Web-Based Authentication This chapter describes how to configure web-based authentication on the device. It contains these sections: Restrictions for Web-Based Authentication, on page 1 Information About Web-Based Authentication, on page 1 How to Configure Web-Based Authentication, on page 10 Verifying Web-Based Authentication, on page 22 Feature History for Web-Based Authentication, on page 22 Restrictions for Web-Based Authentication A device without host switch virtual interface (SVI) does not intercept TCP SYN packets for Cisco Identity Services Engine (ISE) posture redirection.
Information About Web-Based Authentication Web-Based Authentication Overview Use the web-based authentication feature, known as web authentication proxy, to authenticate end users on host systems that do not run the IEEE 802.1x supplicant. When you initiate an HTTP session, web-based authentication intercepts ingress HTTP packets from the host and sends an HTML login page to the users. The users enter their credentials, which the web-based authentication feature sends to the authentication, authorization, and accounting (AAA) server for authentication.
If authentication succeeds, web-based authentication sends a Login-Successful HTML page to the host and applies the access policies returned by the AAA server. If authentication fails, web-based authentication forwards a Login-Fail HTML page to the user, prompting the user to retry the login. If the user exceeds the maximum number of attempts, web-based authentication forwards a Login-Expired HTML page to the host, and the user is placed on a watch list for a waiting period. HTTPS traffic interception for central web authentication redirect is not supported. Note Web-Based Authentication 1