Campus lan and Wireless lan solution Design Guide

Local web authentication
—With this method, the web session of the guest device is redirected by the 
guest wireless controller to a web portal containing the login screen within the guest wireless controller.
The guest’s credentials are then checked against the local database within the guest wireless controller.
The advantage of this option is that the entire management of guest wireless access is confined to the 
guest wireless controller within the DMZ. The downside of this option is that guest credentials are 
maintained separately within the guest wireless controller. 
● 
Central web authentication
—With this method, the web session of the guest device is redirected by the 
guest wireless controller to an external web portal containing the login screen. The guest’s credentials 
are then checked against an external database within an authentication, authorization, and accounting 
(AAA) server. Cisco Identity Services Engine (ISE) can provide both the external web portal and AAA 
server functionality. By positioning the web authentication login portal in a central server, the network 
administrator can provide one unified login page—with an optional AUP or EUA—for all wireless guest 
access without having to create a separate login page on each guest wireless controller. By moving the 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 54 of 76
guest credential database and guest sponsor portal to an AAA server, the network administrator can 
provide one central place for creating and managing guest credentials, versus having to create guest 
credentials on each guest wireless controller. 
● 
Cisco DNA Spaces-based guest onboarding
—Cisco DNA Spaces-based guest-onboarding is often 
implemented by organizations who wish to provide free Internet access within their venue, in exchange 
for collecting some information from customers who visit the site. With this method, guests can use the 
wireless network and access the Internet from the venue by logging in using their existing social media 
credentials. The venue owner may also choose to allow anonymous login to the wireless network. The 
venue owner may also optionally choose to display a splash page and registration form, customized for 
that venue location.