topic Re: Guest User Authentication in Wireless

Guest User Authentication

mark-wise — Tue, 21 Jan 2025 20:22:10 GMT

Has anyone used a 9800-40 as a "Radius Server" to authenticate guest users on the wireless guest SSID? We have a situation where we need to migrate off of Prime. We currently use Prime to create and manage all guest users by our help desk and local IT for all our regional locations. The Anchor controller resides in the DMZ and Security has forbidden the Help Desk and the local IT to have access to the Anchor. As the Foreign controller is permitted such access, I was thinking we could leverage it as the Radius server from the Anchor. We have done some initial configurations and testing. The Web-Auth pages present and accept the UN/PW but fail to complete the authentication. Any thoughts/suggestions would be greatly appreciated.

Re: Guest User Authentication

MHM Cisco World — Tue, 21 Jan 2025 20:30:07 GMT

Check if CoA port 1700 is open from both side

MHM

Re: Guest User Authentication

Mark Elsen — Tue, 21 Jan 2025 20:33:44 GMT

- You can't use 9800 controller(s) as (native) radius servers,

Re: Guest User Authentication

mark-wise — Tue, 21 Jan 2025 20:37:05 GMT

Currently, all ports are permitted between Anchor and Foreign controllers.

Re: Guest User Authentication

Flavio Miranda — Tue, 21 Jan 2025 20:57:54 GMT

@mark-wise

Cisco WLC works for local EAP only. It will not work as radius for remote guest users.

Re: Guest User Authentication

Rich R — Wed, 22 Jan 2025 23:59:44 GMT

As Marce and Flavio have pointed out you can only use it for local EAP, not as a radius server. For local EAP see:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215026-local-eap-authentication-on-catalyst-980.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/config-guide/b_wl_17_12_cg/local-extensible-auth-protocol.html

Re: Guest User Authentication

MHM Cisco World — Thu, 23 Jan 2025 12:22:26 GMT

https://www.netprojnetworks.com/ccie-enterprise-wireless-v1-0-4-4-guest-management-4-4-b-central-web-authentication/

I dont know why they say you can not' if I have anchor sure I can use CWA.

Check the link.

Only make sure the port is open and do config as list in link

Thanks

MHM

Re: Guest User Authentication

Rich R — Thu, 23 Jan 2025 12:30:49 GMT

He's not asking about using CWA, he's asking about using 9800 as radius server @MHM Cisco World .
The example you linked is using ISE for radius, not 9800.

Re: Guest User Authentication

MHM Cisco World — Thu, 23 Jan 2025 12:33:26 GMT

He mention guest but dont mention if he use CWA or LWA

MHM