WLAN Security

Layer 2 Security

This section contains the following subsections:

Prerequisites for Layer 2 Security

WLANs with the same SSID must have unique Layer 2 security policies so that clients can make a WLAN selection based on the information advertised in beacon and probe responses. The available Layer 2 security policies are as follows:

  • None (open WLAN)

  • Static WEP or 802.1X


    Note


    • Because static WEP and 802.1X are both advertised by the same bit in beacon and probe responses, they cannot be differentiated by clients. Therefore, they cannot both be used by multiple WLANs with the same SSID.

    • WLAN WEP is not supported in Cisco Aironet 1810w Access Points.


  • WPA+WPA2


    Note


    • Although WPA and WPA2 cannot be used by multiple WLANs with the same SSID, you can configure two WLANs with the same SSID with WPA/TKIP with PSK and Wi-Fi Protected Access (WPA)/Temporal Key Integrity Protocol (TKIP) with 802.1X, or with WPA/TKIP with 802.1X or WPA/AES with 802.1X.

    • A WLAN configured with TKIP support will not be enabled on an RM3000AC module.


  • Static WEP (not supported on Wave 2 APs)

  • WPA2+WPA3

  • Enhanced Open

MAC Filtering of WLANs

When you use MAC filtering for client or administrator authorization, you need to enable it at the WLAN level first. If you plan to use local MAC address filtering for any WLAN, use the commands in this section to configure MAC filtering for a WLAN.

MAC Filtering with Centrally Authenticated WLANs

After the initial 802.11 authentication exchange between the AP and the clients, the AP sends the client association request in CAPWAP to the controller. If the controller is using a local MAC filter list, it will immediately send a successful or failed association response. If external RADIUS is used, the controller sends an Access-Request to the AAA server, and based on the response from RADIUS, sends its association response to the client.


Note


Wireless clients may time out their wait for association response within as little as 300 ms. Therefore, if you use an external RADIUS server with MAC filtering, ensure that the server responds within this timeframe.


Restrictions for MAC Filtering

  • MAC filtering cannot be configured for Guest LANs.

  • Interface mapping and profile precedence—MAC filtering for the WLAN set to any WLAN/Interface requires a mandatory profile name, followed by the interface name for the traffic to work properly.

Enabling MAC Filtering

Use these commands to enable MAC filtering on a WLAN:

  • Enable MAC filtering by entering the config wlan mac-filtering enable wlan_id command.

  • Verify that you have MAC filtering enabled for the WLAN by entering the show wlan command.

When you enable MAC filtering, only the MAC addresses that you add to the WLAN are allowed to join the WLAN. MAC addresses that have not been added are not allowed to join the WLAN.

When a client tries to associate to a WLAN for the first time, the client gets authenticated with its MAC address from AAA server. If the authentication is successful, the client gets an IP address from DHCP server, and then the client is connected to the WLAN.

When the client roams or sends association request to the same AP or different AP and is still connected to WLAN, the client is not authenticated again to AAA server.

If the client is not connected to WLAN, then the client has to get authenticated from the AAA server.

Local MAC Filters

Controllers have built-in MAC filtering capability, similar to that provided by a RADIUS authorization server.

Prerequisites for Configuring Local MAC Filters

You must have AAA enabled on the WLAN to override the interface name.

Configuring Local MAC Filters (CLI)

  • Create a MAC filter entry on the controller by entering the config macfilter add mac_addr wlan_id [interface_name] [description] [IP_addr] command.

    The following parameters are optional:

    • mac_addr —MAC address of the client.

    • wlan_id —WLAN id on which the client is associating.

    • interface_name —The name of the interface. This interface name is used to override the interface configured to the WLAN.

    • description —A brief description of the interface in double quotes (for example, “Interface1”).

    • IP_addr —The IP address which is used for a passive client with the MAC address specified by the mac addr value above.

  • Assign an IP address to an existing MAC filter entry, if one was not assigned in the config macfilter add command by entering the config macfilter ip-address mac_addr IP_addr command.

  • Verify that MAC addresses are assigned to the WLAN by entering the show macfilter command.


Note


For ISE NAC WLANs, the MAC authentication request is always sent to the external RADIUS server. The MAC authentication is not validated against the local database. This functionality is applicable to Releases 8.5, 8.7, 8.8, and later releases via the fix for CSCvh85830.

Previously, if MAC filtering was configured, the controller tried to authenticate the wireless clients using the local MAC filter. RADIUS servers were attempted only if the wireless clients were not found in the local MAC filter.


Protected Management Frames (802.11w)

Wi-Fi is a broadcast medium that enables any device to eavesdrop and participate either as a legitimate or rogue device. Control and management frames such as authentication/deauthentication, association/disassociation, beacons, and probes are used by wireless clients to select an AP and to initiate a session for network services.

Unlike data traffic which can be encrypted to provide a level of confidentiality, these frames must be heard and understood by all clients. They therefore must be transmitted as open or unencrypted. While these frames cannot be encrypted, they must be protected from forgery to protect the wireless medium from attacks. For example, an attacker could spoof management frames from an AP to tear down a session between a client and an AP.

The 802.11w protocol applies only to a set of robust management frames protected by the Management Frame Protection (PMF) service. These include Disassociation, Deauthentication, and Robust Action frames.

Management frames that are considered as robust action and therefore protected are the following:

  • Spectrum Management

  • QoS

  • DLS

  • Block Ack

  • Radio Measurement

  • Fast BSS Transition

  • SA Query

  • Protected Dual of Public Action

  • Vendor-specific Protected

When 802.11w is implemented in the wireless medium, the following occur:

  • Client protection is added by the AP adding cryptographic protection (by including the MIC information element) to deauthentication and disassociation frames preventing them from being spoofed in a DOS attack.

  • Infrastructure protection is added by adding a Security Association (SA) teardown protection mechanism consisting of an Association Comeback Time and an SA-Query procedure preventing spoofed association request from disconnecting an already connected client.

This section contains the following subsections:

Restrictions for Protected Management Frames (802.11w)

  • With PMF settings set to Optional or Enabled, a wireless client may intermittently fail temporarily to reassociate to an access point. This impact will be mitigated by enabling Fast Transition Over the Air, and by setting the PMF Comeback Timer value to 1 second.

  • The 802.11w standard is not supported .

  • 802.11w cannot be applied on an open WLAN, WEP-encrypted WLAN, or a TKIP-encrypted WLAN.

  • PMF is not supported in Cisco Aironet 1810, 1815, 1832, 1852, 1542, and 1800 series APs in FlexConnect mode prior to Release 8.9.

Configuring Protected Management Frames (802.11w) (GUI)

Procedure

Step 1

Choose WLANs > WLAN ID to open the WLANs > Edit page.

Step 2

In the Security tab, choose the Layer 2 security tab.

Step 3

From the Layer 2 Security drop-down list, choose WPA+WPA2.

The 802.11w IGTK Key is derived using the 4-way handshake, which means that it can only be used on WLANs that are configured for WPA2 security at Layer 2.

Note

 

WPA2 is mandatory and encryption type must be AES. TKIP is not valid.

Step 4

Choose the PMF state from the drop-down list

The following options are available:
  • Disabled—Disables 802.11w MFP protection on a WLAN

  • Optional—To be used if the client supports 802.11w.

  • Required—Ensures that the clients that do not support 802.11w cannot associate with the WLAN.

Step 5

If you choose the PMF state as either Optional or Required, do the following:

  1. In the Comeback Timer box, enter the association comeback interval in milliseconds. It is the time within which the access point reassociates with the client after a valid security association.

  2. In the SA Query Timeout box, enter the maximum time before an Security Association (SA) query times out.

Step 6

In the Authentication Key Management section, follow these steps:

  1. Select or unselect the PMF 802.1X check box to configure the 802.1X authentication for the protection of management frames.

  2. Select or unselect the PMF PSK check box to configure the preshared keys for PMF. Choose the PSK format as either ASCII or Hexadecimal and enter the PSK.

Step 7

Click Apply.

Step 8

Click Save Configuration.


Configuring Protected Management Frames (802.11w) 802.11w (CLI)

Procedure
  • Configure the 802.1X authentication for PMF by entering this command:

    config wlan security wpa akm pmf 802.1x {enable | disable} wlan-id

  • Configure the preshared key support for PMF by entering this command:

    config wlan security wpa akm pmf psk {enable | disable} wlan-id

  • If not done, configure a preshared key for a WLAN by entering this command:

    config wlan security wpa akm psk set-key {ascii | hex} psk wlan-id

  • Configure protected management frames by entering this command:

    config wlan security pmf {disable | optional | required} wlan-id

  • Configure the association comeback time settings by entering this command:

    config wlan security pmf association-comeback timeout-in-seconds wlan-id

  • Configure the SA query retry timeout settings by entering this command:

    config wlan security pmf saquery-retrytimeout timeout-in-milliseconds wlan-id

  • See the 802.11w configuration status for a WLAN by entering this command:

    show wlan wlan-id

  • Configure the debugging of PMF by entering this command:

    debug pmf events {enable | disable}

Fast Secure Roaming

802.11r Fast Transition

802.11r, which is the IEEE standard and generally recommended in order to speed roaming when using EAP, introduces a new concept of roaming where the initial handshake with the new AP is done even before the client roams to the target AP, which is called Fast Transition (FT). The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client does the reassociation request or response exchange with new target AP.

802.11r provides two methods of roaming:

  • Over-the-Air

  • Over-the-DS (Distribution System)

The FT key hierarchy is designed to allow clients to make fast BSS transitions between APs without requiring reauthentication at every AP. WLAN configuration contains a new Authenticated Key Management (AKM) type called FT (Fast Transition).

From Release 8.0, you can create an 802.11r WLAN that is also an WPAv2 WLAN. In earlier releases, you had to create separate WLANs for 802.11r and for normal security. Non-802.11r clients can now join 802.11r-enabled WLANs as the 802.11r WLANs can accept non-802.11r associations. If clients do not support mixed mode or 802.11r join, they can join non-802.11r WLANS. When you configure FT PSK and later define PSK, clients that can join only PSK can now join the WLAN in mixed mode.

How a Client Roams

For a client to move from its current AP to a target AP using the FT protocols, the message exchanges are performed using one of the following two methods:

  • Over-the-Air—The client communicates directly with the target AP using IEEE 802.11 authentication with the FT authentication algorithm.

  • Over-the-DS—The client communicates with the target AP through the current AP. The communication between the client and the target AP is carried in FT action frames between the client and the current AP and is then sent through the controller.

    Note


    Over-the-Air is the preferred and recommended method compared to the Over-the-DS method.


Figure 1. Message Exchanges when Over the Air client roaming is configured. This figure shows the sequence of message exchanges that occur when Over the Air client roaming is configured.
Figure 2. Message Exchanges when Over the DS client roaming is configured. This figure shows the sequence of message exchanges that occur when Over the DS client roaming is configured.

This section contains the following subsections:

Restrictions for 802.11r Fast Transition

  • This feature is not supported on mesh access points.

  • In 8.1 and earlier releases, this feature is not supported on access points in FlexConnect mode. In Release 8.2, this restriction is removed.

  • For APs in FlexConnect mode:

    • 802.11r Fast Transition is supported in central and locally switched WLANs.

    • This feature is not supported for the WLANs enabled for local authentication.

    • 802.11r client association is not supported on access points in standalone mode.

    • 802.11r fast roaming is not supported on access points in standalone mode.

    • 802.11r fast roaming between local authentication and central authentication WLAN is not supported.

    • 802.11r fast roaming works only if the APs are in the same FlexConnect group.

  • 802.11r fast roaming is not supported if the client uses Over-the-DS preauthentication in standalone mode.

  • EAP LEAP method is not supported. WAN link latency prevents association time to a maximum of 2 seconds.

  • The service from standalone AP to client is only supported until the session timer expires.

  • TSpec is not supported for 802.11r fast roaming. Therefore, RIC IE handling is not supported.

  • If WAN link latency exists, fast roaming is also delayed. Voice or data maximum latency should be verified. The controller handles 802.11r Fast Transition authentication request during roaming for both Over-the-Air and Over-the-DS methods.

  • This feature is supported on open and WPA2 configured WLANs.

  • It is not possible to enable WPA1 encryption along with Fast Transition on a WLAN using the controller GUI. The workaround is to configure it using the controller CLI. For more information, see https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp05137.

  • Legacy clients cannot associate with a WLAN that has 802.11r enabled if the driver of the supplicant that is responsible for parsing the Robust Security Network Information Exchange (RSN IE) is old and not aware of the additional AKM suites in the IE. Due to this limitation, clients cannot send association requests to WLANs. These clients, however, can still associate with non-802.11r WLANs. Clients that are 802.11r capable can associate as 802.11i clients on WLANs that have both 802.11i and 802.11r Authentication Key Management Suites enabled.

    802.11i Opportunistic Key Caching (Proactive Key Caching) is supported only by Microsoft Windows clients. It is always enabled and cannot be disabled.

    The workaround is to enable or upgrade the driver of the legacy clients to work with the new 802.11r AKMs, after which the legacy clients can successfully associate with 802.11r enabled WLANs.

    Another workaround is to have two SSIDs with the same name but with different security settings (FT and non-FT).

  • Fast Transition resource request protocol is not supported because clients do not support this protocol. Also, the resource request protocol is an optional protocol.

  • To avoid any Denial of Service (DoS) attack, each controller allows a maximum of three Fast Transition handshakes with different APs.

  • Disable the fast transition padding option for keys setting in the client to prevent the client from getting de-authenticated from an SSID with 802.11r Fast Transition enabled.

  • Non-802.11r capable devices will not be able to associate with FT-enabled WLAN.

  • 802.11r FT + PMF is not recommended.

  • 802.11r FT Over-the-Air roaming is recommended for FlexConnect deployments.

  • In a default FlexGroup scenario, fast roaming is not supported.

Configuring 802.11r Fast Transition (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs window.

Step 2

Click a WLAN ID to open the WLANs > Edit window.

Step 3

Choose Security > Layer 2 tab.

Step 4

From the Layer 2 Security drop-down list, choose WPA+WPA2.

The Authentication Key Management parameters for Fast Transition are displayed.

Step 5

From the Fast Transition drop-down list, choose Fast Transition on the WLAN.

Step 6

Uncheck the Over the DS check box to enable Fast Transition Over the Air.

Fast Transition Over the Air is the recommended configuration for this feature.

This option is available only if you enable Fast Transition or if Fast Transition is adaptive.

Step 7

In the Reassociation Timeout field, enter the number of seconds after which the reassociation attempt of a client to an AP should time out. The valid range is 1 to 100 seconds.

Note

 

This option is available only if you enable Fast Transition.

Step 8

Under Authentication Key Management, choose FT 802.1X or FT PSK. Check or uncheck the corresponding check boxes to enable or disable the keys. If you check the FT PSK check box, from the PSK Format drop-down list, choose ASCII or Hex and enter the key value.

Note

 

When Fast Transition adaptive is enabled, you can use only 802.1X and PSK AKM..

Step 9

From the WPA gtk-randomize State drop-down list, choose Enable or Disable to configure the Wi-Fi Protected Access (WPA) group temporal key (GTK) randomize state.

Step 10

Click Apply to save your settings.


Configuring 802.11r Fast Transition (CLI)

802.11r-enabled WLAN provides faster roaming for wireless client devices. However, if 802.11r is enabled on a WLAN and advertises fast transition (FT) and non-FT AKMs in Beacon and Probe RSN IE, some of the devices with bad implementation may not recognize FT/WPA2 authentication key-management (AKM) in RSN IE and fails to join. As a result, customers cannot enable 802.11r on the SSID.

To overcome this, Cisco Wireless infrastructure introduces adaptive 802.11r feature. When FT mode is set to adaptive, WLAN advertises 802.11r Mobility Domain ID on an 802.11i-enabled WLAN. Apple iOS10 client devices identifies the presence of MDIE on a 80211i/WPA2 WLAN and does a proprietary handshake to establish 802.11r association. Once the client completes successful 802.11r association, it will be able to do FT roaming as in a normal 802.11r enabled WLAN.

The FT adaptive is applicable only to selected Apple iOS10 devices. All other clients will continue to have 802.11i association on the WLAN.

Procedure

Step 1

To enable or disable 802.11r fast transition parameters, use the config wlan security ft { adaptive | enable | disable} wlan-id command.

Fast Transition adaptive option is enabled by default when you create a new WLAN, from the controller, Release 8.3, onwards. However, the existing WLANs will retain its current configuration when the controller upgrades to Release 8.3 from an earlier release.

Enable Fast SSID feature for allowing client devices a smother switching smoother switching from one WLAN to another..

Step 2

To enable or disable 802.11r fast transition parameters over a distributed system, use the config wlan security ft over-the-ds { enable | disable} wlan-id command.

The Client devices normally prefer fast transition over-the-ds if the capability is advertised in the WLAN. To force a client to perform fast transition over-the-air, disable fast transition over-the-ds.

Step 3

To enable or disable the authentication key management for fast transition using preshared keys (PSK), use the config wlan security wpa akm ft psk { enable | disable} wlan-id command.

By default, the authentication key management using PSK is disabled.

Step 4

To enable or disable authentication key management for adaptive using PSK, use the config wlan security wpa akm psk { enable | disable} wlan-id command.

Step 5

To enable or disable authentication key management for fast transition using 802.1X, use the config wlan security wpa akm ft-802.1X { enable | disable} wlan-id command.

By default, authentication key management using 802.1X is enabled.

Step 6

To enable or disable authentication key management for adaptive using 802.1x, use the config wlan security wpa akm 802.1x { enable | disable} wlan-id command.

Note

 
When Fast Transition adaptive is enabled, you can use only 802.1X and PSK AKM.

Step 7

To enable or disable 802.11r fast transition reassociation timeout, use the config wlan security ft reassociation-timeout timeout-in-seconds wlan-id command.

The valid range is 1 to 100 seconds. The default value of reassociation timeout is 20 seconds.

Step 8

To view the fast transition configuration on a WLAN, use the show wlan wlan-id command.

Step 9

To view the fast transition configuration on a client, use the show client detail client-mac command.

Note

 

This command is relevant only for a connected or connecting client station (STA).

Step 10

To enable or disable debugging of fast transition events, use the debug ft events { enable | disable} command.


What to do next
  • The tech support command output and xml config will not display fast transition information when it is disabled.

  • The tech support command output and xml config will display Adaptive 802.11r information when it is enabled.

  • To display a comprehensive view of the current controller configuration, use the show run-config all command.

  • The fast transition adaptive mode is not supported on Releases prior to Release 8.3, the fast transition adaptive WLANs default to fast transition disable when the controller is downgraded from Release 8.3 to a previous release, and the fast transition adaptive configuration is invalidated.

Troubleshooting 802.11r BSS Fast Transition

Symptom Resolution
Non-802.11r legacy clients are no longer connecting. Check if the WLAN has FT enabled. If so, non-FT WLAN will need to be created.
When configuring WLAN, the FT setup options are not shown. Check if WPA2 is being used (802.1x / PSK). FT is supported only on WPA2 and OPEN SSIDs.
802.11r clients appear to reauthenticate when they do a Layer 2 roam to a new controller. Check if the reassociation timeout has been lowered from the default of 20 by navigating to WLANs > WLAN Name > Security > Layer 2 on the controller GUI.

802.11i Sticky Key Caching

The controller supports sticky key caching (SKC). With sticky key caching, the client receives and stores a different PMKID for every AP it associates with. The APs also maintain a database of the PMKID issued to the client.

In SKC, the client stores each Pairwise Master Key ID (PMKID) against a Pairwise Master Key Security Association (PMKSA). When a client finds an AP for which it has the PMKSA, it sends the PMKID in the association request to the AP. If the PMKSA is alive in the AP, the AP provides support for fast roaming. In SKC, full authentication is done on each new AP to which the client associates and the client must keep the PMKSA associated with all APs. For SKC, PMKSA is a per AP cache that the client stores and PMKSA is precalculated based on the BSSID of the new AP.

SKC is useful only in cases where you have a small number of clients, which roam among a small number of APs.

This section contains the following subsections:

Restrictions for Sticky Key Caching

  • The controller supports SKC for up to eight APs per client. If a client roams to more than 8 APs per session, the old APs are removed to store the newly cached entries when the client roams. We recommend that you do not use SKC for large scale deployments.

  • SKC works only on WPA2-enabled WLANs.

  • SKC does not work across controllers in a mobility group.

  • SKC works only on local mode APs.

Configuring Sticky Key Caching (CLI)

Procedure

Step 1

Disable the WLAN by entering this command:

config wlan disable wlan_id

Step 2

Enable sticky key caching by entering this command:

config wlan security wpa wpa2 cache sticky enable wlan_id

By default, SKC is disabled and opportunistic key caching (OKC) is enabled.

Note

 

SKC works only on WPA2 enabled WLANs.

You can check if SKC is enabled by entering this command:

show wlan wlan_id

Information similar to the following appears:


WLAN Identifier.................................. 2
Profile Name..................................... new
Network Name (SSID).............................. new
Status........................................... Disabled
MAC Filtering.................................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
     SKC Cache Support......................... Enabled 
      FT Reassociation Timeout................... 20
      FT Over-The-Air mode....................... Enabled
      FT Over-The-Ds mode........................ Enabled
CCKM tsf Tolerance............................... 1000
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled



Step 3

Enable the WLAN by entering this command:

config wlan enable wlan_id

Step 4

Save your settings by entering this command:

save config


Cisco Centralized Key Management (CCKM)

Cisco Centralized Key Management (CCKM) is an older proprietary method of fast secure roaming that was supported with dynamic WEP, WPA1 & WPA2 EAP security. With WPA2, CCKM is supported only by Cisco wireless phones and Cisco WGBs. It has been superseded by the 802.11r FT standard.

CCKM uses a fast rekeying technique that enables clients to roam from one AP to another without going through the controller, typically in under 150 milliseconds (ms). CCKM reduces the time required by the client to mutually authenticate with the new AP and derive a new session key during reassociation. CCKM fast secure roaming ensures that there is no perceptible delay in time-sensitive applications such as wireless Voice over IP (VoIP), enterprise resource planning (ERP), or Citrix-based solutions. CCKM is a CCXv4-compliant feature. If CCKM is selected, only CCKM clients are supported.

If you enable CCKM, the functionality of APs differs from the controller's for fast roaming in the following ways:

  • If an association request sent by a client has CCKM enabled in a Robust Secure Network Information Element (RSN IE) but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then the controller does not do a full authentication. Instead, the controller validates the PMKID and does a four-way handshake.

  • If an association request sent by a client has CCKM enabled in RSN IE but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then AP does a full authentication. The access point does not use PMKID sent with the association request when CCKM is enabled in RSN IE.

For more information, see https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html#anc24.

Wi-Fi Protected Areas (WPA)

WPA1 and WPA2

Wi-Fi Protected Access (WPA or WPA1) and WPA2 are standards-based security solutions from the Wi-Fi Alliance that provide data protection and access control for wireless LAN systems. WPA1 is compatible with the IEEE 802.11i standard but was implemented prior to the standard’s ratification; WPA2 is the Wi-Fi Alliance's implementation of the ratified IEEE 802.11i standard.


Note


WPA1 is deprecated. It may not be configured by itself, but only enabled if WPA2/CCMP128 (AES) is also enabled. WPA2 is the default. WPA3 is the emerging standard.

These standards provide for an authentication method and a cipher management method. The authentication methods supported are: 802.1X (a.k.a WPA Enterprise) and PSK.


By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated key management by default. However, these options are also available:

  • 802.1X—The standard for wireless LAN security, as defined by IEEE, is called 802.1X for 802.11, or simply 802.1X. An access point that supports 802.1X acts as the interface between a wireless client and an authentication server, such as a RADIUS server, to which the access point communicates over the wired network. If 802.1X is selected, only 802.1X clients are supported.

    In the 802.1X(Enterprise) authentication method, the clients use EAP (extensible authentication protocol) to authenticate with an authentication server. The authentication server can be an external RADIUS or LDAP server, or a local auth server running within the controller.

    To speed up roaming, a fast secure roaming method may optionally be deployed to bypass the authentication and key exchange phases.

  • PSK—When you choose PSK (also known as WPA preshared key or WPA passphrase), you need to configure a preshared key (or a passphrase). This key is used as the pairwise master key (PMK) between the clients and the authentication server.

  • CCKM—Cisco Centralized Key Management (CCKM) uses a fast rekeying technique that enables clients to roam from one access point to another without going through the controller, typically in under 150 milliseconds (ms). CCKM reduces the time required by the client to mutually authenticate with the new access point and derive a new session key during reassociation. CCKM fast secure roaming ensures that there is no perceptible delay in time-sensitive applications such as wireless Voice over IP (VoIP), enterprise resource planning (ERP), or Citrix-based solutions. CCKM is a CCXv4-compliant feature. If CCKM is selected, only CCKM clients are supported.

    When CCKM is enabled, the behavior of access points differs from the controller's for fast roaming in the following ways:

    • If an association request sent by a client has CCKM enabled in a Robust Secure Network Information Element (RSN IE) but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then the controller does not do a full authentication. Instead, the controller validates the PMKID and does a four-way handshake.

    • If an association request sent by a client has CCKM enabled in RSN IE but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then AP does a full authentication. The access point does not use PMKID sent with the association request when CCKM is enabled in RSN IE.

  • 802.1X+CCKM—During normal operation, 802.1X-enabled clients mutually authenticate with a new access point by performing a complete 802.1X authentication, including communication with the main RADIUS server. However, when you configure your WLAN for 802.1X and CCKM fast secure roaming, CCKM-enabled clients securely roam from one access point to another without the need to reauthenticate to the RADIUS server. 802.1X+CCKM is considered optional CCKM because both CCKM and non-CCKM clients are supported when this option is selected.

On a single WLAN, you can allow WPA1, WPA2, and 802.1X/PSK/CCKM/802.1X+CCKM clients to join. All of the access points on such a WLAN advertise WPA1, WPA2, and 802.1X/PSK/CCKM/
802.1X+CCKM information elements in their beacons and probe responses. When you enable WPA1 and/or WPA2, you can also enable one or two ciphers, or cryptographic algorithms, designed to protect data traffic. Specifically, you can enable AES and/or TKIP data encryption for WPA1 and/or WPA2. TKIP is the default value for WPA1, and AES is the default value for WPA2.

This section contains the following subsections:

Configuring WPA1+WPA2 (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Step 3

Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page.

Step 4

Choose WPA+WPA2 from the Layer 2 Security drop-down list.

Step 5

From the Security Type drop-down list, choose from the following options:

  • Personal
  • Enterprise

Step 6

(Optional) Check the MAC Filtering check box if you want MAC filtering to be enabled.

Step 7

(Optional) If you choose the security type as Personal, you can enable the RADIUS server to automatically learn the PSK for a specific client by checking the AutoConfig iPSK check box.

Step 8

Under WPA+WPA2 Parameters, select the WPA Policy check box to enable WPA1, select the WPA2 Policy check box to enable WPA2, or select both check boxes to enable both WPA1 and WPA2.

Note

 

By default, WPA2 with CCMP128 is enabled. Optionally, WPA1 with CCMP128 and/or TKIP may be enabled, but WPA1 may not be configured with WPA2 disabled.

Note

 

Configure CCMP128(AES) for compatibility with greatest range of clients. Optionally, more secure ciphers (CCMP256, GCMP128, GCMP256) may be selected for greater security with recently released clients.

If using 802.1X (Enterprise) authentication, select 802.1X-SHA1 for compatibility with greatest range of clients. Or optionally, select 802.1X-SHA2 for use with recently released clients.

Step 9

Select the WPA2 Policy-AES check box to enable AES data encryption .

Note

 

Based on guidance from the Wi-Fi alliance (WFA), WPA/TKIP can only be configured on a secondary interface (CLI). Any previously saved TKIP configurations are retained upon upgrade and can be viewed on the CLI. This allows customers with Wi-Fi clients that only support WPA/TKIP to have a planned migration to devices that support AES.

Step 10

(Optional) Select the OSEN Policy check box to enable OSEN.

Step 11

(Optional) Select the OSEN Encryption check box to enable OSEN encryption as CCMP128(AES).

Step 12

Choose one of the following key management methods from the Auth Key Mgmt drop-down list: 802.1X, CCKM, PSK, or 802.1X+CCKM.

Step 13

If you chose PSK, choose ASCII or HEX from the PSK Format drop-down list and then enter a preshared key in the blank text box. WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.

Note

 
The PSK parameter is a set-only parameter. The value set for the PSK key is not visible to the user for security reasons. For example, if you selected HEX as the key format when setting the PSK key, and later when you view the parameters of this WLAN, the value shown is the default value. The default is ASCII.

Step 14

Save the configuration.


Configuring WPA1+WPA2 (CLI)

Procedure

Step 1

Disable the WLAN by entering this command:

config wlan disable wlan_id

Step 2

Enable or disable WPA for the WLAN by entering this command:

config wlan security wpa {enable | disable} wlan_id

Step 3

Enable or disable WPA1 for the WLAN by entering this command:

config wlan security wpa wpa1 {enable | disable} wlan_id

Step 4

Enable or disable WPA2 for the WLAN by entering this command:

config wlan security wpa wpa2 {enable | disable} wlan_id

Step 5

Enable or disable AES or TKIP data encryption for WPA1 or WPA2 by entering one of these commands:

  • config wlan security wpa wpa1 ciphers {aes | tkip} {enable | disable} wlan_id

  • config wlan security wpa wpa2 ciphers {aes | tkip} {enable | disable} wlan_id

The default values are TKIP for WPA1 and AES for WPA2.

Note

 
From Release 8.0, you cannot configure TKIP as a standalone encryption method. TKIP can be used only with the AES encryption method.

Note

 
You can enable or disable TKIP encryption only using the CLI. Configuring TKIP encryption is not supported in GUI.

When you have VLAN configuration on WGB, you need to configure the encryption cipher mode and keys for a particular VLAN, for example, encryption vlan 80 mode ciphers tkip . Then, you need configure the encryption cipher mode globally on the multicast interface by entering the following command: encryption mode ciphers tkip .

Step 6

Enable or disable 802.1X, PSK, or CCKM authenticated key management by entering this command:

config wlan security wpa akm {802.1X | psk | cckm} {enable | disable} wlan_id

The default value is 802.1X.

Step 7

If you enabled PSK in Step 6, enter this command to specify a preshared key:

config wlan security wpa akm psk set-key {ascii | hex} psk-key wlan_id

WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.

Step 8

Configure PMK ID inclusion in M1 of 4-way handshake messages by entering this command:

config wlan security wpa akm psk pmkid {enable | disable} wlan_id

Step 9

Enable or disable authentication key management suite for fast transition by entering this command:

config wlan security wpa akm ft {802.1X | psk} {enable | disable} wlan_id

Note

 
You can now choose between the PSK and the fast transition PSK as the AKM suite.

Step 10

Enable or disable randomization of group temporal keys (GTK) between AP and clients by entering this command:

config wlan security wpa gtk-random {enable | disable} wlan_id

Step 11

If you enabled WPA2 with 802.1X authenticated key management or WPA1 or WPA2 with CCKM authenticated key management, the PMK cache lifetime timer is used to trigger reauthentication with the client when necessary. The timer is based on the timeout value received from the AAA server or the WLAN session timeout setting. To see the amount of time remaining before the timer expires, enter this command:

show pmk-cache all

If you enabled WPA2 with 802.1X authenticated key management, the controller supports both opportunistic PMKID caching and sticky (or non-opportunistic) PMKID caching. In sticky PMKID caching (SKC), the client stores multiple PMKIDs, a different PMKID for every AP it associates with. Opportunistic PMKID caching (OKC) stores only one PMKID per client. By default, the controller supports OKC.

Step 12

Enable the WLAN by entering this command:

config wlan enable wlan_id

Step 13

Save your settings by entering this command:

save config


WPA3

WPA3 is a replacement to WPA2, as announced by the Wi-Fi Alliance. The new standard has two modes:

  • WPA3-Personal with 128-bit encryption: The WPA3 standard provides a replacement to WPA2's preshared key (PSK) with Simultaneous Authentication of Equals (SAE), as defined in the IEEE 802.11-2016 standard. With SAE, the user experience is the same (choose a passphrase to connect), but SAE automatically adds a step to the handshake, which makes brute force attacks ineffective. With SAE, the passphrase is not exposed, making it impossible for attackers to find the passphrase through brute force dictionary attacks.

    The Protected Management Frames (PMF) should be used for all WPA3-Personal connections. Previously, PMF was an optional capability, which you could configure. With WPA3, PMF must be negotiated for all WPA3 connections that provide an additional layer of protection from deauthentication and dissociation attacks.

  • WPA3-Enterprise with 192-bit encryption: This WPA3 standards is aligned with the recommendations from the Commercial National Security Algorithm (CNSA) Suite, which is commonly in place in high-security Wi-Fi networks in verticals such as government, defense, finance, and so on.

For more information about WPA3, see the Wi-Fi Alliance's website.

Enhanced Open

The Enhanced Open feature is based on Opportunistic Wireless Encryption (OWE) and provides encryption to open (unencrypted) wireless networks and a higher level of security against passive sniffing and simple attacks compared to a public PSK wireless network.

With Enhanced Open, clients and the controller or the AP perform a Diffie-Hellman key exchange during the access procedure and use the resulting pairwise secret with the 4-way handshake.

Enhanced Open requires no special configuration or user interaction.

For more information about Enhanced Open, see the the Wi-Fi Alliance's website.

Guidelines and Restrictions on WPA3

  • WPA3 is not supported in Cisco Wave 1 (IOS-based) APs.

  • IPSK with SAE is not supported.

  • FT with SAE is not supported.

  • Policy details for client joining WPA2+WPA3 WLANs:

    • Client policy is shown as WPA3 for personal security WLAN with SAE in enabled state.

    • Client policy is shown as WPA3 for Enhanced Open WLANs.

    • Client policy is shown as WPA3 only if client joining the WLAN has PMF in enabled state, has SUITE192-1x AKM, GCMP256 cipher, and the WLAN has WPA3 in enabled state. Else, the client policy is shown as WPA2.

This section contains the following subsections:

Configuring WPA3 (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the corresponding WLAN to open the WLANs > Edit page.

Step 3

Choose the Security > Layer 2 tabs.

Step 4

From the Layer 2 Security drop-down list, choose WPA2+WPA3.

Step 5

From the Security Type drop-down list, choose from the following options:

  • Personal
  • Enterprise

Step 6

(Optional) Check the MAC Filtering check box if you want MAC filtering to be enabled.

Step 7

(Optional) If you choose the security type as Personal, you can enable the RADIUS server to automatically learn the PSK for a specific client by checking the AutoConfig iPSK check box.

Step 8

In the WPA2+WPA3 Parameters section, choose WPA3 as the Policy.

  • If you choose Personal, Encryption Cipher is limited to CCMP128(AES) and Authentication Key Management is in the PSK format. Also, if only WPA3 is selected as the security policy, Fast Transition is set to Disabled state, Protected Management Frame is set to Required state.

  • If you choose Enterprise, all the Encryption Cipher options are available, you can configure Fast Transtion, Protected Management Frame is set to Required state, and the Authentication Key Management options include 802.1X-SHA1, 802.1X-SHA2 , and CCKM.

Step 9

Chose the Encryption Cipher from the following options:

  • CCMP128(AES)
  • CCMP256 (not available for Personal security type)
  • GCMP128 (not available for Personal security type)
  • GCMP256 (not available for Personal security type)

Step 10

(Optional) If you have chosen security type as Personal and the security policy as WPA3, configure the PSK in the Authentication Key Management section by specifying the PSK format and the key.

Step 11

(Optional) If you have chosen security type as Enterprise, configure the Authentication Key Management using 802.1x-SHA256 only.

Step 12

From the WPA GTK-randomize State drop-down list, choose Enable or Disable to configure the Wi-Fi Protected Access (WPA) group temporal key (GTK) randomize state.

Step 13

Save the configuration.


Configuring SAE Mixed Mode (WPA2+WPA3) (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Step 3

Choose the Security > Layer 2 tabs.

Step 4

Choose WPA2+WPA3 from the Layer 2 Security drop-down list.

Step 5

From the Security Type drop-down list, choose from the following options:

  • Personal
  • Enterprise

Step 6

In the WPA2+WPA3 Parameters section, choose WPA2 and WPA3 as the Policy.

Step 7

Chose the Encryption Cipher from the following options:

  • CCMP128(AES)
  • CCMP256 (not available for Personal security type)
  • GCMP128 (not available for Personal security type)
  • GCMP256 (not available for Personal security type)

Step 8

Configure the Fast Transtion. You can enable, disable, or set Fast Transition to Adaptive mode.

Step 9

In the Protected Management Frame section, set PMF to either of the following states:

  • Required: Forces clients to negotiate 802.11w PMF on the WLAN.
  • Optional: To be used if clients support 802.11w.

Step 10

In the Comeback Timer field, enter the association comeback interval, in seconds. It is the time within which the AP reassociates with the client after a valid security association. Valid range is 1 to 10 seconds.

Step 11

In the SA Query Timeout field, enter the maximum time before a Security Association (SA) query times out. Valid range is 100 to 500 milliseconds.

Step 12

Configure Authentication Key Management depending on the security type you have chosen:

  • Personal: If you have chosen the security type as Personal, specify the PSK format, the key, enable or disable PSK and PSK-SHA2.
  • Enterprise: If you have chosen the security type as Enterprise, enable or disable 802.1x-SHA256.

Step 13

From the WPA GTK-randomize State drop-down list, choose Enable or Disable to configure the Wi-Fi Protected Access (WPA) group temporal key (GTK) randomize state.

Step 14

Save the configuration.


Configuring WPA3 (CLI)

Procedure

Step 1

(Optional) Create a WLAN by entering this command:

config wlan create wlan-id wlan-name ssid

Step 2

Disable 802.1X support on the WLAN by entering this command:

config wlan security wpa akm 802.1x disable wlan-id

Step 3

Enable SAE AKM support on the WLAN by entering this command:

config wlan security wpa akm sae enable wlan-id

Step 4

Set the PMF to Required state to force clients to negotiate 802.11w PMF on the WLAN by entering this command:

config wlan security pmf required wlan-id

Step 5

Configure the PSK by entering this command:

config wlan security wpa akm psk set-key ascii psk-key wlan-id

Step 6

Disable WPA2 on the WLAN by entering this command:

config wlan security wpa wpa2 disable wlan-id

Step 7

Enable WPA3 on the WLAN by entering this command:

config wlan security wpa wpa3 enable wlan-id

Step 8

Disable 802.11r Fast Transition roaming support on the WLAN by entering this command:

config wlan security ft disable wlan-id

Step 9

Enable the WLAN by entering this command:

config wlan enable wlan-id


Configuring SAE Anticlogging (CLI)

Anticlogging token is a mechanism to protect entities from Denial of Service (DoS) attack. Anticlogging token is bound to MAC address of the station (STA). The length of the token cannot be more than 256 bytes.

You can configure anticlogging threshold in terms of resource percentage. On hitting the threshold for the resource, the controller starts to reject authentication commit requests that come with anticlogging token. Subsequent authentication commit requests from client must have the same token. Controller processes only the authentication commit requests that have valid anticlogging tokens.

Procedure
  • Configure SAE anticlogging threshold by entering this command:

    config advanced sae anti-clog-threshold limit

    Valid range for the block limit is 0 to 90. If the anticlogging threshold limit is 90, the anticlogging is enforced by the controller when the number of clients reach 90 percent of the supported number.

  • Configure the maximum number of retries for an SAE message by entering this command:

    config advanced sae max-retry limit

    Valid range for the maximum number of retransmission attempt for a message is 2 to 4.

  • Configure message retry timeout by entering this command:

    config advanced sae retry-timeout timeout

    Valid range for the timeout for retransmission is 200 to 2000 milliseconds.

  • View information about an SAE configuration by entering this command:

    show wlan wlan-id

  • View information about SAE client by entering this command:

    show client detail client-mac-address

Configuring SAE AntiClogging for FlexConnect APs (CLI)

Procedure
  • Configure SAE anticlogging threshold by entering this command:

    config wlan flexconnect sae anti-clog-threshold limit

    Valid range for the block limit is 0 to 90.

  • Configure the maximum number of retries for an SAE message by entering this command:

    config wlan flexconnect sae max-retry limit

    Valid range for the maximum number of retransmission attempt for a message is 3 to 10.

  • Configure message retry timeout by entering this command:

    config wlan flexconnect sae retry-timeout timeout

    Valid range for the timeout for retransmission is 40 to 3000 milliseconds.

Configuring SAE Exclusion List (CLI)

SAE clients are put in a blocked list if they experience authentication failure five times consecutively. The clients are put in a blocked list for the timeout you have configured for the WLAN. SAE clients can be put in a blocked list on the following failures:
  • ECC Group is not correct

  • Anticlogging token is requested multiple times

  • Token validation failure

  • Commit parameter invalid

  • Commit frame received in incorrect state

  • Other internal error occurs while processing SAE commit and confirm messages

SAE clients are put in a blocked list, and are removed based upon the WLAN’s configured exclusion list timer, rounded off to the nearest 60 seconds.

Procedure
  • Configure exclusion listing for SAE clients by entering this command:

    config wlan exclusion-list wlan-id {enabled | disabled}

  • Configure exclusion listing timeout by entering this command:

    config wlan exclusion-list wlan-id timeout

    Valid range for the exclusion list timeout is 0 to 2147483647 seconds, with the default value set at 180 seconds. Timeout value of 0 requires admin override.

  • See the blocked-list client entry by entering this command:

    show exclusionlist

Configuring Enhanced Open (GUI)

Before you begin
Ensure that you have at least one open WLAN created with Layer 2 Security set to None.
Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the desired WLAN to open the WLANs > Edit page.

Step 3

Choose the Security > Layer 2 tabs.

Step 4

Choose Enhanced Open from the Layer 2 Security drop-down list.

Step 5

Enable MAC Filtering if required.

Step 6

In the Protected Management Frame section, PMF is by default set to Required state.

Step 7

Save the configuration.


Configuring Enhanced Open (CLI)

Procedure

Step 1

(Optional) Create a WLAN by entering this command:

config wlan create wlan-id wlan-name ssid

Step 2

Disable WPA2 on the WLAN by entering this command:

config wlan security wpa wpa2 disable wlan-id

Step 3

Enable WPA3 on the WLAN by entering this command:

config wlan security wpa wpa3 enable wlan-id

Step 4

Disable 802.1X support on the WLAN by entering this command:

config wlan security wpa akm 802.1x disable wlan-id

Step 5

Enable OWE AKM support on the WLAN by entering this command:

config wlan security wpa akm owe enable wlan-id

Step 6

Set the PMF to Required state to force clients to negotiate 802.11w PMF on the WLAN by entering this command:

config wlan security pmf required wlan-id

Step 7

Disable 802.11r fast transition roaming support on the WLAN by entering this command:

config wlan security ft disable wlan-id

Step 8

Enable the WLAN by entering this command:

config wlan enable wlan-id


Configuring Opportunistic Wireless Encryption Transition Mode (GUI)

The Opportunistic Wireless Encryption (OWE) transition mode enables OWE and non-OWE STAs to connect to the same DS simultaneously. When all the OWE STAs see an AP in OWE transition mode, they connect with the OWE.

Both the open WLAN and the OWE WLAN transmit beacon frames. Beacon and probe response frames from the OWE WLAN include the Wi-Fi Alliance vendor IE to encapsulate the BSSID and SSID of the open WLAN, and similarly, the open WLAN also includes for OWE WLAN.

OWE-capable STAs display only the SSID of the OWE WLAN (extracted from Wi-Fi Alliance vendor IE in the open WLAN’s beacons and probe responses) to the user in the list of available networks. The display of the open WLAN is suppressed. OWE-capable STAs associate only with the OWE WLAN of an AP in OWE transition mode.

Before you begin
Ensure that you have created at least one WLAN with Layer 2 Security set to Enhanced Open.
Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the WLAN to open the WLANs > Edit page.

Step 3

Choose the Security > Layer 2 tabs.

Step 4

From the Layer 2 Security drop-down list, choose None.

Step 5

(Optional) Enable MAC Filtering if required.

Step 6

Enable OWE Transition Mode.

Step 7

From the Enhanced Open SSID drop-down list, choose a WLAN SSID that has Layer 2 security set to Enhanced Open, to be mapped to this open WLAN.

Step 8

Configure the Fast Transition parameters as required.

Step 9

Save the configuration.


Configuring Opportunistic Wireless Encryption Transition Mode (CLI)

Before you begin
Ensure that you have created at least one WLAN with Layer 2 Security set to Enhanced Open.
Procedure
  • Enable OWE Transition Mode on a WLAN by entering this command:

    config wlan security owe-tm enable owe-wlan-id open-wlan-id


    Note


    To enforce bidirectional mapping of OWE-TM, that is OWE WLAN to Open WLAN and Open WLAN to OWE WLAN, there are two commands per OWE-TM mapping in the configuration file:

    • config wlan security owe-tm enable owe-wlan-id open-wlan-id

    • config wlan security owe-tm enable open-wlan-id owe-wlan-id


  • Disable OWE Transition Mode on a WLAN by entering this command:

    config wlan security owe-tm disable owe-wlan-id

Monitoring WPA3 Configuration on APs (CLI)

The commands in this section are to be entered on the Cisco Wave 2 and 802.11ax AP CLI.
Procedure
  • View the WPA3 configuration on 802.11 networks by entering this command:

    show dot11 wlan wpa3

  • View the 802.11 interface information by entering this command:

    show controllers dot11Radio dot11-interface-number wlan

  • View the WPA3 statistics by entering this command:

    show dot11 wlan statistics wpa3

  • View the WPA3 transition mode details by entering this command:

    show dot11 wlan wpa3 transition

  • View WPA3 OWE or SAE client details by entering this command:

    show dot11 wlan clients security wpa3

Monitoring WPA3 Configuration on the Controller (CLI)

Procedure
  • View the WPA3 configuration on a WLAN by entering this command:

    show wlan wlan-id

  • View the WPA3 policy type and authentication key management information on a client by entering this command:

    show client detail client-mac-address

  • View the SAE parameter details by entering this command:

    show advanced sae

Troubleshooting WPA3 Configuration on the Controller (CLI)

Procedure
  • Configure debugging of WPA3 on a client by entering this command:

    debug client client-mac-address

  • Configure debugging of SAE events and details by entering this command:

    debug sae {events | details} {enable | disable}

Wireless Encryption Protocol (WEP)

WLAN for Static WEP

You can configure up to four WLANs to support static WEP keys. Follow these guidelines when configuring a WLAN for static WEP:

  • When you configure static WEP as the Layer 2 security policy, no other security policies can be specified. That is, you cannot configure web authentication. However, when you configure static WEP as the Layer 2 security policy, you can configure web authentication.

Restrictions for Configuring Static WEP

  • The controller software supports CCX versions 1 through 5. CCX support is enabled automatically for every WLAN on the controller and cannot be disabled. The controller stores the CCX version of the client in its client database and uses it to limit client functionality. Clients must support CCXv4 or v5 in order to use CCKM. For more information about CCX, see the Configuring Cisco Client Extensions section.

  • In a unified architecture where multiple VLAN clients are supported for a WGB, you also need to configure encryption cipher suite and WEP keys globally, when the WEP encryption is enabled on the WGB. Otherwise, multicast traffic for wired VLAN clients fail.

Configuring Dynamic WEP (CLI)

Controllers can control 802.1X dynamic WEP keys using Extensible Authentication Protocol (EAP) across access points and support 802.1X dynamic key settings for WLANs.


Note


WEP is deprecated and is only supported in Cisco Wave 1 (IOS-based) APs; not supported on Cisco Wave 2 or 802.11ax (Wi-Fi 6) APs.



Note


To use LEAP with lightweight access points and wireless clients, make sure to choose Cisco-Aironet as the RADIUS server type when configuring the CiscoSecure Access Control Server (ACS).


  • Check the security settings of each WLAN by entering this command:

    show wlan wlan_id

    The default security setting for new WLANs is 802.1X with dynamic keys enabled. To maintain robust Layer 2 security, leave 802.1X configured on your WLANs.

  • Disable or enable the 802.1X authentication by entering this command:

    config wlan security 802.1X {enable | disable} wlan_id

    After you enable 802.1X authentication, the controller sends EAP authentication packets between the wireless client and the authentication server. This command allows all EAP-type packets to be sent to and from the controller.


    Note


    The controller performs both web authentication and 802.1X authentication in the same WLAN. The clients are initially authenticated with 802.1X. After a successful authentication, the client must provide the web authentication credentials. After a successful web authentication, the client is moved to the run state.


  • Change the 802.1X encryption level for a WLAN by entering this command:

    config wlan security 802.1X encryption wlan_id [0 | 40 | 104]

    • Use the 0 option to specify no 802.1X encryption.

    • Use the 40 option to specify 40/64-bit encryption.

    • Use the 104 option to specify 104/128-bit encryption. (This is the default encryption setting.)

MAC Authentication Failover to 802.1X Authentication

You can configure the controller to start 802.1X authentication when MAC authentication for the client fails. If the RADIUS server rejects an access request from a client instead of deauthenticating the client, the controller can force the client to undergo an 802.1X authentication. If the client fails the 802.1X authentication too, then the client is deauthenticated.

If MAC authentication is successful and the client requests for an 802.1X authentication, the client has to pass the 802.1X authentication to be allowed to send data traffic. If the client does not choose an 802.1X authentication, the client is declared to be authenticated if the client passes the MAC authentication.


Note


WLAN with WPA2 + 802.1X + WebAuth with WebAuth on MAC failure is not supported.


This section contains the following subsections:

Configuring MAC Authentication Failover to 802.1x Authentication (GUI)

Procedure

Step 1

Choose WLANs > WLAN ID to open the WLANs > Edit page.

Step 2

In the Security tab, click the Layer 2 tab.

Step 3

Select the MAC Filtering check box.

Step 4

Select the Mac Auth or Dot1x check box.


Configuring MAC Authentication Failover to 802.1X Authentication (CLI)

Procedure

To configure MAC authentication failover to 802.1X authentication, enter this command:

config wlan security 802.1X on-macfilter-failure {enable | disable} wlan-id


Identity PSK

This feature is designed to provide a simple and secured way for the growing number of devices to connect to the network. Some devices such as Internet of Things (IoT) clients may not support the 802.1x security protocol. These devices can connect to the network using the PSK authentication mechanism.

If all the clients are using the same key and if the key is shared with unauthorized users, then it leads to security breach.

The IPSK feature enables the administrator to configure WPA-PSK protocol-based unique pre-shared keys in the same SSID. This pre-shared key can be issued to an individual or group of users for their devices to connect to the network easily and safely. This also helps in identifying and managing a set of devices without affecting the other pre-shared key devices connected to the network. These keys can be configured with rules to authenticate and provide the appropriate level of access in the network.

Here, the AAA RADIUS server key is used to authenticate the client.

For documentation on Cisco ISE configuration, see the relevant administration guide at https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html.

This section contains the following subsections:

Prerequisites for Identity PSK

The RADIUS server must be configured to return the following Cisco AV pairs in its response to the MAC-filtering authentication request:

  • psk-mode=ascii

  • psk=cisco123

Key length must be between 8 and 63 characters for ASCII and 64 characters for HEX. If the key configured on the RADIUS server does not meet the length requirement, the client can be authenticated with PSK configured on the WLAN.

Configuring Identity PSK (GUI)

Procedure

Step 1

Choose WLAN to open the WLAN page.

Step 2

Create a new WLAN or click an existing WLAN.

Step 3

Check the Status Enabled check box.

Step 4

Choose Security > Layer 2 tab.

Step 5

Choose WPA+WPA2 or WPA2+WPA3 from the Layer 2 Security drop-down list.

Step 6

In the Security Type drop-down list, select Personal.

Step 7

(Optional) Check the MAC Filtering check box.

Step 8

Check the AutoConfig iPSK check box.

Step 9

Choose Security > AAA Servers tab.

Step 10

Check the Authentication Servers Enabled check box.

Step 11

Select the Server IP address and port number from the drop-down list.

If the RADIUS server is not configured, the RADIUS server is selected from the global list.

Step 12

Choose Advanced tab.

Step 13

Check the Allow AAA Override Enabled check box to enable AAA override. The default value is disabled.

Step 14

Click Apply.


Configuring Identity PSK (CLI)

Procedure
  • Enable MAC filtering by entering this command:

    config wlan mac-filtering enable wlan-id
  • Enable AAA-override on a WLAN by entering this command:

    config wlan aaa-override enable wlan-id

  • Enable RADIUS authentication on a WLAN by entering this command:

    config wlan radius_server auth enable wlan-id
  • Enable PSK support on a WLAN by entering this command:

    config wlan security wpa akm psk enable wlan-id
  • Configure the PSK pre-share key by entering this command:

    config wlan security wpa akm psk set-key ascii/hex psk-key wlan-id

Random MAC Filtering

For network interface cards (NICs), networks use the MAC addresses assigned by device manufacturers. These MAC addresses, also known as burn-in addresses (BIAs), are used for various purposes such as authentication, seamless roaming, policy binding, and so on.

From the time device manufactures provided the option to generate and use random MAC addresses for the device as a privacy tool, a network's ability to identify clients, provide appropriate services and intended user experiences has been disrupted. To prevent such disruptions, you can configure the controller to deny clients with the Random MAC Address feature enabled from joining the network.

In a High-Availability network setup, periodic synchronization between the primary and standby controllers includes the WLAN random MAC filtering configuration.

Guidelines and Limitations

  • Cisco Wave 1 (Cisco IOS-based) access points are not supported.

Configuring Random MAC Filtering (GUI)

Procedure

Step 1

Choose WLAN > WLAN ID

This opens the WLANs > Edit page.

Step 2

In the Security tab, click the Layer 2 tab.

Step 3

Check the Random MAC Filtering check box to deny clients with Random MAC Address feature enabled from joining the network..

Note

 
By default, Random MAC Filtering is in Disabled state.

Step 4

Save the configuration.


Configuring Random MAC Filtering (CLI)

Procedure

Step 1

Disable the WLAN by entering this command:

config wlan disable wlan-id

Step 2

Enable or disable random MAC filtering by entering this command:

config wlan random-mac-filter {enable | disable} wlan-id

Step 3

Enable the WLAN by entering this command:

config wlan enable wlan-id


Verifying Random MAC Filtering (CLI)

Procedure
  • View the status of Random MAC Filtering by entering this command:

    show wlan wlan-id

  • Show client statistics by entering this command:

    show client randomMacDrop-stats

Verifying Random MAC Filtering (AP-CLI)

Procedure
  • View the WLAN configuration by entering this command in the AP console:

    show configuration wlan wlan-id

    In the CLI output, the LAA Mac Denial field shows the configuration status on the WLAN.

Layer 3 Security

Layer 3 security takes effect only after Layer 2 is operational and also the wireless client has a working IP address. Layer 3 security is triggered by the client opening a web session (HTTP or HTTPS).


Note


Layer 2 security should not be considered as a truly effective security method unless used in conjunction with a strong Layer 2 security method. This is because without Layer 2 security, the client’s data can be captured in clear text over the air.


This section contains the following subsections:

With Layer 3 security, the client will issue a DNS query for a web server; the controller spoofs the DNS response, providing its own Virtual IP address. The client then opens a web connection (HTTP port 80 or HTTPS port 443) to that address. The controller redirects (to itself [Local Web Authentication] or to an external server [Central Web Authentication]), and then that dialog is used to authorize the client to connect to the network.

  • Hijacking an initial HTTPS connection is an inherently problematic operation, as HTTPS is designed to prevent hijacking. In general, you can expect client browsers to prevent, or at least warn, the user against connecting.

  • If the Layer 3 redirect goes to HTTPS rather than HTTP, the client browser is also likely to be warnted against connecting, unless the HTTPS server provides a valid certificate chain that is trusted by the client.

Types of Layer 3 Security

  • Web Passthrough: This is a variation of the internal web authentication. It displays a page with a warning or an alert statement, but does not prompt for credentials. The user should click ok. You can enable email input, and the user can enter their email address, which becomes their username. When the user is connected, check your active clients list; that user is listed with the email address they entered as the username. For more information, see the Wireless LAN Controller 5760/3850 Web Passthrough Configuration Example.

  • Local Web Authentication: Validates credentials against local database or RADIUS server. For more information, see https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/69340-web-auth-config.html.

  • Redirect to External Web Authentication: With external web authentication, the login page used for web authentication is stored on an external web server. For more information, see https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71881-ext-web-auth-wlc.html.

  • Central Webauth with Cisco ISE: In the case of Central Web Authentication (CWA), web authentication occurs on the Cisco ISE server. The web portal in the Cisco ISE server provides a login page to a client. After the credentials are verified on the Cisco ISE server, the client is provisioned. The client remains in the POSTURE_REQD state until a change of authorization (CoA) is reached. The credentials and ACLs are received from the Cisco ISE server. For more information, see Central Web Authentication.

This section contains the following subsections:

Information About Web Authentication

For more information about web authentication, see https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/115951-web-auth-wlc-guide-00.html.

Prerequisites for Configuring Web Authentication on a WLAN

  • To initiate HTTP/HTTPS web authentication redirection, use HTTP URL or HTTPS URL.

  • If the CPU ACLs are configured to block HTTP / HTTPS traffic, after the successful web login authentication, there could be a failure in the redirection page.

  • Before enabling web authentication, make sure that all proxy servers are configured for ports other than port 53.

  • When you enable web authentication for a WLAN, a message appears indicating that the controller forwards DNS traffic to and from wireless clients prior to authentication. We recommend that you have a firewall or intrusion detection system (IDS) behind your guest VLAN to regulate DNS traffic and to prevent and detect any DNS tunneling attacks.

  • If the web authentication is enabled on the WLAN and you also have the CPU ACL rules, the client-based web authentication rules take higher precedence as long as the client is unauthenticated (in the webAuth_Reqd state). Once the client goes to the RUN state, the CPU ACL rules get applied. Therefore, if the CPU ACL rules are enabled in the controller, an allow rule for the virtual interface IP is required (in any direction) with the following conditions:

    • When the CPU ACL does not have an allow ACL rule for both directions.

    • When an allow ALL rule exists, but also a DENY rule for port 443 or 80 of higher precedence.

  • The allow rule for the virtual IP should be for TCP protocol and port 80 (if secureweb is disabled) or port 443 (if secureweb is enabled). This process is required to allow client’s access to the virtual interface IP address, post successful authentication when the CPU ACL rules are in place.

Restrictions for Configuring Web Authentication on a WLAN

  • Web authentication is supported only with these Layer 2 security policies: open authentication, open authentication+WEP, and WPA-PSK.

  • Special charecters are not supported in the username field for web-authentication.

  • When clients connect to a WebAuth SSID and a preauthorization ACL configured to allow VPN users, the clients will get disconnected from the SSID every few minutes. Webauth SSIDs must not connect without authenticating on the web page.

    You can select the following identity stores to authenticate web-auth user, under WLANs > Security > AAA servers > Authentication priority order for web-auth user section:

    • Local

    • RADIUS

    • LDAP

    If multiple identity stores are selected, then the controller checks each identity store in the list, in the order specified, from top to bottom, until authentication for the user succeeds. The authentication fails, if the controller reaches the end of the list and user remains un-authenticated in any of the identity stores.

Default Web Authentication Login Page

If you are using a custom web-auth bundle that is served by the internal controller web server, the page should not contain more than 5 elements (including HTML, CSS, and Images). This is because the internal controller web server implements a DoS protection mechanism that limits each client to open a maximum of 5 (five) concurrent TCP connections depending on the load. Some browsers may try to open more than 5 TCP sessions at the same time if the page contains more elements and this may result in the page loading slowly depending on how the browser handles the DoS protection.

If you do not want users to connect to a web page using a browser that is configured with SSLv2 only, you can disable SSLv2 for web authentication by entering the config network secureweb cipher-option sslv2 disable command . If you enter this command, users must use a browser that is configured to use a more secure protocol such as SSLv3 or later releases. The default value is disabled.


Note


Cisco TAC is not responsible for creating a custom webauth bundle.


If you have a complex custom web authentication module, it is recommended that you use an external web-auth config on the controller, where the full login page is hosted at an external web server.

This section contains the following subsections:

Choosing the Default Web Authentication Login Page (GUI)
Procedure

Step 1

Choose Security > Web Auth > Web Login Page to open the Web Login page.

Step 2

From the Web Authentication Type drop-down list, choose Internal (Default).

Step 3

If you want to use the default web authentication login page as is, go to Step 8. If you want to modify the default login page, go to Step 4.

Step 4

If you want to hide the Cisco logo that appears in the top right corner of the default page, choose the Cisco Logo Hide option. Otherwise, click the Show option.

Step 5

If you want the user to be directed to a particular URL (such as the URL for your company) after login, enter the desired URL in the Redirect URL After Login text box. You can enter up to 254 characters.

Step 6

If you want to create your own headline on the login page, enter the desired text in the Headline text box. You can enter up to 127 characters. The default headline is “Welcome to the Cisco wireless network.”

Step 7

If you want to create your own message on the login page, enter the desired text in the Message text box. You can enter up to 2047 characters. The default message is “Cisco is pleased to provide the Wireless LAN infrastructure for your network. Please login and put your air space to work.”

Step 8

Click Apply to commit your changes.

Step 9

Click Preview to view the web authentication login page.

Step 10

If you are satisfied with the content and appearance of the login page, click Save Configuration to save your changes. Otherwise, repeat any of the previous steps as necessary to achieve your desired results.


Choosing the Default Web Authentication Login Page (CLI)
Procedure

Step 1

Specify the default web authentication type by entering this command:

config custom-web webauth_type internal

Step 2

If you want to use the default web authentication login page as is, go to Step 7. If you want to modify the default login page, go to Step 3.

Step 3

To show or hide the Cisco logo that appears in the top right corner of the default login page, enter this command:

config custom-web weblogo {enable | disable}

Step 4

If you want the user to be directed to a particular URL (such as the URL for your company) after login, enter this command:

config custom-web redirecturl url

You can enter up to 130 characters for the URL. To change the redirect back to the default setting, enter the clear redirecturl command.

Step 5

If you want to create your own headline on the login page, enter this command:

config custom-web webtitle title

You can enter up to 130 characters. The default headline is “Welcome to the Cisco wireless network.” To reset the headline to the default setting, enter the clear webtitle command.

Step 6

If you want to create your own message on the login page, enter this command:

config custom-web webmessage message

You can enter up to 130 characters. The default message is “Cisco is pleased to provide the Wireless LAN infrastructure for your network. Please login and put your air space to work.” To reset the message to the default setting, enter the clear webmessage command.

Step 7

To enable or disable the web authentication logout popup window, enter this command:

config custom-web logout-popup {enable | disable}

Step 8

Enter the save config command to save your settings.

Step 9

Import your own logo into the web authentication login page as follows:

  1. Make sure that you have a Trivial File Transfer Protocol (TFTP) server available for the file download. Follow these guidelines when setting up a TFTP server:

    • If you are downloading through the service port, the TFTP server must be on the same subnet as the service port because the service port is not routable, or you must create static routes on the controller.

    • If you are downloading through the distribution system network port, the TFTP server can be on the same or a different subnet because the distribution system port is routable.

    • A third-party TFTP server cannot run on the same computer as the Cisco Prime Infrastructure because the Prime Infrastructure built-in TFTP server and the third-party TFTP server require the same communication port.

  2. Ensure that the controller can contact the TFTP server by entering this command:

    ping ip-address

  3. Copy the logo file (in .jpg, .gif, or .png format) to the default directory on your TFTP server. The maximum file size is 30 kilobits. For an optimal fit, the logo should be approximately 180 pixels wide and 360 pixels high.

  4. Specify the download mode by entering this command:

    transfer download mode tftp

  5. Specify the type of file to be downloaded by entering this command:

    transfer download datatype image

  6. Specify the IP address of the TFTP server by entering this command:

    transfer download serverip tftp-server-ip-address

    Note

     

    Some TFTP servers require only a forward slash (/) as the TFTP server IP address, and the TFTP server automatically determines the path to the correct directory.

  7. Specify the download path by entering this command:

    transfer download path absolute-tftp-server-path-to-file

  8. Specify the file to be downloaded by entering this command:

    transfer download filename {filename.jpg | filename.gif | filename.png}

  9. View your updated settings and answer y to the prompt to confirm the current download settings and start the download by entering this command:

    transfer download start

  10. Save your settings by entering this command:

    save config

    Note

     

    If you ever want to remove this logo from the web authentication login page, enter the clear webimage command.

Step 10

Follow the instructions in the Verifying the Web Authentication Login Page Settings (CLI) section to verify your settings.


Example: Modified Default Web Authentication Login Page Example
Figure 3. Modified Default Web Authentication Login Page Example. This figure shows an example of a modified default web authentication login page.

These CLI commands were used to create this login page:

  • config custom-web weblogo disable

  • config custom-web webtitle Welcome to the AcompanyBC Wireless LAN!

  • config custom-web webmessage Contact the System Administrator for a Username and Password.

  • transfer download start

  • config custom-web redirecturl url

Using a Customized Web Authentication Login Page from an External Web Server

Information About Customized Web Authentication Login Page

You can customize the web authentication login page to redirect to an external web server. When you enable this feature, the user is directed to your customized login page on the external web server.

You must configure a preauthentication access control list (ACL) on the WLAN for the external web server and then choose this ACL as the WLAN preauthentication ACL under Layer 3 Security > Web Policy on the WLANs > Edit page.

Choosing a Customized Web Authentication Login Page from an External Web Server (GUI)
Procedure

Step 1

Choose Security > Web Auth > Web Login Page to open the Web Login page.

Step 2

From the Web Authentication Type drop-down list, choose External (Redirect to external server).

Step 3

In the Redirect URL after Login field, enter the URL that you want the user to be redirected after a login.

For example, you may enter your company's URL here and the users will be directed to that URL after login. The maximum length is 254 characters. By default, the user is redirected to the URL that was entered in the user's browser before the login page was served. of the customized web authentication login page on your web server. You can enter up to 252 characters.

Step 4

In the External Webauth URL field, enter the URL that is to be used for external web authentication.

Step 5

Click Apply.

Step 6

Click Save Configuration.


Choosing a Customized Web Authentication Login Page from an External Web Server (CLI)
Procedure

Step 1

Specify the web authentication type by entering this command:

config custom-web webauth_type external

Step 2

Specify the URL of the customized web authentication login page on your web server by entering this command:

config custom-web ext-webauth-url url

You can enter up to 252 characters for the URL.

Step 3

Specify the IP address of your web server by entering this command:

config custom-web ext-webserver {add | delete} server_IP_address

Step 4

Enter the save config command to save your settings.

Step 5

Follow the instructions in the Verifying the Web Authentication Login Page Settings (CLI) section to verify your settings.


Example: Creating a Customized Web Authentication Login Page

This section provides information on creating a customized web authentication login page, which can then be accessed from an external web server.

Here is a web authentication login page template. It can be used as a model when creating your own customized page:


Note


We recommend that you follow the Cisco guidelines to create a customized web authentication login page. If you have upgraded to the latest versions of Google Chrome or Mozilla Firefox browsers, ensure that your webauth bundle has the following line in the login.html file:

<body onload="loadAction();">

For more information about this issue, see CSCvj17640.



<html>
<head>
<meta http-equiv="Pragma" content="no-cache">
<meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<title>Web Authentication</title>
<script>

function submitAction(){
	var link = document.location.href;
	var searchString = "redirect=";
	var equalIndex = link.indexOf(searchString);
	var redirectUrl = "";
	
	if (document.forms[0].action == "") {
		var url = window.location.href;
		var args = new Object();
		var query = location.search.substring(1);
		var pairs = query.split("&");
		for(var i=0;i<pairs.length;i++){
		var pos = pairs[i].indexOf('=');
			if(pos == -1) continue;
				var argname = pairs[i].substring(0,pos);
				var value = pairs[i].substring(pos+1);
				args[argname] = unescape(value);
		}
			document.forms[0].action = args.switch_url;
		}

      if(equalIndex >= 0) {
		equalIndex += searchString.length;
		redirectUrl = "";
		redirectUrl += link.substring(equalIndex);
		}
		if(redirectUrl.length > 255)
		redirectUrl = redirectUrl.substring(0,255);
		document.forms[0].redirect_url.value = redirectUrl;
		document.forms[0].buttonClicked.value = 4;
      		document.forms[0].submit();
}

	function loadAction(){
      var url = window.location.href;
      var args = new Object();
      var query = location.search.substring(1);
      var pairs = query.split("&");
      for(var i=0;i<pairs.length;i++){
          var pos = pairs[i].indexOf('=');
          if(pos == -1) continue;
          var argname = pairs[i].substring(0,pos);
          var value = pairs[i].substring(pos+1);
          args[argname] = unescape(value);
      }
//alert( "AP MAC Address is " + args.ap_mac);
      //alert( "The Switch URL to post user credentials is " + args.switch_url);
      document.forms[0].action = args.switch_url;

      // This is the status code returned from webauth login action
      // Any value of status code from 1 to 5 is error condition and user
      // should be shown error as below or modify the message as it suits
      // the customer
      if(args.statusCode == 1){
        alert("You are already logged in. No further action is required on your part.");
      }
      else if(args.statusCode == 2){
        alert("You are not configured to authenticate against web portal. No further action is required on your part.");
      }
      else if(args.statusCode == 3){
        alert("The username specified cannot be used at this time. Perhaps the username is already logged into the system?");
      }
      else if(args.statusCode == 4){
        alert("The User has been excluded. Please contact the administrator.");
      }
      else if(args.statusCode == 5){
        alert("Invalid username and password. Please try again.");
      }
	     else if(args.statusCode == 6){
								alert("Invalid email address format. Please try again.");
      }
}

</script>
</head>
<body topmargin="50" marginheight="50" onload="loadAction();">
<form method="post" action="https://209.165.200.225/login.html">
<input TYPE="hidden" NAME="buttonClicked" SIZE="16" MAXLENGTH="15" value="0">
<input TYPE="hidden" NAME="redirect_url" SIZE="255" MAXLENGTH="255" VALUE="">
<input TYPE="hidden" NAME="err_flag" SIZE="16" MAXLENGTH="15" value="0">

<div align="center">
<table border="0" cellspacing="0" cellpadding="0">
<tr> <td>&nbsp;</td></tr>

<tr align="center"> <td colspan="2"><font size="10" color="#336699">Web Authentication</font></td></tr>

<tr align="center">

<td colspan="2"> User Name &nbsp;&nbsp;&nbsp;<input type="TEXT" name="username" SIZE="25" MAXLENGTH="63" VALUE="">
</td>
</tr>
<tr align="center" >
<td colspan="2"> Password &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="Password" name="password" SIZE="25" MAXLENGTH="24">
</td>
</tr>

<tr align="center">
<td colspan="2"><input type="button" name="Submit" value="Submit" class="button" onclick="submitAction();">
</td>
</tr>
</table>
</div>

</form>
</body>
</html>


These parameters are added to the URL when the user’s Internet browser is redirected to the customized login page:

  • ap_mac —The MAC address of the access point to which the wireless user is associated.

  • switch_url —The URL of the controller to which the user credentials should be posted.

  • redirect —The URL to which the user is redirected after authentication is successful.

  • statusCode —The status code returned from the controller’s web authentication server.

  • wlan —The WLAN SSID to which the wireless user is associated.

The available status codes are as follows:

  • Status Code 1: “You are already logged in. No further action is required on your part.”

  • Status Code 2: “You are not configured to authenticate against web portal. No further action is required on your part.”

  • Status Code 3: “The username specified cannot be used at this time. Perhaps the username is already logged into the system?”

  • Status Code 4: “You have been excluded.”

  • Status Code 5: “The User Name and Password combination you have entered is invalid. Please try again.”


    Note


    For additional information, see the External Web Authentication with Wireless LAN Controllers Configuration Example at http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71881-ext-web-auth-wlc.html.


Downloading a Customized Web Authentication Login Page

You can compress the page and image files used for displaying a web authentication login page into a.tar file for download to a controller. These files are known as the webauth bundle. The maximum allowed size of the files in their uncompressed state is 1 MB. When the .tar file is downloaded from a local TFTP server, it enters the controller’s file system as an untarred file.

You can download a login page example from Cisco Prime Infrastructure and use it as a starting point for your customized login page. For more information, see the Cisco Prime Infrastructure documentation.


Note


If you load a webauth bundle with a .tar compression application that is not GNU compliant, the controller cannot extract the files in the bundle and the following error messages appear: “Extracting error” and “TFTP transfer failed.” Therefore, we recommend that you use an application that complies with GNU standards, such as PicoZip, to compress the .tar file for the webauth bundle.



Note


Configuration backups do not include extra files or components, such as the webauth bundle or external licenses, that you download and store on your controller, so you should manually save external backup copies of those files or components.



Note


If the customized webauth bundle has more than 3 separated elements, we advise you to use an external server to prevent page load issues that may be caused because of TCP rate-limiting policy on the controller.


Prerequisites for Downloading a Customized Web Authentication Login Page
  • Name the login page login.html. The controller prepares the web authentication URL based on this name. If the server does not find this file after the webauth bundle has been untarred, the bundle is discarded, and an error message appears.

  • Include input text boxes for both a username and password.

  • Retain the redirect URL as a hidden input item after extracting from the original URL.

  • Extract and set the action URL in the page from the original URL.

  • Include scripts to decode the return status code.

  • Ensure that all paths used in the main page (to refer to images, for example).

  • Ensure that no filenames within the bundle are greater than 30 characters.

Downloading a Customized Web Authentication Login Page (GUI)
Procedure

Step 1

Copy the .tar file containing your login page to the default directory on your server.

Step 2

Choose Commands > Download File to open the Download File to Controller page.

Step 3

From the File Type drop-down list, choose Webauth Bundle.

Step 4

From the Transfer Mode drop-down list, choose from the following options:

  • TFTP
  • FTP
  • SFTP

Step 5

In the IP Address field, enter the IP address of the server.

Step 6

If you are using a TFTP server, enter the maximum number of times the controller should attempt to download the .tar file in the Maximum Retries field.

The range is 1 to 254.

The default is 10.

Step 7

If you are using a TFTP server, enter the amount of time in seconds before the controller times out while attempting to download the *.tar file in the Timeout field.

The range is 1 to 254 seconds.

The default is 6 seconds.

Step 8

In the File Path field, enter the path of the .tar file to be downloaded. The default value is “/.”

Step 9

In the File Name field, enter the name of the .tar file to be downloaded.

Step 10

If you are using an FTP server, follow these steps:

  1. In the Server Login Username field, enter the username to log into the FTP server.

  2. In the Server Login Password field, enter the password to log into the FTP server.

  3. In the Server Port Number field, enter the port number on the FTP server through which the download occurs. The default value is 21.

Step 11

Click Download to download the .tar file to the controller.

Step 12

Choose Security > Web Auth > Web Login Page to open the Web Login page.

Step 13

From the Web Authentication Type drop-down list, choose Customized (Downloaded).

Step 14

Click Apply.

Step 15

Click Preview to view your customized web authentication login page.

Step 16

If you are satisfied with the content and appearance of the login page, click Save Configuration.


Downloading a Customized Web Authentication Login Page (CLI)
Procedure

Step 1

Copy the .tar file containing your login page to the default directory on your server.

Step 2

Specify the download mode by entering this command:

transfer download mode {tftp | ftp | sftp}

Step 3

Specify the type of file to be downloaded by entering this command:

transfer download datatype webauthbundle

Step 4

Specify the IP address of the TFTP server by entering this command:

transfer download serverip tftp-server-ip-address.

Note

 

Some TFTP servers require only a forward slash (/) as the TFTP server IP address, and the TFTP server automatically determines the path to the correct directory.

Step 5

Specify the download path by entering this command:

transfer download path absolute-tftp-server-path-to-file

Step 6

Specify the file to be downloaded by entering this command:

transfer download filename filename.tar

Step 7

View your updated settings and answer y to the prompt to confirm the current download settings and start the download by entering this command:

transfer download start

Step 8

Specify the web authentication type by entering this command:

config custom-web webauth_type customized

Step 9

Enter the save config command to save your settings.


Example: Customized Web Authentication Login Page
Figure 4. Customized Web Authentication Login Page Example. This figure shows an example of a customized web authentication login page.
Verifying the Web Authentication Login Page Settings (CLI)

Verify your changes to the web authentication login page by entering this command:

show custom-web

Assigning Login, Login Failure, and Logout Pages per WLAN

You can display different web authentication login, login failure, and logout pages to users per WLAN. This feature enables user-specific web authentication pages to be displayed for a variety of network users, such as guest users or employees within different departments of an organization.

Different login pages are available for all web authentication types (internal, external, and customized). However, different login failure and logout pages can be specified only when you choose customized as the web authentication type.

This section contains the following subsections:

Assigning Login, Login Failure, and Logout Pages per WLAN (GUI)
Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the WLAN to which you want to assign a web login, login failure, or logout page.

Step 3

Choose Security > Layer 3.

Step 4

Make sure that Web Policy and Authentication are selected.

Step 5

To override the global authentication configuration web authentication pages, select the Override Global Config check box.

Step 6

When the Web Auth Type drop-down list appears, choose one of the following options to define the web authentication pages for wireless guest users:

  • Internal—Displays the default web login page for the controller. This is the default value.

  • Customized—Displays custom web login, login failure, and logout pages. If you choose this option, three separate drop-down lists appear for login, login failure, and logout page selection. You do not need to define a customized page for all three options. Choose None from the appropriate drop-down list if you do not want to display a customized page for that option.

    Note

     

    These optional login, login failure, and logout pages are downloaded to the controller as webauth.tar files.

  • External—Redirects users to an external server for authentication. If you choose this option, you must also enter the URL of the external server in the URL text box.

    You can choose specific RADIUS or LDAP servers to provide external authentication on the WLANs > Edit (Security > AAA Servers) page. Additionally, you can define the priority in which the servers provide authentication.

Step 7

If you chose External as the web authentication type in Step 6, choose AAA Servers and choose up to three RADIUS and LDAP servers using the drop-down lists.

Note

 

The RADIUS and LDAP external servers must already be configured in order to be selectable options on the WLANs > Edit (Security > AAA Servers) page. You can configure these servers on the RADIUS Authentication Servers page and LDAP Servers page.

Step 8

Establish the priority in which the servers are contacted to perform web authentication as follows:

Note

 

The default order is local, RADIUS, LDAP.

  1. Highlight the server type (local, RADIUS, or LDAP) that you want to be contacted first in the box next to the Up and Down buttons.

  2. Click Up and Down until the desired server type is at the top of the box.

  3. Click the < arrow to move the server type to the priority box on the left.

  4. Repeat these steps to assign priority to the other servers.

Step 9

Click Apply to commit your changes.

Step 10

Click Save Configuration to save your changes.


Assigning Login, Login Failure, and Logout Pages per WLAN (CLI)
Procedure

Step 1

Determine the ID number of the WLAN to which you want to assign a web login, login failure, or logout page by entering this command:

show wlan summary

Step 2

If you want wireless guest users to log into a customized web login, login failure, or logout page, enter these commands to specify the filename of the web authentication page and the WLAN for which it should display:

  • config wlan custom-web login-page page_name wlan_id—Defines a customized login page for a given WLAN.

  • config wlan custom-web loginfailure-page page_name wlan_id—Defines a customized login failure page for a given WLAN.

    Note

     

    To use the controller’s default login failure page, enter the config wlan custom-web loginfailure-page none wlan_id command.

  • config wlan custom-web logout-page page_name wlan_id—Defines a customized logout page for a given WLAN.

    Note

     

    To use the controller’s default logout page, enter the config wlan custom-web logout-page none wlan_id command.

Step 3

Redirect wireless guess users to an external server before accessing the web login page by entering this command to specify the URL of the external server:

config wlan custom-web ext-webauth-url ext_web_url wlan_id

Note

 

For the external web authentication URL, the CLI does not accept the ? character. For example, if the URL is https://example.com?text , the CLI saves the URL as https://example.comtext . For more information, see CSCvu53350.

Step 4

Define the order in which web authentication servers are contacted by entering this command:

config wlan security web-auth server-precedence wlan_id {local | ldap | radius} {local | ldap | radius} {local | ldap | radius}

The default order of server web authentication is local, RADIUS and LDAP.

Note

 

All external servers must be preconfigured on the controller. You can configure them on the RADIUS Authentication Servers page and the LDAP Servers page.

Step 5

Define which web authentication page displays for a wireless guest user by entering this command:

config wlan custom-web webauth-type {internal | customized | external} wlan_id

where

  • internal displays the default web login page for the controller. This is the default value.

  • customized displays the custom web login page that was configured in Step 2.

    Note

     

    You do not need to define the web authentication type in Step 5 for the login failure and logout pages as they are always customized.

  • external redirects users to the URL that was configured in Step 3.

Step 6

Use a WLAN-specific custom web configuration rather than a global custom web configuration by entering this command:

config wlan custom-web global disable wlan_id

Note

 

If you enter the config wlan custom-web global enable wlan_id command, the custom web authentication configuration at the global level is used.

Step 7

Save your changes by entering this command:

save config


Captive Network Assistant Bypass

Many clients will attempt to determine whether their wireless network connection is being intercepted by Layer 3 security, in order to improve the user interaction experience. For example: Windows 10, Apple iOS, Firefox. Such a software interface is known as a Captive Network Assistant (CNA). In rare cases, the functionality of a CNA can cause problems with Layer 3 security; in such a situation, you can enable Captive Network Assistant Bypass (CNAB). With CNAB, the congtroller tries to trick the CNA into thinking that it is fully connected to the Internet, thus requiring the client to Layer-3 authenticate using a full browser session.


Note


Enabling CNAB does not guarantee that all CNAs will fail to detect the Captive Portal because CNA implementations are continually refining their Captive Portal detection heuristics.


Configuring Captive Bypassing (CLI)

Use these commands to configure captive bypassing:

  • config network web-auth captive-bypass {enable | disable} —Enables or disables the controller to support bypass of captive portals at the network level.
  • show network summary —Displays the status for the WISPr protocol detection feature.

Configuring Captive Network Assistant Bypass per WLAN (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the WLAN ID.

Step 3

Click the Security tab and then click the Layer 3 tab.

Step 4

From the Captive Network Assistant Bypass drop-down list, choose:

  • None: Global Captive Network Assistant Bypass setting is applied

  • Enable: Captive Network Assistant Bypass is enabled for this particular WLAN

  • Disable: Captive Network Assistant Bypass is disabled for this particular WLAN

Step 5

Click Apply to commit your changes.

Step 6

Click Save Configuration to save your changes.


Configuring Captive Network Assistant Bypass per WLAN (CLI)

Procedure
  • Enable, disable or activate global Captive Network Assistant Bypass per WLAN by entering this command:

    config wlan security web-auth captive-bypass {none | enable | disable} wlan-id

    By default, Captive Network Assistant Bypass per WLAN is in disabled state.

Fallback Policy with MAC Filtering and Web Authentication

You can configure a fallback policy mechanism that combines Layer 2 and Layer 3 security. In a scenario where you have both MAC filtering and web authentication implemented, when a client tries to connect to a WLAN using the MAC filter (RADIUS server), if the client fails the authentication, you can configure the authentication to fall back to web authentication. When a client passes the MAC filter authentication, the web authentication is skipped and the client is connected to the WLAN. With this feature, you can avoid disassociations based on only a MAC filter authentication failure.

Restrictions

  • MAC filtering does not support passthrough web-authentication. It supports only username and password for web-authentication.

Mobility is not supported for SSIDs with security type configured for Webauth on MAC filter failure.

This section contains the following subsections:

Configuring a Fallback Policy with MAC Filtering and Web Authentication (GUI)


Note


Before configuring a fallback policy, you must have MAC filtering enabled.


Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the WLAN for which you want to configure the fallback policy for web authentication. The WLANs > Edit page appears.

Step 3

Choose the Security and Layer 3 tabs to open the WLANs > Edit (Security > Layer 3) page.

Step 4

From the Layer 3 Security drop-down list, choose None.

Step 5

Select the Web Policy check box.

Note

 

The controller forwards DNS traffic to and from wireless clients prior to authentication.

The following options are displayed:

  • Authentication

  • Passthrough

  • Conditional Web Redirect

  • Splash Page Web Redirect

  • On MAC Filter Failure

Step 6

Click On MAC Filter Failure.

Step 7

Click Apply to commit your changes.

Step 8

Click Save Configuration to save your settings.


Configuring a Fallback Policy with MAC Filtering and Web Authentication (CLI)


Note


Before configuring a fallback policy, you must have MAC filtering enabled.


Procedure

Step 1

Enable or disable web authentication on a particular WLAN by entering this command:

config wlan security web-auth on-macfilter-failure wlan-id

Step 2

See the web authentication status by entering this command:

show wlan wlan_id


FT Over-The-Ds mode.............................. Enabled
CKIP ......................................... Disabled
   IP Security................................... Disabled
   IP Security Passthru.......................... Disabled
   Web Based Authentication...................... Enabled-On-MACFilter-Failure
        ACL............................................. Unconfigured
        Web Authentication server precedence:
        1............................................... local
        2............................................... radius
        3............................................... ldap


Central Web Authentication

In the case of Central Web Authentication (CWA), web authentication occurs on the Cisco ISE server. The web portal in the Cisco ISE server provides a login page to a client. After the credentials are verified on the Cisco ISE server, the client is provisioned. The client remains in the POSTURE_REQD state until a change of authorization (CoA) is reached. The credentials and ACLs are received from Cisco ISE server.


Note


  • In a CWA and MAC filtering configuration scenario, if a change in VLAN occurs during pre-authentication and post-authentication, dissociation request is sent to clients and the clients are forced to go through DHCP again.

  • Inter-controller roaming with non-802.1X L2 security, with MAC filtering and CWA, is not supported prior to 8.9.


For new clients, the RADIUS access accept message carries redirected URL for port 80 and pre-auth ACLs or quarantine VLAN. Definition of ACL is defined in the controller (IP addresses and ports).

Clients will be redirected to the URL provided in the access accept message and put into a new state until posture validation is done. Clients in this state validate themselves against ISE server and the policies configured on the ISE NAC server.

The NAC agent on the clients initiates posture validation (traffic to port 80): The agent sends HTTP discovery request to port 80, which the controller redirects to the URL provided in the access accept message. Cisco ISE knows that the client is trying to reach and responds directly to the client. This way, the client learns about the Cisco ISE IP address and from now on, the client talks directly with the Cisco ISE.

The controller allows this traffic because the ACL is configured to allow this traffic. In case of VLAN override, the traffic is bridged so that it reaches the Cisco ISE.

ISE NAC

After the client completes the assessment, a RADIUS CoA-Req with reauth service is sent to the controller. This initiates reauthentication of the client (by sending EAP-START). Once reauthentication succeeds, the Cisco ISE sends an access accept message with a new ACL (if any) and no URL redirect, or access VLAN.

The controller has support for CoA-Req and Disconnect-Req as per RFC 3576. The controller needs to support CoA-Req for re-auth service, as per RFC 5176.

Instead of downloadable ACLs, pre-configured ACLs are used on the controller. Cisco ISE sends the ACL name, which is already configured in the controller.

This design should work for both VLAN and ACL cases. In case of VLAN override, the port 80 is redirected and allows (bridge) rest of the traffic on the quarantine VLAN. For the ACL, the pre-auth ACL received in the access accept message is applied.

Here is the workflow:

  1. The guest user associates with the controller.

  2. The controller sends a MAB Request to ISE.

  3. ISE matches the first authorization rules, and sends the redirect parameters (ACL and URL).

  4. The controller redirects the GUEST to ISE.

  5. After the guest is authenticated, ISE makes a second authorization, which is called RADIUS Change of Authorization (CoA). In this second authorization, a profile must be returned so that the guest is permitted access to the network. We can use usecase: guestflow to easily match this second authorization.


Note


Guest clients connecting to a web-auth WLAN in a CWA setup may also reach the internal virtual interface web-auth login page using port 80 or by using port 443 when the web authentication secure web is enabled in the Cisco AireOS controllers. This behavior is in line with how Cisco AireOS controllers handle all web authentication redirect scenarios and have no potential risk or vulnerability.


Authentication of Sleeping Clients

Clients with guest access that have had successful web authentication are allowed to sleep and wake up without having to go through another authentication process through the login page. You can configure the duration for which the sleeping clients are to be remembered for before reauthentication becomes necessary. The valid range is 10 minutes to 43200 minutes, with the default being 720 minutes. You can configure the duration on a WLAN and on a user group policy that is mapped to the WLAN. The sleeping timer becomes effective after the idle timeout. If the client timeout is lesser than the time configured on the sleeping timer of the WLAN, then the lifetime of the client is used as the sleeping time.

The order of precedence is session timeout, sleeping client timeout, and user idle timeout. If the user idle timeout expires, then the sleeping client comes into play. If the sleeping client wakes up and if the sleeping client timeout has not expired, but if the session timeout has expired, the client must reauthenticate.


Note


The sleeping timer expires every 5 minutes.

This feature is supported in the following FlexConnect scenario: local switching and central authentication.


Caution


If the MAC address of a client that goes to sleep mode is spoofed, the fake device such as a laptop can be authenticated.


Following are some guidelines in a mobility scenario:

  • L2 roaming in the same subnet is supported.

  • Anchor sleeping timer is applicable.

  • The sleeping client information is shared between multiple autoanchors when a sleeping client moves from one anchor to another.

Supported Mobility Scenarios

A sleeping client does not require reauthentication in the following scenarios:

  • Suppose there are two controllers in a mobility group. A client that is associated with one controller goes to sleep and then wakes up and gets associated with the other controller.

  • Suppose there are three controllers in a mobility group. A client that is associated with the second controller that is anchored to the first controller goes to sleep, wakes up, and gets associated with the third controller.

  • A client sleeps, wakes up and gets associated with the same or different export foreign controller that is anchored to the export anchor.

This section contains the following subsections:

Restrictions for Authenticating Sleeping Clients

  • The sleep client feature works only for WLAN configured with WebAuth security. Web passthrough is supported on Release 8.0 and later.

  • You can configure the sleeping clients only on a per-WLAN basis.

  • With Release 8.8.111.0, sleeping clients are supported in a scenario where both Layer 2 security and Layer 3 security are configured on a WLAN.

  • With Layer 3 security, the Authentication, Passthrough, and On MAC Filter failure web policies are supported. The Conditional Web Redirect and Splash Page Web Redirect web policies are not supported.

  • The central web authentication of sleeping clients is not supported.

  • The authentication of sleeping clients feature is not supported on guest LANs and remote LANs.

  • A guest access sleeping client that has a local user policy is not supported. In this case, the WLAN-specific timer is applied.

  • The number of sleeping clients that are supported depends on the controller platform:

    • Cisco 5520 Wireless Controller—25000

    • Cisco 8540 Wireless Controller—64000

    • Cisco Virtual Wireless LAN Controller—500

Configuring Authentication for Sleeping Clients (GUI)

Procedure

Step 1

Choose WLANs.

Step 2

Click the corresponding WLAN ID.

The WLANs > Edit page is displayed.

Step 3

Click the Security tab and then click the Layer 3 tab.

Step 4

Select the Sleeping Client check box to enable authentication for sleeping clients.

Step 5

Enter the Sleeping Client Timeout, which is the duration for which the sleeping clients are to be remembered before reauthentication becomes necessary.

The default timeout is 12 hours.

Step 6

Click Apply.

Step 7

Click Save Configuration.


Configuring Authentication for Sleeping Clients (CLI)

Procedure
  • Enable or disable authentication for sleeping clients on a WLAN by entering this command:

    config wlan custom-web sleep-client {enable | disable} wlan-id
  • Configure the sleeping client timeout on a WLAN by entering this command:

    config wlan custom-web sleep-client timeout wlan-id duration
  • View the sleeping client configuration on a WLAN by entering this command:

    show wlan wlan-id
  • Delete any unwanted sleeping client entries by entering this command:

    config custom-web sleep-client delete client-mac-addr
  • View a summary of all the sleeping client entries by entering this command:

    show custom-web sleep-client summary
  • View the details of a sleeping client entry based on the MAC address of the client by entering this command:

    show custom-web sleep-client detail client-mac-addr

Authenticating Sleeping Clients on L2+L3 Enabled WLANs

With this feature enhancement, the sleeping client functionality works even if L2 and L3 credentials are different.

This feature also supports a configuration which allows sleeping clients to be authenticated automatically when they wake up without the need for the user to try web access.

Although the security parameters have not changed, the feature functions with only 802.1X + web authentication setups.

Configuring Sleeping Client Authentication on L2+L3 Enabled WLANs (GUI)

Procedure

Step 1

Choose WLANs > WLANs to open the WLAN page.

Step 2

Click the WLAN-ID number of the WLAN to which you want to configure the feature.

Step 3

Choose the Security > Layer 3 > tab from the WLANs > Edit page.

Step 4

Check the Sleeping Client check box to enable authentication for sleeping clients

Step 5

Enter the value for Sleeping Client Timeout,

This is the duration for which the sleeping clients are to be remembered before reauthentication is required. The default timeout is 12 hours.

Step 6

Check the Sleeping Client Auto Authenticate check box to enable auto authentication of the sleeping clients when they wake up .

Step 7

Save the configuration.


Configuring Sleeping Client Authentication on L2+L3 Enabled WLANs (CLI)

Procedure
  • Enable or disable the auto authentication of the sleeping client on wake up without the need for web access by entering this command:

    config wlan custom-web sleep-client authenticate-without-trigger {enable | disable} wlan-id

    The default value is Enabled.

  • View the status of the sleeping client authentication by entering this command:

    show wlan wlan-id

Web Redirect with 802.1X Authentication

You can configure a WLAN to redirect a user to a particular web page after 802.1X authentication has completed successfully. You can configure the web redirect to give the user partial or full access to the network.

This section contains the following subsections:

Conditional Web Redirect

If you enable conditional web redirect, the user can be conditionally redirected to a particular web page after 802.1X authentication has completed successfully. You can specify the redirect page and the conditions under which the redirect occurs on your RADIUS server. Conditions might include the user’s password reaching expiration or the user needing to pay his or her bill for continued usage.

If the RADIUS server returns the Cisco AV-pair “url-redirect,” then the user is redirected to the specified URL upon opening a browser. If the server also returns the Cisco AV-pair “url-redirect-acl,” the specified access control list (ACL) is installed as a preauthentication ACL for this client. The client is not considered fully authorized at this point and can only pass traffic allowed by the preauthentication ACL.

After the client completes a particular operation at the specified URL (for example, changing a password or paying a bill), the client must reauthenticate. When the RADIUS server does not return a “url-redirect,” the client is considered fully authorized and allowed to pass traffic.


Note


The conditional web redirect feature is available only for WLANs that are configured for 802.1X or WPA+WPA2 Layer 2 security.


After you configure the RADIUS server, you can then configure the conditional web redirect on the controller using either the controller GUI or CLI.

Splash Page Web Redirect

If you enable splash page web redirect, the user is redirected to a particular web page after 802.1X authentication has completed successfully. After the redirect, the user has full access to the network. You can specify the redirect page on your RADIUS server and the corresponding ACL to allow access to this server in "url-redirect-acl". If the RADIUS server returns the Cisco AV-pair “url-redirect,” then the user is redirected to the specified URL upon opening a browser. The client is considered fully authorized at this point and is allowed to pass traffic, even if the RADIUS server does not return a “url-redirect.”


Note


The splash page web redirect feature is available only for WLANs that are configured for 802.1X or WPA+WPA2 Layer 2 security with 802.1x key management. Preshared key management is not supported with any Layer 2 security method.


Suppose there are backend applications running on the wireless clients and they use HTTP or HTTPS port for their communication. If the applications start communicating before the actual web page is opened, the redirect functionality does not work with web passthrough.

After you configure the RADIUS server, you can then configure the splash page web redirect on the controller using either the controller GUI or CLI.

Configuring the RADIUS Server (GUI)


Note


These instructions are specific to the CiscoSecure ACS; however, they should be similar to those for other RADIUS servers.


Procedure

Step 1

From the CiscoSecure ACS main menu, choose Group Setup.

Step 2

Click Edit Settings.

Step 3

From the Jump To drop-down list, choose RADIUS (Cisco IOS/PIX 6.0).

Step 4

Select the [009\001] cisco-av-pair check box.

Step 5

Enter the following Cisco AV-pairs in the [009\001] cisco-av-pair edit box to specify the URL to which the user is redirected and, if configuring conditional web redirect, the conditions under which the redirect takes place, respectively:

url-redirect=http://url

url-redirect-acl=acl_name


Configuring Web Redirect

Configuring Web Redirect (GUI)

Procedure

Step 1

Choose WLANs to open the WLANs page.

Step 2

Click the ID number of the desired WLAN. The WLANs > Edit page appears.

Step 3

Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page.

Step 4

From the Layer 2 Security drop-down list, choose 802.1X or WPA+WPA2.

Step 5

Set any additional parameters for 802.1X or WPA+WPA2.

Step 6

Choose the Layer 3 tab to open the WLANs > Edit (Security > Layer 3) page.

Step 7

From the Layer 3 Security drop-down list, choose None.

Step 8

Check the Web Policy check box.

Step 9

Choose one of the following options to enable conditional or splash page web redirect: Conditional Web Redirect or Splash Page Web Redirect. The default value is disabled for both parameters.

Step 10

If the user is to be redirected to a site external to the controller, choose the ACL that was configured on your RADIUS server from the Preauthentication ACL drop-down list.

Step 11

Click Apply to commit your changes.

Step 12

Click Save Configuration to save your changes.


Configuring Web Redirect (CLI)

Procedure

Step 1

Enable or disable conditional web redirect by entering this command:

config wlan security cond-web-redir {enable | disable} wlan_id

Step 2

Enable or disable splash page web redirect by entering this command:

config wlan security splash-page-web-redir {enable | disable} wlan_id

Step 3

Save your settings by entering this command:

save config

Step 4

See the status of the web redirect features for a particular WLAN by entering this command:

show wlan wlan_id

Information similar to the following appears:


WLAN Identifier.................................. 1
Profile Name..................................... test
Network Name (SSID).............................. test
...
Web Based Authentication......................... Disabled
Web-Passthrough.................................. Disabled
Conditional Web Redirect......................... Disabled
Splash-Page Web Redirect......................... Enabled
...


Web Authentication Proxy

This feature enables clients that have manual web proxy enabled in the browser to facilitate authentication with the controller. If the user's browser is configured with manual proxy settings with a configured port number as 8080 or 3128 and if the client requests any URL, the controller responds with a web page prompting the user to change the Internet proxy settings to automatically detect the proxy settings so that the browser’s manual proxy settings information does not get lost. After enabling this settings, the user can get access to the network through the web authentication policy. This functionality is given for port 8080 and 3128 because these are the most commonly used ports for the web proxy server.


Note


The web authentication proxy redirect ports are not blocked through CPU ACL. If a CPU ACL is configured to block the port 8080, 3128, and one random port as part of web authentication proxy configuration, those ports are not blocked because the webauth rules take higher precedence than the CPU ACL rules unless the client is in the webauth_req state.


A web browser has the following three types of Internet settings that you can configure:

  • Auto detect

  • System Proxy

  • Manual

In a manual proxy server configuration, the browser uses the IP address of a proxy server and a port. If this configuration is enabled on the browser, the wireless client communicates with the IP address of the destination proxy server on the configured port. In a web authentication scenario, the controller does not listen to such proxy ports and the client is not able to establish a TCP connection with the controller. The user is unable to get any login page to authentication and get access to the network.

When a wireless client enters a web-authenticated WLAN, the client tries to access a URL. If a manual proxy configuration is configured on the client's browser, all the web traffic going out from the client will be destined to the proxy IP and port configured on the browser.

  • A TCP connection is established between the client and the proxy server IP address that the controller proxies for.

  • The client processes the DHCP response and obtains a JavaScript file from the controller. The script disables all proxy configurations on the client for that session.

    Note


    For external clients, the controller sends the login page as is (with or without JavaScipt).


  • Any requests that bypass the proxy configuration. The controller can then perform web-redirection, login, and authentication.

  • When the client goes out of the network, and then back into its own network, a DHCP refresh occurs and the client continues to use the old proxy configuration configured on the browser.

  • If the external DHCP server is used with webauth proxy, then DHCP option 252 must be configured on the DHCP server for that scope. The value of option 252 will have the format http://<virtual ip>/proxy.js. No extra configuration is needed for internal DHCP servers.


    Note


    When you configure FIPS mode with secure web authentication, we recommend that you use Mozilla Firefox as your browser.


  • If web authentication redirect to HTTPS is enabled, then both the client HTTPS and client HTTP requests are redirected to HTTPS web authentication.


    Note


    This enhancement was introduced in Release 8.0.


This section contains the following subsections:

Configuring Web Authentication Proxy (GUI)

Procedure

Step 1

Choose Controller > General

Step 2

From the WebAuth Proxy Redirection Mode drop-down list, choose Enabled or Disabled.

Step 3

In the WebAuth Proxy Redirection Port text box, enter the port number of the web auth proxy.

This text box consists of the port numbers on which the controller listens to for web authentication proxy redirection. By default, the three ports 80, 8080, and 3128 are assumed. If you configured the web authentication redirection port to any port other than these values, you must specify that value.

Step 4

Click Apply.


Configuring Web Authentication Proxy (CLI)

Procedure
  • Enable web authentication proxy redirection by entering this command:

    config network web-auth proxy-redirect {enable | disable}
  • Configure the secure web (HTTPS) authentication for clients by entering this command:

    config network web-auth secureweb {enable | disable}
    The default secure web (HTTPS) authentication for clients is enabled.

    Note


    If you configure to disallow secure web (HTTPS) authentication for clients using the config network web-auth secureweb disable command, then you must reboot the controller to implement the change.
  • Set the web authentication port number by entering this command:

    config network web-auth port port-number

    This parameter specifies the port numbers on which the controller listens to for web authentication proxy redirection. By default, the three ports 80, 8080, and 3128 are assumed. If you configured the web authentication redirection port to any port other than these values, you must specify that value.

  • Configure secure redirection (HTTPS) for web authentication clients by entering this command:

    config network web-auth https-redirect {enable | disable}
  • See the current status of the web authentication proxy configuration by entering one of the following commands:

    • show network summary
    • show running-config

Supporting IPv6 Client Guest Access

The client is in WebAuth Required state until the client is authenticated. The controller intercepts both IPv4 and IPv6 traffic in this state and redirects it to the virtual IP address of the controller. Once authenticated, the user's MAC address is moved to the run state and both IPv4 and IPv6 traffic is allowed to pass.

In order to support the redirection of IPv6-only clients, the controller automatically creates an IPv6 virtual address based on the IPv4 virtual address configured on the controller. The virtual IPv6 address follows the convention of [::ffff:<virtual IPv4 address>]. For example, a virtual IP address of 192.0.2.1 would translate into [::ffff:192.0.2.1]. For an IPv6 captive portal to be displayed, the user must request an IPv6 resolvable DNS entry such as ipv6.google.com which returns a DNSv6 (AAAA) record.

EAP and AAA Servers

This section contains the following subsections:

802.1X and Extensible Authentication Protocol

In order to provide enterprise-level WLAN security, 802.1X and Extensible Authentication Protocol (EAP) authentication mechanisms were implemented to provide mutual authentication of WLANs and WLAN client devices. The following figure shows the basic 802.1X and EAP authentication secure topology.

Figure 5. 802.1X and EAP Wireless LAN Security Topology


802.1X is an IEEE standard for port-based network access control and was adopted by the 802.11i security standard workgroup. The 802.1X standard provides authenticated access to 802.11 wireless LAN networks using the following logic:

  • A virtual port is created at the AP during the 802.11 association process for each WLAN client device.

  • The AP then blocks all data frames on this virtual port except for 802.1X-based traffic.

  • EAP authentication packets are carried in 802.1X traffic frames and are passed by the AP and Wireless LAN Controller to the AAA authentication server.

  • Assuming EAP authentication is successful, the authentication server sends an EAP success message back to the Wireless LAN Controller and AP, which in turn pass the message on to the WLAN client device.

  • The AP then allows data traffic (including voice and video) from the WLAN client device to flow through the virtual port.

  • Before the virtual port opens to allow data traffic, data link encryption is established between the client device and the AP.

During the authentication process, a unique per-user per-session shared key is derived, and a portion of this key is used as a per-session encryption key.

The EAP authentication process supports a number of protocols, and which protocol is used ultimately depends on the capabilities of the WLAN client device supplicant and the WLAN infrastructure. Regardless of the EAP type that is used, all protocols generally behave as shown in the example EAP flow in the following figure:

Figure 6. EAP Protocol Flow


EAP as defined by RFC 3748 supports four packet types as part of the EAP authentication process:

  • EAP request: The request packet that is sent by the authenticator (in the preceding figure, it is the Wireless LAN Controller and AP in combination) to the 802.1X supplicant (in the preceding figure, it is the WLAN client device). Each EAP request has a specific type that indicates what is being requested. In the example in the preceding figure, the first EAP request is for the WLAN client device identity, while the second EAP request is for the EAP type to be used for the authentication. A sequence number allows the authenticator and the peer to match an EAP response to each EAP request.

  • EAP response: The response packet is sent by the WLAN client device to the AP and in turn to the controller, and uses a sequence number to match the initiating EAP request. In the case of an identity or type response, the response is forwarded by the controller to the authentication server.

  • EAP success: Assuming that the WLAN client device or user has provided appropriate credentials during the authentication conversation, as shown in the preceding figure, the AAA server sends an EAP success packet to the controller, which in turn relays it through the AP to the WLAN client device.

  • EAP failure: If the appropriate credentials are not provided at the WLAN client device or some other failure occurs, the AAA server sends an EAP failure packet to the controller, which relays it through the AP to the WLAN client device, resulting in failure of the authentication.

For more information, see https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/RToWLAN/CCVP_BK_R7805F20_00_rtowlan-srnd/CCVP_BK_R7805F20_00_rtowlan-srnd_chapter_0100.html#CCVP_RF_8B1E3C6A_00.

LDAP

An LDAP backend database allows the controller to query an LDAP server for the credentials (username and password) of a particular user. These credentials are then used to authenticate the user. For example, local EAP may use an LDAP server as its backend database to retrieve user credentials.


Note


From Release 8.0, IPv6 can also be used to configure the LDAP server on the controller.

Fallback LDAP Servers

The LDAP servers are configured on a WLAN for authentication. You require at least two LDAP servers to configure them for fallback behavior. A maximum of three LDAP servers can be configured for the fallback behavior per WLAN. The servers are listed in the priority order for authentication. If the first LDAP server becomes irresponsive, then the controller switches to the next LDAP server. If the second LDAP server becomes irresponsive, then the controller switches again to the third LDAP server.

The LDAP backend database supports these local EAP methods: EAP-TLS, EAP-FAST/GTC, and PEAPv1/GTC. LEAP, EAP-FAST/MSCHAPv2, EAP-FAST/EAP-GTC and PEAPv0/MSCHAPv2 are also supported, but only if the LDAP server is set up to return a clear-text password.

Controllers support Local EAP authentication against external LDAP databases such as Microsoft Active Directory and Novell’s eDirectory.

This section contains the following subsections:

Configuring LDAP (GUI)

Procedure

Step 1

Choose Security > AAA > LDAP to open the LDAP Servers page.

  • If you want to delete an existing LDAP server, hover your cursor over the blue drop-down arrow for that server and choose Remove.
  • If you want to make sure that the controller can reach a particular server, hover your cursor over the blue drop-down arrow for that server and choose Ping.

Step 2

Perform one of the following:

  • To edit an existing LDAP server, click the index number for that server. The LDAP Servers > Edit page is displayed.

  • To add an LDAP server, click New. The LDAP Servers > New page is displayed. If you are adding a new server, choose a number from the Server Index (Priority) drop-down list to specify the priority order of this server in relation to any other configured LDAP servers. You can configure up to 17 servers. If the controller cannot reach the first server, it tries the second one in the list and so on.

Step 3

If you are adding a new server, enter the IP address of the LDAP server in the Server IP Address field. Both IPv4 and IPv6 addresses are supported.

Step 4

If you are adding a new server, enter the LDAP server’s TCP port number in the Port Number field. The valid range is 1 to 65535, and the default value is 389.

Note

 

Only LDAP port 389 is supported on the controller. No other ports are supported for LDAP.

Step 5

From the Server Mode (via TLS) drop-down list, choose Disabled to establish LDAP connection (without secure tunnel) between LDAP server and the controller using TCP or Enabled to establish a secure LDAP connection using TLS.

Step 6

Check the Enable Server Status check box to enable this LDAP server or unselect it to disable it. The default value is disabled.

Step 7

From the Simple Bind drop-down list, choose Anonymous or Authenticated to specify the local authentication bind method for the LDAP server. The Anonymous method allows anonymous access to the LDAP server. The Authenticated method requires that a username and password be entered to secure access. The default value is Anonymous.

Step 8

If you chose Authenticated in the previous step, follow these steps:

  1. In the Bind Username field, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters.

    Note

     

    If the username starts with “cn=” (in lowercase letters), the controller assumes that the username includes the entire LDAP database path and does not append the user base DN. This designation allows the authenticated bind user to be outside the user base DN.

  2. In the Bind Username field, enter a username to be used for local authentication to the LDAP server. The username can contain up to 80 characters.

Step 9

In the User Base DN field, enter the distinguished name (DN) of the subtree in the LDAP server that contains a list of all the users. For example, ou=organizational unit, .ou=next organizational unit, and o=corporation.com. If the tree containing users is the base DN, type.

o=corporation .com

or

dc =corporation, dc=com

Step 10

In the User Attribute field, enter the name of the attribute in the user record that contains the username. You can obtain this attribute from your directory server.

Step 11

In the User Object Type field, enter the value of the LDAP objectType attribute that identifies the record as a user. Often, user records have several values for the objectType attribute, some of which are unique to the user and some of which are shared with other object types.

Step 12

In the Server Timeout field, enter the number of seconds between retransmissions. The valid range is 2 to 30 seconds, and the default value is 2 seconds.

Step 13

Click Apply to commit your changes.

Step 14

Click Save Configuration to save your changes.

Step 15

Specify LDAP as the priority backend database server for local EAP authentication as follows:

  1. Choose Security > Local EAP > Authentication Priority to open the Priority Order > Local-Auth page.

  2. Highlight LOCAL and click < to move it to the left User Credentials field.

  3. Highlight LDAP and click > to move it to the right User Credentials field. The database that is displayed at the top of the right User Credentials field is used when retrieving user credentials.

    Note

     

    If both LDAP and LOCAL appear in the right User Credentials field with LDAP on the top and LOCAL on the bottom, local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If LOCAL is on the top, local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.

  4. Click Apply to commit your changes.

  5. Click Save Configuration to save your changes.

Step 16

(Optional) Assign specific LDAP servers to a WLAN as follows:

  1. Choose WLANs to open the WLANs page.

  2. Click the ID number of the desired WLAN.

  3. When the WLANs > Edit page is displayed, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

  4. From the LDAP Servers drop-down lists, choose the LDAP server(s) that you want to use with this WLAN. You can choose up to three LDAP servers, which are tried in priority order.

    Note

     

    These LDAP servers apply only to WLANs with web authentication enabled. They are not used by local EAP.

  5. Click Apply to commit your changes.

  6. Click Save Configuration to save your changes.

Step 17

Specify the LDAP server fallback behavior, as follows:

  1. Choose WLAN > AAA Server to open the Fallback Parameters page.

  2. From the LDAP Servers drop-down list, choose the LDAP server in the order of priority when the controller attempts to authenticate management users. The order of authentication is from server.

  3. Choose Security > AAA > LDAP to view the list of global LDAP servers configured for the controller.


Configuring LDAP (CLI)

Procedure
  • Configure an LDAP server by entering these commands:

    • config ldap add index server_ip_address port# user_base user_attr user_type secure —
Adds an LDAP server for secure LDAP.

    • config ldap delete index —Deletes a previously added LDAP server.

    • config ldap {enable | disable} index —Enables or disables an LDAP server.

    • config ldap security-mode enable index —Enables the LDAP server using index with existing commands.

    • config ldap simple-bind {anonymous index | authenticated index username username password password} —Specifies the local authentication bind method for the LDAP server. The anonymous method allows anonymous access to the LDAP server whereas the authenticated method requires that a username and password be entered to secure access. The default value is anonymous. The username can contain up to 80 characters.

      If the username starts with “cn=” (in lowercase letters), the controller assumes that the username includes the entire LDAP database path and does not append the user base DN. This designation allows the authenticated bind user to be outside the user base DN.

    • config ldap retransmit-timeout index timeout —Configures the number of seconds between retransmissions for an LDAP server.
  • Specify LDAP as the priority backend database server by entering this command:

    config local-auth user-credentials ldap

    If you enter the config local-auth user-credentials ldap local command , local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If you enter the config local-auth user-credentials local ldap command , local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.

  • (Optional) Assign specific LDAP servers to a WLAN by entering these commands:

    • config wlan ldap add wlan_id server_index —Links a configured LDAP server to a WLAN.

      The LDAP servers specified in this command apply only to WLANs with web authentication enabled. They are not used by local EAP.

    • config wlan ldap delete wlan_id {all | index} —Deletes a specific or all configured LDAP server(s) from a WLAN.
  • View information pertaining to configured LDAP servers by entering these commands:

    • show ldap summary —Shows a summary of the configured LDAP servers.

      
      Idx  Server Address   Port  Enabled
      ---  ---------------  ----  -------
      1    2.3.1.4           389    No
      2    10.10.20.22       389    Yes

      
      Idx      Server Address      Port     Enabled  Secure
      ---      --------------      -----    ------  -------   
      1         2.3.1.4            389       No       No
      2         2.3.1.5            389       Yes      No

    • show ldap index —Shows detailed LDAP server information. Information like the following appears:

      
      Server Index..................................... 2
      Address.......................................... 10.10.20.22
      Port............................................. 389
      Enabled.......................................... Yes
      User DN.......................................... ou=active,ou=employees,ou=people,
          o=cisco.com
      User Attribute................................... uid
      User Type........................................ Person
      Retransmit Timeout............................... 2 seconds
      Bind Method ..................................... Authenticated
      Bind Username................................. user1
      
      (Cisco Controller)> show ldap 1 
      Server Index..................................... 1
      Address.......................................... 9.1.0.100
      Port............................................. 389
      Server State..................................... Disabled
      User DN.......................................... user1
      User Attribute................................... user
      User Type........................................ user
      Retransmit Timeout............................... 2 seconds
      Secure (via TLS)................................. Disabled
      Bind Method ..................................... Anonymous
      
    • show ldap statistics —Shows LDAP server statistics.

      
      Server Index..................................... 1
      Server statistics:
        Initialized OK................................. 0
        Initialization failed.......................... 0
        Initialization retries......................... 0
        Closed OK...................................... 0
      Request statistics:
        Received....................................... 0
        Sent........................................... 0
        OK............................................. 0
        Success........................................ 0
        Authentication failed.......................... 0
        Server not found............................... 0
        No received attributes......................... 0
        No passed username............................. 0
        Not connected to server........................ 0
        Internal error................................. 0
        Retries........................................ 0
      
      Server Index..................................... 2
      ..
      
    • show wlan wlan_id —Shows the LDAP servers that are applied to a WLAN.

  • Make sure the controller can reach the LDAP server by entering this command:

    ping server_ip_address
  • Save your changes by entering this command:

    save config

  • Enable or disable debugging for LDAP by entering this command:

    debug aaa ldap {enable | disable}

Local EAP

Local EAP is an authentication method that allows users and wireless clients to be authenticated locally. It is designed for use in remote offices that want to maintain connectivity to wireless clients when the backend system becomes disrupted or the external authentication server goes down. When you enable local EAP, the controller serves as the authentication server and the local user database, which removes dependence on an external authentication server. Local EAP retrieves user credentials from the local user database to authenticate users. Local EAP supports LEAP, EAP-FAST, EAP-TLS, P EAPv0/MSCHAPv2, and PEAPv1/GTC authentication between the controller and wireless clients.

This section contains the following subsections:

Restrictions for Local EAP

  • Timer restrictions for local and central authentication using EAP: The EAP timeout cannot be configured on Wave 2 APs. Even though you can configure the EAP timeout on the controller, for Wave 2 APs, the EAP timeout is hardcoded to 30 seconds. This is due to the following reasons:

    • Clients get stuck in 8021X state indefinitely if AP moves from connected to standalone mode while EAP is in process.

    • Controller does not send EAP frames due to some issue, resulting in clients getting stuck indefinitely at AP.

    This has impact on clients, such as Windows clients, that wait for EAP identity request to pop up and are prompted for username and password. This issue is not seen on clients such as Apple, Samsung, Zebra, or WPA supplicants because they take the username and password beforehand.

  • For mesh APs, you cannot configure EAP parameters. The mesh APs have the following static EAP configuration: EAP request timeout set to 60 seconds and the maximum number of EAP identity request retries set to 2.

  • Legacy clients that require RC4 or 3DES encryption type are not supported in Local EAP authentication.

Configuring Local EAP (GUI)

Before you begin

Note


EAP-TLS, P EAPv0/MSCHAPv2, and PEAPv1/GTC use certificates for authentication, and EAP-FAST uses either certificates or PACs. The controller is shipped with Cisco-installed device and Certificate Authority (CA) certificates. However, if you want to use your own vendor-specific certificates, they must be imported on the controller.


Procedure

Step 1

If you are configuring local EAP to use one of the EAP types listed in the note above, make sure that the appropriate certificates and PACs (if you will use manual PAC provisioning) have been imported on the controller.

Step 2

If you want the controller to retrieve user credentials from the local user database, make sure that you have properly configured the local network users on the controller.

Step 3

If you want the controller to retrieve user credentials from an LDAP backend database, make sure that you have properly configured an LDAP server on the controller.

Step 4

Specify the order in which user credentials are retrieved from the backend database servers as follows:

  1. Choose Security > Local EAP > Authentication Priority to open the Priority Order > Local-Auth page.

  2. Determine the priority order in which user credentials are to be retrieved from the local and/or LDAP databases. For example, you may want the LDAP database to be given priority over the local user database, or you may not want the LDAP database to be considered at all.

  3. When you have decided on a priority order, highlight the desired database. Then use the left and right arrows and the Up and Down buttons to move the desired database to the top of the right User Credentials box.

    Note

     
    If both LDAP and LOCAL appear in the right User Credentials box with LDAP on the top and LOCAL on the bottom, local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If LOCAL is on the top, local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.
  4. Click Apply to commit your changes.

Step 5

Specify values for the local EAP timers as follows:

  1. Choose Security > Local EAP > General to open the General page.

  2. In the Local Auth Active Timeout field, enter the amount of time (in seconds) in which the controller attempts to authenticate wireless clients using local EAP after any pair of configured RADIUS servers fails. The valid range is 1 to 3600 seconds, and the default setting is 300 seconds.

Step 6

Specify values for the Advanced EAP parameters as follows:

  1. Choose Security> Advanced EAP.

  2. In the Identity Request Timeout field, enter the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

  3. In the Identity Request Max Retries field, enter the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

  4. In the Dynamic WEP Key Index field, enter the key index used for dynamic wired equivalent privacy (WEP). The default value is 0, which corresponds to a key index of 1; the valid values are 0 to 3 (key index of 1 to 4).

    This feature is no longer supported.

  5. In the Request Timeout field, enter the amount of time (in seconds) in which the controller attempts to send an EAP request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

  6. In the Request Max Retries field, enter the maximum number of times that the controller attempts to retransmit the EAP request to wireless clients using local EAP. The valid range is 1 to 120 retries, and the default setting is 2 retries.

  7. From the Max-Login Ignore Identity Response drop-down list, enable the feature if you want to ignore the EAP identity responses when enforcing the net user login limit.

  8. In the EAPOL-Key Timeout field, enter the amount of time (in seconds) in which the controller attempts to send an EAP key over the LAN to wireless. The valid range is 200 to 5000 milliseconds, and the default setting is 1000 milliseconds.

  9. In the EAPOL-Key Max Retries field, enter the maximum number of times that the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.

  10. In the EAP-Broadcast Key Interval field, enter the interval between the Group Temporal Key (GTK) key rotation for all the stations on a BSSID that is using WPA protocol. The default interval is 3600 seconds.

  11. Click Apply to commit your changes.

Step 7

Create a local EAP profile, which specifies the EAP authentication types that are supported on the wireless clients as follows:

  1. Choose Security > Local EAP > Profiles to open the Local EAP Profiles page.

    This page lists any local EAP profiles that have already been configured and specifies their EAP types. You can create up to 16 local EAP profiles.

    Note

     
    If you want to delete an existing profile, hover your cursor over the blue drop-down arrow for that profile and choose Remove.
  2. Click New to open the Local EAP Profiles > New page.

  3. In the Profile Name field, enter a name for your new profile and then click Apply.

    Note

     
    You can enter up to 63 alphanumeric characters for the profile name. Make sure not to include spaces.
  4. When the Local EAP Profiles page is displayed again, click the name of your new profile. The Local EAP Profiles > Edit page is displayed.

  5. Check the LEAP, EAP-FAST, EAP-TLS, and/or PEAP check boxes to specify the EAP type that can be used for local authentication.

    Note

     
    You can specify more than one EAP type per profile. However, if you choose multiple EAP types that use certificates (such as EAP-FAST with certificates, EAP-TLS, PEAPv0/MSCHAPv2, and PEAPv1/GTC), all the EAP types must use the same certificate (from either Cisco or another vendor).

    Note

     
    If you check the PEAP check box, both PEAPv0/MSCHAPv2 or PEAPv1/GTC are enabled on the controller.
  6. If you chose EAP-FAST and want the device certificate on the controller to be used for authentication, check the Local Certificate Required check box. If you want to use EAP-FAST with PACs instead of certificates, leave this check box unselected, which is the default setting.

    Note

     
    This option applies only to EAP-FAST because device certificates are not used with LEAP and are mandatory for EAP-TLS and PEAP.
  7. If you chose EAP-FAST and want the wireless clients to send their device certificates to the controller in order to authenticate, check the Client Certificate Required check box. If you want to use EAP-FAST with PACs instead of certificates, leave this check box unchecked, which is the default setting.

    Note

     
    This option applies only to EAP-FAST because client certificates are not used with LEAP or PEAP and are mandatory for EAP-TLS.
  8. If you chose EAP-FAST with certificates, EAP-TLS, or PEAP, choose which certificates will be sent to the client, the ones from Cisco or the ones from another Vendor, from the Certificate Issuer drop-down list. The default setting is Cisco.

  9. If you chose EAP-FAST with certificates or EAP-TLS and want the incoming certificate from the client to be validated against the CA certificates on the controller, check the Check against CA certificates check box. The default setting is enabled.

  10. If you chose EAP-FAST with certificates or EAP-TLS and want the common name (CN) in the incoming certificate to be validated against the Local Net Users configured on the controller, check the Verify Certificate CN Identity check box. The default setting is disabled.

  11. If you chose EAP-FAST with certificates or EAP-TLS and want the controller to verify that the incoming device certificate is still valid and has not expired, check the Check Certificate Date Validity check box. The default setting is enabled.

    Note

     
    Certificate date validity is checked against the current UTC (GMT) time that is configured on the controller. Timezone offset will be ignored.
  12. Click Apply to commit your changes.

Step 8

If you created an EAP-FAST profile, follow these steps to configure the EAP-FAST parameters:

  1. Choose Security > Local EAP > EAP-FAST Parameters to open the EAP-FAST Method Parameters page.

  2. In the Server Key and Confirm Server Key fields, enter the key (in hexadecimal characters) used to encrypt and decrypt PACs.

  3. In the Time to Live for the PAC field, enter the number of days for the PAC to remain viable. The valid range is 1 to 1000 days, and the default setting is 10 days.

  4. In the Authority ID field, enter the authority identifier of the local EAP-FAST server in hexadecimal characters. You can enter up to 32 hexadecimal characters, but you must enter an even number of characters.

  5. In the Authority ID Information field, enter the authority identifier of the local EAP-FAST server in text format.

  6. If you want to enable anonymous provisioning, check the Anonymous Provision check box. This feature allows PACs to be sent automatically to clients that do not have one during PAC provisioning. If you disable this feature, PACS must be manually provisioned. The default setting is enabled.

    Note

     
    If the local and/or client certificates are required and you want to force all EAP-FAST clients to use certificates, uncheck the Anonymous Provision check box.
  7. Click Apply to commit your changes.

Step 9

Enable local EAP on a WLAN as follows:

  1. Choose WLANs to open the WLANs page.

  2. Click the ID number of the desired WLAN.

  3. When the WLANs > Edit page is displayed, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

  4. Uncheck the Enabled check boxes for RADIUS Authentication Servers and Accounting Server to disable RADIUS accounting and authentication for this WLAN.

  5. Check the Local EAP Authentication check box to enable local EAP for this WLAN.

  6. From the EAP Profile Name drop-down list, choose the EAP profile that you want to use for this WLAN.

  7. If desired, choose the LDAP server that you want to use with local EAP on this WLAN from the LDAP Servers drop-down lists.

  8. Click Apply to commit your changes.

Step 10

Enable EAP parameters on a WLAN as follows:

  1. Choose WLANs to open the WLANs page.

  2. Click the ID number of the desired WLAN.

  3. When the WLANs > Edit page is displayed, choose the Security > AAA Servers tabs to open the WLANs > Edit (Security > AAA Servers) page.

  4. Check the Enable check box to configure EAP parameters for this WLAN.

  5. In the EAPOL Key Timeout (200 to 5000 millisec) field, enter the amount of time (in milliseconds) in which the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 200 to 5000 milliseconds and the default value is 1000 milliseconds.

  6. In the EAPOL Key Retries (0 to 4) field, enter the maximum number of times that the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 0 to 4 retries and the default setting is 2 retries.

  7. In the Identity Request Timeout (1 to 120 sec) field, enter the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds and the default value is 30 seconds.

  8. In the Identity Request Retries (1 to 20 sec) field, enter the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

  9. In the Request Timeout (1 to 120 sec) field, enter the amount of time (in seconds) in which the controller attempts to send an EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.

  10. In the Request Retries (1 to 20 sec) field, enter the maximum number of times that the controller attempts to retransmit the EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

  11. Click Apply to commit your changes.

Step 11

Click Save Configuration to save your changes.


Configuring Local EAP (CLI)

Before you begin

Note


EAP-TLS, P EAPv0/MSCHAPv2, and PEAPv1/GTC use certificates for authentication, and EAP-FAST uses either certificates or PACbs. The controller is shipped with Cisco-installed device and Certificate Authority (CA) certificates. However, if you want to use your own vendor-specific certificates, they must be imported on the controller.


Procedure

Step 1

If you are configuring local EAP to use one of the EAP types listed in the note above, make sure that the appropriate certificates and PACs (if you will use manual PAC provisioning) have been imported on the controller.

Step 2

If you want the controller to retrieve user credentials from the local user database, make sure that you have properly configured the local network users on the controller.

Step 3

If you want the controller to retrieve user credentials from an LDAP backend database, make sure that you have properly configured an LDAP server on the controller.

Step 4

Specify the order in which user credentials are retrieved from the local and/or LDAP databases by entering this command:

config local-auth user-credentials {local | ldap}

Note

 
If you enter the config local-auth user-credentials ldap local command, local EAP attempts to authenticate clients using the LDAP backend database and fails over to the local user database if the LDAP servers are not reachable. If the user is not found, the authentication attempt is rejected. If you enter the config local-auth user-credentials local ldap command , local EAP attempts to authenticate using only the local user database. It does not fail over to the LDAP backend database.

Step 5

Specify values for the local EAP timers by entering these commands:

  • config advanced eap identity-request-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
  • config advanced eap bcast-key-interval seconds —Configures EAP-broadcast key renew interval time in seconds. The valid range is 120 to 86400 seconds.
  • config advanced eap identity-request-retries retries —Specifies the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients using local EAP. The valid range is 1 to 20 retries, and the default setting is 20 retries.
  • config advanced eap key-index index —Specifies the key index used for dynamic wired equivalent privacy (WEP). The default value is 0, which corresponds to a key index of 1; the valid values are 0 to 3 (key index of 1 to 4).
  • config advanced eap request-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP request to wireless clients using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
  • config advanced eap request-retries retries —Specifies the maximum number of times that the controller attempts to retransmit the EAP request to wireless clients using local EAP. The valid range is 1 to 120 retries, and the default setting is 20 retries.
  • config advanced eap eapol-key-timeout timeout —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP key over the LAN to wireless clients. The valid range is 200 to 5000 milliseconds, and the default setting is 1000 milliseconds.

    Note

     
    If the controller and access point are separated by a WAN link, the default timeout of 1 second may not be sufficient.
  • config advanced eap eapol-key-retries retries —Specifies the maximum number of times that the controller attempts to send an EAP key over the LAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.
  • config advanced eap max-login-ignore-identity-response {enable | disable}

    Enable the feature if you want to ignore the EAP identity responses when enforcing the net user login limit. See the User Login Policies section for details.

  • config advanced eap rsn-capability-validation { enable | disable } —When used, this command allows you to enable or disable the RSN-capability (2-Byte in EAPOL-M2 frame) validation with respect to association request.

Step 6

Specify values for the local EAP timers on a WLAN by entering these commands:

  • config wlan security eap-params {enable | disable} wlan_id —Specifies to enable or disable SSID specific EAP timeouts or retries. The default value is disabled.
  • config wlan security eap-params eapol-key-timeout timeout wlan_id —Specifies the amount of time (in milliseconds) in which the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 200 to 5000 milliseconds, and the default setting is 1000 milliseconds.
  • config wlan security eap-params eapol-key-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to send an EAP key over the WLAN to wireless clients using local EAP. The valid range is 0 to 4 retries, and the default setting is 2 retries.
  • config wlan security eap-params identity-request-timeout timeout wlan_id —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
  • config wlan security eap-params identity-request-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to retransmit the EAP identity request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.
  • config wlan security eap-params request-timeout timeout wlan_id —Specifies the amount of time (in seconds) in which the controller attempts to send an EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 120 seconds, and the default setting is 30 seconds.
  • config wlan security eap-params request-retries retries wlan_id —Specifies the maximum number of times that the controller attempts to retransmit the EAP parameter request to wireless clients within WLAN using local EAP. The valid range is 1 to 20 retries, and the default setting is 2 retries.

Step 7

Create a local EAP profile by entering this command:

config local-auth eap-profile add profile_name

Note

 
Do not include spaces within the profile name.

Note

 
To delete a local EAP profile, enter the config local-auth eap-profile delete profile_name command.

Step 8

Add an EAP method to a local EAP profile by entering this command:

config local-auth eap-profile method add method profile_name

The supported methods are leap, fast, tls, and peap.

Note

 
If you choose peap, both P EAPv0/MSCHAPv2 or PEAPv1/GTC are enabled on the controller.

Note

 
You can specify more than one EAP type per profile. However, if you create a profile with multiple EAP types that use certificates (such as EAP-FAST with certificates, EAP-TLS, PEAPv0/MSCHAPv2, and PEAPv1/GTC), all of the EAP types must use the same certificate (from either Cisco or another vendor).

Note

 
To delete an EAP method from a local EAP profile, enter the config local-auth eap-profile method delete method profile_name command.

Step 9

Configure EAP-FAST parameters if you created an EAP-FAST profile by entering this command:

config local-auth method fast ?

where ? is one of the following:

  • anon-prov {enable | disable} —Configures the controller to allow anonymous provisioning, which allows PACs to be sent automatically to clients that do not have one during PAC provisioning.

  • authority-id auth_id —Specifies the authority identifier of the local EAP-FAST server.

  • pac-ttl days —Specifies the number of days for the PAC to remain viable.

  • server-key key —Specifies the server key used to encrypt and decrypt PACs.

Step 10

[Optional] Disable EAP local authentication using TLS v1.0 handshake by entering this command:

config local-auth low-cipher { enable | disabled}

Default state is Enabled.

Step 11

Configure certificate parameters per profile by entering these commands:

  • config local-auth eap-profile method fast local-cert {enable | disable} profile_name —
Specifies whether the device certificate on the controller is required for authentication.

    Note

     

    This command applies only to EAP-FAST because device certificates are not used with LEAP and are mandatory for EAP-TLS and PEAP.

  • config local-auth eap-profile method fast client-cert {enable | disable} profile_name —
Specifies whether wireless clients are required to send their device certificates to the controller in order to authenticate.

    Note

     

    This command applies only to EAP-FAST because client certificates are not used with LEAP or PEAP and are mandatory for EAP-TLS.

  • config local-auth eap-profile cert-issuer {cisco | vendor} profile_name —If you specified EAP-FAST with certificates, EAP-TLS, or PEAP, specifies whether the certificates that will be sent to the client are from Cisco or another vendor.
  • config local-auth eap-profile cert-verify ca-issuer {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the incoming certificate from the client is to be validated against the CA certificates on the controller.
  • config local-auth eap-profile cert-verify cn-verify {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the common name (CN) in the incoming certificate is to be validated against the CA certificates’ CN on the controller.
  • config local-auth eap-profile cert-verify date-valid {enable | disable} profile_name —If you chose EAP-FAST with certificates or EAP-TLS, specifies whether the controller is to verify that the incoming device certificate is still valid and has not expired.

Step 12

Enable local EAP and attach an EAP profile to a WLAN by entering this command:

config wlan local-auth enable profile_name wlan_id

Note

 
To disable local EAP for a WLAN, enter the config wlan local-auth disable wlan_id command.

Step 13

Save your changes by entering this command:

save config

Step 14

View information pertaining to local EAP by entering these commands:

  • show local-auth config— Shows the local EAP configuration on the controller.
    
    User credentials database search order:
       Primary ..................................... Local DB
    
    Timer:
        Active timeout .............................. 300
    
    Configured EAP profiles:
       Name ........................................ fast-cert
         Certificate issuer ........................ vendor
         Peer verification options:
           Check against CA certificates ........... Enabled
           Verify certificate CN identity .......... Disabled
           Check certificate date validity ......... Enabled
         EAP-FAST configuration:
           Local certificate required .............. Yes
           Client certificate required ............. Yes
         Enabled methods ........................... fast
         Configured on WLANs ....................... 1
    
       Name ........................................ tls
         Certificate issuer ........................ vendor
         Peer verification options:
           Check against CA certificates ........... Enabled
           Verify certificate CN identity .......... Disabled
           Check certificate date validity ......... Enabled
         EAP-FAST configuration:
           Local certificate required .............. No
           Client certificate required ............. No
         Enabled methods ........................... tls
         Configured on WLANs ....................... 2
    
    EAP Method configuration:
       Low-Cipher Support(TLSv1.0 for local EAP)..... Enabled
       EAP-FAST:
         Server key ................................ <hidden>
         TTL for the PAC ........................... 10
         Anonymous provision allowed ............... Yes
         Accept client on auth prov ................ No
         Authority ID ...... 436973636f0000000000000000000000
         Authority Information ..................... Cisco A-ID
    
  • show local-auth statistics —Shows the local EAP statistics.
  • show local-auth certificates —Shows the certificates available for local EAP.
  • show local-auth user-credentials —Shows the priority order that the controller uses when retrieving user credentials from the local and/or LDAP databases.
  • show advanced eap —Shows the timer values for local EAP.
    
    EAP-Identity-Request Timeout (seconds)........... 1
    EAP-Identity-Request Max Retries................. 20
    EAP Key-Index for Dynamic WEP.................... 0
    EAP Max-Login Ignore Identity Response........... enable
    EAP-Request Timeout (seconds).................... 20
    EAP-Request Max Retries.......................... 20
    EAPOL-Key Timeout (seconds)...................... 1
    EAPOL-Key Max Retries......................... 2

    
  • show ap stats wlan Cisco_AP —Shows the EAP timeout and failure counters for a specific access point for each WLAN.
  • show client detail client_mac —Shows the EAP timeout and failure counters for a specific associated client. These statistics are useful in troubleshooting client association issues.
    
    ...
    Client Statistics:
          Number of Bytes Received................... 10
          Number of Bytes Sent....................... 10
          Number of Packets Received................. 2
          Number of Packets Sent..................... 2
          Number of EAP Id Request Msg Timeouts...... 0
          Number of EAP Id Request Msg Failures...... 0
          Number of EAP Request Msg Timeouts......... 2
          Number of EAP Request Msg Failures......... 1
          Number of EAP Key Msg Timeouts............. 0
          Number of EAP Key Msg Failures............. 0
          Number of Policy Errors.................... 0
          Radio Signal Strength Indicator............ Unavailable
          Signal to Noise Ratio...................... Unavailable
    
  • show wlan wlan_id —Shows the status of local EAP on a particular WLAN.

Step 15

(Optional) Troubleshoot local EAP sessions by entering these commands:

  • debug aaa local-auth eap method {all | errors | events | packets | sm} {enable | disable} —
Enables or disables debugging of local EAP methods.

  • debug aaa local-auth eap framework {all | errors | events | packets | sm} {enable | disable} —
Enables or disables debugging of the local EAP framework.

    Note

     

    In these two debug commands, sm is the state machine.

  • clear stats local-auth —Clears the local EAP counters.

  • clear stats ap wlan Cisco_AP —Clears the EAP timeout and failure counters for a specific access point for each WLAN.
    
    WLAN      1
       EAP Id Request Msg Timeouts................... 0
       EAP Id Request Msg Timeouts Failures.......... 0
       EAP Request Msg Timeouts...................... 2
       EAP Request Msg Timeouts Failures............. 1
       EAP Key Msg Timeouts.......................... 0
       EAP Key Msg Timeouts Failures................. 0
    WLAN      2
       EAP Id Request Msg Timeouts................... 1
       EAP Id Request Msg Timeouts Failures.......... 0
       EAP Request Msg Timeouts...................... 0
       EAP Request Msg Timeouts Failures............. 0
       EAP Key Msg Timeouts.......................... 3
    EAP Key Msg Timeouts Failures.............. 1
    

Local Network Users on Controller

You can add local network users to the local user database on the controller. The local user database stores the credentials (username and password) of all the local network users. These credentials are then used to authenticate the users. Local network user entries can be used to authenticate clients through web authentication or local EAP.

This section contains the following subsections:

Configuring Local Network Users for the Controller (GUI)
Procedure

Step 1

Choose Security > AAA > Local Net Users to open the Local Net Users page.

Note

 

If you want to delete an existing user, hover your cursor over the blue drop-down arrow for that user and choose Remove.

When admin modifies the credentials of a local network user, the user gets disassociated from the WLAN. Here, credentials refer to the change in password or wlan profile for that user.

Step 2

Perform one of the following:

  • To edit an existing local network user, click the username for that user. The Local Net Users > Edit page appears.

  • To add a local network user, click New. The Local Net Users > New page appears.

Step 3

If you are adding a new user, enter a username for the local user in the User Name text box. You can enter up to 49 alphanumeric characters.

Note

 

Local network usernames must be unique because they are all stored in the same database.

Step 4

In the Password and Confirm Password text boxes, enter a password for the local user. You can enter up to 49 alphanumeric characters.

Step 5

If you are adding a new user, select the Guest User check box if you want to limit the amount of time that the user has access to the local network. The default setting is unselected.

Step 6

If you are adding a new user and you selected the Guest User check box, enter the amount of time (in seconds) that the guest user account is to remain active in the Lifetime text box. The valid range is 60 to 2,592,000 seconds (30 days) inclusive, and the default setting is 86,400 seconds.

Step 7

If you are adding a new user, you selected the Guest User check box, and you want to assign a QoS role to this guest user, select the Guest User Role check box. The default setting is unselected.

Note

 

If you do not assign a QoS role to a guest user, the bandwidth contracts for this user are defined in the QoS profile for the WLAN.

Step 8

If you are adding a new user and you selected the Guest User Role check box, choose the QoS role that you want to assign to this guest user from the Role drop-down list.

Step 9

From the WLAN Profile drop-down list, choose the name of the WLAN that is to be accessed by the local user. If you choose Any WLAN, which is the default setting, the user can access any of the configured WLANs.

Note

 
If you are deleting a WLAN associated with network users, then the system prompts you to delete all network users associated with the WLAN before deleting the WLAN itself.

Step 10

In the Description text box, enter a descriptive title for the local user (such as “User 1”).

Step 11

Click Apply to commit your changes.

Step 12

Click Save Configuration to save your changes.


Configuring Local Network Users for the Controller (CLI)
Procedure
  • Configure a local network user by entering these commands:

    • config netuser add username password wlan wlan_id userType permanent description description —Adds a permanent user to the local user database on the controller.

    • config netuser add username password {wlan | guestlan} {wlan_id | guest_lan_id} userType guestlifetime seconds description description —Adds a guest user on a WLAN or wired guest LAN to the local user database on the controller.

      Note


      Instead of adding a permanent user or a guest user to the local user database from the controller, you can choose to create an entry on the RADIUS server for the user and enable RADIUS authentication for the WLAN on which web authentication is performed.


    • config netuser delete { username username | wlan-id wlan-id}
      • username—Deletes a user from the local user database on the controller.


        Note


        Local network usernames must be unique because they are all stored in the same database.


      • wlan-id—Delete all the network users associated with the WLAN ID.


        Note


        When a WLAN associated with network users is deleted, the system prompts to delete all network users associated with the WLAN first. After deleting the network users, you can delete the WLAN.
  • See information related to the local network users configured on the controller by entering these commands:

    • show netuser detail username —Shows the configuration of a particular user in the local user database.
    • show netuser summary —Lists all the users in the local user database.

  • Save your changes by entering this command:

    save config

Uploading PACs for EAP-FAST

Protected access credentials (PACs) are credentials that are either automatically or manually provisioned and used to perform mutual authentication with a local EAP authentication server during EAP-FAST authentication. When manual PAC provisioning is enabled, the PAC file is manually generated on the controller.

Follow the instructions in this section to generate and load PACs from the controller through the GUI or CLI. However, before you begin, make sure you have a TFTP or FTP server available for the PAC upload. Follow these guidelines when setting up a TFTP or FTP server:

  • If you are uploading through the service port, the TFTP or FTP server must be on the same subnet as the service port because the service port is not routable, or you must create static routes on the controller.

  • If you are uploading through the distribution system network port, the TFTP or FTP server can be on the same or a different subnet because the distribution system port is routable.

PAC Provisioning and Device Enrolment

Controller device enrollment is initiated by controller as part of Protected Access Credential (PAC) provisioning with the Cisco ISE server. Controller initiates EAP-FAST and gets a PAC. This is accomplished by using the infrastructure of LOCAL-EAP EAP-FAST PAC provisioning. The PAC that is obtained uniquely maps to the device ID. If the device ID changes, the PAC data associated with the previous device ID is removed from the PAC store. PAC provisioning is triggered when a RADIUS server instance is enabled to provision the PAC.


Note


Ensure that the Cisco ISE and the controller time are synchronized for PAC to be downloaded on controller appropriately.


In a High Availability (HA) setup, PACs are not shared over redundancy channel; instead, PAC download is reinitiated on a new active controller immediately after switchover.

This section contains the following subsections:

Uploading PACs (GUI)

Procedure

Step 1

Choose Commands > Upload File to open the Upload File from Controller page.

Step 2

From the File Type drop-down list, choose PAC (Protected Access Credential).

Step 3

In the User field, enter the name of the user who will use the PAC.

Step 4

In the Validity field, enter the number of days for the PAC to remain valid. The default setting is zero (0).

Step 5

In the Password and Confirm Password text boxes, enter a password to protect the PAC.

Step 6

From the Transfer Mode drop-down list, choose from the following options:

  • TFTP
  • FTP
  • SFTP (available in 7.4 and later releases)

Step 7

In the IP Address (IPv4/IPv6) field, enter the IPv4/IPv6 address of the server.

Step 8

In the File Path field, enter the directory path of the PAC.

Step 9

In the File Name field, enter the name of the PAC file. PAC files have a .pac extension.

Step 10

If you are using an FTP server, follow these steps:

  1. In the Server Login Username field, enter the username to log into the FTP server.

  2. In the Server Login Password field, enter the password to log into the FTP server.

  3. In the Server Port Number field, enter the port number on the FTP server through which the upload occurs. The default value is 21.

Step 11

Click Upload to upload the PAC from the controller. A message appears indicating the status of the upload.

Step 12

Follow the instructions for your wireless client to load the PAC on your client devices. Make sure to use the password that you entered above.


Uploading PACs (CLI)

Procedure

Step 1

Log on to the controller CLI.

Step 2

Specify the transfer mode used to upload the config file by entering this command:

transfer upload mode {tftp | ftp | sftp}

Step 3

Upload a Protected Access Credential (PAC) by entering this command:

transfer upload datatype pac

Step 4

Specify the identification of the user by entering this command:

transfer upload pac username validity password

Step 5

Specify the IP address of the TFTP or FTP server by entering this command:

transfer upload serverip server-ip-address

Note

 
The server supports both, IPv4 and IPv6.

Step 6

Specify the directory path of the config file by entering this command:

transfer upload path server-path-to-file

Step 7

Specify the name of the config file to be uploaded by entering this command:

transfer upload filename manual.pac.

Step 8

If you are using an FTP server, enter these commands:

  • transfer upload username username

  • transfer upload password password

  • transfer upload port port

    Note

     
    The default value for the port parameter is 21.

Step 9

View the updated settings by entering the transfer upload start command. Answer y when prompted to confirm the current settings and start the upload process.

Step 10

Follow the instructions for your wireless client to load the PAC on your client devices. Make sure to use the password that you entered above.