Web Auth and Guest Services

What this chapter covers

This chapter is about users and devices that sign in through a web page rather than through a supplicant.

It covers local and central web authentication, the guest access services that sit on top of them, and the guest and sponsor portals that people see. Together they let you give visitors limited access without sharing company credentials.

The ideas build on the policy chapter. You write a first authorization result that redirects, and a second one that gives the final access.

How the topics fit together

Web authentication is the mechanism, guest access is the service, and the portals are the screens.

The topics work as a chain:

• Web authentication explains the redirect, the redirect ACL and the CoA that finishes the flow.
• Guest access services adds guest types, the three guest flows, the guest identity store and the wireless design.
• Sponsor and guest portals covers the portal types, certificates, ports and sponsor groups.

The pages share a few building blocks. The portal certificate, the redirect ACL on the network device, and the CoA setting appear in every topic, so a fault in one of them can break the whole flow. When you troubleshoot, check those three first.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the web authentication page first, since the guest pages assume you understand the redirect. If you have a lab, build a hotspot portal first because it is the quickest to test. Then try a sponsored portal to see how sponsor groups work.