WLC- Local net user

Hi,
Normally in cisco WLC, we can create "local net user" , same user can able to access internet via captive portal authentication.
Query is : can we use "password policy " which was there on the same screen under security tab : as the Possword policy is only for "local management & AP User "
did "AP user" is same like "local net user"
Br'Subhojit

Hi,
I have exact the same issue to applying a password policy to local net users ? I am running version 7.6 on our 2504 ?
Thanks

Similar Messages

Cisco WLC Local Net user Authentication

Hi,
I have a Controller configured with local net users. Web policy with authentication has been configured for Layer 3 security. When the user tries to access the Wireless, they will be redirected to a web authentication screen, where they need to enter the pre-configured credentials to gain access.
Now, the requirement is: users shall have to provide login credentials only upon initial access (one time) and shall not have to accept an Acceptable Use Agreement when their systems connect to the wireless network. The next time user tries, they should be provided access automatically.
We have configured the following setting on Windows 7 client:
1. Connect automatically when the network is in range is selected
2. Please refer the attached screenshots for further configuration for Windows 7 Clients.
On WLC: SSID --> Advanced Options --> We have disabled the “Enable Session Timeout” setting, but we still have "Client Exclusion" Enabled.
When a computer is shutdown and brought back up within a few minutes the wireless credentials seem to stick, however, when the computer is shutdown for a period of overnight, the credentials are no longer cached and we have to re-authenticate to the wireless.
Is this issue because of "Client Exclusion" Enabled on the SSID/WLAN ?
If not, can someone share the complete procedure to make sure that users local net user credentials will be cache.
Thanks,
Jagan

Well you only can keep it connected for an x number of minutes. You will not be able to set it longer than a day. This means, I can't configure the WLC/Client to cache the credentials permanently? And everyday, they have to enter the credentials to access SSID?You can extend it up to 30 days, but you have to run v7.5. After that, they will have to login again.Change the idle timer to about 2-4 hours and that should keep the client on the WLC DB. This will allow the client to go away for the number set and come back without having to login again. As you said, if I configure the WLC Idle Time for 2-4 hours, do the client have to provide credentials the next day when they access Wireless?Yes. See my previous answerIs there any other way via which this can be achieved? (The limitation is : client should be authenticated only with the WLC.)If you are looking for clients to login once and then never again, the answer is no. You have two choices, you can use the new v7.5 and use the sleeping client feature which gives you max of 720 hours (30 days), or you use th eidle timer and after the idle timer expires, the user will have to login.Thanks,Jagan
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Cisco WLC local net user - guest account

Hello,
We have a 2504 Cisco WLC. I am creating Local Net Users for one of the WLANs that uses Web Auth and the Local Database.
My one question is, what does a "guest account" do differently than a non guest account besides the ability to create the lifetime of the account? I mean, it seems both give access to the WLAN so I am failing to see the difference between the two.
Any help is greatly appreciated.

A guest acct can only login to a webauth WLAN. A normal netuser can login to any WLAN that you allow or all. Including 802.1x if that WLAN is allowed to chek the local db
Steve
Sent from Cisco Technical Support iPhone App

Problem audit mismatch WCS/WLC for local net user

HI,
I have a problem in my WCS the audit status is mismatch for my two controllers. When I see the details of the mismatch, it is said that all my 400 users are "not present in controller".
However, I checked directly on my web interface of my controllers and my users are there (Security--> AAA--> Local Net Users). I've also checked on the WCS (ConfigureàControllersà controlerà Security à AAA -> local net user).
In both My users are present and are identical.
When i refresh config from controllers on the WCS it disappears but a week after the mismatch comes back.
If anyone can help, Thanks
Alex

Anyone able to answer this one?
We are having the same issue. We had WLC code 7.0.116.0 with WCS giving us mismatches on certain thresholds, despite the fact that the controller and the WCS configs were a match and no one made changes. We would refresh confgi from controller and a week later, the mismatch was back. It's as if there was something wrong with the WCS database. We upgraded to NCS 1.1 and are now on WLC code 7.0.230.0 and it worked for a while, but we are now randomly experiencing the same issues and then some with NCS.
We have a multi-tenant campus that has several of another organizations access points configured as friendly in NCS, but the controllers still had them as rogue and were containing them. We are also experiencing a max client count threshold that is set to 20 on the controller, but NCS is now reverting back to the default 12 value and giving off a mismatch. I don't know if there is a SQL issue with the database or not, but we service roughly 3000 users on a 5 million sq. ft. campus and some of these mismatches and failure to identify critical mismatches is starting to become a problem. Going to open a TAC case, but if anyone has any insight in the mean time, that would be helpful. Thanks!

Generate a Local net user Report from WLC or through WCS

Need advice regarding downloading the Local net user list from Anchor WLC or through WCS. In WCS I could not find any menu to generate a report on Local net users in other words Guest account list.
Please advice Thanks
Jacob

I don't know aobut using WCS, but you can always run a command through the cli:
show netuser summary

CISCO WLC , connecting SSID with local net user

Dears,
Created Local Net User
created SSID and Broadcasted, users can connect to SSID with PSK
But not able to connect using Local net user created in WLC
Edwin

Hi,
What kind of Layer 2 Security are you using on your SSID?
You can't have both PSK and Local user database authentication on the same SSID.
Best regards,
Sebastian

WLC 7 on 5508 - 802.1x and Local Net Users or LDAP

Is it possible under the 7 version of the software to use LDAP or Local Net Users for authentication instead of RADIUS for doing 802.1x authentication, and if it is, is there any documentation around that has some configuration information? I've been doing some poking around and haven't had much luck yet.

Wireless users on 802.1x? We're in the midst of testing this with 6.X and 7.X firmware. So far, no complaints.

Import local net users to Cisco Prime 1.2

Hi,
We have 4400 WLC that has about 400 local users configured under local net users and we are deploying Cisco Prime 1.2 in our company. Does anyone know how to import these users to Cisco prime? I was told that it could only be done manually like re entering all 400 entries to Cisco Prime! if this is the case it 'll be tedious.
Thanks for any help.

Hello,
Complete the following steps to migrate data from WCS:
1. Place the WCS export ZIP file (for example, wcs.zip) in a repository or folder (for example, repositories).
2. Log in as the admin user and stop the Cisco Prime Infrastructure server by entering the ncs stop command. Configure the FTP repository on the Cisco Prime Infrastructure appliance using the repository command as shown in configuration snippet below:
pi-appliance/admin# configure
pi-appliance/admin(config)# repository pi-ftp-repo
pi-appliance/admin(config-Repository)# url ftp://209.165.200.227/backup
pi-appliance/admin(config-Repository)# user ftp-user password plain ftp-user
Note: Make sure the archived file is available with the show repository command.
3. Enter the ncs migrate command in order to restore the WCS database.
pi-appliance/admin# ncs migrate wcs-data wcs.zip repository pi-ftp-repo
4. By default, no WCS events are migrated. Enter the ncs start command in order to start the Cisco Prime Infrastructure server after the upgrade is completed. Log in to the Cisco Prime Infrastructure user interface with the root login and the root password.
For mmore information you can refer to the cisco prime infrastructure deployment guide:
http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/deployment_guide_c07-721232.html#wp9000654

Internal Web Authentication + Local Net User

Hi all,
I'm trying to setup the WLC with internal web authentication + local net user account. I've setup a WLAN for this local net user configure the user profile map to this WLAN.
When the laptop get associated with the designated WLAN, and user tried to browse to the internet, the internal web authentication page doesn't appear on the browser.
I'm just curious is there any DNS server require in order to direct the user entered URL request to the virtual interface?
regards.

Well if you are using webauth for guest users, you really want to have an open ssid and wither have a username and password on the wlc or use a passthrough webauth where the guest users just have to click submit or accept. If you are using this for internal users, then you really shouldn't use webauth since this will not be single sign on. Again, you can if you want your internal users to sign on again. There is wpa/wpa2 PSK and then there is wpa/wpa2 8021.x in which this will require either using local EAP or a Radius Server. Ther radius server will either have the local user accounts or you can point this to AD. Depending on if you use EAP-PEAP (certificate on the radius server only) or EAP-TLS (certificate on both the radius and clinet) you will need a certificate.
For webauth only, you do not need a certificate on the user or radius server, a certificate will be required on the wlc if you don't want users to be promted with a certifcate error message. 5.1 supports unchained certificates, but I always use RapiddSSL for a root ca cert just to make deployment mush simpler for the client. So webauth and EAP will require certifcates with webauth being optional.

Local net users - usernames case sensitive

I am facing an annoying issue with our WLC's 5508.We have configured some local accounts - local net users and we found out that usernames are case sensitive.For example when i setup an account with username:TEST and the then try to login with username:test i get authentication failure..
I thought that only the admin accounts were case sensitive.
Has anyone else faced this problem?Is there any solution for this as i have already configured 60 local accounts.
Thank you in advance.

#Management Usernames are case sensitive.
#Local net user seem to be case sensitive per below bug, however it is a old one on 4.0.
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsg72444
*for local netuser, Does WLC allows to create same usernames like this - Apple, APPLE, AppLe. If allowed then at this point its considered that wlc allows to create case insensitive users for local netusers. Else if only Apple is allowed then it is case sensitive for user creation.
*Now try to login like - apple, aPPLE and also like Apple, APPLE, AppLe.
*Share the result along with the tested wlc code for conclusion. Let see what works and doesn't.

Local management users and Radiusproblem

I have created a wlan for guests and would like to only authenticate guestusers against Local Net Users database on the WLC.
My problem is that it is also possible to log on with usercredentials for radiusauthentication.
I have not enabled any AAAservers for the guestwlan.
Any tips how to stop the radiusauthentication for this wlan ?
JF

That is how it currently works, but here are two options:
You can either change the Web Radius Authentication to CHAP or MD5-CHAP which is located in the GUI... Controller | General
Or else you can create 3 fake radius servers on the wlc and then specify those three under the guest wlan radius servers.

"Sharepoint 2013" is giving error that prevents local domain users authentication for "Team Foundation Server"

I am getting 2 errors through the event viewer that prevents TFS 2013 authentication for local domain users, also this error started appearing after having TFS upgraded to [ 12.0.30723.0 (Tfs2013.Update3) ].
1st Error (from administrative events):
The Execute method of job definition Microsoft.SharePoint.Administration.SPUsageImportJobDefinition (ID a51a0244-765d-433b-8502-0bb0540ad1fd) threw an exception. More information is included below.
Access to the path 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS' is denied.
Tried so far:-
- changed the path to another folder from "Diagnostic Logging" in another drive, but still getting the same error.
2nd Error (from application server):
DistributedCOM error
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{000C101C-0000-0000-C000-000000000046}
and APPID
{000C101C-0000-0000-C000-000000000046}
to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Which I already got fixed using the following steps on a thread I opened before (but still getting the same error).
https://social.technet.microsoft.com/Forums/windows/en-US/3896e35c-b99a-4d30-b662-f92d337c8d6f/windows-servers-components-services-and-regedit-permissions-are-grayed-out-for-my-admin-account?forum=winservergen
Other Fixes I tried
- Found on another topic that it is not sharepoint that is causing the problem, but it is the generated ASP.NET web pages used for testing is causing the memory to fill up due to cashing on RAM, the fix suggested to change IIS cashing from RAM to HD to prevent
loading up using w3wp.exe from processes.
Concern
- by checking other topics for people having the same problem, it was mentioned that this error appeared after the lastest TFS update, is there is a fix for it ?

Hi Kpdn,
Thanks for your post.
All your participation and support are very important to build such harmonious/ pleasant / learning environment for MSDN community.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

How to get the MAC address of other hosts in local net

1. Is there any kerner or user function to get the MAC address of other hosts in local net?
2. ire_route_lookup() can only lookup MAC in routing table(arp -a),Is there any way to enable it to find out all MAC of hosts in the local net?
Best Regards
Hann

ChristianEC wrote:
Hi,
I am looking for a way to get the MAC address of a PXI RT controller. I know that there is a VI to do this, but I am looking for a solution for a dll (C-Code).
I use the "Call library node" to call this dll and want to make sure that it is only used on a specific PXI.
Since the VI provides the functionality, I am wondering if it is also available to be called from C-Code?
Thank you,
Christian
If it is available in LabVIEW it is probably available in CVI, which you could then build into a DLL (if there isn't one available already).
CLA, LabVIEW Versions 2010-2013

Acces to an external drive through a local net

I have 2 mac powerbook, connected through airport for the 1st, and ethernet for the 2nd. The 1st has some external drives connected to it, and I want the second to access these drives... I haven't found a way to do it... I guess it should be easy !
I have set up in the pref "share file mac" (not sure of the english words for it ! ), but I can access the 1st from the 2nd only as a user (through the finder "go to" the local net). Even if I log as an admin, I don't have access to the drives...
What has to be done ?
Big thanks
Jean Christophe

By default Mac OS X only shares certain directories on the main drive. You have to explictly tell it to share other volumes.
The easiest way to do this is to get a copy of SharePoints which is far easier than manually editing configuration files.

Wlc local EAP Help

Hi guys,
i need to set ip my wlc as a local eap authenticator.
I create a new Wlan(test1) ad associated yo a dynamic interface.
layer 2 security--->wpa+wpa2+auth(802.1x)
aa server-->local eap
I created a local-eap profile where i checked PEAP
I create a local-database user
My wireless-pc card pc was not able to work.
did i miss any step?
thx..
Ale.

Follow the steps in order to configure the devices for EAP authentication :
1. Configure the WLC for basic operation and register the Lightweight APs to the controller.
2. Configure the WLC for RADIUS authentication through an external RADIUS server.
3. Configure the WLAN parameters.
4. Configure Cisco Secure ACS as the external RADIUS server and create a user database for authenticating clients.
For the further details for configuration follow the URL It will help you :
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml

WLC- Local net user

Similar Messages

Maybe you are looking for