Skip to main content

Cisco Mobility Express

Configure Cisco Mobility Express access points with IronWifi for lightweight wireless management. This guide covers RADIUS server configuration, external splash page integration, pre-authentication access lists, and WPA-Enterprise setup for guest captive portal and secure employee WiFi without dedicated hardware controllers.

Overview​

Cisco Mobility Express is a lightweight wireless controller solution that runs on Cisco Aironet access points, providing enterprise-grade wireless management without requiring a dedicated hardware controller.

Prerequisites​

In Cisco Mobility Express:​

  • Cisco Mobility Express-enabled access point
  • Network connectivity between AP and IronWifi RADIUS servers
  • Administrative access to Mobility Express web interface

In IronWifi Console (complete these first):​

  1. Create a Network in IronWifi Console
  2. Create a Captive Portal with vendor Cisco
  3. Note the following details:
    • Primary and Backup RADIUS server IP addresses
    • RADIUS ports (1812 for authentication, 1813 for accounting)
    • Shared secret
    • Splash Page URL

Mobility Express Configuration​

Access the Management Interface​

  1. Connect to the Mobility Express management network
  2. Navigate to the web interface (typically https://[AP_IP])
  3. Log in with administrator credentials

Step 1: Configure RADIUS Server​

  1. Navigate to Wireless Settings → RADIUS
  2. Click Add RADIUS Server
  3. Configure:
    • Server IP Address: {Primary IP}
    • Shared Secret: {Shared secret}
    • Port: 1812
    • Server Type: Authentication
  4. Add accounting server with port 1813
  5. Add backup servers

Step 2: Create Guest WLAN​

  1. Navigate to Wireless Settings → WLANs
  2. Click Add new WLAN
  3. Configure:
    • Profile Name: Guest-WiFi
    • SSID: Guest-WiFi
    • Status: Enabled

Step 3: Configure WLAN Security​

  1. Select Security tab
  2. Configure:
    • Guest Network: Yes
    • Captive Portal: External Splash Page
    • Splash Page URL: {IronWifi Splash URL}
    • Authentication Server: Select IronWifi server
    • Accounting Server: Select IronWifi server

Step 4: Configure Pre-Auth Access​

Add to the allowed list:

  • 107.178.250.42
  • DNS servers
  • Additional authentication provider domains

Required Walled Garden Entries​

In addition to the IronWifi splash page IP (107.178.250.42) and DNS servers, you may need to add entries for authentication providers and payment processors:

ProviderRequired Entries
Google*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
LinkedIn*.linkedin.com, *.licdn.com, linkedin.com
Twitter/X*.twitter.com, *.twimg.com, twitter.com, *.x.com, x.com
Apple*.apple.com, *.icloud.com, appleid.apple.com
Microsoft/Azure AD*.microsoft.com, *.microsoftonline.com, *.msftauth.net, login.microsoftonline.com
Stripe*.stripe.com, js.stripe.com
PayPal*.paypal.com, *.paypalobjects.com
Twilio (SMS)*.twilio.com

WPA-Enterprise Setup​

The following configuration is for 802.1X authentication without captive portal:

  1. Create new WLAN
  2. Security settings:
    • Guest Network: No
    • Security Type: WPA2 Enterprise
    • Authentication Server: IronWifi
  3. Configure client supplicants with RADIUS credentials

Expert Mode Configuration​

The following configurations require Expert Mode for advanced settings:

  1. Navigate to Management → Admin Accounts
  2. Enable Expert Mode
  3. Access additional configuration options

ACL Configuration (Expert Mode)​

Create pre-authentication ACL:

  1. Navigate to Security → Access Control Lists
  2. Create new ACL
  3. Add permit rules for:
    • IronWifi splash page (107.178.250.42)
    • DNS
    • DHCP

Verification​

After completing the configuration steps above, verify everything works correctly.

Check WLAN Status​

  1. Navigate to Monitoring → Wireless
  2. View active WLANs and client count

Check Client Status​

  1. Navigate to Monitoring → Clients
  2. View connected clients and authentication status

Troubleshooting​

If testing reveals issues, use this section to diagnose common problems:

SymptomCauseSolution
Captive Portal not appearingExternal Splash Page not enabledVerify External Splash Page is enabled in WLAN settings
Captive Portal not appearingIncorrect Splash Page URLCheck Splash Page URL is correct in WLAN settings
Captive Portal not appearingPre-auth access blocking splash pageConfirm pre-auth access allows splash page (107.178.250.42)
Captive Portal not appearingBrowser caching issueTest from incognito/private browser window
RADIUS authentication failingIncorrect server configurationVerify RADIUS server IP and port in Mobility Express
RADIUS authentication failingShared secret mismatchCheck shared secret matches IronWifi Console
RADIUS authentication failingNetwork connectivity issueEnsure network connectivity to RADIUS servers
RADIUS authentication failingServer or user issueReview logs in IronWifi Console
Clients stuck in Web AuthCaptive portal timeoutCheck captive portal timeout settings
Clients stuck in Web AuthAccounting not enabledVerify accounting is enabled in WLAN settings
Clients stuck in Web AuthClient device issueReview client device captive portal detection settings