Configure and verify wireless security features
📘CCNP Encore (350-401-ENCORE-v1.1)
WebAuth (Web Authentication) is a wireless security feature that allows users to authenticate through a web browser before getting access to the network. This is commonly used in guest networks, public Wi-Fi, or situations where you want a simple authentication method without using full enterprise credentials like 802.1X.
Think of it like a login page you see before using Wi-Fi in hotels or offices. In Cisco networks, this is handled by Cisco Wireless LAN Controllers (WLCs) and Access Points.
1. How WebAuth Works
WebAuth works in a few steps:
- User connects to the SSID
- When a client device (like a laptop or phone) connects to a wireless SSID configured with WebAuth, the device doesn’t have full network access yet.
- Redirect to Web Login Page
- The WLC intercepts HTTP/HTTPS traffic and redirects the user to a login page.
- This page can be customized to show your company or guest network information.
- User Enters Credentials
- The user types their username and password (or other credentials, depending on configuration).
- Credentials can be validated against Internal WLC database, RADIUS server, or LDAP/Active Directory.
- WLC Authenticates User
- Once credentials are correct, WLC authorizes the user to access the network.
- The WLC applies policies like VLAN assignment, ACLs, or QoS policies.
- Network Access Granted
- The user now gets access to the network according to the policy defined for them (guest, employee, or restricted access).
2. Types of WebAuth
There are two main types in Cisco wireless networks:
- Local WebAuth (WLC-hosted)
- WLC hosts the web page and handles authentication internally.
- Simple and easy to set up.
- Used for small deployments or guest access.
- External WebAuth (External RADIUS/Web Server)
- Authentication is offloaded to a RADIUS server and/or external web server.
- Allows more flexibility, such as branding, custom pages, and integration with corporate directories.
- Used for enterprise networks or where custom portals are needed.
3. Key Features of WebAuth
- Captive Portal: Forces users to interact with the login page before using the network.
- VLAN Assignment: You can place authenticated users into specific VLANs.
- Access Control Lists (ACLs): Limit what users can access based on authentication.
- Guest Access: Supports temporary accounts or self-registration portals.
- Security Options: Can use HTTPS for secure credential transmission.
4. Configuring WebAuth on Cisco WLC
Here’s a simplified overview:
Step 1: Enable WebAuth on SSID
- Go to the SSID settings and choose Web Authentication as the security type.
- Decide whether it’s local or external.
Step 2: Choose WebAuth Type
- Internal (Local): WLC hosts the portal. You can customize the login page.
- External: Provide the URL of an external web server to redirect users.
Step 3: Configure Authentication
- Select authentication method:
- Internal database (simple for guest accounts)
- RADIUS server (for enterprise user validation)
- Configure timeout and session settings.
Step 4: Configure VLAN and ACL (Optional)
- Assign a VLAN after login.
- Apply ACLs to restrict access for guests.
Step 5: Test
- Connect a device to the SSID.
- Ensure it is redirected to the login page, enters credentials, and gets network access.
5. Verification Commands (for Exam)
On Cisco WLC, you can verify WebAuth using these commands:
- Check which clients are WebAuth pending:
show client summary
- See WebAuth status for a specific client:
show web-auth sessions
- Verify configured WebAuth on SSID:
show wlan <wlan-id>
- Test connectivity from client:
- Connect to SSID → should be redirected to login page.
6. Exam Tips
- Remember the difference between local and external WebAuth.
- Understand the flow: connect → redirect → login → authentication → network access.
- Know the verification commands on WLC.
- Guest VLAN and ACL concepts are often tested.
7. Example in IT Environment
- A company offers a guest Wi-Fi.
- Guests connect → redirected to a login page hosted on the WLC → enter a temporary username/password → get access to the internet only (restricted by ACL).
- Employees connect to the same SSID → redirected to an external portal validating AD credentials via RADIUS → get full network access with VLAN assignment.
✅ Summary for Exam:
- WebAuth is web-based authentication for wireless users.
- Can be local or external.
- Forces users to login before access.
- Works with VLANs, ACLs, and RADIUS.
- Must know configuration steps, flow, and verification commands.
