Figure 1: Web-Based Authentication Device Roles This figure shows the roles of these devices in a network. Host Detection The switch maintains an IP device tracking table to store information about detected hosts. For Layer 2 interfaces, web-based authentication detects IP hosts by using these mechanisms: • ARP based trigger—ARP redirect ACL allows web-based authentication to detect hosts with a static IP address or a dynamic IP address. • Dynamic ARP inspection • DHCP snooping—Web-based authentication is notified when the switch creates a DHCP-binding entry for the host. Session Creation When web-based authentication detects a new host, it creates a session as follows:
• Reviews the exception list. If the host IP is included in the exception list, the policy from the exception list entry is applied, and the session is established. • Reviews for authorization bypass If the host IP is not on the exception list, web-based authentication sends a nonresponsive-host (NRH) request to the server. If the server response is access accepted, authorization is bypassed for this host. The session is established. • Sets up the HTTP intercept ACL If the server response to the NRH request is access rejected, the HTTP intercept ACL is activated, and the session waits for HTTP traffic from the host.
Authentication Process When you enable web-based authentication, these events occur: • The user initiates an HTTP session. Web-Based Authentication Host Detection Web-Based Authentication 3