- [Instructor] Similar to 'MAC Authentication bypass,'
'WebAuth' can be used for clients attempting
to connect the network,
which do not have 802.1x supplicant software installed.
This can also be used as a fall back method for
.1x authentication.
Especially for guest users or outside parties,
such as contractors.
And you can certainly use that as a primary method as well,
for things like guests' wireless networks.
With 'WebAuth' as a fallback method,
users are redirected to a web portal requesting
identity credentials before they're granted access
to the network,
if you have '802.1x', 'WebAuth'
and 'MAB' enabled on your network.
So, in other words, if you have two fallback methods
you want to know that after
the initial 802.1x authentication times out
the initial method that's going to be attempted is MAB.
Then, WebAuth authentication will be attempted.
So, be aware of the implications of that for enabling
both fallback methods here.
The WebAuth portal will request a simple
username and password combination.
Which will be forwarded to the RADIUS server in a standard
RADIUS Access-Request packet,
very similar to how MAB functions.
The limitation here is that WebAuth only works
for end-users, that doesn't work with things like a printer.
Because, well, obviously a printer can't get out to a
web portal and put in its' own user credentials,
so often we don't have the ability to launch a browser
on most printers to do so, so this is only going to work
for users where they can input
manual user name and password credentials.
WebAuth comes in two flavors,
'Local WebAuth' and 'Centralized WebAuth'.
Local WebAuth is the original standard,
and with Local WebAuth we will have a switch,
or maybe a wireless land controller,
redirecting web traffic to a web portal where the
user is prompted for credentials.
The web portal itself would be hosted by the switch,
and on a Cisco switch these local WebAuth portals are not
customizable.
Also lacking are the option for displaying and agreeing to
acceptable use policies before accessing the network.
And that's something which is really important,
especially if you're providing guest network access.
Also, Local WebAuth does not support the ability to
assign the client to a particular VLAN.
To overcome some of these limitations,
we use Centralized Web Authentication more commonly
in our enterprise networks.
In some of the main features that Cisco created
with their 'Identity Service Engine' were designed
to overcome many of these Local WebAuth limitations.
Centralized WebAuth allows for many
advanced features including;
dynamic VLAN assignment, customizable landing pages,
and acceptable use policy displays.
Using Cisco ISE we can leverage the more advanced features,
such as posture profiling.
That's where Cisco ISE examines the security posture
of the client.
In other words, it takes a look at whether or not
the client has an up-to-date operating system,
whether or not the patches are current,
and updates are installed,
and it makes sure if there is a valid anti-virus running,
and so on.
With Centralized WebAuth, let's assume in this example,
this client wants to join the network and it does not have
a supplicant software installed,
and that we've also already enabled
MAC Authentication bypass, (MAB).
.1x authentication first would timeout after 90 seconds,
and the switch would perform MAB operations,
sending a RADIUS Access-Request message to Cisco ISE.
The authenticator switch is only going to see the MAB,
and the rest will be handled by ISE itself,
the authenticator would send
the RADIUS Access-Request message to the ISE
and the ISE would send the RADIUS result,
including a URL redirection for end-users that would
direct them to a centralized authentication portal.
The end-user would then see that in their web browser,
and they would enter their credentials into the portal.
Those credentials would be stored within the ISE directory,
rather than being sent through the authenticator switch.
If the user properly authenticates,
the session will be formed and the client will be allowed
access to the network.
In a configuration like this, it could take quite some time
for a 802.1x to timeout,
we already see that that takes 90 seconds by default,
before MAB authentication begins.
So, this problem is addressed by using something called,
'Enhanced Flexible Authentication' or 'FlexAuth'.
This allows for multiple authentications
to take place concurrently.
So, 802.1x and MAB at the same time for example.
This is going to allow the client to access the network
much more quickly using something called,
'Cisco Identity Based Networking Services' or 'IBNS'
that would be deployed on a Cisco Access Server such as ISE.
So that's an overview of using WebAuth
as a fallback method for authentication in cases where
a client does not have 802.1x supplicant abilities.