How can I secure CISCO Radius?

Question

Cisco offers a WLAN system that allows admins to restrict WiFi access to authenticated users. However, the following statement bothers me:

1. Use the secure https://1.1.1.1/login.html.

   .... A security alert window displays.

2. Click Yes in order to proceed.

That security alert is a warning that the HTTPS certificate is invalid. As best I can tell, nothing prevents an attacker from setting up a rogue AP to phish passwords intended for login.html. Even more worrisome, if the attackers don't use SSL, Firefox is more likely to warn about a legitimate AP than a phising one!

Can anything be done here?

Answer 1

To specifically answer your question, you need to install a valid SSL certificate under Security > Web Auth > Certificate on the controller's web UI. That will allow you to use SSL to authenticate users through the controller's captive portal.

This protects their password, but it doesn't protect the wireless traffic because the rest of the traffic won't be encrypted. For that, you should really look into using WPA2-Enterprise for your users.