I'd like to use WLAN Web authentication, but have no experience with it. I'd like to use such an authentication for staff members and external people, whereby the external people when logged are only permitted internet access. The staff on the other hand should also get access to specific internal servers.

Is it possible to distinguish between two logged in users if they are either staff members or guests and then forward/redirect the traffic?

I found the Cisco Web authentication on a WLC controller that has a lot of options, but I couldn't find anything regarding this specific requirement link

Has anyone experience with such a device?

2 Answers 2


I think you are looking at this incorrectly.

Typically, you would have multiple SSIDs, including one for guests. The VLAN for the guest SSID would only be allowed to be routed to the Internet, while other SSIDs would be on networks which have various internal access restrictions, or not.

Often, 802.1X is used for such authentication, but there are other authentication methods, and Cisco WLCs support several (see Authentication on Wireless LAN Controllers Configuration Examples). A guest would only be able to be authenticated on the guest SSID since the guest credentials will not exist for the other SSIDs.

Authentication on WLCs

The Cisco Unified Wireless Network (UWN) security solution bundles potentially complicated Layer 1, Layer 2, and Layer 3 802.11 Access Point (AP) security components into a simple policy manager that customizes system-wide security policies on a per-wireless LAN (WLAN) basis. The Cisco UWN security solution provides simple, unified, and systematic security management tools.

These security mechanisms can be implemented on WLCs.

Layer 1 Solutions

Restrict client access based on the number of consecutive failed attempts.

Layer 2 Solutions

None Authentication —When this option is selected from the Layer 2 Security drop-down list, No Layer 2 authentication is performed on the WLAN. This is the same as the open authentication of the 802.11 standard.

Static WEP —With Static Wired Equivalent Privacy (WEP), all APs and client radio NICs on a particular WLAN must use the same encryption key. Each sending station encrypts the body of each frame with a WEP key before transmission, and the receiving station decrypts it using an identical key upon reception.

802.1x —Configures the WLAN to use the 802.1x based authentication. The use of IEEE 802.1X offers an effective framework in order to authenticate and control user traffic to a protected network, as well as dynamically vary encryption keys. 802.1X ties a protocol called Extensible Authentication Protocol (EAP) to both the wired and WLAN media and supports multiple authentication methods.

Static WEP + 802.1x —This Layer 2 security setting enables both 802.1x and Static WEP. Clients can either use Static WEP or 802.1x authentication in order to connect to the network.

Wi-Fi Protected Access (WPA) —WPA or WPA1 and WPA2 are standard-based security solutions from the Wi-Fi Alliance that provide data protection and access control for WLAN systems. WPA1 is compatible with the IEEE 802.11i standard but was implemented before the standard's ratification. WPA2 is the Wi-Fi Alliance's implementation of the ratified IEEE 802.11i standard.

By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data protection. WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated key management by default. However, these options are also available: PSK, CCKM, and CCKM+802.1x. If you select CCKM, Cisco only allows clients which support CCKM. If you select CCKM+802.1x, Cisco allows non-CCKM clients also.

CKIP —Cisco Key Integrity Protocol (CKIP) is a Cisco-proprietary security protocol for encrypting 802.11 media. CKIP improves 802.11 security in infrastructure mode using key permutation, MIC, and message sequence number. Software release 4.0 supports CKIP with static key. For this feature to operate correctly, you must enable Aironet information elements (IEs) for the WLAN. The CKIP settings specified in a WLAN are mandatory for any client that attempts to associate. If the WLAN is configured for both CKIP key permutation and MMH MIC, the client must support both. If the WLAN is configured for only one of these features, the client must support only this CKIP feature. WLCs only support static CKIP (like static WEP). WLCs do not support CKIP with 802.1x (dynamic CKIP).

Layer 3 Solutions

None—When this option is selected from the Layer 3 security drop-down list, no Layer 3 authentication is performed on the WLAN.

Note: The configuration example for No Layer 3 authentication and No Layer 2 authentication is explained in the None Authentication section.

Web Policy (Web Authentication and Web Passthrough) —Web authentication is typically used by customers who want to deploy a guest-access network. In a guest-access network, there is initial username and password authentication, but security is not required for the subsequent traffic. Typical deployments can include "hot spot" locations, such as T-Mobile or Starbucks.

Web authentication for the Cisco WLC is done locally. You create an interface and then associate a WLAN/service set identifier (SSID) with that interface.

Web authentication provides simple authentication without a supplicant or client. Keep in mind that web authentication does not provide data encryption. Web authentication is typically used as simple guest access for either a "hot spot" or campus atmosphere where the only concern is the connectivity.

Web passthrough is a solution through which wireless users are redirected to an acceptable usage policy page without having to authenticate when they connect to the Internet. This redirection is taken care of by the WLC itself. The only requirement is to configure the WLC for web passthrough, which is basically web authentication without having to enter any credentials.

VPN Passthrough —VPN Passthrough is a feature which allows a client to establish a tunnel only with a specific VPN server. Therefore, if you need to securely access the configured VPN server as well as another VPN server or the Internet, this is not possible with VPN Passthrough enabled on the controller.

  • Sorry for the question but the WLC is then sitting on a router that then routes the traffic respectively to one or another interface, depending on the configuration?
    – wasp256
    Mar 13, 2016 at 20:22
  • A WLC is usually connected to a switch via a trunk which has a VLAN for WLC management, and a VLAN for each SSID. The LWAPs are connected to the various access switches, and you use DHCP Option 43 to provide the LWAPs with the WLC address(es). See this: networkengineering.stackexchange.com/a/28450/8499
    – Ron Maupin
    Mar 13, 2016 at 20:26

You can do this with Cisco ISE. The idea is that your users get assigned different guest types, and ISE will return an ACL name to the WLC depending on the guest type. You would then tune the ACL on the WLC to allow access to whatever resources are appropriate.

Nevertheless, I would tend to agree with Ron Maupin's answer, in that you probably want to separate categories that are as fundamentally different as staff and guests by using different SSIDs, and use the mechanism I described above only to differentiate guests (e.g. short-term and long-term guests, or guests vs staff BYOD devices...).

Also keep in mind that the configurations on ISE and the WLCs are not exactly intuitive, and are - to my eyes at least - prone to relatively subtle mistakes that can have serious security consequences.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.