vWLC - webauth (DNS resolve)

[Trbo90]

Hi all,

I have some questions about LWA, I configured everything and I get login page and can login and everything works fine. The problem is that I don't want to use 192.0.2.1 address for guest portal, when I set Virtual IPv4 Address to guest-wifi.com, clients can't reach it, because they can't resolve it. As we use public DNS servers it is not possible to create record there. Is there any way to make it work, maybe some type of mapping of guest-wifi.com to 192.0.2.1 on WLC itself?

[balaji.bandi]

it should be resolvable - either you need to use local DNS or make sure it resolved by Public DNS like google.

not sure what WLC - check how the process works :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html

[Trbo90]

Hi @balaji.bandi 

We are using C9800-CL, we don't have local DNS and it is quite difficult for us to install and implement one to be used only for this. How can I make address like 192.0.2.1 to be resolved by Google?

We are using LWA, where guest username and password are generated on WLC and used for guest access.

[balaji.bandi]

Public IP is the key here - that can point to that domain, then you can point to Local Webserver Piblic to Local IP NAT.

[Trbo90]

Ok, it seems that is not possible - https://community.cisco.com/t5/wireless/webauth-redirect-dns-host-not-resolving/m-p/2050184

If anyone has any idea, feel free to share it.

[Rich R]

You can't register 192.0.2.1 in public DNS.
If you don't want to set up your own local DNS then your only option is to get a registered public IP (which you own and is not routed anywhere else) and configure public DNS with that IP.
Although the guides say you should use a private, non-routable IP - it's actually also fine to use a public IP as long as you own it and control the routing for it.  Then the public DNS points to that IP for the clients.
Remember your cert needs to match the registered DNS name for clients to trust the cert.