topic Re: DOT1X WEBAUTH REDIRECT in Network Access Control

DOT1X WEBAUTH REDIRECT

askalot — Thu, 15 Dec 2022 13:13:26 GMT

Hello,

I understand that following configurations are required on a cisco switch to facilitate redirection for webauth:

ip http server

ip http secure-server.

Is the ip http secure-server configuration absolutely necessary? I'm asking because we've enabled it as a result of which we've been bombarded with vulnerabilities owing to https certificates on the ios devices. I'm hoping that we can do without enabling https on the switches so that I shut it off and resolve the flagged issues.

Re: DOT1X WEBAUTH REDIRECT

Rob Ingram — Thu, 15 Dec 2022 13:17:12 GMT

@askalot no it's not recommended to redirect using https - so configure "no ip http secure-server" to disable.

Re: DOT1X WEBAUTH REDIRECT

Rodrigo Diaz — Thu, 15 Dec 2022 17:28:05 GMT

@askalot

For this specific scenario, you might review the redirection flow that you want to implement , the "ip http server " command in catalyst platforms is required for http traffic exclusively and the " ip http secure-server" for https , in any case if you have problems using https within ios , I would attempt/redesign a flow to use only http for now while reviewing the vulnerabilities you mention.

Re: DOT1X WEBAUTH REDIRECT

thomas — Fri, 16 Dec 2022 18:34:24 GMT

Please see our > Web Authentication/URL Redirection and ACLs which has examples and explanations.