Change Webauth Consent page to HTTP

[shawn.pattison]

 We have two Cisco Catalyst 9800-L-F WLC's in HA config.

We setup a Guest wireless SSID with a custom WebConsent page.

Currently when a use accesses the SSID it takes them to a "Your connection is not private" HTTPS page.

We don't need HTTPS on our Guest SSID.  Can this be changed to HTTP instead?  

[marce1000]

 - Try :  9800#configure terminal
            9800(config)#parameter-map type webauth global
             ....
            9800(config-params-parameter-map)#secure-webauth-disable
            9800(config-params-parameter-map)#webauth-http-enable

 M.

[shawn.pattison]

Thanks!  We will give this a try.

[balaji.bandi]

Personally i would not advise to use http for guest network - this will bring security Risk.

[shawn.pattison]

Thank you but our current WLC is configured with HTTP for the Guest SSID Consent page.

[Rich R]

If you're going to use http that makes it completely insecure (anybody can sniff the unencrypted packets over the air) so what's the point of even using web-auth in that case?

Just have an open SSID that anybody can join and use without any web-auth. 
If you're going to use web-auth then you should be doing it securely.

[shawn.pattison]

This is how one of our VP's wants it setup, with a splash page, a disclaimer and a consent button.  This is how it was setup by previous network admins, this is the way they want it setup on the new controller.  I don't make the decisions; I just make them happen.

[jspilde]

Reviving an old thread. If no user personal info is gathered, and the portal is only requiring consent to the terms of service to proceed, is an SSL cert really necessary technically? With the industry moving to 100 day certs in 2027 and 47 day certs in 2029, that's a lot of maintenance for local webauth configurations.

[Rich R]

> is an SSL cert really necessary technically?
Yes - otherwise the page simply will not display at all in most cases and that affects progressively more browsers and OS as time goes by and security gets stricter.  The main reason for reducing those expiry times (apart from the obvious security benefits) is to force people to use automated certificate updates.

So technically yes - so it's a policy decision ultimately. 
Do you want a dreadful user experience where most of the users cannot display the captive portal page or not?

[jspilde]

I understand a self signed cert would cause issues. I started using SSL 15+ years ago for webauth, but don't recall specifically why, no PII is involved in my case. I don't want to be updating SSL certs on multiple WLCs every 100 or 47 days. Do the WLCs support ACME? Why would an http portal page not display?

[Rich R]

TLS is used to secure the connection, not only to protect PII but also to ensure the connection is not tampered with eg MITM attack to inject malware.  It's about the client trusting that it's talking to who it thinks it's talking to.

AireOS will never support ACME (it's end of life).
I expect 9800 will in due course but not yet - I answered about this here:
https://community.cisco.com/t5/wireless/9800-wlcs-certificate-renewal-and-automation/m-p/4980217/highlight/true#M264436

An http portal page would display (because there is no certificate involved) but most browsers expect to use https now and will often redirect to https automatically (except for when doing captive portal detection).  Not sure what the current status of the captive portal assistants are in iOS and Android but the move is towards mandating https.

[jspilde]

Thanks Rich. I suppose it makes sense then that the cert shows that it is company XYZ vs. someone duplicating XYZ's SSID and downloading / spoofing XYZ's portal pages.

I'll ask my account team about the 9800 roadmap and ACME support as well as look into centralizing the portal vs. using local.

Regards