{"id":5015,"date":"2021-11-02T16:16:59","date_gmt":"2021-11-02T15:16:59","guid":{"rendered":"https:\/\/cyber-fi.net\/?p=5015"},"modified":"2024-09-15T09:08:21","modified_gmt":"2024-09-15T07:08:21","slug":"central-web-authentication-cwa-with-cisco-ewc-flexconnect-aps","status":"publish","type":"post","link":"https:\/\/cyber-fi.net\/index.php\/2021\/11\/02\/central-web-authentication-cwa-with-cisco-ewc-flexconnect-aps\/","title":{"rendered":"Central Web Authentication (CWA) with Cisco EWC\/ FlexConnect APs"},"content":{"rendered":"\n<p>Recently I had to implement Central Web Authentication (CWA) on a network that uses the Cisco Embedded Wireless Controller (EWC) on Catalyst 9100 APs. Configuration is not that hard, but there is some misleading information in the documentation. Although this blog post is about EWC, it is nearly the same for the &#8220;bigger&#8221; 9800 WLC where the WLAN uses FlexConnect local switching. And yes, I know that no one really likes Captive portals. But that is a different story. \ud83d\ude42<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Components used in this Example:<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Cisco Catalyst 9120 with EWC, version 17.3.4<\/li><li>Cisco ISE 2.7 as the RADIUS-server<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">The CWA Process with FlexConnect<\/h2>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"475\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/diagram1-1-1024x475.jpg\" alt=\"\" class=\"wp-image-5052\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/diagram1-1-1024x475.jpg 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/diagram1-1-300x139.jpg 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/diagram1-1-768x356.jpg 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/diagram1-1.jpg 1328w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\"><li>The client connects to an AP. We use local switching, but central Authentication here.<\/li><li>The WLAN is configured for MAC filtering, a RADIUS Access-Request with the Clients MAC address is sent to the RADIUS-Server.<\/li><li>The RADIUS server is not aware of this MAC address and sends an Access-Accept with the first Authorisation. This includes the redirect-URL and the redirect-ACL. Both are forwarded to the AP as the FlexConnect-AP will handle the redirection.<\/li><li>The client does an HTTP request. It has to be HTTP as HTTPS redirection will always give certificate-warnings. This can be a little bit tricky nowadays as many browsers default to HTTPS. If the build-in captive-portal detection of the OS does not work, the user can point the browser to a site like neverssl.com which only uses HTTP and no HTTPS. <\/li><li>The AP intercepts the HTTP-request based on the redirect-ACL and redirects the client to the redirect-URL.<\/li><li>The client opens a new connection to the server which implements the Central Web Authentication. In my use case it is hosted on the ISE.<\/li><li>The client interacts with the captive portal. In this example it will be a simple HotSpot-page with an AUP, but it could also ask for credentials or implement a self-registration.<\/li><li>When the client went through all necessary steps of CWA, the RADIUS-server sends a CoA to the EWC\/WLC with the request to reauthenticate.<\/li><li>The EWC sends another Access-Request, similar to what was done in step (2).<\/li><li>This time the RADIUS-server is aware of the MAC-address and sends back an Access-Accept which can include authorisation like an ACL, but no redirect-ACL and no redirect-URL. This information is again forwarded to the FlexConnect-AP<\/li><li>The client can now connect to the internet or wherever our authorisation allows the client to go to.<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">The Configuration<\/h2>\n\n\n\n<p>Here I will only show the config that is relevant for CWA.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The WLAN<\/h3>\n\n\n\n<p>This is the config of my Hotspot-WLAN under Configuration -&gt; Tags &amp; Profiles -&gt; WLAN:<\/p>\n\n\n\n<div class=\"wp-block-image is-style-default\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"942\" height=\"512\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.40.36@2x.png\" alt=\"\" class=\"wp-image-5021\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.40.36@2x.png 942w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.40.36@2x-300x163.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.40.36@2x-768x417.png 768w\" sizes=\"auto, (max-width: 942px) 100vw, 942px\" \/><\/figure><\/div>\n\n\n\n<p>MAC filtering is enabled, I have a &#8220;default&#8221; Authorisation-List of type &#8220;network&#8221; that points to the ISE. Layer 2 Security Mode could also be Open if wanted.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"956\" height=\"348\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.41.12@2x.png\" alt=\"\" class=\"wp-image-5022\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.41.12@2x.png 956w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.41.12@2x-300x109.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.41.12@2x-768x280.png 768w\" sizes=\"auto, (max-width: 956px) 100vw, 956px\" \/><\/figure><\/div>\n\n\n\n<p>The Authentication-List &#8220;default&#8221; is of type &#8220;dot1x&#8221; and also points to my ISE.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Policy-Profile<\/h3>\n\n\n\n<p>This is the config of my Policy-Profile &#8220;GUESTS&#8221; under Configuration -&gt; Tags &amp; Profiles -&gt; Policy<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"982\" height=\"838\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.48.34@2x.png\" alt=\"\" class=\"wp-image-5023\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.48.34@2x.png 982w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.48.34@2x-300x256.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.48.34@2x-768x655.png 768w\" sizes=\"auto, (max-width: 982px) 100vw, 982px\" \/><\/figure>\n\n\n\n<p>The GUEST-WLAN is statically bound to VLAN 1161, for my environment, the VLAN will not be changed later based on the Authorisation.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"924\" height=\"550\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.50.19@2x.png\" alt=\"\" class=\"wp-image-5024\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.50.19@2x.png 924w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.50.19@2x-300x179.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.50.19@2x-768x457.png 768w\" sizes=\"auto, (max-width: 924px) 100vw, 924px\" \/><\/figure><\/div>\n\n\n\n<p>Under Advanced -&gt; AAA Policy we need to enable, &#8220;Allow AAA Override&#8221;, &#8220;NAC State&#8221; and define the &#8220;NAC Type&#8221; as &#8220;RADIUS&#8221;. The Accounting-List of type &#8220;identity&#8221; again points to my ISE.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Policy-Tag<\/h3>\n\n\n\n<p>This is not CWA-specific, the WLAN Profile and Policy Profile are added to the Policy-Tag (Configuration -&gt; Tags &amp; Profiles -&gt; Tags -&gt; Policy) which gets assigned to the APs.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"420\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.56.57@2x-1024x420.png\" alt=\"\" class=\"wp-image-5025\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.56.57@2x-1024x420.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.56.57@2x-300x123.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.56.57@2x-768x315.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-14.56.57@2x.png 1058w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">The redirect-ACL<\/h3>\n\n\n\n<p>On step (3) of the Workflow, the RADIUS-server sends the name of the redirect-ACL. This ACL of type &#8220;IPv4 extended&#8221; is not downloaded from the RADIUS-server, it has to be configured on the EWC (Configuration -&gt; Security -&gt; ACL) and assigned to the APs:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"220\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x-1024x220.png\" alt=\"\" class=\"wp-image-5030\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x-1024x220.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x-300x65.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x-768x165.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x-1536x330.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.39.31@2x.png 1878w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p>The 9800\/EWC is based on IOS-XE, the logic of the redirect-ACL is that &#8220;deny&#8221; does not redirect and &#8220;permit&#8221; will redirect. In my example I configured:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>no redirection for icmp<\/li><li>no redirection for traffic going to the ISE (10.255.192.141) on the portal-port (8445)<\/li><li>redirection for tcp\/80 (HTTP)<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">The Flex-Profile<\/h3>\n\n\n\n<p>With FlexConnect APs, the APs need to be aware of all used VLANs and ACLs. We assign these in the Flex-Profile Configuration -&gt; Tags &amp; Profiles -&gt; Flex. The Flex-Profile is later added to the Site-Tag that is assigned to the AP.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"964\" height=\"626\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.00@2x.png\" alt=\"\" class=\"wp-image-5031\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.00@2x.png 964w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.00@2x-300x195.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.00@2x-768x499.png 768w\" sizes=\"auto, (max-width: 964px) 100vw, 964px\" \/><\/figure><\/div>\n\n\n\n<p>Under &#8220;VLAN&#8221; all VLANs that are used on this AP are configured. I have one for the Guests, and two for Users.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"472\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.33@2x-1024x472.png\" alt=\"\" class=\"wp-image-5032\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.33@2x-1024x472.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.33@2x-300x138.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.33@2x-768x354.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.45.33@2x.png 1132w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p>&#8220;Policy ACL&#8221; lists all ACLs the AP needs. ACL_GUEST will later be assigned from the RADIUS-server and controls on the AP which traffic is allowed. ACL_WEBAUTH_REDIRECT is the previously configured redirect-ACL. As this ACL is used for CWA-redirection it needs the option &#8220;Central Web Auth&#8221;.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The ISE config<\/h2>\n\n\n\n<p>We need two rules in the Authorisation Policy:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"289\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x-1024x289.png\" alt=\"\" class=\"wp-image-5033\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x-1024x289.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x-300x85.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x-768x217.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x-1536x433.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.54.25@2x.png 1660w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p>I also match on the SSID-names and not only on the Endpoint Identity Group or MAB; this is a LAB-setup that includes additional config for different SSIDs with different functionality.<\/p>\n\n\n\n<p>Guest-Hotspot is used in step (3) of the workflow and references the Authorisation Profile WLAN-Hotspot with the following attributes:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"111\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x-1024x111.png\" alt=\"\" class=\"wp-image-5034\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x-1024x111.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x-300x32.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x-768x83.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x-1536x166.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.56.00@2x.png 1758w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Guest-Access is used in step (10) of the workflow and references the Authorisation Profile Guest-Access with the following attributes:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"102\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x-1024x102.png\" alt=\"\" class=\"wp-image-5035\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x-1024x102.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x-300x30.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x-768x77.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x-1536x153.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-15.59.52@2x.png 1542w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Testing the setup<\/h2>\n\n\n\n<p>When connecting to the SSID, the ISE applies the first authorisation:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"433\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.10@2x-1024x433.png\" alt=\"\" class=\"wp-image-5037\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.10@2x-1024x433.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.10@2x-300x127.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.10@2x-768x325.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.10@2x.png 1382w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"388\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.38@2x-1024x388.png\" alt=\"\" class=\"wp-image-5038\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.38@2x-1024x388.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.38@2x-300x114.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.38@2x-768x291.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.10.38@2x.png 1352w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p>The EWC sees the client and uses the received Authorisation:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"131\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x-1024x131.png\" alt=\"\" class=\"wp-image-5039\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x-1024x131.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x-300x38.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x-768x98.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x-1536x197.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.11.14@2x.png 1844w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"435\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x-1024x435.png\" alt=\"\" class=\"wp-image-5040\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x-1024x435.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x-300x127.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x-768x326.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x-1536x652.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.13.05@2x.png 1654w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p>Next, the client is redirected to the ISE portal.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>After accepting the AUP, the Server issues a CoA and sends the next Authorisation:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"423\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.15.02@2x-1024x423.png\" alt=\"\" class=\"wp-image-5041\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.15.02@2x-1024x423.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.15.02@2x-300x124.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.15.02@2x-768x317.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.15.02@2x.png 1376w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"478\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.16.25@2x-1024x478.png\" alt=\"\" class=\"wp-image-5042\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.16.25@2x-1024x478.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.16.25@2x-300x140.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.16.25@2x-768x359.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.16.25@2x.png 1358w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>EWC switches to Run-State and applies the new authorisation:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"139\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x-1024x139.png\" alt=\"\" class=\"wp-image-5043\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x-1024x139.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x-300x41.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x-768x104.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x-1536x208.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.17.23@2x.png 1802w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"371\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x-1024x371.png\" alt=\"\" class=\"wp-image-5044\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x-1024x371.png 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x-300x109.png 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x-768x278.png 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x-1536x556.png 1536w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-01-at-16.18.43@2x.png 1658w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Problems, Pitfalls, things to mention<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">The redirection-ACL (1):<\/h3>\n\n\n\n<p>This is the redirection ACL on the EWC:<\/p>\n\n\n\n<p><kbd>ewc#sh ip access-lists<br>Extended IP access list ACL_WEBAUTH_REDIRECT<br>1 deny icmp any any echo<br>11 deny tcp any host 10.255.192.141 eq 8445<br>12 deny tcp host 10.255.192.141 eq 8445 any<br>30 permit tcp any any eq www<\/kbd><\/p>\n\n\n\n<p>This is the redirection ACL on the AP:<\/p>\n\n\n\n<p><kbd>ap1-c9120#sh ip access-lists<br>Extended IP access list ACL_WEBAUTH_REDIRECT<br>1 permit icmp any any<br>2 permit tcp any range 0 65535 10.255.192.141 0.0.0.0 eq 8445<br>3 permit tcp 10.255.192.141 0.0.0.0 eq 8445 any range 0 65535<br>4 deny tcp any range 0 65535 any eq 80<\/kbd><\/p>\n\n\n\n<p>As already mentioned, &#8220;permit\/deny&#8221; on the EWC uses the IOS-logic. But the AP operates in a legacy way and needs deny and permit reversed. The option &#8220;Central Web Auth&#8221; in the Flex-Profile takes care of this.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The redirection-ACL (2):<\/h3>\n\n\n\n<p>Many examples for redirection ACLs include explicit statements for DNS and some also for DHCP. In my tests this was not needed.<\/p>\n\n\n\n<p>Other examples state that the ACL only needs to include the direction from the client to the network and that the reverse gets automatically added when the ACL is used in the Flex-Profile. This did not work for me and I needed to add lines for both directions (11 and 12 in the EWC ACL).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Downloadable ACLs (DACLs)<\/h3>\n\n\n\n<p>This is from the <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/wireless\/controller\/ewc\/17-3\/config-guide\/ewc_cg_17_3\/ipv4_acls.html#Cisco_Concept.dita_badec58f-1c40-4ecb-8903-b8b4709c128e\" data-type=\"URL\" data-id=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/wireless\/controller\/ewc\/17-3\/config-guide\/ewc_cg_17_3\/ipv4_acls.html#Cisco_Concept.dita_badec58f-1c40-4ecb-8903-b8b4709c128e\" target=\"_blank\" rel=\"noreferrer noopener\">EWC config guide<\/a>:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Punt\/Redirect\/Downloadable Access Control List (DACL): For the downloadable ACL (dACL), all the full ACEs and the dacl name are configured only on the Cisco ISE. The Cisco ISE sends the dacl name to the device in its ACCESS-Accept attribute, which takes the dacl name and sends the dACL name back to the Cisco ISE for the ACEs, using the ACCESS-request attribute.<\/p><\/blockquote>\n\n\n\n<p>I got a little enthusiastic as DACLs were not supported previously in FlexConnect. I tried a lot but came to the conclusion that this is a documentation-bug, where large parts from the documentation was just copied from the IOS-XE config guide.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">HTTP\/HTTPS Access Configuration<\/h3>\n\n\n\n<p>This was driving me crazy and I wasted hours of time troubleshooting. In my first tests the redirection didn&#8217;t want to kick in although the ACL and the URL got applied. Then I remembered that I disabled HTTP Access when I initially configured the controller. It needs to be enabled for redirection to work which is the same as with Catalyst switches.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"491\" height=\"342\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-02-at-15.34.25.png\" alt=\"\" class=\"wp-image-5049\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-02-at-15.34.25.png 491w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2021\/11\/CleanShot-2021-11-02-at-15.34.25-300x209.png 300w\" sizes=\"auto, (max-width: 491px) 100vw, 491px\" \/><\/figure><\/div>\n\n\n\n<p>On Catalyst switches, the attack-surface is typically reduced by disabling the session modules:<\/p>\n\n\n\n<p><kbd>ip http active-session-modules none<\/kbd><\/p>\n\n\n\n<p>The EWC-GUI doesn&#8217;t have any option for this. On the CLI these commands are available, but when trying to disable the HTTP modules, I always lost connection to the GUI. This needs some more research.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Named AAA-lists<\/h3>\n\n\n\n<p>In the above configuration I use default AAA-lists to ease the configuration. This also works with named Authentication-, Authorisation- and Accounting-Lists. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>As always with EWC\/9800 WLC, when anything doesn&#8217;t work, the Radioactive Trace is of great help. Sadly, the EWC doesn&#8217;t have an embedded Packet-Capture. On the CLI, the commands are available, but it fails with a message that it will only work on the legacy APs (which are not supported with EWC):<\/p>\n\n\n\n<p><kbd>ewc(config)#wireless profile ap packet-capture CAP<br>ewc(config-packet-capture)#classifier broadcast<br>ewc(config-packet-capture)#classifier management<br>ewc(config-packet-capture)#exit<br>ewc(config)#ap profile default-ap-profile<br>ewc(config-ap-profile)#packet-capture CAP<br>This feature is supported only on AP803, AP170x, AP270x, AP370x, AP157x, IW3700 APs and not supported on other APs<br>ewc(config-ap-profile)#<\/kbd><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently I had to implement Central Web Authentication (CWA) on a network that uses the Cisco Embedded Wireless Controller (EWC) on Catalyst 9100 APs. Configuration is not that hard, but there is some misleading information in the documentation. Although this blog post is about EWC, it is nearly the same for the &#8220;bigger&#8221; 9800 WLC <\/p>\n<div class=\"read-more-text\"><a href=\"https:\/\/cyber-fi.net\/index.php\/2021\/11\/02\/central-web-authentication-cwa-with-cisco-ewc-flexconnect-aps\/\" class=\"read-more\">continue reading<\/a><\/div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"twitterCardType":"summary","cardImageID":4915,"cardImage":"https:\/\/cyber-fi.net\/wp-content\/uploads\/2020\/05\/cyber-fi.jpg","cardTitle":"","cardDesc":"Configuring CWA in FlexConnect mode is not always straight-forward compared to central switching. This Blog-post shows the needed configuration for CWA on a Cisco Embedded Wireless Controller.","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[1,685,717],"tags":[699,137,698,700],"class_list":["post-5015","post","type-post","status-publish","format-standard","hentry","category-general","category-cisco-wireless","category-wireless","tag-9800-wlc","tag-cisco","tag-ewc","tag-flexconnect"],"_links":{"self":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/comments?post=5015"}],"version-history":[{"count":16,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5015\/revisions"}],"predecessor-version":[{"id":5634,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5015\/revisions\/5634"}],"wp:attachment":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/media?parent=5015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/categories?post=5015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/tags?post=5015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}