- [Instructor] In this video, we're going to take a look
at how we can configure Web auth
on a Cisco wireless LAN controller.
This can be handled by the controller itself
in smaller network environments through local web auth
or LWA.
So first let's go under the main security tab at the top
and when we click that, near the very bottom
on the left side, we can see the web auth menu.
Clicking that is going to reveal a couple of sub options
under that.
We want to choose that first option, that web login page.
If we click that, we can see that we're brought to
the web login page menu and right up top,
we have the web authentication type.
If we look at that drop-down menu,
we have several options there.
We have the first option, which is the default,
for an internal method and then we have a customized
or downloaded method and external redirection
to an external server.
Since we are looking at local web auth, we can leave
the default setting in place, so we'll leave that
to internal.
We can also put in a URL if we want to do that
so that users will be directed to a specific web page
after logging in.
So just as a placeholder, I'll put in www.cisco.com
and beneath that we have the option to either show
or hide the Cisco logo and we can also customize
the web auth page with a message of our choosing.
I'll go head and do that now.
Just a real simple message.
You can see it's already populated in there
where I had it previously.
Then beneath that, you can put in a welcome message.
I'm just going to make a really short, generic message here.
I'm going to put "Please read and accept our usage policies
to continue."
By the way, you can find lots and lots of examples
of acceptable use policies with a quick online search.
There are tons and tons of templates out there.
You can tailor those for your own organization.
Don't toil too much over the wording here
unless there's something really specific you want
to mention.
There are lots and lots of great examples out there.
So now we can go over to the right
and we can hit the apply button.
We can move ahead.
Actually, before we even do that, we can also,
you see there's a preview button there too.
So if we hit preview, notice that it gives us a preview
of what that's going to look like to our users.
It has our headline and our message
that we've configured there.
Over on the right we see the Cisco logo.
Remember there's an option to show or hide that.
That's what this page is going to look like
for our end users.
If we go back here, that's all finished up, we've
already hit apply.
We can go under out WLANs tab now on the left
and here we can see all the networks that we have in place.
I have a corporate, a guest network, and I have one
also called, "WEBAUTH," and I'm going to choose that
WEBAUTH network and then I'm going to go under
the security tab.
Notice we come first to the layer 2 security window
and the option that is chosen here
that I've set up is none, and that means this
is really simple, open authentications.
Users are not going to be prompted for any type
of authentication at layer 2 when they try
to join the network.
Now since WEBAUTH is a layer 3 security feature,
we want to choose the layer 3 tab and take
a look under there.
And you can see we now have the option to choose our layer 3
security type and the only option available under there
is web policy.
So let's choose web policy and we're going to have a message
pop up, saying that DNS traffic is going to be allowed
to and from our clients, even before they're authenticated
unless we specifically block that
with an access control list.
Remember we discussed that in the previous web auth overview
video, we talked about that until a host provides a valid
username and password, no IP traffic is going to be allowed
from the host except for addressing related packets
that are required to set up the auth session.
So that's exactly what we're being prompted with here.
So we can click OK and we can accept that message.
Now we see below that, we have several radio buttons
that we can choose.
Since we're using local web auth, we can leave
the authentication radio button chosen there if we want to.
Choosing the passthrough option is going to display
an acceptable use policy that users will have to accept
before they have network access.
We also have an option for conditional web redirection
based on login success or failure
and an external splash page redirect.
Something that you might commonly see there
is once you're connected, you might be redirected
to a corporate homepage.
You see that fairly commonly with fast food restaurants
and hotel wifi.
So we can click apply and accept that.
Again, we get another message saying that our wireless LAN
is going to be momentarily disabled, so again a warning.
You don't want to do this during production hours.
You want to make sure that there are no users connected,
doing critical tasks when you do that.
I'm going to go ahead and click OK and accept that message.
Once we do all of that, we actually have configured local
web auth for this particular wireless LAN.
Now you want to make sure that if you're using
an authentication method, that you do have an internal
user database in place to do that.
If we actually go under security
and then about halfway down on the left,
we'll see local net users.
I did already configure a test user in a previous video
so we do have a user in there, but you would want
to add all of your authorized users here
if you're using local web auth.
Now, you can of course use a radius server externally
for that as well, but if we're looking at local web auth,
you want to make sure you have your users populated in here.
If you want to require open guest network access without
authentication, where they simply have to accept
the usage policy that you present them,
actually we'll go under wireless LANs,
and we'll choose our particular network.
Then under that security tab, layer 3 security
and we would choose that passthrough option.
If we want to verify we're using verified local web auth
authentication, we can go back to that WLANs main tab,
where we are able to see a list of all
of our enabled networks, and at the very bottom,
we have our WEBAUTH wireless LAN.
All the way over on the right, under the securities column,
we do see it listed that this is using web passthrough
as the policy, which is exactly what we would want to see.
So that's a look at how we can configure and verify
web auth authentication on a Cisco wireless LAN controller.