Cisco 9800-CL Certificate for Web Auth Guest WIFI

[CMH812009]

I need some guidance on how to get rid of the security warning for the Cisco 9800-CL guest wifi SSID I have created.  This guest SSID used Central Authentication (Web-Auth) with the Cisco 9800-CL controller guest login page. From the way I understand it from the documentation, I need to generate a CSR from the controller (which I have done and saved to a text file).

The part that I need guidance on is where to go to get this signed by a CA.  Can I use our organization's internal (Windows CA Server) or does it have to be signed by a public CA so guests coming in from any organization will see this guest wifi sign-on page a secure (assuming this is the case).

If I need to get it signed by a public CA, does anyone have any suggestions on a good public CA to use that is not too expensive?

Thanks!

[ammahend]

you are probably using local webauth (where guest page is hosted on 9800 itself) central webauth is when the guest page is hosted in central radius server. 

anyways, if using local webauth, you will need to get the CSR, get it signed by a public CA because guest endpoints dont trust your internal CA, use digicert, dogaddy etc. 

follow this documentation to install cert on 9800. 

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213917-generate-csr-for-third-party-certificate.html

[CMH812009]

Yes, local webauth is what I meant.  One challenge I have is that the way I understand it, I can't have a public CA sign a cert that includes a private IP address (the virtual IP address of the 9800-CL controller - 192.0.2.1).  Am I going to have to create a public A record for our domain (i.e. guest.domainname.com) and somehow link that to the 9800-cl?  Looking for guidance here so I can get this setup and tested.

[MHM Cisco World]

Web Authentication
Similar to web administration, layer 3 authentication can also be used on the 9800. This trustpoint links a certificate to a web portal that is shown to a user as it attempts to authenticate to a WLAN through a guest portal that is automatically presented to the user. Using a trustpoint for web authentication helps protect the user credentials between the WLC and the client that is connecting to.
By default, the WLC uses the self-signed certificate. Again, this causes a warning message to pop up for the client stating that the web page is not trusted.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/221047-understand-certificate-and-trustpoint-ty.html

So I think you can use web auth with self singed signature, the warning message appear to wifi client and he must accept it. 

I think it work but it not secure 

MHM

[Rich R]

@MHM Cisco World some browsers and OS will not even display the warning - they will simply not display the page at all.

The only way to get a 100% reliable working client experience, without warnings or page getting blocked, is with a public cert which matches the FQDN of the page resolved by DNS.

So @CMH812009 yes you will need to do that if you do not control the client devices.
If all your client devices are managed (eg corporate environment with mobile device management) then you could use internal CA and make sure all the devices trust your internal CA.  The virtual IP you use should not be reachable from the internet and Cisco recommend that it isn't a routable address at all (but it can be).  But for the cert the CA will often ask you to update your DNS records (to prove your ownership of the domain) so they can query the DNS but they will never be using the IP it resolves to, just checking the DNS records.

And yes the cert must be for a fully qualified domain name - not an IP address.

[MHM Cisco World]

Internal CA vs public CA

If he use internal CA (which I prefer) he need to add cert. Of CA to all client before they start accepting WLC signed by internal CA.

Meanwhile public CA the cert. Of CA is add auto with OS

So it depends' are client in one site and he can manage to add CA cert. Or not.

MHM

[ammahend]

you are right but 90% of the devices connecting to guest wifi are unmanaged devices, I am being generous saying 90%