Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

5-9
Web Authentication for Mobile Users
Overview
The Wireless Edge Services xl Module automatically permits certain station
traffic, even when the destination is not on the Allow list:
■ DHCP requests—The station must receive an IP address before it can
access the Web login page and authenticate.
■ Domain Name System (DNS) requests—The station must attempt to
reach a valid IP address in order for the Wireless Edge Services xl Module
to redirect the browser to the login page. The DNS requests allows the
station’s Web browser to resolve a Web site URL to a valid IP address.
So you do not need to add the IP addresses of your DHCP and DNS servers to
the allow list.
The only necessary IP address on the Allow list is that of the Web server—
when you store the Web-Auth login, welcome, and failed pages on an external
Web server. On the other hand, if these pages are stored on the Wireless Edge
Services xl Module, you do not have to add the module’s IP address to the
Allow list. In fact, to protect management access to the module, you should
not.
You can add a maximum of 10 IP addresses to the Allow list.
Creating a VLAN Interface for the Web-Auth VLAN
The Wireless Edge Services xl Module requires an IP address on the static
VLAN to which the Web-Auth WLAN maps. See “IP Settings” on page 6-3 of
Chapter 6: IP Services—IP Settings, DHCP, and DNS for information on
creating the VLAN interface and assigning it an IP address.
You can apply access control lists (ACLs) to the VLAN interface in order to
continue to control traffic from the wireless stations, even after they authen-
ticate. You can also apply dynamic Network Address Translation (NAT) to
traffic from wireless users, protecting the IP addresses used in your private
network. (See Chapter 7: Access Control Lists (ACLs) and Chapter 8: Con-
figuring Network Address Translation (NAT).)
You can also, if you so desire, have the module place users in dynamic VLANs
after they authenticate. With Web-Auth, however, stations initially receive IP
addresses in the static VLAN. To allow stations to receive IP addresses in the
dynamic VLAN after users authenticate, set the lease time in the DHCP
configuration for the static VLAN very low.