Controllerless Networks

Reply
MVP
Posts: 145
Registered: ‎07-12-2012

How to provide Guest&Employee access with the same SSID using Instant & Captive portal/WPA-2 E#mhc

[ Edited ]

                 I will add 2 ways of doing the access using the same SSID:

  • Using a Captive Portal (this tutorial is done using internal Radius but Aruba support advised that they are not supporting this type of Captive Portal setup even if through the WEB GUI of the AP we are able to do such configuration and they are planing on limiting the choise in the WEB GUI) - the work arround is to use an external Radius server or ClearPass
  • Using WAP-2 Enterprise (Tested and working on 4.0.0.3)

 

                The only improvement that I would like to see for this setup is to have the Reauth interval defined on the user role and I added an Idea on the Aruba site: https://arubanetworkskb.secure.force.com/prm/ideas/viewIdea.apexp?id=08740000000LEgT.

 

 

How to provide Guest and Employee access with the same SSID using Instant solution with Captive Portal

 

 

                The idea of the tutorial was to be able to introduce new clients to the Aruba solution with the minimal investment in the hardware. Once the client would understand the benefits of getting Aruba hardware in his environment and would require an increase in scale we would depending on the size campus solution or we would stick with the instant solution.

                High level the solution is to use a simple external captive portal, because this option provides access to the role base authentication on the iAP, with the internal Radius server. The external captive portal can be hosted on any computer that has apache with php installed.

                We will start first with preparing the core code for the HTML pages that we will use to give access:

-          Index.html will provide the choice of Guest or Employ access :

<form method=POST action="http://securelogin.arubanetworks.com/cgi-bin/login">

 <input name=user value="GUsername" type="hidden">

<input name=password value="GUpassword" type="hidden">

<input name=cmd value="authenticate" type="hidden">

<input name=mac value="" type="hidden">

<input name=ip value="" type="hidden">

<input name=essid value="" type="hidden">

<input name=url value="http://www.google.com" type="hidden">

<BR><input type="submit" name="Guest" value="login" class="button" />

</form>

<a href="employ.html"><button type="button">Employ Access </button></a>

-          Employ.html will provide the possibility to enter a username and password

<form method=POST action="http://securelogin.arubanetworks.com/cgi-bin/login">

 Username: <input name=user value="">

Password: <input name=password value="" type="password" size=25>

<input name=cmd value="authenticate" type="hidden">

<input name=mac value="" type="hidden">

<input name=ip value="" type="hidden">

<input name=essid value="" type="hidden">

<input name=url value="http://www.google.com" type="hidden">

<BR><input type="submit" name="Guest" value="login" class="button" />

</form>

 

 

 

 

Now that the pages are done we will start to configure the iAP to provide different roles based on what username is typed:

-          We will configure first the captive portal profile on the iAP:

  • Under Security -> External Captive Portal we will click the New button

 ext_captive portal profile.JPG

-          Now we will configure the Users:

  • Under Security -> Users for Internal Server we will add our usernames and passwords using the type Guest

 User creation for the captive portal.JPG

-          Next step will be to create the 2 user roles that we will want to give to the Guest users will be put under “Guest_cp” and Employ users will be put under “Employ_cp”

At this stage we will start to configure the SSID that will bring all this together:

-          Step 1 :

 SSID step 1.JPG

-          Step 2 (We could do Virtual Controller assigned or Network with VLAN’s and Client VLAN Assignment Dynamic if we want to split the users on VLAN’s too)

 

 SSID step 2.JPG

 

-          Step 3 – we will choose the Slash page type to external and choose the Captive portal profile to the one that we have created previously (Marked in red are the options that need to be changed the other options are optional):

 

SSID step 3.JPG

 

-          Step 4 – Access rules will be Rule-based and then we create the Role Assignment Rules as in the picture bellow:

 

SSID step 4.JPG

 

           

 

 

How to provide Guest and Employ access with the same SSID using Instant solution with WAP2-Enterprise

 

 

                The idea of the tutorial was to be able to introduce new clients to the Aruba solution with the minimal investment in the hardware. Once the client would understand the benefits of getting Aruba hardware in his environment and would require an increase in scale we would depending on the size campus solution or we would stick with the instant solution.

                High level the solution is to use a WPA2-Enterprise and internal Radius server in order to provide 2 or more user roles.

                The first thing that we want first to think about is how to do the separation of the usernames between the Guest and Employee. The way I will do it is to use a set of character specific to each type, for Guest the username will start with “GU” and the employee will start with “EM”

Now we will configure the Users:

  • Under Security -> Users for Internal Server we will add our usernames and passwords using the type Employee

User creation.JPG 

 

-          Next step will be to create the 2 user roles that we will want to give to the Guest users will be put under “Guest_wpa” and Employ users will be put under “Employee_wpa”

 

 

 

At this stage we will start to configure the SSID that will bring all this together:

-          Step 1 :

 SSID step 1.JPG

-          Step 2 (We could do Virtual Controller assigned or Network with VLAN’s and Client VLAN Assignment Dynamic if we want to split the users on VLAN’s too)

 

 SSID step 2.JPG

 

-          Step 3 – we will choose Enterprise with Key management WPA-2 Enterprise and of course we will choose for the Authentication server the internal server:

 SSID step 3.JPG

 

-          Step 4 – Access rules will be Rule-based and then we create the Role Assignment Rules as in the picture bellow:

 

   SSID step 4.JPG

 

If you found my post helpful, please give kudos!
MVP
Posts: 145
Registered: ‎07-12-2012

Re: [Tutorial] How to provide Guest and Employ access with the same SSID using Instant solution #mhc

[ Edited ]

Please be advised that Aruba is planning on removing this feature in the future releases because they were unable to make it properly work.

 

The feature is to use the role-base authentication when using the INTERNAL RADIUS.

 

The way for the solution to work is using an external Radius server and the captive portal will still work. Another way is using ClearPass.

If you found my post helpful, please give kudos!
Search Airheads
Showing results for 
Search instead for 
Did you mean: