Web authentication on the wireless network can be done with the help of Cisco ISE server. 2 types of web authentification: Local –   LWA   (Local Web Authentication) –   two certificates required: onefor WLC and one for ISE Central –   CWA   (Central Web Authentication) –   only one certificate required (for ISE) First type (LWA) – the WLC redirects HTTP traffic to an internal or external server, where the user is offered the option of entering the credentials. WLC then downloads these credentials (sent via the HTTP GET request, in the case of an external server) and tries RADIUS authentication. In the case of a guest user, an external server is required (eg ISE or NAC Guest Server (NGS)) because the portal provides options such as device registration and self-provisioning. The LWA process follows the following steps: The user is associated with an SSID that uses web authentication The user opens his browser WLC redirects it to the guest portal (eg ISE or NGS) as soon as a user enters a URL The user is authenticated on the portal The guest portal redirects the user back to the WLC-enabled credentials WLC authenticates a guest user via RADIUS WLC redirects back to the original URL. This process involves many redirects. LWA also requires 2 certificates; one on the WLC, and the other on the ISE. The new approach, which simplifies the authentication process, is with the help of central web authentication – CWA (running from ISE version 1.1 and WLC version 7.2 … so long ago). In this case, only one certificate is required – on the Cisco ISE … because the controller only passes the authentication request. The CWA process follows the following steps: The user is associated with an SSID that uses web authentication The user opens his browser WLC redirects it to the guest portal The user is authenticated on the portal ISE sends the RADIUS CoA message (Change of Authorization – UDP Port 1700) to emphasize to the WLC that the user has entered credentials correctly and possibly sends RADIUS attributes such as Access Control List (ACL) The user is reminded that it is necessary to re-enter the desired URL. https://timnetworks.rs/wpe/2019/07/01/lwa-and-cwa-for-cisco-wlc-and-mobility-express/ ... View more

See the answer above. I just attached a screenshot. ... View more

I want to know for sure. Is the inactive time when it is in sleep mode or when the computer is shut down? ... View more

I've already done it. But the results are the same. ... View more

You're right. I finished all the Windows processes with VPN connected and monitored without doing anything. No solution? ... View more

Im experiencing the same issue. I configured to vpn-idle-timeout 300. 300 is 5 hours. However, if I wake up after a few seconds after connecting to the VPN, it will be disconnected immediately. ... View more

group-policy DfltGrpPolicy attributes  vpn-idle-timeout 1 group-policy GroupPolicy_VPN_IMSI internal group-policy GroupPolicy_VPN_IMSI attributes  wins-server none  vpn-idle-timeout 1  vpn-tunnel-protocol ssl-client  split-tunnel-policy tunnelspecified  split-tunnel-network-list value VPN_IMSI_Tunnel  webvpn   anyconnect profiles value VPN_IMSI type user   After setting the monitor for 5 minutes, the VPN cannot be disconnected. ... View more

session-timeout : disconnects even when a tunnel is in use. I'm right ?? I want to disconnect the VPN when not in use. ... View more

I added a config and tried the test several times. But VPN don't disconnect. VPN-ASA-IMSI# sh run group-policy group-policy GroupPolicy_VPN_IMSI internal group-policy GroupPolicy_VPN_IMSI attributes wins-server none vpn-idle-timeout 1 vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value VPN_IMSI_Tunnel webvpn anyconnect profiles value VPN_IMSI type user ... View more

I added a config and tried the test several times. But VPN don't disconnect. VPN-ASA-IMSI# sh run group-policy group-policy GroupPolicy_VPN_IMSI internal group-policy GroupPolicy_VPN_IMSI attributes wins-server none vpn-idle-timeout 1 vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelspecified split-tunnel-network-list value VPN_IMSI_Tunnel webvpn anyconnect profiles value VPN_IMSI type user ... View more