topic AAA override Wireless Web authentication in Wireless

AAA override Wireless Web authentication

remco.gussen — Sun, 04 Jul 2021 00:38:59 GMT

I was wondering if it is possible to use a Guest SSID network with AAA override option. So that WLC intercepts all requests, prompts for Username and password, sends the credentials to RADIUS server. Is it possible that the Guest SSID can user the AAA override option, to dynamicly assign the guest user to a VLAN ?

thanx

Re: AAA override Wireless Web authentication

dancampb — Thu, 28 May 2009 18:24:59 GMT

You can send the guest wlan username and password to AAA for validation. Just define a Radius server under that WLAN. It is not possible to use AAA Override to have a dynamic VLAN assigned. With a guest WLAN the client already has an IP address and is on the vlan before the credentials are sent to Radius. The controller is just blocking the client's traffic from going any further until the authentication is passed.

Re: AAA override Wireless Web authentication

remco.gussen — Tue, 02 Jun 2009 10:25:35 GMT

You are right ! Thanx for your reply.

Gr.

Remco

Re: AAA override Wireless Web authentication

MICHAEL SCHROEDER — Wed, 03 Jun 2009 11:32:33 GMT

Does this also work for an HREAP? Regards, Michael

Re: AAA override Wireless Web authentication

raun.williams — Tue, 09 Jun 2009 17:08:10 GMT

I do find this inability frustrating for me personally. I don't want to change the vlan after the user authenticates to the web, but in my setup I'm authenticating off of ACS and would like to pass some additional ACL's (per user/group) and QoS attributes through to the user logging into the web authentication. However, it seems in 4.2.130 if you turn AAA Override, web authentication stop working all together. This would be very helpfull in traffic/bandwidth control considering the lack of ability to do it elsewhere. Currently it seems I have to adjust my QoS profiles on the controller to do this, which I find unexceptable. Can you tell me if this issue is resolved in later releases?

Re: AAA override Wireless Web authentication

dancampb — Wed, 10 Jun 2009 12:23:20 GMT

If you are authenticating the webaut users to Radius you can pass down ACL's and QoS policies. You just can't do dynamic VLAN assignments since the user would already be sitting on the VLAN by the time the authentication takes place.

Re: AAA override Wireless Web authentication

raun.williams — Wed, 10 Jun 2009 12:32:14 GMT

How do I do this? As far as I know, the only way it'll pass the attributes down via AAA is if I turn AAA override on. However if I turn AAA Override on, WebAuth seems to stop responding for users connecting to the guest wifi and then takes awhile to recover once I turn AAA override off?

Re: AAA override Wireless Web authentication

Marucho Mendez — Wed, 01 Dec 2010 18:21:34 GMT

This still been the same with the AIR-WLC4404-100-K9 and the IOS 7.0.98.0? I am trying to get dynamic vlan assigment to work but with webauthentication but I am only able to override the QoS values.

Regards,

Marucho Mendez

Re: AAA override Wireless Web authentication

Serge Yasmine — Thu, 02 Dec 2010 00:04:31 GMT

Marucho, the particularity of how Web authentication works on the WLC is that it is carried over HTTP between Client and WLC. So the Wireless Client has to already have an IP address prior to starting the web authentication. Since the Wireless Client already has an IP address then you cannot override it anymore.

Unlike dot1x, which takes place over EAPOL and then when you have eap success, client moves to get an ip address from the sent by Radius VLAN.

On webauth, dynamic vlan assignment will not work, but yeah, will work for QoS and ACLs.

Re: AAA override Wireless Web authentication

Marucho Mendez — Fri, 03 Dec 2010 20:11:18 GMT

Thanks pal. I am having another issue, I have configured two LDAP servers entries for two SSIDs to get webauth working for students and employs, but since i while just one is working for BOTH SSID... I dont know how but even if i remove the ldap server from aaa options under the wlan settings i get working that empty ldap options SSID with the LDAP that works.

Do you have any idea why is happening this?

Regards,

Marucho Mendez