Skip to main content

Cisco WLC

Integrate Cisco AireOS Wireless LAN Controller with IronWifi's RADIUS authentication services for guest and enterprise WiFi. This guide covers RADIUS server configuration, WLAN security profiles, web authentication setup, pre-authentication ACLs, and WPA-Enterprise deployment for secure network access.

Prerequisites​

In Cisco WLC:​

  • Cisco WLC running AireOS
  • Network connectivity to IronWifi RADIUS servers
  • Administrative access to WLC (GUI or CLI)

In IronWifi Console (complete these first):​

  1. Create a Network in IronWifi Console
  2. Create a Captive Portal with vendor Cisco WLC
  3. Note the following details:
    • Primary and Backup RADIUS server IP addresses
    • RADIUS ports (1812 for authentication, 1813 for accounting)
    • Shared secret
    • Splash Page URL

WLC Configuration via GUI​

Step 1: Add RADIUS Servers​

  1. Navigate to SECURITY → AAA → RADIUS → Authentication
  2. Click New
  3. Configure primary server:
    • Server Address: {Primary IP}
    • Port Number: 1812
    • Shared Secret: {Shared secret}
    • Server Status: Enabled
  4. Add backup server similarly

Step 2: Add RADIUS Accounting​

  1. Navigate to SECURITY → AAA → RADIUS → Accounting
  2. Add servers with accounting port (1813)

Step 3: Create WLAN​

  1. Navigate to WLANs → Create New
  2. Configure:
    • Profile Name: Guest-WiFi
    • SSID: Guest-WiFi
    • Status: Enabled

Step 4: Configure Security​

  1. Select your WLAN
  2. Go to Security → Layer 2
    • Layer 2 Security: None (for captive portal)
  3. Go to Security → Layer 3
    • Layer 3 Security: Web Policy
    • Web Policy Type: External (redirect to external server)
    • Preauthentication ACL: Select or create ACL

Step 5: Configure AAA Servers​

  1. Go to Security → AAA Servers
  2. Enable Authentication Servers and Accounting Servers
  3. Select the IronWifi RADIUS servers

Step 6: Configure Web Auth​

  1. Navigate to SECURITY → Web Auth → Web Login Page
  2. Set Web Authentication Type: External
  3. Set Redirect URL after Login: {Splash Page URL}

Pre-Authentication ACL​

Create ACL for pre-auth access:

  1. Navigate to SECURITY → Access Control Lists → Access Control Lists
  2. Create new ACL named "IronWifi-PreAuth"
  3. Add rules:
    • Permit IP to 107.178.250.42
    • Permit DNS (UDP 53)
    • Deny all

Required Walled Garden Entries​

In addition to the IronWifi splash page IP (107.178.250.42), you may need to add entries for authentication providers and payment processors:

ProviderRequired Entries
Google*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
LinkedIn*.linkedin.com, *.licdn.com, linkedin.com
Twitter/X*.twitter.com, *.twimg.com, twitter.com, *.x.com, x.com
Apple*.apple.com, *.icloud.com, appleid.apple.com
Microsoft/Azure AD*.microsoft.com, *.microsoftonline.com, *.msftauth.net, login.microsoftonline.com
Stripe*.stripe.com, js.stripe.com
PayPal*.paypal.com, *.paypalobjects.com
Twilio (SMS)*.twilio.com

WPA-Enterprise Configuration​

The following configuration is for 802.1X authentication without captive portal:

  1. Create WLAN
  2. Security → Layer 2: WPA+WPA2
  3. Authentication Key Management: 802.1X
  4. Security → AAA Servers: Enable and select IronWifi servers

CLI Configuration​

RADIUS Servers​

config radius auth add 1 {PRIMARY_IP} 1812 ascii {SECRET}
config radius auth add 2 {BACKUP_IP} 1812 ascii {SECRET}
config radius acct add 1 {PRIMARY_IP} 1813 ascii {SECRET}
config radius acct add 2 {BACKUP_IP} 1813 ascii {SECRET}

WLAN Configuration​

config wlan create 1 Guest-WiFi Guest-WiFi
config wlan security web-auth enable 1
config wlan security web-auth server-precedence 1 local radius
config wlan radius_server auth add 1 1
config wlan radius_server auth add 1 2
config wlan radius_server acct add 1 1
config wlan enable 1

Web Auth​

config custom-web webauth-type external
config custom-web redirecturl {SPLASH_URL}

Verification​

After completing the configuration steps above, verify everything works correctly:

show radius summary
show radius auth statistics
show wlan 1
show client summary

Troubleshooting​

If testing reveals issues, use this section to diagnose common problems:

SymptomCauseSolution
Clients not redirecting to splash pageLayer 3 security not set to Web PolicyVerify Layer 3 security is set to Web Policy
Clients not redirecting to splash pagePre-auth ACL blocking splash pageCheck pre-auth ACL allows splash page access (107.178.250.42)
Clients not redirecting to splash pageIncorrect redirect URLConfirm redirect URL is correct in Web Auth settings
RADIUS timeoutsNetwork connectivity issueTest connectivity to RADIUS servers using ping
RADIUS timeoutsIncorrect shared secretVerify shared secret matches IronWifi Console
RADIUS timeoutsFirewall blocking RADIUSCheck firewall rules allow UDP 1812-1813
RADIUS timeoutsServer issuesReview RADIUS statistics: show radius auth statistics
Authentication failuresInvalid credentialsCheck user credentials in IronWifi Console
Authentication failuresRADIUS communication issueEnable RADIUS debugging: debug aaa all enable
Authentication failuresConfiguration mismatchReview IronWifi authentication logs