Can you set an exception to the acceptable use policy on 5508 wireless controller?

[buchanan-g]

On our public wi-fi network we have an acceptable use policy page that users must accept in order to access the internet.  However I would like to exclude a few devices from having to do this.  We have a couple of Kindle devices from a vendor that they configured to automatically connect to the internet for updates twice a day.  But they cannot accept the policy so they are blocked.  Any ideas?

[George Stefanick]

Hi Gary,

Welcome to CSC!

You can add an Pre-Authentication ACL to specific sites a device can access prior to hitting the accept button. But to white list devices and allow them to bypass the AUP, no. If you add ISE or some other 3rd party system you can get fancy but on the WLC its pretty dry. There could be something in later code, but my expereince is in 7.0 ..

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[buchanan-g]

Thanks.  I will try that.  Also we just put ISE in limited functionality. I will look into using it also.

[David Watkins]

I think you're going to be limited either way.  Since you are going with ISE, I would depend on using that as a solution for this, however you will not be able to present just an AUP page as of ISE 1.1.3.  You would have the guest users authenticating, while the other devices are placed in an Endpoint Identity group or manual Whitelist.

The same issue happens on the WLC.  You can configure the L3 portion of your WLAN to only do webauth "On Mac Filter failure", where if the client is found in the local mac entries or radius, then they do not have to perform the L3 authentication/splash-page.  Unfortunately, when you enable this feature, users that do not "bypass" must login to the guest portal; an AUP will not be presented.

The pre-authentication ACL is a workaround, however the client will only remain in the WEBAUTH_REQD state for up to 5 minutes before being deauthenticated and be forced to re-connect, and re-establish any previously existing connections.