ip http secure-active-session-modules & ip http active-session-module

[andrew.butterworth]

I'm asking this here, but its relevant for all IOS/IOS-XE platforms I think.

I have a C9800 WLC with both the http server and the http secure-server enabled.  The reason for this is the admin GUI is used to configure and monitor the thing, and web authentication is enabled for guest users with a generic splash page.  I want to access the admin GUI using HTTPS and the WEB auth splash page using HTTP as I don't have a public certificate.

I thought the commands "ip http secure-active-session-modules" & "ip http active-session-module" would be what I want but it appears not.  I configured this:

ip http secure-active-session-modules all
ip http active-session-modules none

But it stops the admin GUI working and I need to enable the modules for the 'ip http active-session-modules all'.  If I don't have that the admin GUI won't display.

It feels like I was in the right area, but either its a bug or I'm misunderstanding how its supposed to work.

[Mark Elsen]

   - @andrew.butterworth                  You can't have :   ip http active-session-modules none
                                                         It's a bit like a ladder;  secure access depends on lower http modules (too)

 M.

[aleabrahao]

Look, if I'm not mistaken, if you simply check the "Disable HTTP secure server for Web Auth" option, you'll be able to do what you want.

[Rich R]

@andrew.butterworth "and the WEB auth splash page using HTTP as I don't have a public certificate."
- at your own risk - you realise you're going against pretty much every security guideline out there right?
The default web auth design is to intercept the http captive portal check from the client and redirect to the https captive portal page (splash page).

Can't say I've ever tried it myself but I think what @aleabrahao suggested would be the correct answer.
In general you should not be fiddling with the web server modules - I've only ever seen that used to mitigate a vulnerability in a specific module.

Did you know you can get free certs from https://letsencrypt.org/ ?

[andrew.butterworth]

I appreciate its going against security best practises, but the splash screen is just an acceptable use policy with a button.  There are no real credentials sent.

It does appear checking that box solves the issue (it adds 'secure-webauth-disable' to the global webauth parameter-map).  Attempting to access the admin GUI using http automatically gets redirected to https, so it seems to work.  I'm not sure about any specifically crafted requests over http tcp/80 though as it accepts connections on the management interface on tcp/80.

[Rich R]

Fair enough <smile>

If you want to, you can disable http for the admin GUI using "no ip http server" but make sure you have "webauth-http-enable" configured in your parameter map for http web-auth.

See page 78 (labelled 104) of https://www.ciscolive.com/c/dam/r/ciscolive/global-event/docs/2025/pdf/BRKEWN-2339.pdf and the HTTP and HTTPS access modes for web authentication section of https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-18/config-guide/b_wl_17_18_cg/m_vewlc_sec_webauth_cg.html 

[andrew.butterworth]

Ah, I'm sure I'd tried this previously and without 'ip http server' in the configuration, the webauth splashpage never appeared.  Its working now though, so not sure what happened there...

[aleabrahao]

@Rich R @andrew.butterworth That's exactly right, you don't need to have HTTP enabled in the management settings for Web Auth to work via HTTP.