Device Roles - Cisco Catalyst 2960-X Security Configuration Manual

Device Roles

If authentication succeeds, web-based authentication sends a Login-Successful HTML page to the host and
applies the access policies returned by the AAA server.
If authentication fails, web-based authentication forwards a Login-Fail HTML page to the user, prompting
the user to retry the login. If the user exceeds the maximum number of attempts, web-based authentication
forwards a Login-Expired HTML page to the host, and the user is placed on a watch list for a waiting period.
HTTPS traffic interception for central web authentication redirect is not supported.
Note
Note You should use global parameter-map (for method-type, custom, and redirect) only for using the same
web authentication methods like consent, web consent, and webauth, for all the clients and SSIDs. This
ensures that all the clients have the same web-authentication method.
If the requirement is to use Consent for one SSID and Web-authentication for another SSID, then you
should use two named parameter-maps. You should configure Consent in first parameter-map and configure
webauth in second parameter-map.
The traceback that you receive when webauth client tries to do authentication does not have any performance
Note
or behavioral impact. It happens rarely when the context for which FFM replied back to EPM for ACL
application is already dequeued (possibly due to timer expiry) and the session becomes 'unauthorized'.
Device Roles
With web-based authentication, the devices in the network have these specific roles:
• Client—The device (workstation) that requests access to the LAN and the services and responds to
• Authentication server—Authenticates the client. The authentication server validates the identity of the
• Switch—Controls the physical access to the network based on the authentication status of the client. The
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
360
requests from the switch. The workstation must be running an HTML browser with Java Script enabled.
client and notifies the switch that the client is authorized to access the LAN and the switch services or
that the client is denied.
switch acts as an intermediary (proxy) between the client and the authentication server, requesting
identity information from the client, verifying that information with the authentication server, and relaying
a response to the client.
Configuring Web-Based Authentication
OL-29048-01