aaaQueueReader: Aug 20 09:44:29.940: 00000050: 00 00 0d 20 0b 42 4c 52 57 4c 43 4f 30 31 3d 06 .....BLRWLCO01=.
*aaaQueueReader: Aug 20 09:44:29.940: 00000060: 00 00 00 13 1a 0c 00 00 37 63 01 06 00 00 00 01 ........7c......
*aaaQueueReader: Aug 20 09:44:29.940: 00000070: 1f 10 31 37 32 2e 32 32 2e 32 30 37 2e 31 35 37 ..172.22.207.157
*aaaQueueReader: Aug 20 09:44:29.940: 00000080: 1e 10 31 37 32 2e 32 32 2e 32 30 37 2e 31 33 31 ..172.22.207.131
*aaaQueueReader: Aug 20 09:44:29.940: 00000090: 50 12 ef 00 53 8b 39 31 14 93 b3 82 1c f5 b5 51 P...S.91.......Q
*aaaQueueReader: Aug 20 09:44:29.940: 000000a0: 82 45                                             .E
*radiusTransportThread: Aug 20 09:44:30.516: 00000000: 02 be 00 1a 0c 8e d4 54 91 55 d6 ae b2 91 05 6e .......T.U.....n
*radiusTransportThread: Aug 20 09:44:30.516: 00000010: 93 f9 4b 7e 1b 06 00 21 70 70                    ..K~...!pp
*radiusTransportThread: Aug 20 09:44:30.517: ****Enter processIncomingMessages: response code=2
*radiusTransportThread: Aug 20 09:44:30.517: ****Enter processRadiusResponse: response code=2
*radiusTransportThread: Aug 20 09:44:30.517: 00:23:14:ec:3d:38 Access-Accept received from RADIUS server 194.156.169.111 for mobile 00:23:14:ec:3d:38 receiveId = 0
But for wired user below is the output
User IP ADDR - 172.22.207.151
5.338: 00:26:b9:e0:36:a6 Successful transmission of Authentication Packet (id 188) to 194.156.169.111:1812, proxy state 00:26:b9:e0:36:a6-00:01
*aaaQueueReader: Aug 20 09:35:15.338: 00000000: 01 bc 00 a2 2c fe c1 97 a7 d1 25 a0 59 34 89 38 ....,.....%.Y4.8
*aaaQueueReader: Aug 20 09:35:15.338: 00000010: c1 be 59 f3 01 1b 6d 61 68 65 62 6f 6f 62 2e 6b ..Y...maheboob.k
*aaaQueueReader: Aug 20 09:35:15.338: 00000020: 68 61 6e 40 61 6d 61 64 65 75 73 2e 63 6f 6d 02 [email protected].
*aaaQueueReader: Aug 20 09:35:15.338: 00000030: 12 37 c7 5c 52 27 41 5b 0d 60 98 70 76 3b b3 ba .7.\R'A[.`.pv;..
*aaaQueueReader: Aug 20 09:35:15.338: 00000040: f5 06 06 00 00 00 01 04 06 ac 16 cd 74 05 06 00 ............t...
*aaaQueueReader: Aug 20 09:35:15.338: 00000050: 00 00 0d 20 0b 42 4c 52 57 4c 43 4f 30 31 3d 06 .....BLRWLCO01=.
*aaaQueueReader: Aug 20 09:35:15.338: 00000060: 00 00 00 0f 1a 0c 00 00 37 63 01 06 00 00 02 02 ........7c......
*aaaQueueReader: Aug 20 09:35:15.338: 00000070: 1f 10 31 37 32 2e 32 32 2e 32 30 37 2e 31 35 31 ..172.22.207.151
*aaaQueueReader: Aug 20 09:35:15.338: 00000080: 1e 10 31 37 32 2e 32 32 2e 32 30 35 2e 31 31 36 ..172.22.205.116
*aaaQueueReader: Aug 20 09:35:15.338: 00000090: 50 12 36 60 54 47 0b 84 02 5c 0b da 19 a1 05 eb P.6`TG...\......
*aaaQueueReader: Aug 20 09:35:15.338: 000000a0: af 2b                                             .+
*aaaQueueReader: Aug 20 09:35:17.053: AuthenticationRequest: 0x2ab12b50

Similar Messages

WLC - Layer 3 Wired guest lan ?

Hello
Has anyone been able to do this with a WLC, configuration guidlines say :"
"Wired guest access ports must be in the same Layer 2 network as the foreign controller."
Anyone know if Cisco is working on making this solution work on L3 aswell ?
Regards,
Gk

Hi gudmundurk,
I'm not sure if they would consider it worth developing as you would have to create a tunnel between the guest vlan's gateway and the subnet that the controller is on to keep your network secure anyway. Unless someone out there knows..........
Regards
Scott

DHCP issues for Wired Guest LAN

Hi Everyone,
I've a 1751 acting as a DHCP server for client PCs on a guest network A.B.8.x (using an Anchor controller) on the DMZ of my firewall. The 1751 reports the following
Nov 30 15:35:45: DHCPD: DHCPDISCOVER received from client 0100.1708.37a3.55 through relay A.B.7.y.
Nov 30 15:42:41: DHCPD: there is no address pool for A.B.7.y.
I'd tied my guest vlan and corresponding DHCP scope on the router to A.B.8.x, but as A.B.7.x is the DHCP relay for the Anchor controller I don't understand why the DHCP server on the router is not doing what I expected it to.
As ever any help will be appreciated.
Many Thanks
Scott

Hi Cristian,
After much pulling of hair and gnashing of teeth I have got it working - what was not clear to me, and it looks as though you've fallen into the same trap, is that the egress interface on the anchor controller (ie the management port) defines the addresses given to the clients. The dhcp scope on your server has to be from the same network as the address of the management interface (so my guest clients get a A.B.7.x address). In fact the ingress interface addresses have no bearing (as I'm sure I read somewhere afterwards!) on how the guest access operates and can (should?) be dummy addresses.
I tried creating another vlan (with A.B.8.x) on the anchor controller and assigning that to the egress of the guest WLAN on the anchor and I could get A.B.8.x addresses from my DHCP server as I had planned, but, and this is a big but, web authentication just will not instigate. So it would seem that guest access is reliant on using the management interface as the egress on the anchor of the guest WLAN.
I hope this is helpful,
Regards
Scott

ISE with CWA and wired guest access via WLC Anchor

Can an Anchor WLC (WLCa) provide a wired guest LAN service if the wlan guest access is using CWA?
We are deploying a WLAN only ISE solution (it is a full license ISE though) but they just want a few wired guest ports. I was hoping to add L2 switch to the DMZ where the WLCa is and that the L2 switch wouldnt need any other config as the WLCa just bridges the wired to the wlan vlan. This Im sure i have done before.
So now I have set wiredguest the same as i have done before ISE and my wired clients get an IP address, but when they redirect, the URL they get is different, and the redirect just doesnt work.
It comes out as:
https://my_ise_ip:8443/guestportal/Login.action?switch_url=https://my_ise_host/login.html&wlan=my_wired_guest_lan&redirect=www.google.co.uk
So does my simple L2 only switch need an ISE config on it or should the WLCa be handling or the redirection just as it would for a wlan device.

The ISE never receives an auth entry, so i dont believe the redirect is working for the wired client. So even though the clients browser gets a redirect url which fails connection, the client info in the WLCa doesnt have a redirect ACL listed like a wlan client would

Wired guest config error: Learn Client IP Address

Hi
I get the following error message when I want enable a wired guest lan on WiSM2

Thanks Scott, it was the right thing. I've deleted all 4 wired guest lan and created new and now it workes propperly. The problem was occured after upgrade to the new version.
I will test in the labor if this problem occours on each upgrade or if it was a single failor.
Kurt

Guest LAN and DHCP Options not passing through

Managed to get the Guest LAN up and running for wired clients and all's working well. Users are sat behind a proxy and if I force the use of a appropriate wpad file I can get the WLC auth to happen and then push off to the proxy.
I'm trying to use option 252 in DHCP to present the WPAD url. Only issue that happens is that while the DHCP server on the egress interface is handing out addresses to clients on the ingress interface correctly, the WLC doesn't appear to be handing through the option 252 I have set in DHCP. I've used network monitor to see what the dhcp request process is dishing out in terms of options, and all look good if I'm not behind the WLC.
Anyone know if theres a limitation on the WLC that prevents DHCP options being passed through to the guest LAN?
TIA

When configured as a DHCP server, some of the firewalls do not support DHCP requests from a relay agent. The WLC is a relay agent for the client. The firewall configured as a DHCP server ignores these requests. Clients must be directly connected to the firewall and cannot send requests through another relay agent or router. The firewall can work as a simple DHCP server for internal hosts that are directly connected to it. This allows the firewall to maintain its table based on the MAC addresses that are directly connected and that it can see. This is why an attempt to assign addresses from a DHCP relay are not available and the packets are discarded. PIX Firewall has this limitation.
For more information please refer to the link-http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008070ba8f.shtml

Preauth ACL for Wired guest not working

Hi Guys,
I have 5508 wireless lan controller running code 7.2. We recently implemented Wired guest access on the WLC and configured necessary changes on the switch. We also have wireless guest profile as well configured on the WLC. We have some people who usually use Jabber client for video conferencing so what we have done is we have configured a preauth acl so that if any users connect to the wireless guest profile they automatically connect to the Jabber server without going through the Web auth. We have applied the same ACL in the Wired guest profile as well but the problem is that Jabber is not able to connect unless we manually go through web browser and then authenticate, but it is working normally for wireless guest access without the web authentication. Let me know if this is some kind of bug or a known issue which can fixed in some way. Thanks in advance
- Krishna

Krishna:
Can you please confirm if other type of traffic (other than jabber traffic) is allowed by the pre-auth ACL?
try - for testing - to allow traffic -by same ACL - to some other destination and try via normal user to ping to open whatever session with that destination.
let me know if that works or not.
Regards,
Amjad
Rating useful replies is more useful than saying "Thank you"

Wired guest

Respected members of this community... :) I need help.
The last couple of days i spend implementing unified wireless at a customers site.
We used the latest versions of the controller and WCS software.
This new software offers a new feature, wired guest.
Since we already implemented 802.1x with a guest VLAN on the wired network last year, we wanted to offer the guest access functionality on the wired LAN as well.
So first we implemented wireless guest access, which worked fairly quickly.
Then we added another interface on the controllers, which matched the already existing wired guest VLAN. First we wanted to use that VLAN for wireless guests as well as wired, but we found out that is not possible (so we created a new wireless guest VLAN). Then we added a new WLAN wich we marked for wired guest.
Anyway, we followed the documentation and...could not get it to work.
The network is a layer 3 routed network with 40 or so VLANs. The controllers are connected to the core switch (with nicely configured trunks), which does all the routing.
DHCP is the first thing that didn't work. The interfaces we created on the controllers have the guest lan checkbox checked, ingress interface is the guest VLAN, egress interface is the mngt interface.
The DHCP relay function did not work.
DHCP will work with IP-helper configured on the VLAN interface on the core router, but this al goes outside of the controllers.
This is by the way the major thing i do not understand. With wireless, all traffic goes via de controller through the LWAPP tunel. But with wired, my layer 2 VLAN ends on the core switch, not on the controller.
So what should the default gateway be for that VLAN? The interface VLAN of the coreswitch or one of the controller IP adresses?
Traffic should be directed to the controllers (i guess?) to enable them to catch HTTP and send the redirect to the webauth page.
But if you set the default gateway to the controllers, DNS does not work because the controllers do not forward traffic untill after authentication, but for this to work, you need DNS for the client to start the HTTP session.
Is there anyone out there who has this working, including DHCP?
The customers network is flexible, we can build almost anything we want there, so iw we need to change something, we can.
Wireless guest was no problem at all, and de data WLAN, including 802.1x, auth on AD and dynamic VLAN assignment worked perfectly. So we did get something to work actually... :)

Does this help?
<http://www.cisco.com/warp/public/102/wired_guest_access.pdf>
Also keep in mind that the clients and the controller needs L2 adjacency (i.e. the Guest-VLANs would need to be trunked directly to the controller where you define the Guest-WLAN).
I assume you have already deployed an anchor controller for wireless Guest traffic. So, the idea is to leverage the same EoIP tunnel infrastructure also for wired guest traffic. DHCP/DNS traffic should be blindly tunneled across this infrastructure, so your network services should be deployed in the anchor controller location (i.e. DMZ). Keep in mind again, that this design implements a logical L2 connection from the endpoints to the anchor controller.
Hope this helps,

Wired guest access on WLC 4400 with SW 7.0.240.0

Hello,
after we upgrade our Wlan-controller 4400 from software 7.0.116.0 to 7.0.240.0
wired guest access don't work anymore.
All other things works fine, incl. WLAN guest access!
When we try wired guest access, we get the web-authentication page and can log in.
On the controller we can see that the Policy Manager State changes from WEBAUTH_REQD
to RUN.
But then there is no access to the internet.
We tried also SW 7.0.250.0, same problem!
Log Analysis on the WCS:
Time :03/12/2014 14:21:23 MEZ Severity :INFO Controller IP :10.101.200.11 Message :The WLAN to which client is connecting does not require 802 1x authentication.
Time :03/12/2014 14:21:23 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client does not have an IP address yet.
Time :03/12/2014 14:21:23 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client L3 authentication is required
Time :03/12/2014 14:21:23 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client Moved to DHCP Required State.
Time :03/12/2014 14:21:26 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Mobility role update request. from Unassociated to Local Peer = 0.0.0.0, Old Anchor = 0.0.0.0, New Anchor = 10.101.200.11
Time :03/12/2014 14:21:26 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Mobility role changed. State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED
Time :03/12/2014 14:21:26 MEZ Severity :INFO Controller IP :10.101.200.11 Message :DHCP successful.
Time :03/12/2014 14:21:26 MEZ Severity :ERROR Controller IP :10.101.200.11 Message :Client got an IP address successfully and the WLAN requires Web Auth or Web Auth pass through.
Time :03/12/2014 14:21:26 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client IP address is assigned.
Time :03/12/2014 14:22:01 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Webauth user logged in to the network. manni
Time :03/12/2014 14:22:01 MEZ Severity :INFO Controller IP :10.101.200.11 Message :AAA response message sent.
Time :03/12/2014 14:22:01 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client has completed Web Auth successfully.
Time :03/12/2014 14:22:01 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client has completed Web Auth successfully.
Trying http://www.google.de .... doesnt work. No Log Entries. Next entries while logging out.
Time :03/12/2014 14:36:20 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Web auth is being triggered again.
Time :03/12/2014 14:36:20 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client L2 authentication has been completed successfully.
Time :03/12/2014 14:36:20 MEZ Severity :INFO Controller IP :10.101.200.11 Message :Client Moved to DHCP Required State.
Time :03/12/2014 14:36:20 MEZ Severity :INFO Controller IP :10.101.200.11 Message :WebAuth user Logged out from network.
Has someone a idea how to solve this problem?
Regards
Manfred

Hi
Yes got it resolved. It turns out that the connection from the wired guest access port to the WLC must be L2. That is the switch that the wired guest acces sport is connected and WLC are connected to must be L2 only. We were using a single switch to do the testing and it was also doing the routing for the test LAN. Even though there was no L3 VLAN interface configured for the VLAN that the guest access port was on for some reason this breaks it. Absolu Didnt have chance to work out the exact limitations of this as we simply made the switch L2 only and configured an 802.1Q trunk to the Internet router and made subinterfaces on the router for the wired and wireless egress ports and it worked then. No config change was needed on the WLC at all.
The only thing I can think of is that it's something about the way the WLC joins the wired guest access ingress VLAn and egress VLAN. The WLC isn't a reall router it says so in the documentation. I think the packet coming from the wired access port is being bridged to the egress VLAn not routed and this is what screws it up (remeber with a router the source and destination MAC addresses would be changed with a bridge they aren't). Got to be something along those lines. If you have a bigger newtork with a guest anchor WLC handling this function you dont run into this as the traffic is coming over an EOIP tunnle from the remote WLC so the switch with the guest anchor WLC doesnt see the MAC address of the wired guest PC.

Ask the Experts: Wired Guest Access

Sharath K.P.
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions on wired guest access with expert Sharath K.P. Wired guest access enables guest users to connect to the guest access network from a wired Ethernet connection designated and configured for guest access. Sharath K.P. is a Customer Support Engineer specialized in wireless and switching technologies at the Technical Assistance Center in Cisco Bangalore. He has been troubleshooting wireless and switching networks and management tools since 2009. Sharath has a bachelor's degree in Electrical Electronics Engineering from P.E.S College of Engineering (PESCE), VTU at Belgaum. India. He holds CCNP certifications in R&S and Wireless.
Remember to use the rating system to let Sharath know if you have received an adequate response.
Sharath might not be able to answer each question due to the volume expected during this event.
Remember that you can continue the conversation on the Wireless and Mobility sub-community discussion forum shortly after the event. This event lasts
through January 27, 2012. Visit this forum often to view responses to your questions and the questions
of other community members.

Hi Daniel ,
Wonderful observation and great question .
Yes, we dont find any recommendation or inputs in Cisco Docs on scenarios where we have multiple foriegn WLC's present .When we go through the Cisco Doc available for Wired Guest Access
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808ed026.shtml
Two separate solutions are available to the customers:
A single WLAN controller (VLAN Translation mode) - the access switch trunks the wired guest traffic in the guest VLAN to the WLAN controller that provides the wired guest access solution. This controller carries out the VLAN translation from the ingress wired guest VLAN to the egress VLAN.
Two WLAN controllers (Auto Anchor mode) - the access switch trunks the wired guest traffic to a local WLAN controller (the controller nearest to the access switch). This local WLAN controller anchors the client onto a DMZ Anchor WLAN controller that is configured for wired and wireless guest access. After a successful handoff of the client to the DMZ anchor controller, the DHCP IP address assignment, authentication of the client, etc. are handled in the DMZ WLC. After it completes the authentication, the client is allowed to send/receive traffic.
So as per Cisco best pratices using multiple foreign controllers for the same wired guest VLAN is not supported and the results will be unpredictable
I do understand the confusion regarding such scenario's as this( Multiple foriegn WLC's) is a very general setup which customer would like to deploy .
We have already opened a bug for the same (Little late though )
BUG ID :CSCtw44999
The WLC Config Guide should clarify our support for redundancy options for wired guest
Symptom:
Do not trunk a wired guest VLAN to multiple foreign controllers. This is not supported, and will
generate unpredictable results.
Some of the other tthat changes we will be making as a part of doc correction would be
http://www.cisco.com/en/US/docs/wireless/controller/7.0MR1/configuration/guide/cg_user_accts.html#wp1066125
1. The WiSM2 needs to be added as a supported controller. (Not sure about the 7500, check with PM)
2. Where it says "Do not attempt to trunk a guest VLAN on the Catalyst 3750G ...", this should read:
"Do not trunk a wired guest VLAN to multiple foreign controllers. This is not supported, and will
generate unpredictable results."
3. Add at least a line mentioning support for multiple anchors for a guest wired LAN.
Now if you already have such deployments , ther criteria would be that nearest WLC on the broadcast domain (Layer 2) would respond to the client associtation request .
Cisco Controller) >Tue Sep 11 13:27:42 2007: 00:0d:60:5e:ca:62 Adding mobile on Wired Guest 00:00:00:00:00:00(0)
Tue Sep 11 13:27:42 2007: 00:0d:60:5e:ca:62 apfHandleWiredGuestMobileStation (apf_wired_guest.c:121) Changing state for mobile
00:0d:60:5e:ca:62 on AP 00:00:00: 00:00:00 from Idle to Associated .
I hope the above explanation could clarify your doubts to certain extent and also keep you
informed on Cisco's roadmap on this feature .
Regards ,
Sharath K.P.

What is a Guest LAN?

My company is currently in the process of creating a guest wireless ssid for vendors. I have already created the VLAN on our network and configured it with an ACL so that it can only get to the internet and no where else.
I am now going through creating an interface on my lwapp controllers and there is a check box that says "Guest LAN". Now the guide that I am using to configure my controllers is for an older version of WCS (I can't find one for 5.1). And they do not check the Guest LAN.
I am just curious as to what this setting actually does.
Thanks

It has been a few months since I looked in to this and I never got around to implementing it, but I'll see if I can help any.
This "Guest LAN" allows you to use your Wireless Controllers as an anchor point for Wired Users.
When I was looking in to this, I was going to anchor a Layer 2 VLAN to an internal controller and have that controller anchor those clients to my DMZ Controller just like I do with my "wireless guest" access.
In theory it allows the Wireless Controller to pick up your Wired clients and treat them like your Wireless clients.
So, trunk an unrouted VLAN into that controller and let the controller do the dirty work....
I'm going to create a post on this in the general forum about an idea I once had with this....

Cisco wired guest with one wlc

Hello my name is Ivan
I have a question:
You can configure wired guest for wired network users so that appears the cisco wlc web portal for guest user authentication? having the following:
Only one (1) cisco wlc 5508 no settings for auto anchor or foreing controller, a cisco acs v5.4, cisco switches, and access points.
I'm using 802.1x, and when the user because autententicacion policies fall into the guest vlan, the user receives full IP routing vlan guest, comes to internet through the router for guest users, but not redirected to the website of wlc .
I would like to redirect http traffic from cisco switch to the cisco wlc for wlc web portal
My deployment is to flex connect wireless authentication, and local switching center
How I can do this?
Thanks for your answers.

Hi Scott, thanks for your answer:
My scenary is:
Site A Corporate
WLC 5508 Flex Connect Central Auth + Local Switching
1. int management: vlan 10 - 10.1.1.2/24
2. int virtual: 1.1.1.1
3. wired-guest: vlan 30
wlans:
1. corporate - mapped to interface management 802.1x wpa, 2pa2
2. guest - mapped to interface management web auth
3. wired-guest: web auth, ingress wired, egress management
Cisco ACS v5.4
Site B: Branch
AP Ligthweight in the vlan 10, vlans mapped 100 and 30, 100 for wlan corporate and 30 for wlan guest.
Switches Cisco,
The branch have a router of internet to users guest.
The switch cisco have a 802.1x configuration, and the method to authenticate users can not have a supplicant 802.1x is web auth.
Actually i can not redirect the traffic from the switch in the branch to cisco wlc 5508 in the corporate site. The users bypass the interception of the cisco wlc and they can goes to internet without the portal of authentication.
Please could you give and advice to resolv it?
Regards for your answers.

Wired guest access with 5508

Hi
I have setup wireless guest access for a customer with a single 5508 and web authentication no problem at all. He then wanted to test wired guest access. The 5508 is currently connected to a single 3560 switch. The wired clients get a DHCP address OK but cannot reslove DNS and thus don't get redirected to teh guest login portal. I have even tried turning of all L3 security to no avail. The setup is as follows
VLAN 101 access points and 5508 management interface
VLAN 102 wired guest access dynamic ingress (L2 config only no SVI on 3560)
VLAN 103 wireless guest dynamic egress nterface L3 network with SVI on switch
VLAN 104 wired guest dynamic egress interface L3 network with SVI on switch
There are two DHCP pools setup on the WLC one for the VLAN 103 and one for the VLAN 104 subnets.
The internet router is also connected to the 3560 on a sepearte VLAN with an SVI. the 3560 has a default route to teh internet router and teh DHCP pools give the DHCP clients a default gateway of the IP address of dynamic interface 103 or 104. The Internet routre can ping the WLC on both these addresses.
LAG is enabled on teh WLC and VLANs 101-104 are trunked to it from the 3560.
I even tried making the wired guest egress interface the same one as for wireless. The wired clientys now got an IP address on the wireless range but still couldnt pass any traffic. It's like the intrenal bridging on teh WLC between VALN 102 and 104 (or 103) is broken. Tried both the lates 6.x and 7.x software on the WLC. Any ideas ? All the problems I can find with this seem to relate to not gettingas far as a DHCP address but that works fine.
Thanks
Pat

Hi
Yes got it resolved. It turns out that the connection from the wired guest access port to the WLC must be L2. That is the switch that the wired guest acces sport is connected and WLC are connected to must be L2 only. We were using a single switch to do the testing and it was also doing the routing for the test LAN. Even though there was no L3 VLAN interface configured for the VLAN that the guest access port was on for some reason this breaks it. Absolu Didnt have chance to work out the exact limitations of this as we simply made the switch L2 only and configured an 802.1Q trunk to the Internet router and made subinterfaces on the router for the wired and wireless egress ports and it worked then. No config change was needed on the WLC at all.
The only thing I can think of is that it's something about the way the WLC joins the wired guest access ingress VLAn and egress VLAN. The WLC isn't a reall router it says so in the documentation. I think the packet coming from the wired access port is being bridged to the egress VLAn not routed and this is what screws it up (remeber with a router the source and destination MAC addresses would be changed with a bridge they aren't). Got to be something along those lines. If you have a bigger newtork with a guest anchor WLC handling this function you dont run into this as the traffic is coming over an EOIP tunnle from the remote WLC so the switch with the guest anchor WLC doesnt see the MAC address of the wired guest PC.

Anyone seen strange behavior with wired guest access on WLAN Controller?

Cisco Doc ID 99470 spells out how to deploy wired guest access over wireless LAN Controllers.
That said, everything has been up and working for almost a year. Guest wireless uses anchor controller in DMZ - no issues.
Recently configured two wired ports for wired guest networking. The desktops get the correct IP address via DHCP. A wireless client (on the table right next to the wired clients) on the guest wireless gets an IP address as expected as well.
Open a continuous ping to the gateway 172.16.16.1 on all three machines.
The two desktops will ping for a few minutes and then stop for 30 seconds or longer. Wireless client will keep its connection. (you might think it would be the other way around)
I understand there is a 65,535 second inactivity timeout, but I am only sitting here for minutes, not 18 hours when this happens.
On the wired desktops, you have to bring up a browser and log back in just as you do on a wireless client ever few minutes. After debugging the client, I found a "failed to find scb" message in the output.
The other trick here is that the wired clients are miles away from where I can actually get on the CLI of the controller. This makes it difficult to run a debug and bring up a browser since I am not local to the machines when running debugs.
Has anyone ever see this behavior? Has anyone see the "failed to find scb" message?
Thanks in advance!
Succ
essfully plumbed mobile rule (ACL ID 255)
*pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef 0.0.0.0 tokenID = 5
*pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef Set bi-dir guest tunn
el for 00:25:b3:ce:cb:ef as in Export Foreign role
*pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef 0.0.0.0 Added NPU ent
ry of type 1, dtlFlags 0x4
*spamReceiveTask: Dec 30 11:34:54.569: CCKM: Send CCKM cache entry
FP08:(33207772)[cmdSendNodeInfo:3787]failed to find scb 0023.2422.c6eb
*mmListen: Dec 30 11:35:58.539: 00:25:b3:ce:cb:ef Scheduling deletion of Mobi
le Station: (callerId: 73) in 1 seconds
*mmListen: Dec 30 11:35:59.471: 00:25:b3:ce:cb:ef Scheduling deletion of Mobi

I found it in the document
B.1 How Logout Works
The WebGate logs a user out when it receives a URL containing "logout." (including the "."), with the exceptions of logout.gif and logout.jpg, for example, logout.html or logout.pl. When the WebGate receives a URL with this string, the value of the ObSSOCookie is set to "logout."
The Access System sets an obSSOCookie for each user or application that accesses a resource protected by a WebGate. The obSSOCookie enables users to access resources that are protected by the Access System that have the same or a lower authentication level. Removing the ObSSOcookie causes the WebGate to log the user out and requires the user to re-authenticate the next time he or she requests a resource that is protected by the Access System.
Well, I havn't got that far in the document:)
Thanks a lot for your help.
-Wei

Wired Guest Using ISE Interface

Ive scoured the forums for a solution but struck out looking for design tips. I have a centralized guest wireless using ISE with CWA on an anchor controller and it works great. Now I need to create wired guest network for my remote sites. Is this possible using an interface on my 3415 running ISE, or can the anchor controller be used some how?
The 3415 sits in my Pennsylvania data center. It has a new dedicated interface going to the internet for guest traffic. Can this interface be used as a redirect for a guest at a remote site? If so, is there documentation detailing the basic steps to implement this?
Thanks in advance!

If you are already authenticating your wireless users and anchoring them to a DMZ you can do the same with wired users as long as you have a foreign controller layer 2 adjacent to the wired guests.
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/99470-config-wiredguest-00.html
You would just need to set the VLAN on the port for the guest users, or if you want you can use ISE wired AuthZ policy to place the guest users into the correct VLAN, or FlexAuth using guest VLANs.

Wired guest lan authentication through NGS

Similar Messages

Maybe you are looking for