DOT1X WEBAUTH REDIRECT

[askalot]

Hello,

I understand that following configurations are required on a cisco switch to facilitate redirection for webauth:

ip http server

ip http secure-server.

Is the ip http secure-server configuration absolutely necessary? I'm asking because we've enabled it as a result of which we've been bombarded with vulnerabilities owing to https certificates on the ios devices. I'm hoping that we can do without enabling https on the switches so that I shut it off and resolve the flagged issues.

[Rob Ingram]

@askalot no it's not recommended to redirect using https - so configure "no ip http secure-server" to disable.

[Rodrigo Diaz]

@askalot 

For this specific scenario, you might review the redirection flow that you want to implement , the  "ip http server " command in catalyst platforms is required for http traffic exclusively and the " ip http secure-server" for https , in any case if you have problems using https within ios , I would attempt/redesign  a flow to use only http for now while reviewing the vulnerabilities you mention. 

[thomas]

Please see our ISE Secure Wired Access Prescriptive Deployment Guide > Web Authentication/URL Redirection and ACLs which has examples and explanations.