Cisco WLC / Guest WIFI Question

[ogelnisan]

I am currently configuring my WLC for Lobby Ambassador operation.

I have the feature working fine.

I currently do not have any Layer 2 security enabled however and would like to enable it, but it does not seem I can do 802.1x using the credentials setup by the Lobby Admin. A PSK is out of the question and I only want the users to deal with 1 login.

Is there an easy way of enabling layer 2 security that I'm missing?

[MHM Cisco World]

L2 security for guest ? can I ask why you need it ?

[Flavio Miranda]

Hi

 It is possible but it depends. Depends on which devices you have and which method you use. You can check all the options here

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKEWN-2014.pdf 

But, Layer 2 security for guest was and still is something complicate to implement. 

[JPavonM]

The only think I can think of to deal with your concerns is to use Cisco ISE and iPSK, otherwise, using 802.1X for guests would only add more and more administrative effords to your setup as you would need to create individual accounts for any visitor.

[Arshad Safrulla]

Solution I see as below;

1. Go for CWA (Cisco ISE required) or similar solution by any other vendor. This way all the enterprise users will use their credentials from the identity source (LDAP, Active directory etc.) and you can create local accounts in the radius server for guest users only by leveraging lobby ambassador option.

2. Go for EWA, Web auth will be performed locally in the WLC but radius server is required to gain visibility in to user identity. 

3. Use IPSK as suggested by @JPavonM 

4. Use dedicated Captive portal solutions where user authenticates by providing OTP over email or mobile phone or exposes social media presence. 

[Rich R]

Like the others said - why?

But if you think your guest WiFi should be encrypted (is that what you mean by L2 security?) then in addition to the options mentioned above WPA3 does have a solution to this problem for open SSIDs - Opportunistic Wireless Encryption (OWE)

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/16-12/config-guide/b_wl_16_12_cg/wpa3.html#id_107934

You've not stated what WLC, software version, AP models you're using or what your clients are - but if your network and clients could support WPA3 then that is a simple way to get your open SSID encrypted.  Be aware that a significant number of clients still don't support WPA3 and some with faulty drivers will not see the SSID at all even if WPA3 transition mode is enabled.