Set up Cisco wireless controllers (web auth + RADIUS) with MyWiFi

MyWiFi works with Cisco wireless LAN controllers using external web authentication and RADIUS. The controller sends each guest to your MyWiFi splash page (the branded login page guests see). After the guest logs in, the guest's browser posts the login back to the controller, and the controller checks it with MyWiFi's RADIUS server.

Not supported: MyWiFi does not integrate with Cisco Identity Services Engine (ISE) or Catalyst Center. There is no ISE sponsor account, ISE API connection, Central Web Authentication or Change of Authorization (CoA) setup in MyWiFi. If ISE is in your network, leave it out of the guest SSID described below. Using Cisco Meraki? Follow the Meraki article instead.

What you'll need

• Admin access to your Cisco wireless controller.
• The MAC address of every access point that will broadcast the guest SSID.
• MyWiFi's RADIUS server address and shared secret, and the external web-auth (splash page) URL for your account. These aren't shown in the dashboard, so email support@mywifinetworks.com for them before you start.
• A MyWiFi location already created for this venue.

Step 1: add the device in MyWiFi

1. Go to Devices and click Add New Device.
2. Choose the Location and enter a Device Name.
3. Under Select Your Hardware, choose Cisco. Don't choose Cisco Meraki, which is a different integration.
4. In MAC Address, paste the MAC addresses of every access point that serves the guest SSID, separated by commas. Each one appears in the list below the field.
5. Check the summary and click Confirm Setup.

MyWiFi doesn't connect to your controller or change its settings. Everything on the controller side is done by you, in step 2.

Step 2: configure the controller

1. Add MyWiFi's RADIUS server (from support) as an authentication server and an accounting server, with the shared secret.
2. Create an open guest SSID (no WPA key) and turn on Layer 3 web authentication with an external web-auth server. Use the external web-auth URL from support.
3. Set the SSID's web-auth to authenticate against the MyWiFi RADIUS server from item 1.
4. Add the MyWiFi portal host to the pre-authentication ACL (walled garden). Guests must be able to reach it before they log in.
5. Apply the configuration to the access points whose MAC addresses you entered in step 1.

Step 3: test one access point first

Connect a phone to the guest SSID near one of the access points you registered. You should see your venue's MyWiFi splash page and get online after logging in.

• You see a generic page instead of your venue's campaign: the access point that served you isn't in the device's MAC address list. Edit the device and add it.
• The splash page loads but login never finishes: check the RADIUS server and shared secret on the controller, and check that guests can reach the controller's virtual/web-auth address.

Related articles

• Set up Cisco Meraki with MyWiFi
• Edit a device