Showing results for 
Search instead for 
Did you mean: 

Cisco WLC / Guest WIFI Question


I am currently configuring my WLC for Lobby Ambassador operation.

I have the feature working fine.

I currently do not have any Layer 2 security enabled however and would like to enable it, but it does not seem I can do 802.1x using the credentials setup by the Lobby Admin. A PSK is out of the question and I only want the users to deal with 1 login.

Is there an easy way of enabling layer 2 security that I'm missing?

5 Replies 5

L2 security for guest ? can I ask why you need it ?


 It is possible but it depends. Depends on which devices you have and which method you use. You can check all the options here 


But, Layer 2 security for guest was and still is something complicate to implement. 


The only think I can think of to deal with your concerns is to use Cisco ISE and iPSK, otherwise, using 802.1X for guests would only add more and more administrative effords to your setup as you would need to create individual accounts for any visitor.

Solution I see as below;

1. Go for CWA (Cisco ISE required) or similar solution by any other vendor. This way all the enterprise users will use their credentials from the identity source (LDAP, Active directory etc.) and you can create local accounts in the radius server for guest users only by leveraging lobby ambassador option.

2. Go for EWA, Web auth will be performed locally in the WLC but radius server is required to gain visibility in to user identity. 

3. Use IPSK as suggested by @JPavonM 

4. Use dedicated Captive portal solutions where user authenticates by providing OTP over email or mobile phone or exposes social media presence. 

Rich R

Like the others said - why?

But if you think your guest WiFi should be encrypted (is that what you mean by L2 security?) then in addition to the options mentioned above WPA3 does have a solution to this problem for open SSIDs - Opportunistic Wireless Encryption (OWE)

You've not stated what WLC, software version, AP models you're using or what your clients are - but if your network and clients could support WPA3 then that is a simple way to get your open SSID encrypted.  Be aware that a significant number of clients still don't support WPA3 and some with faulty drivers will not see the SSID at all even if WPA3 transition mode is enabled.

TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's   and   Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
     after 4 Dec 2022 Due to Certificate Expiration - Fixed in and latest 9800 IOS-XE releases
     also fixed in (8.5 mainline) and (8.5 IRCM) if you can't upgrade to 8.10
     TAC confirmed that Mobility Express AP TFTP download is not affected so ME still works but see FN-74035 below
Field Notice: FN-70479 Out-Of-The-Box AP Fails to Join WLC or Joins with Single Radio due to Country Mismatch - RMA required
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN-74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
     fixed in and see the field notice for 8.5, Mobility Express and other fixed releases
Check your WLC config with Wireless Config Analyzer using "show tech wireless" output (9800) or "config paging disable" then "show run-config" output (AireOS) and use Wireless Debug Analyzer to analyze your WLC client debugs
Leo Laohoo's list of bugs affecting 2800/3800/4800/1560 APs
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: