topic Re: Whitelist a single client to bypass local web authentication (9800 in Wireless

Whitelist a single client to bypass local web authentication (9800)

nickydd9 — Tue, 29 Oct 2024 18:37:06 GMT

I am running a Catalyst 9800 WLC on 17.12.3 and have an SSID currently setup and working for local web authentication. When users attempt to connect, they are presented with the web auth portal and must enter the username and password of the guest account we have created for them to connect.

I have a potential requirement of adding a non-standard device to this SSID wirelessly which is a printer. The printer won't be able to access the web auth portal GUI to enter any credentials, so I was wondering if there is a method to whitelist one specific client to bypass the local web authentication and connect to the SSID. Perhaps a MAC address bypass?

My other solution would be to have a separate SSID for this with MAC filtering enabled that maps to the same VLAN as the existing SSID, but I'd rather not broadcast a new SSID if I don't have to.

Re: Whitelist a single client to bypass local web authentication (9800

balaji.bandi — Tue, 29 Oct 2024 18:40:04 GMT

If you using ISE or Radius, you can use MAB for this kind of requirement, yes you can also consider other SSID if you like for the different IP address VLAN to segment the Printers.

example :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html

Re: Whitelist a single client to bypass local web authentication (9800

nickydd9 — Tue, 29 Oct 2024 18:45:08 GMT

I am not using ISE, so is a second SSID with MAC filtering my only option?

Re: Whitelist a single client to bypass local web authentication (9800

Flavio Miranda — Tue, 29 Oct 2024 19:03:20 GMT

@nickydd9

For external guest portal you need Access List in order to redirect, This could be possible by adding one line on the ACL for the printer. This way the redirect wouldn´t happen.

Now, internal web portal, I dont believe is possible. I believe the second alternative is the one to follow.

Re: Whitelist a single client to bypass local web authentication (9800

Haydn Andrews — Wed, 30 Oct 2024 02:38:15 GMT

Given Local WebAuth your best option would be seperate SSID for the printer

Re: Whitelist a single client to bypass local web authentication (9800

balaji.bandi — Wed, 30 Oct 2024 08:09:17 GMT

Different SSID - May be explore option MAC filtering :

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_mab_auth_bypass.html

Re: Whitelist a single client to bypass local web authentication (9800

srimal99 — Wed, 30 Oct 2024 08:31:17 GMT

As @Flavio Miranda mention you can create a access-list and separate SSID with mac filtering for printer.

*** Please rate helpful posts ***