WebAuthentication in 12.2(35) on 3750

[dominic.caron]

Hi,

Him trying to test this feature and I'm having a hard time.

Him geting log like this with result code 1 0 and -1. What are those result code.

Dec 12 11:49:25: ip_admission_det:Validate IP=10.10.2.12 with static rule rule1 on FastEthernet1/0/2. Result

=1

Second, I cant get the web authentication to work and I did everything by the book. I think there s something missing in the DOC

If anyone have a working example for the switch config, that would be great!

[vjokhoo]

DO you by chance have a msn contact?

Mine is coolie_number_1@hotmail.com

[andrew.butterworth]

I have been reading this thread with interest as I am looking into what options one of my customers has for Role Based authentication. We are looking at 802.1x with WEB Authentication fallback for clients without 802.1x supplicants. I have sucessfully deployed 802.1x previously so I don't have any issues getting this part working, however I have never used WEB Authentication. After reading through this post and some playing around I now have this working with IAS as my Radius Server.

I would like to take this a step further now and introduce dynamic VLANs, however I don't know if this will work with WEB Authentication. It works fine for 802.1x and switches the VLAN when it receives the correct Radius Attributes (Radius Attributes 'Tunnel-Medium-Type', 'Tunnel-Type' & 'Tunnel-Pvt-Group-ID'). However with WEB Authentication the switch isn't doing anything with the Radius Attributes it receives other than dynamically updating the ACL.

Is this actually possible with WEB Authentication? If it isn't, is it possible without any 3rd party products such as Bradford Campus Manager or Cisco's NAC?

Thanks

Andy

[jafrazie]

This is possible. Look at defining Web-Authentication for the 3750 per this thread, and look a the NAC guest server to provide a solution for this. Define your switches as AAA clients for the NGS. Here's some guidance:

Release Notes for Cisco NAC Guest Server, Release 1.1.0

http://www.cisco.com/en/US/docs/security/nac/guestserver/release_notes/11/gsrn110.html

Cisco NAC Guest Server Installation and Configuration Guide, Release 1.1.0

http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/11/nacguestserver.html

However, VLAN-Assignment is not possible as an authorization technique for Web-Authentication today though.

Let me know if this helps,

[andrew.butterworth]

Hi & thanks for the reply. I had pretty much come to the same conclusion. What isn't in the budget for the customer is Cisco NAC so I was hoping we could achieve this without any additional hardware or software.

It is possible VLAN assignment will be an authorisation technique for WEB-Authentication in the future?

Andy