Cisco Catalyst 9800 - Passpoint configuration

This document is in draft version. For any problem with the configuration please contact our support team.

Prerequisites

Use Cisco IOS XE Amsterdam 17.3 or later for Cloud4Wi.

Log in to the Cisco Catalyst 9800 Series Wireless Controller Dashboard

To start the configuration process, log in to the Cisco Catalyst 9800-CL Wireless Controller Dashboard as admin.  For existing environments with additional users, log in as a user with administrative privileges.

The Cisco Catalyst 9800-CL Wireless Controller Dashboard appears. Your access points are displayed.

Note: There are a number of options you can set. Only the options that require your input are shown. Default values are used for options that don’t need adjustment.

Set up a secure RADIUS connection

It’s important to set up a secure RADIUS connection between the wireless LAN controller and Cloud4Wi. We recommend that you create a primary and a secondary RADIUS server for high availability. Then create a server group and add those servers to the group.  

Add RADIUS authentication and accounting servers

1. Select Configuration > Security > AAA from the menu on the left side of the Dashboard.
   
   
   
   The AAA page appears.
   
   
   
   
2. Make sure that RADIUS and Servers are selected.
   
3. Click + Add under Servers/Groups.
   
   The Create AAA Radius Server dialog box appears.
   
   
   
4. Enter a Name, such as “Primary_radius”.
   
5. For the Server Address enter the IP address of the Primary Radius server (52.48.102.108)
   
6. For Key, enter the value that will be communicated by Cloud4Wi, then enter the same value for Confirm Key.
   
7. Verify that Auth Port is 1812 (RADIUS authentication) and Acct Port is 1813 (RADIUS accounting).
   
8. For Server Timeout, enter “30” seconds. This is the maximum timeout as recommended in RFC 5080.
   
9. Click Apply to Device on the bottom right.
   
   You return to the AAA page where the server you added is listed.
   
   
   
   
10. To review or edit server values, select the server in the list.
    
    
    
    
11. Repeat steps 3-10 to add the Secondary RADIUS server (34.252.97.217)

Add a RADIUS server group

Using a server group, you can separate Cloud4Wi authentication requests from the rest of your network. If you don’t create a server group, the controller will send authentication requests to the default server group, which might contain servers that aren’t associated with Cloud4Wi.

1. Navigate to Configuration > Security > AAA.
   
2. On the AAA page, under Servers/Groups, select the Server Groups tab.
   
3. Make sure that RADIUS and Server Groups are selected.
   
4. Click + Add under Servers/Groups.
   
   The Create AAA Radius ServerGroup dialog box appears.
   
   
5. Enter a Name, such as “Cloud4Wi_RADIUS”.
   
6. Select all of your RADIUS servers under Available Servers.
   
7. Click > to move the servers to Assigned Servers.
   
8. Click Apply to Device on the bottom right.
   
   You see a message indicating that the configuration was saved. You return to the AAA page where the server group you added is listed.
   
   

Create AAA Method List

1. Navigate to Configuration > Security > AAA > AAA Method List
2. Select the Authentication tab and click + Add
   The Quick Setup : AAA Authentication box appears.

2. Enter a Method List Name, such as “guest_auth”.
3. For the category Type select dot1x from the drop-down menu.
   
4. For the category Group Type select group from the drop-down menu.
   
5. Select all of the RADIUS servers group previously created under Available Server Groups.
   
6. Click > to move the servers to Assigned Servers Groups.
   
7. Click Apply to Device on the bottom right.
   
   
8. Select the Accouting tab on the left and click + Add
   The Quick Setup : AAA Accouting box appears.
9. Enter a Method List Name, such as “guest_acct”.
10. For the category Type select identity from the drop-down menu.
    
11. Select all of the RADIUS servers group previously created under Available Server Groups.
    
12. Click > to move the servers to Assigned Servers Groups.
    
13. Click Apply to Device on the bottom right.
    

Configure the WLAN AA Policy

1. Navigate to Configuration > Security > Wireless AAA Policy
2. Click + Add
   The Add Wireless AAA Policy dialog appears.
   
   
   
   
3. Enter a Policy Name such as "Cloud4Wi"
4. On NAS-ID Option 1 select AP MAC Address
   
   
   
   
5. Click Apply to Device on the bottom right.

Configure Hotspot 2.0

Hotspot 2.0 allows mobile devices to join a WiFi network automatically, including during roaming, when the devices enter the Hotspot 2.0 area.

Configure ANQP Server Parameters

Access Network Query Protocol (ANQP) provides a range of information, such as IP address type and availability, and roaming partners accessible through a hotspot.

1. Select Configuration > Wireless > Hotspot/Openroaming from the menu on the left side of the Dashboard.
   
   
   
   The Hotspot/OpenRoaming page appears.
   
   
2. Click + Add under ANQP Servers.
   
   The Add New ANQP Server dialog box appears. The General/OpenRoaming tab is selected.
   
   
   

General/OpenRoaming settings

1. In the Add New ANQP Server dialog box, enter a Name for the server, such as “Cloud4Wi”.
   
2. Check the box next to Internet Access.
   
3. For Network Type, select Free Public.
   
   
4. In the NAI Realms section on the bottom left, click + Add.
   
   The Add NAI Realm page appears.
   
   
   
5. For NAI Realm Name, enter the value associated with your home network domain, as provided in the Cloud4Wi dashboard, such as “companyname.securewifi.io”.
6. For EAP Method, select eap-ttls.
   An EAP-TTLS dialog box appears.
   
7. Select inner-auth-non-eap, and check to box next to mschap2. T
   his is the EAP authentication method.
   
8. Click Save at the bottom of the EAP-TLS dialog box.
   
   
9. Click Apply to Device at the bottom of the Add NAI Realm dialog box.
   
   You see your real, such as companyname.securewifi.io listed as an NAI realm.
   
   
10. To enable also OpenRoaming, in the Roaming OIs section on the top right, enter “5A03BA0000” for Roaming OI.
    
11. Click + Add.
12. Repeat the same steps to add also the Roaming OIs "004096".
    
    You see the RCOI under Assigned ROI :: Beacon State.
    
    
13. Check the box next to Beacon State. This includes the RCOI in access point broadcasts.
    
    
    
    
14. In the Domains section, enter your home network domain, as provided in the Cloud4Wi dashboard, such as “companyname.securewifi.io” for Domain Name
    
15. Click + Add.
    
    You see the domain name in the Domain Name list.
    
    

Server Settings

1. Still on the  Add New ANQP Server dialog box, select Server Settings at the top.
   
   The Server Settings page appears.
   
   
   
2. In the WAN Metrics section, set the parameters as appropriate for your network. Don’t leave these values blank.
   
3. Set Link Status to Up.
   
4. Don’t enable Full Capacity Link unless you want to block devices from connecting. This setting tells devices that there’s no bandwidth available so devices will refuse to connect.
   
   
   
5. Click Apply to Device at the bottom right.
   
   You see a message indicating that the configuration was saved. You return to the Hotspot/OpenRoaming page where the ANQP server you added is listed.
   
   

Configure the Wireless LAN Profile

To configure the wireless LAN, you create an SSID to identify the wireless LAN. Then you associate the security profile and RADIUS servers with the wireless LAN.

Create the SSID

1. Select Configuration > Tags & Profiles > WLANs from the menu on the left side of the Dashboard.
   
   
   
   The WLANs page appears.
   
   
   
2. Click + Add.
   
   The Add WLAN dialog box appears. The General tab is selected.
   
   
   
3. Enter a Profile Name, such as, “Cloud4Wi”.
   
4. For SSID, enter your SSID name, such as “Cloud4Wi”.
   
5. Change Status to Enabled.
   
6. Click Apply to Device on the bottom right.
   
   
   
   You see a message indicating that the configuration was saved. You return to the WLANs page where the wireless LAN you added is listed.
   
   

Associate the security profile and RADIUS servers with the wireless LAN

1. Navigate to Configuration > Tags & Profiles > WLANs.
   
2. Select the wireless LAN you added.
   
   The Edit WLAN page appears.
   
   
3. Select Security at the top. The Layer2 tab is selected.
   
   
   
4. For Layer 2 Security Mode, select WPA + WPA2 (default).
   Note: do not use a security level lower than “WPA2 + WPA3”, otherwise you might get a “Security Weak” error on iOS.
   
   
5. Verify that the boxes next to these security options are checked:
   WPA2 Policy
   WPA2 Encryption AES(CCMP128)
   Auth Key Mgmt 802.1x
   
6. Select AAA at the top.
   
7. Select the Authentication list created earlier from the drop down menu, “guest_auth”.

Configure Policy Profile

A Policy Profile enables you to assign parameters like VLAN, Access Controls List [ACLs], Quality of Service [QoS].

1. Navigate to Configuration > Tags & Profiles > Policy > ADD+
   
2. The Add Policy Profile page appears.

3. Enter a Policy Name, such as, “Cloud4Wi”
   
4. Enter a Policy Description, such as, “Cloud4Wi”
   
5. Enable the Status of this profile by clicking on the category.

6. Still on the  Add Policy Profile dialog box, select Access Policies option at the top.

The Access Policies page appears as below:

7. Enter the VLAN ID allocated for Cloud4Wi WLAN, in case of default VLAN type the number 1. DO NOT leave this field blank or select default from the drop down menu.
   
   
   
   
8. Still on the  Add Policy Profile dialog box, select Advanced option at the top.
   

The Advanced Option page appears:

9. Under the WLAN Timeout section, uncheck the Client Exclusion Timeout option
   
   
10. Under Hotspot Server option (Top right) select the Hotspot Server name configured earlier, “Cloud4Wi”.
    
    
11. Under AAA Policy (Bottom Left) check the box next to Allow AAA Override and 
    as Policy Name select the Wireless AAA Policy created before (e.g. "Cloud4Wi")
    as a Accoutning List select the Accoutning List created before (e.g. Cloud4Wi")
    
    
    
    
12. Click Apply to Device at the bottom right.
    
    

Configure Policy Tag

A Policy tag is configured to connect the WLAN Profile to the Policy Profile.

1. Navigate to Configuration > Tags & Profiles > Tags > Policy > ADD
   
2. The Add Policy Tag dialogue box appears.

3. Enter a Profile Name, such as, “Cloud4Wi”.
   
4. For Description, enter “Cloud4Wi”.
   
5. Click on ADD under WLAN-POLICY Maps
   

6. Select the WLAN Profile configured earlier from the drop down menu option ("Cloud4Wi").
   
7. Select the Policy Profile configured earlier from the drop down menu option ("Cloud4Wi").
   

8. Click on the check mark below & Save & Apply to Device on the bottom right.

Assign Policy Tag

To deploy configured policies to the Access Points each Policy Tag should be attached to the required Access Point.

1. Navigate to Configuration > Wireless Setup > Advanced > Start Now > Apply

2. Click on Tag APs (Bottom Right) of the page 

3. Select the Access Points to be tagged and +Tag APs from the Top of the page
   
4.  The Tag APs dialogue box appears

5. For Policy select the Policy Tag configured earlier from the drop down menu.

6. Click Save & Apply to Device on the bottom right.