Connect your Cisco Catalyst 9800 or AireOS wireless LAN controller to CaptiFi with Central Web Authentication (CWA): capture guest emails, automate Google reviews and run marketing on autopilot. No ISE required.
As of August 2026, CaptiFi supports both Cisco WLC operating systems using Central Web Authentication (CWA): the same ISE-style flow, with CaptiFi acting as the RADIUS server. You do not need ISE.
| Catalyst 9800 | Appliance, cloud or embedded, running IOS-XE 17.x. Follow steps 2 to 4 below. |
|---|---|
| AireOS WLC | 5500, 8500 or virtual WLC running AireOS 8.x (for example serving Aironet 2700 APs). Follow steps 2 and 3 conceptually, then the AireOS section. |
The sequence at runtime: a guest joins your open guest SSID, the WLC sends MAC authentication (MAB) to CaptiFi's RADIUS server, unknown guests are accepted into a quarantine state with a redirect to your CaptiFi splash page, the guest completes the splash form, CaptiFi authorises their MAC and tells your WLC to re-check the session (CoA on the 9800, Disconnect-Request/PoD on AireOS), and the WLC re-authenticates the session and grants full internet access.
url-redirect attribute), pointing the guest at your branded splash page, which you design in the CaptiFi dashboard's Splash Manager. The exact URL for your site is shown in your config pack.On the 9800 GUI, go to Configuration → Security → AAA → Servers/Groups → RADIUS → Servers → Add and enter:
| Server Address | radius.captifi.io |
|---|---|
| Auth Port | 1812 |
| Accounting Port | 1813 |
| Shared Secret | Provided by CaptiFi in your config pack (also shown in the dashboard's Cisco Setup Guide) |
| Support for CoA | Enabled |
CLI equivalent, including dynamic authorization for CoA:
Then create a server group and the method lists the WLAN will reference:
The ACL named CAPTIFI_REDIRECT controls which traffic is intercepted (redirected to the splash) versus allowed through pre-authentication:
deny (reachable pre-auth), all other web traffic permit (redirected).These are the CaptiFi hosts that must be reachable before login:
url-redirect-acl av-pair, so any other name is never matched.Go to Configuration → Tags & Profiles → WLANs → Add and configure:
| Guest SSID security | Layer 2 → None (open, the splash page handles sign-in) |
|---|---|
| MAC Filtering | Enabled, select the CAPTIFI_AUTHZ authorization list |
In the Policy Profile for this WLAN:
| AAA Override | Enabled |
|---|---|
| NAC State | Enabled, NAC Type RADIUS |
| Accounting list | CAPTIFI_ACCT |
CLI equivalent (key lines):
AireOS (5500, 8500 or virtual WLC running 8.x) uses the same CaptiFi RADIUS settings but a different GUI and, importantly, opposite ACL semantics.
Go to Security → AAA → RADIUS → Authentication → New: server IP is the resolved IP of radius.captifi.io, shared secret from your config pack, port 1812, Support for CoA enabled. Repeat under Accounting with port 1813.
The ACL must again be named exactly CAPTIFI_REDIRECT, but AireOS redirect ACLs use normal permit semantics, the opposite of the Catalyst 9800: you permit the traffic that should reach the network pre-auth, and the implicit deny-all at the bottom is what drives the redirect. Under Security → Access Control Lists, permit DNS (UDP 53, both directions), DHCP (UDP 67 and 68, both directions), and TCP 80 and 443 to app.captifi.io and captifi.io. Do not add a blanket permit for all web traffic: that would let HTTP/HTTPS through and suppress the redirect.
CAPTIFI_REDIRECT must exist BOTH as a FlexConnect ACL mapped to your FlexConnect group (Wireless → FlexConnect Groups → your group → ACL Mapping → Policies) AND as an identically named regular ACL under Security → Access Control Lists. Missing either is the most common reason a client gets an IP but is then denied instead of redirected.| Security → Layer 2 | None, with MAC Filtering enabled |
|---|---|
| Security → Layer 3 | None |
| Security → AAA Servers | Select the CaptiFi RADIUS server for Authentication and Accounting |
| Advanced | Allow AAA Override enabled, NAC State = RADIUS NAC (the AireOS 8.x GUI labels this ISE NAC, it is the same setting), and FlexConnect Local Switching enabled if your APs run FlexConnect |
Connect a phone to the guest SSID. The CaptiFi splash page should appear automatically (or open a browser to any HTTP site). Complete the splash form: full internet access should be granted within a few seconds, which is the CoA plus re-auth round trip.
Verify the capture landed in your CaptiFi dashboard under Site Guest Logs. If the guest shows up, you are live.
| No splash page appears | Verify MAC filtering points at the CaptiFi authorization list and the WLC can reach radius.captifi.io:1812 (UDP). |
|---|---|
| Splash page will not load | Check the redirect ACL entries for DNS and the CaptiFi hosts: guests must be able to reach app.captifi.io pre-auth. |
| Guest stuck after submitting the form | CoA/PoD may be blocked. Verify dynamic authorization is enabled and the right UDP port is open inbound from CaptiFi to the WLC: 1700 on the 9800, 3799 on AireOS. |
| "RADIUS server not responding" | Check the shared secret matches exactly; verify no firewall blocks UDP 1812/1813 outbound. |
| Works once, then guests re-prompted | Session timeout: CaptiFi returns the session length from your site settings. Check minutes authorised in your dashboard. |
| ACL errors in logs | The ACL name must be exactly CAPTIFI_REDIRECT (case-sensitive). |
| AireOS FlexConnect: client gets an IP then "network access denied", never redirected | With FlexConnect local switching the redirect only enforces when CAPTIFI_REDIRECT exists both as a FlexConnect ACL mapped to the group and as an identically named regular ACL. See the AireOS section above. |
Useful debug commands on the 9800:
CaptiFi is honest about this: you do not need to buy anything new. There are two paths and both are included with your plan.
| Use your existing Cisco kit | If you already run a Catalyst 9800 or AireOS WLC with joined access points, follow the steps above. CaptiFi acts as the RADIUS server and serves the branded splash. No ISE, no extra hardware. |
|---|---|
| Use our included plug-and-play device | No Cisco controller, or you would rather not touch the WLC? We post you a pre-configured CaptiFi device. Plug it into your existing network by Ethernet, it pulls its config from the cloud, and a guest SSID appears in about two minutes. No controller, no static IP, no firewall changes. |
As of August 2026, CaptiFi supports the Catalyst 9800 family (appliance, cloud and embedded, running IOS-XE 17.x) and AireOS WLCs (5500, 8500 and virtual WLC running 8.x). Both use the same CWA flow with CaptiFi as the RADIUS server.
No. CaptiFi uses the same ISE-style Central Web Authentication flow, but CaptiFi itself acts as the RADIUS server. There is nothing else to license or deploy.
You do not. On a Cisco WLC the redirect URL is returned dynamically by CaptiFi in the RADIUS reply (the url-redirect attribute), so there is no splash URL field to fill in. You design the splash page itself in the CaptiFi dashboard's Splash Manager.
The re-authorisation message is probably blocked. Verify dynamic authorization is enabled on the WLC and that the right UDP port is open inbound from CaptiFi: 1700 for CoA on the Catalyst 9800, 3799 for Disconnect-Request on AireOS.
No. CaptiFi only handles the sign-in splash page and the RADIUS authorisation. Once a guest is through, their traffic runs straight over your Cisco network as normal. Speeds are unaffected.
Yes. CaptiFi captures guest details with clear consent and keeps a full audit trail, so the email capture on your Cisco guest WiFi stays UK GDPR and PECR compliant.
CaptiFi partners resell at a 30-40% wholesale margin, with white-label available at the same wholesale rates. You set your own retail price and bill your clients directly. The full wholesale rate card is published in six currencies (GBP, USD, EUR, CAD, AUD and NZD).
Start a free 30-day trial, or watch a live demo first.