Security

Hi guys,

 

I'm new to CPPM so there are somethings that I'm still learning.

 

I would like to change a specific user from the initial vlan.

 

Workflow:

 

User associates to the open Guest SSID, gets an IP and authenticates. After that, based on that user role I would like to change his VLAN.

 

At this momment I only have 1 service for Guest Authentication. I believe that to achieve this I'll have to create a mac auth service.

 

Can someone help me to achieve this?

 

Thanks

You can create the mac caching using the CPPM Guest Mac Auth Template

 

Once you do that on the Guest Mac auth enforcement policy you can create a rule that if the device has a particular mac address you can send another VLAN

 

 

 

 

 

There is a fundamental issue with changing a user's vlan on a captive portal.  The number one reason is that the client normally does not re-ip unless it is forcefully disconnected.  This creates client-side confusion when the user's wifi drops.  Is there a reason why a guest's vlan cannot stay on the same VLAN that we have to work around?

 

cjoseph is right about that...

Well this is a requirement of a costumer.

I do agree with you that it may be unnecessary.

It is not clear to me though how can I force a guest with role XYZ to be assign into a specific vlan after the authentication.

I wouldn't like to do that based on the MAC address but on the user role.

Thank you guys!

send a COA. 

You should inform the customer that there will be inconsistent client behavior.

I understand that. 

 

I would like to test it anyway... just for learning purporses...

 

Can anyone point me some example for this?

 

Thanks a lot for your time and pacience

 

Try the following :

 

1- Using the ClearPass templates create a Guest Mac Auth 

2- Then create an enforcement profile and use the Aruba attribute Aruba-user-VLAN then add the VLAN you want that user to get 

3- Create another enforcement profile and use the Aruba attribute Aruba-user-role then add the Role you have created on the controller that points the user to the guest captive portal registration page

 

Then do the following:

 

Using this logic the device doesn't have to change VLANs instead it stays using the same VLAN at the Captive Portal Stage and after it completes registration

 

Note: I haven't tested this out so this may or may not work.

Thank you for your guidence.

 

Solved! :)