WPA2 and Captive Portal for Guest Network

[drudich]

We have an Aironet 2802i.  Is it possible to configure a combination of WPA2 and Captive Portal for a guest network?

It does not look like it can be setup this way in the GUI, but I didn't know if it's possible to accomplish this in the CLI?  Ideally, we want people to enter a pre-shared key to connect to the network and then they would be taken to a Captive Portal and/or forced to go to a web site once connected to put in their info.

Thanks in advance!

[Sandeep Choudhary]

is there any specif reason to use WPA with webauth ??

There isn't any issue doing that, but if you are going to do this for guest access then you should probably keep it open and use webauth to allow guest access. You don't want to be responsible to setup non-employee devices and you don't want to take on the responsibility of something going wrong with their equipment. Now if you want to use it for internal use, then I guess it is okay, but it defeats the purpose of single sign on.

Normally most of us use only webauth or wpa2 with PSK!!

as far as your question is concern: it must work with WPA/WPA2 with Layer 3 webauth.

chekc the combtibility matrix:

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/106082-wlc-compatibility-matrix.html

Regards

Dont forget to rate helpful posts

[drudich]

Thanks for the reply.  We want to be able to utilize WPA2 for our guest network, so that it's encrypted but also require guests to enter in something unique (their email address, name, etc.) so that we know who is connecting.  I understand that the guest user could just enter something fictitious, but it's just another measure.

I should have mentioned that we are using Mobility Express, not a controller.  Is this possible to accomplish with Mobility Express?

[Sandeep Choudhary]

I think yes..but only with CLI as GUI has very limited feature.

*** I dont see any document about it on cisoc web.

Regards

Dont forget to arte helpful posts

[drudich]

What is the command to do it without Mobility Express?  That might help me figure out how to do it in this version.

[Sandeep Choudhary · Accepted solution]

its not a single command..

you need to configure the AP via CLI.

1. Create a dynamic interface

2. create a wlan, assign security (Layer 2 and Layer 3 security)

2. Assign the dynamic interface to wlan.

you may try this:

change interface name/wlan name and IP address accordingly. 

config interface create test 192
config interface address dynamic-interface test 192.168.178.5 255.255.255.0 192.168.178.1
config interface dhcp dynamic-interface test primary 192.168.178.1
config interface port 1

config wlan create 8 TEST TEST
config wlan security wpa wpa2 ciphers aes enable 8
config wlan security wpa akm 802.1x disable
config wlan security wpa akm psk enable 8
config wlan security wpa akm psk set-key ascii cisco123 8
config wlan security web-auth enable 8
config wlan security web-passthrough email-input enable 8
config wlan interface 8 test
config wlan enable 8

Regards

Dont forget to arte ehlpful posts