Deployment Guide

Deploying Centralized Web
Authentication
Deployment Strategy on page 120
CWA with ISE Deployment on page 121
CWA with ExtremeControl Deployment on page 136
Deployment Strategy
Centralized Web Authentication (CWA) provides the URL for the captive portal dynamically through
RADIUS attributes, following the successful authentication over 802.1x. CWA can integrate with both an
ExtremeControl captive portal server and a Cisco® ISE captive portal server.
The configuration required on Extreme Campus Controller is the same regardless of the captive portal
server used:
On Extreme Campus Controller:
1. Configure a AAA Policy, defining the RADIUS server, then reference that AAA Policy on the CWA
captive portal network configuration.
The RADIUS server in the AAA Policy is the authentication server that sends the redirection attribute
back to Extreme Campus Controller. You only need the role name on Extreme Campus Controller to
match the Filter-ID sent in the RADIUS-Accept.
2. Configure a CWA captive portal network.
3. Configure a Redirect Policy Role that includes at least one redirect rule.
When integrating with an ExtremeControl server, we use the ExtremeControl rules engine. The rule
engine assigns the policy Unregistered to the redirection and assigns the policy Enterprise User when
authenticated by the captive portal:
1. Map the redirection policy that you created on Extreme Campus Controller to ExtremeControl.
2. Create an allow policy on Extreme Campus Controller and map it to ExtremeControl.
When integrating with a Cisco® ISE captive portal server:
1. Configure an Authorization Profile that references the policy role configured on Extreme Campus
Controller.
2. Configure an Authorization Policy that references the Authorization Profile.
120
Extreme Campus Controller Deployment Guide for version 5.46.03