topic Re: vWLC - webauth (DNS resolve) in Wireless

vWLC - webauth (DNS resolve)

Trbo90 — Tue, 29 Aug 2023 18:54:26 GMT

Hi all,

I have some questions about LWA, I configured everything and I get login page and can login and everything works fine. The problem is that I don't want to use 192.0.2.1 address for guest portal, when I set Virtual IPv4 Address to guest-wifi.com, clients can't reach it, because they can't resolve it. As we use public DNS servers it is not possible to create record there. Is there any way to make it work, maybe some type of mapping of guest-wifi.com to 192.0.2.1 on WLC itself?

Re: vWLC - webauth (DNS resolve)

balaji.bandi — Tue, 29 Aug 2023 19:04:20 GMT

it should be resolvable - either you need to use local DNS or make sure it resolved by Public DNS like google.

not sure what WLC - check how the process works :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html

Re: vWLC - webauth (DNS resolve)

Trbo90 — Tue, 29 Aug 2023 19:17:33 GMT

Hi @balaji.bandi

We are using C9800-CL, we don't have local DNS and it is quite difficult for us to install and implement one to be used only for this. How can I make address like 192.0.2.1 to be resolved by Google?

We are using LWA, where guest username and password are generated on WLC and used for guest access.

Re: vWLC - webauth (DNS resolve)

Trbo90 — Tue, 29 Aug 2023 19:29:39 GMT

Ok, it seems that is not possible - https://community.cisco.com/t5/wireless/webauth-redirect-dns-host-not-resolving/m-p/2050184

If anyone has any idea, feel free to share it.

Re: vWLC - webauth (DNS resolve)

Rich R — Wed, 30 Aug 2023 13:33:05 GMT

You can't register 192.0.2.1 in public DNS.
If you don't want to set up your own local DNS then your only option is to get a registered public IP (which you own and is not routed anywhere else) and configure public DNS with that IP.
Although the guides say you should use a private, non-routable IP - it's actually also fine to use a public IP as long as you own it and control the routing for it. Then the public DNS points to that IP for the clients.
Remember your cert needs to match the registered DNS name for clients to trust the cert.

Re: vWLC - webauth (DNS resolve)

balaji.bandi — Wed, 30 Aug 2023 13:49:41 GMT

Public IP is the key here - that can point to that domain, then you can point to Local Webserver Piblic to Local IP NAT.