Have you ever gone to a corporate site, maybe as a guest, and you fire up your
laptop and
you find that the network is actually completely open?
And so you think, "Oh, okay, great.
I'm just going to join this network then.
I don't have to provide a username and password or anything like that."
And we associate and authenticate to the access point we connect.
And then I try to go to a website and all of a sudden I'm redirected to a web
portal.
And at this point, I have to provide some kind of authentication mechanism. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And at this point, I have to provide some kind of authentication mechanism.
And usually at this point, it's going to be a username and password.
This is known as web auth or web authentication.
And it's just another tool in our belt, a way that we can help our users get
onto our
wireless network without maybe going with one of the other options.
So if we think about our options, we have now web auth in here.
We also have the concept of pre-shared key and then we have our enterprise WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also have the concept of pre-shared key and then we have our enterprise
option.
Well when we look at pre-shared key, we understand that there's a whole lot of
downside, a whole
lot of cons.
It has to do with scalability and potentially security risks and so on and so
forth.
But keep in mind that even though there's a lot of downsides, it's very easy to
operate.
Whereas enterprise, even though there's a lot of pros, it's also a little bit
complex
to set up.
I might need to put a certificate onto a laptop.
I might need to ask a user to use multi-factor authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I might need to ask a user to use multi-factor authentication.
Whatever the situation is, we know that this is a little bit more complex.
Web auth aims to go kind of right in the middle here because we're trying to
get a little
bit easier access to our wireless network and yet still have some of the pros
of our
enterprise.
Remember, pre-shared key lacks authentication, it relies on the pre-shared key.
So what we're trying to do here is reintroduce the idea of authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what we're trying to do here is reintroduce the idea of authentication.
Now I have to log in with a username and password.
And yet it's still very easy.
The wireless network was open.
I didn't need to do anything complex to get on board.
Now that said, there is a downside because even though web auth as the name
implies here
provides authentication, it doesn't provide encryption.
Now we could potentially pair up with WPA pre-shared key in order to provide
the encryption.
But at that point, what are we doing here? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But at that point, what are we doing here?
We might as well go ahead and migrate over to our enterprise side rather than
trying to
deploy a WPA pre-shared key.
So in most situations that we're deploying web auth, we're going to have no
encryption.
So why?
Why would we go with web auth?
What is the purpose of using this?
Well once again, it's to provide somewhat easy access to the network.
And it's also supposed to provide actual real authentication.
I'll say real here, potentially in quotes, because we're using a username and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll say real here, potentially in quotes, because we're using a username and
password,
we're not relying on a pre-shared key.
But because we're not encrypting the traffic, usually at this point, we're
going to find
that this is reserved for guest access.
As I mentioned at the start, maybe we showed up at a corporate site.
We're there for a meeting, a sales pitch, whatever the reason is, we're there
and they
tell us, hey, we can log in and use the Wi-Fi.
And all they had to do was provide us with maybe a username and password, like
a print WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a print
out, that kind of thing.
And so I fill in the username and password and I'm able to get onto their
wireless network
very seamlessly.
And yet, anybody else, the threat actors who are out there, even though this
network is
open, they're not able to get on because they lack the username and password
that I was
provided at the official meeting at the front desk or whatever the situation is
there.
So at this point, this becomes known as a layer three security mechanism. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So at this point, this becomes known as a layer three security mechanism.
Because it's open here, the layer two mechanism is essentially non-existent.
I don't have layer two security because my wireless device was able to
associate to the
access point without ever providing any kind of authentication mechanism.
Layer three security says, hey, let's just go ahead and get you wirelessly
associated,
no problem.
And then we'll worry about security on the back end.
So what this means is that my device is going to perform again my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what this means is that my device is going to perform again my
authentication and association
to this access point.
And then from a network perspective, I'm actually going to get DHCP.
So I've got an IP address.
I'm going to get DNS.
I've got the ability to get out to the web.
And yet going out to the web is going to redirect me.
So that's exactly what ends up happening.
I usually point my web browser to a www type of site, whatever that is, and I
get redirected WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
get redirected
to the web portal.
Now here's a question, where exactly does this portal get hosted?
Because this is a real web page, I need a real web server to host a real web
page.
Well fortunately for us, Cisco does give us the option of this being hosted on
the wireless
LAN controller.
We'll see that there is a pretty seamless option for me just to, or simple
option to
get onto the wireless LAN controller configuration and tell it, hey, I want you
to manage the
portal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
portal.
And so at this point, this is really connecting to an internal web server on
the wireless
LAN controller.
This would be known as an internal portal.
However, I can also connect to an actual web server, which would be known as an
external
connection.
The external web server allows for max customization.
So if I want the web portal to look exactly like I want it to look, then I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I want the web portal to look exactly like I want it to look, then I
should go out
and create my own web page on a web server.
The internal WLC wireless LAN controller hosted website is going to allow for
customization.
I can usually put my company logo on there and probably edit the text in there,
but there's
not much I can do beyond that.
And so this is a very basic web portal.
If I wanted to look really super professional, then I would have to do
something involving
an external web server.
But for the most part, the vast majority of wireless networks that I've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But for the most part, the vast majority of wireless networks that I've
personally deployed
or interacted with, we're usually using the basic portal because we're not
trying to impress
a whole lot of people with our guest access web portal.
So web auth is certainly an option that we can not only enable for the sake of
simplicity.
Again, trying to figure out how to make it easier for our guests to get online
while
still providing some amount of security around this.
I still have to provide a username and password to my guests to log in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I still have to provide a username and password to my guests to log in.
So I'm trying to find that balance.
But I'm also still again trying to keep these threat actors out.
And so web auth is a great way to create a great method maybe to consider for
my guest
access to bridge the gap and not require either running pre shared key, which
is not
the best, but also not running full WPA enterprise for my guests.