• The custom login page should follow best practices for a web form, such as page timeout, hidden password, and prevention of redundant submissions. Redirection URL for Successful Login Guidelines When configuring a redirection URL for successful login, consider these guidelines: • If the custom authentication proxy web pages feature is enabled, the redirection URL feature is disabled and is not available in the CLI. You can perform redirection in the custom-login success page. • If the redirection URL feature is enabled, a configured auth-proxy-banner is not used • To remove the specification of a redirection URL, use the no form of the command.
• If the redirection URL is required after the web-based authentication client is successfully authenticated, then the URL string must start with a valid URL (for example, http://) followed by the URL information. If only the URL is given without http://, then the redirection URL on successful authentication might cause page not found or similar errors on a web browser. Web-based Authentication Interactions with Other Features Port Security You can configure web-based authentication and port security on the same port. Web-based authentication authenticates the port, and port security manages network access for all MAC addresses, including that of the client.
You can then limit the number or group of clients that can access the network through the port. LAN Port IP You can configure LAN port IP (LPIP) and Layer 2 web-based authentication on the same port. The host is authenticated by using web-based authentication first, followed by LPIP posture validation. The LPIP host policy overrides the web-based authentication host policy. If the web-based authentication idle timer expires, the NAC policy is removed. The host is authenticated, and posture is validated again. Gateway IP You cannot configure Gateway IP (GWIP) on a Layer 3 VLAN interface if web-based authentication is configured on any of the switch ports in the VLAN.
You can configure web-based authentication on the same Layer 3 interface as Gateway IP. The host policies for both features are applied in software. The GWIP policy overrides the web-based authentication host policy. ACLs If you configure a VLAN ACL or a Cisco IOS ACL on an interface, the ACL is applied to the host traffic only after the web-based authentication host policy is applied. For Layer 2 web-based authentication, it is more secure, though not required, to configure a port ACL (PACL) as the default access policy for ingress traffic from hosts connected to the port. After authentication, the web-based authentication host policy overrides the PACL.
The Policy ACL is applied to the session even if there is no ACL configured on the port. Web-Based Authentication Redirection URL for Successful Login Guidelines Web-Based Authentication 9