Security

Just curious if this is even possible.

I am in the process of deploying, and found out the client has no PEFNG licenses.  I cannot use User Roles since the PEFNG is required for that.  I have the re-direct working, but it looks like it never passes on anything other than a MAC Auth to the clearpass server.

Thanks.

Yes, this is definitely possible.

Did you configure the RADIUS server for the L3 Captive Portal Profile to point to ClearPass and enable User Login on the Captive Portal Profile?

I configured the layer 3 portal and it does redirect me to the page.  The whole flow on the guest side of clearpass looks fine.  I never see any other entry in Access tracker after submitting though.

And you checked that User Login was enabled in the Captive Portal profile?

correct, it has user login checked.

Ok, that looks good.

What about the Server Group for that Captive Portal profile?

It points to the Clearpass server group, and the clearpass server is in that group.

I have also tested the Server group itself with an 802.1X SSID point to it. 

A couple things to check...

1. Do you see anything of interest in CPPM->Monitoring->Even Viewer?

2. In CPG, Under the Guest Self Reg page you are using, check the NAS Login settings. They should be set to Aruba. If you ever changed your certificate on your controller, then you will need to change the IP Address listed from securelogin.arubanetworks.com to whatever the cert was that you put on your controller. Or for testing with a single controller, you could set this to the IP address of the controller on the Guest VLAN.

Now without the PEFNG licenses, I cannot push down Aruba User roles can I?  I know that I cannot create them in the controller.

Correct. You cannot use user roles. Just send an Allow Access profile for successful Guest Auth. Then the user will get the guest role.

You will need to make the same change for the MAC caching service. Just pass Allow Access enforcement profile for successful auth.

That was it, they changed their cert.  I updated to what they changed their cert to and it started working.  Thanks for all the help!

I think what Tim means here is that your MAC Caching service should be deny access by default so that the guest user gets the default AAA profile (Captive Portal profile) when they first connect.

So, you should see MAC Auth failure on the first connection attempt.

That is correct, I get a MAC Auth failure first.