Guest SSID Showing Security None on Client Devices

[rahulnaik]

Hi Community,

I have configured Local Web Authentication on our Cisco 9800 WLC for the Guest SSID. However, when users connect to the Guest SSID, the client device is displaying the security type as “None”.

Please find the attached snapshot for your reference. Could you kindly confirm if this behavior is expected with Local Web Authentication, or provide any reference documentation to validate the same?

Looking forward to your guidance.

[Mark Elsen]

  - @rahulnaik   That is being reported with bare  'Local Web Authentication'  with no other security protocols being involved  ; to have added security options take a look at : 
                      https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-6/config-guide/b_wl_17_6_cg/m_pol_guest_foreign_vewlc.html#config-guest-acc-sec-method

  M.

[ammahend · Accepted solution]

Webauth is for authentication,it itself does not inherently encrypt wireless traffic, what you are seeing is expected behavior. If the infrastructure supports then explore using OWE.

[Rich R]

When you say Guest SSID I presume you mean Open SSID @rahulnaik ?

That means no encryption - by definition, by design.  The wireless traffic is sent in the clear - user traffic should be secured with https and/or VPN.

As @ammahend says WPA3 addresses this with OWE for "open" SSIDs.  It's not as secure as full WPA3 but once the connection is negotiated all the wireless traffic is encrypted.  In fact OWE is mandatory for open SSIDs in WiFi 6E (on 6GHz) and WiFi 7.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/wpa3-dg.html#OWE