Web Authentication Behavior and Timeouts

Andy Ruiz Inami — Fri, 29 Oct 2021 23:24:09 GMT

Greetings!

I have some doubts about the behavior of a scenario with Web Authentication and Timeouts configured. In this company there is an SSID with Web Authentication and it has the following timers configured:

Session Timeout.................................. 28800 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
Sleep Client Auto Auth Feature................... Enabled

Web Authentication Timeout.................... 300

PMF........................................... Disabled

PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60

802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40

11ax Target Wake Time............................ Enabled

1. Is it normal behavior for a user to disconnect from the SSID and after a few minutes reconnect and be asked for credentials?

2. If the above is expected, however, I have noticed that I can disconnect from that SSID and when I reconnect it has not asked me for credentials, how long do I have to wait for that to happen?

3. I also noticed the session timeout is independent of whether the user is currently using the network or not? that is, I'm working using the Internet but after 8 hours it logs me out of the session and I have to enter my credentials again. I assume I have to increase the session timeout.

4. What are the best practices for configuring wlan timers? Are there other timers, apart from what I mentioned above, in play?

Thanks

Re: Web Authentication Behavior and Timeouts

Arshad Safrulla — Sat, 30 Oct 2021 05:03:59 GMT

1. No.

2. You have idle timeout and sleeping client disabled. So only until session timeout.

3 & 4. You can set the session timeout as per your business requirements. There is no industry standard. You also need to understand how these timers work.

Session Timeout - This will make sure that the Wireless client is deauthenticated after the set timer even it is actively transmitting and receiving data.

Idle Timeout - This is there to make sure that the wireless client is deauthenitcated after client is idle for certain time, where the time is defined in the WLC.

Web Authentication Timeout - If the user has not completed the web auth he will be prompted a new login page after the defined timer.

Sleeping client - Once the user complete the web auth how long controller has to remember the client. Sleeping client doesnt work for CWA.

topic Web Authentication Behavior and Timeouts in Wireless

Web Authentication Behavior and Timeouts

Re: Web Authentication Behavior and Timeouts