Configuring Web Authentication Options

The following steps configure the options available for Web Authentication.

Enable RADIUS accounting.

device(config-vlan-10-webauth)# accounting

Create a list of trusted ports.

device(config-vlan-10-webauth)# trust-port ethernet 1/1/3
device(config-vlan-10-webauth)# trust-port ethernet 1/1/6 to 1/1/10

Configure a host to be permanently authenticated.
```
device(config-vlan-10-webauth)# add mac 0000.00eb.2d14 duration 0
```

Configure the re-authentication period (number of seconds a host remains authenticated before being logged off).
```
device(config-vlan-10-webauth)# reauth-time 10
```
You can specify 0 through 128000 seconds. The default is 28800 seconds, and 0 means the host is always authenticated and will never have to re-authenticate, except if an inactive period less than the re-authentication period is configured on the Web Authentication VLAN. If this is the case, the host becomes de-authenticated if there is no activity and the timer for the inactive period expires.

Define the authentication cycle time.
```
device(config-vlan-10-webauth)# cycle time 20
```

Limit the number of Web Authentication attempts.
```
device(config-vlan-10-webauth)# attempt-max-num 4
```

Set the block duration for Web Authentication attempts, specifying how many seconds users must wait before the next cycle of Web Authentication begins.
```
device(config-vlan-10-webauth)# block duration 4
```

Manually block a specific host from attempting Web Authentication.
```
device(config-vlan-10-webauth)# block mac 0000.00d1.0a3d duration 4
```

Limit the number of hosts that can be authenticated at a time.
```
device(config-vlan-10-webauth)# host-max-num 300
```

Define Domain Name System (DNS) filters that will restrict DNS queries from unauthenticated hosts to be forwarded explicitly to defined
```
device(config-vlan-10-webauth)# dns-filter 1 10.166.2.44/24
```

Enable forced reauthentication of the hosts if all the ports on the device go down.
```
device(config-vlan-10-webauth)# port-down-authenticated-mac-cleanup
```

Configure the time duration after which the user-associated MAC address is aged out and reauthentication is enforced.
```
device(config-vlan-10-webauth)# authenticated-mac-age-time 300
```

Configure a redirect address for Web Authentication to prevent the display certificate mismatch error message.
```
device(config-vlan-10-webauth)# webauth-redirect-address my.domain.net
```

Clear authenticated hosts from the Web Authentication table.
```
device# clear webauth vlan 25 authenticated-mac
```