- [Instructor] Web authentication or WebAuth
is a layer 3 wireless security feature that allows
for the authentication of end users.
Specifically, we can use WebAuth in cases where host systems
do not have 802.1x supplicant software installed.
Remember that when using 802.1x authentication
each client requires a special supplicant software
in order to communicate with the authentication server.
That's not the case with WebAuth.
So this authentication method is a bit more flexible.
The most common place you've probably seen WebAuth deployed
is where simple guest network access is needed,
such as a public Wi-Fi hotspot.
So if you've ever connected to the Wi-Fi,
maybe in a coffee shop or a fast food restaurant
or a hotel, you've probably experienced this.
When a user connects to a guest SSID and initiates
an HTTP session, the WebAuth feature will recognize
the HTTP packets from the user and then return
an HTML login page where the user must accept
the terms of use and enter login credentials.
When login credentials are entered, WebAuth will send
the credentials to a triple-A server for authentication.
If the authentication credentials are correct,
a login successful HTML page will be returned to the host
and any access policies identified by the triple-A server
will be applied to the host's session.
Users may also be asked to read acceptable use policies
and to accept those terms before they can continue.
Until the host provides a valid username and password
and the acceptable use policy is accepted, no IP traffic
will be allowed from the host except for the VHCP
and DNS-related packets required to set up
the WebAuth session.
This entire process using a triple-A server
is known as Central Web Authentication.
This can also be performed in smaller deployments
where the user database is contained on the wireless
LAN controller itself rather than using an external
triple-A server.
When these are deployed locally on the wireless
LAN controller, this would be referred to
as Local Web Authentication.
It's also worth noting that WebAuth can be used
as an additional layer of security together
with EAP or PSK-based authentication.
This gives administrators an opportunity to present
an acceptable use policy or any other information
about the network to the end user before
they're granted access.
Here we can see a fairly common topology
where this would be used.
We have a lightweight wireless access point
connected to a wireless LAN controller.
The wireless LAN controller is connected
to an authentication server.
In the case of this example, that authentication server
is the Cisco Identity ServISEs Engine or Cisco ISE.
A user will connect to the SSID that is configured
for WebAuth and will then launch a web browser locally.
The wireless LAN controller will recognize the attempt
to initiate an HTTP session and it will redirect
to the user's browser to the guest portal
where they are prompted to authenticate
with a valid username and password.
The guest portal is contained on the triple-A server
in a Central WebAuth deployment such as this,
which again, in this particular example is the Cisco ISE.
Once this is verified, the Cisco ISE will send
a radius message back to the wireless LAN controller
to indicate that the user is in fact valid.
And it will then push specific attributes
back to the host as well.
Those attributes include access control lists
and any sort of user policies that will identify
how the host is able to interact with the network.
Finally, the wireless LAN controller will return
a successful login page to the end user, letting them know
that they are successfully connected to the network.
This also provides the opportunity to present
those acceptable use policies that we mentioned earlier
and to require the user to accept the terms
that are presented before they can use the network.
The benefits of a WebAuth deployment include the fact
that they do not require any special client software.
Remember that 802.1x authentication requires special
supplicant software to be installed on every single client
in order for them to authenticate with the network.
With WebAuth, any host with a browser
can successfully join the wireless network.
WebAuth also provides a very familiar user interface.
End users are familiar with the process of logging in
to websites through web-based login pages so this feels
similar to logging in to maybe their social media
or email accounts.
And finally, WebAuth is very customizable.
The page is presented for successful or unsuccessful login
or even expired sessions.
Those can be customized to provide the same look
and feel of their organizational website.
So that allows an administrator
to brand the portal somewhat.
A few limitations to mention would include the fact
that WebAuth is not transparent to the user.
That is users must first launch a web browser
and complete the authentication process in order
to obtain network access.
Also, WebAuth is considered to be a weaker
password-based form of authentication as opposed
to the stronger IEEE 802.1x authentication method.
And WebAuth has a lack of single sign-on.
This means that even though a user might be logged in
to their operating system, they still require
separate credentials in order to obtain
wireless network access.
Most 802.1x supplicants can be configured to use
previously-entered credentials instead of that.
So for example, if a corporate user logs in
with a Microsoft Active Directory account,
802.1x can be configured to recognize these credentials
and to use those for authentication
rather than requiring additional credentials.
So it's a bit easier for the users to manage.
So that's an overview of the theory behind WebAuth
or Web-Based Authentication.
In our next video, we're going to take a look
at how to configure and verify this wireless
security feature on a Cisco wireless LAN controller.