Change Webauth Consent page to HTTP

shawn.pattison · ‎08-30-2023

We have two Cisco Catalyst 9800-L-F WLC's in HA config.

We setup a Guest wireless SSID with a custom WebConsent page.

Currently when a use accesses the SSID it takes them to a "Your connection is not private" HTTPS page.

We don't need HTTPS on our Guest SSID. Can this be changed to HTTP instead?

marce1000 · ‎08-30-2023

- Try : 9800#configure terminal
9800(config)#parameter-map type webauth global
....
9800(config-params-parameter-map)#secure-webauth-disable
9800(config-params-parameter-map)#webauth-http-enable

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

shawn.pattison · ‎08-31-2023

Thanks! We will give this a try.

balaji.bandi · ‎08-31-2023

Personally i would not advise to use http for guest network - this will bring security Risk.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

shawn.pattison · ‎08-31-2023

Thank you but our current WLC is configured with HTTP for the Guest SSID Consent page.

Rich R · ‎08-31-2023

If you're going to use http that makes it completely insecure (anybody can sniff the unencrypted packets over the air) so what's the point of even using web-auth in that case?

Just have an open SSID that anybody can join and use without any web-auth.
If you're going to use web-auth then you should be doing it securely.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

shawn.pattison · ‎09-05-2023

This is how one of our VP's wants it setup, with a splash page, a disclaimer and a consent button. This is how it was setup by previous network admins, this is the way they want it setup on the new controller. I don't make the decisions; I just make them happen.