Hello folks. I currently have a guest network setup using guest tunneling and an anchor controller. I have it configured for web authentication. So basically, a client associates to the SSID, obtains an DHCP IP from the guest anchor controller, and then when the browser is launched the client is redirected to 220.127.116.11 and receives the splash page where they are required to click "OK" to proceed and begin surfing the internet.
I am being told from a vendor that it's possible to use a mac-address exception method so specific clients (based on mac address) will not have to web authenticate. So basically they bypass the splash screen and can immediately begin surfing the internet.
From what I can tell it's all or nothing per SSID.
Has anyone ever heard of this and if so do you know how it is accomplished.
I don't think they gave you the right info. You can use MAC filters to allow devices access, but this is guest, so why even bother. If you want certain people to bypass the pass-through splash page, then create another ssid that is just open.... not a good idea though. The reason for a splash page is that you can provide a term of use to protect yourself legally. Just my opinion.
I've seen people ask for something like this for like an XBOX in a dorm (appearently XBOX doesn't have a browser?).....
Bottom line though is that on the WLC, all wireless clients on a WebAuth/WebPassthrough SSID must pass layer3 authentication. There is no way around this on this SSID. You'd have to create a different SSID as Scott suggested, which I'd probably suggest doing some kind of PSK on it, so only a few priveledged devices can associate.... you could even through in mac-filtering if you really wanted to complicate it....
Now, I understand that switches may have such a feature called mac-bypass, but it isn't on the WLC.
Thanks for the input guys. This is my take on it as well. I have not been able to find a feature on the guest anchor WLC to allow certain client mac addresses to bypass the splash page. I have no intention of standing up a separate SSID and leaving it wide open. I also have no intention of using PSK for a separate SSID. I try to avoid creating a new SSID for every application each department wants to trial. The system could get unmanageable very quickly by doing that. I'll see what the vendor comes back with.
I have a customer that does this with Bluesocket. We are in the process of installing WLC's to replace their Bluesocket and I've come to the realization that I'll have to standup one SSID that group A uses with webauth and group B will use with MAC filtering/authentication. The idea is that group B needs the same "guest" type access but they don't want to log into the spash page when they use the WLAN.
Transferring Crash file from standby:
Login to the Active WLC in HA.
(Cisco Controller) >transfer upload datatype crash
(Cisco Controller) >transfer upload filename <Desired filename>
(Cisco Controller) >transfer up...
This is the start of a display filter cross reference between Wireshark and OmniPeek.
The 1st installment is a table of advanced filters. More filters will be added as time allows.
It is a living doc, so check back for changes every so often
Please feel ...
I have created a Powershell script to automatically add a Wireless Guest User on Cisco WLCs. (tested on 2500 Series)
The script should be completely self explanatory.
Powershell SNMP Module (Install-Module -Name SNMP)
SNMP Write Access to...