Cisco WLC 9800 and Central Web authentication

[Harutyun Hakobyan]

Hi All,

On Cisco WLC 9800 for Guest authentication external web portal authentication (non Cisco) is used. On web portal sponsor can approve for example 7 days for guest, however Guest wireless connection asks every day for authentication.

I increased "Sleeping Client Timeout" from default 720 minutes to 7 days, however that did not help. On policy config "Session Timeout" is default 86400 sec, which is max possible value and "Idle Timeout" is default 300 sec.

What other timing parameter can be changed, that during 7 days approved Guests can connect without new authentication?

Thanks

[marce1000 · Accepted solution]

  - I doubt it's even possible ; general settings are discussed here (indeed) : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#clienttimer

   + The question is  : does it make sense in security terms , especially for guests. I would consider each day a 'security minimum' to avoid irregular use , devices being passed on to 'unknowns' for malicious use , etc (?)

 M,.

[Rich R]

Agreed with @marce1000 - it's not possible to do with timers.
You would need to use a solution which supports MAC auth so that the client MAC is remembered and automatically authenticated on successive visits till expiry.
This is a standard feature offered by most WiFi portal services.

[MHM Cisco World]

I see your post I will update ypu tomorrow if you want to waiting 

Thanks 

MHM

[Harutyun Hakobyan]

Update: after increasing "Sleeping Client Timeout" more than 1 day, some users reported, that they had Guest connection in the next day without reauthentication.

[MHM Cisco World]

But you mention that you increase sleep timeout to 7 days 

Can you more elaborate 

Thanks 

MHM

[Harutyun Hakobyan]

Actually need some time for more Guest users results.