Wired Intelligent Edge

last person joined: yesterday 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

Aruba 3810M Wired Guest

This thread has been viewed 2 times

  • 1.  Aruba 3810M Wired Guest

    Posted Apr 29, 2017 10:31 PM

    Hi Folks. I am trying to do wired guest with ClearPass and Aruba 3810M access switches.  I have two services on CPPM to accomplish this:

    1. First service is Allow All MAC AUTH. If EndPoint is Unknown, it returns dynamic ACL along hpe-captive-portal-url attribute to the switch. If endpoint is know, an unrestricted profile is sent to the switch.

    2. Second service is Web-auth to authenticate the captive portal user.

     

    Everything seems to be working as aticipated. If an unknown endpoint comes on the network, I can see radius ACL assinged on the port (show access-list radius port id) and captive portal URL receied by the switch (show port-access clients detailed). Somehow, client is not being automatically redirected to the captive portal page. End to end flow works fine if I manually type the registration page URL and register/login.

     

    I do have L3 interface on guest VLAN creatd on the switch. Running out of options to troubleshoot this issue further. Any help would be appreciated.

     

    I also have a TAC case opened, but havent progressed bit in last 4 days unfortunately.



  • 2.  RE: Aruba 3810M Wired Guest

    EMPLOYEE
    Posted Apr 29, 2017 11:49 PM

    What version of ArubaOS-Switch?



  • 3.  RE: Aruba 3810M Wired Guest

    Posted Apr 30, 2017 12:14 AM

    Was running on 16.03.0003 & yesterday upgraded to 16.03.0004. both have similar behavior.



  • 4.  RE: Aruba 3810M Wired Guest

    EMPLOYEE
    Posted Apr 30, 2017 11:57 AM

    Please post screenshots of your enforcement profile(s).



  • 5.  RE: Aruba 3810M Wired Guest

    Posted Apr 30, 2017 07:32 PM

    Hi Tim,

     

    Please find below:

     

    1.PNG

     

    2.PNG

     

    3.PNG

     

    4.PNG

     

    5.PNG

     

    Also, I can vertify correct attributes sent back to the switch:

    5a.PNG

     

    6.PNG

     

    7.PNG

     

    And the switch config is pretty simple:

    l3swaccstack# sh ip  | inc 153
      Wi-Fi_Guest04        | Manual     172.25.153.200  255.255.255.0    No    No
    l3swaccstack#

    ==================================================

    radius-server host 172.25.16.4 key "xxxx"
    radius-server host 172.25.16.4 dyn-authorization
    radius-server host 172.25.16.4 time-window 0

    aaa authentication port-access chap-radius
    aaa port-access mac-based 1/48

    aaa authentication captive-portal enable

     

    where 172.25.16.4 is CPPM VIP.



  • 6.  RE: Aruba 3810M Wired Guest

    Posted Apr 30, 2017 07:36 PM

    Hi Tim,

     

    For some reason I am unable to add the screenshots inline. I have atttached them.

     

    The switch config is pretty simple:

    radius-server host 172.25.16.4 key "xxxxx"
    radius-server host 172.25.16.4 dyn-authorization
    radius-server host 172.25.16.4 time-window 0

    aaa authentication port-access chap-radius
    aaa port-access mac-based 1/48

    aaa authentication captive-portal enable

     

    l3swaccstack#
    l3swaccstack# sh ip  | inc 153
      Wi-Fi_Guest04        | Manual     172.25.153.200  255.255.255.0    No    No
    l3swaccstack#

     

    where 172.25.16.4 is CPPM VIP.



  • 7.  RE: Aruba 3810M Wired Guest
    Best Answer

    EMPLOYEE
    Posted May 01, 2017 08:50 AM

    You need the following two entries to trigger the redirect:

    Radius:IETF	NAS-Filter-Rule	=	deny in tcp from any to any 80 cpy
Radius:IETF	NAS-Filter-Rule	=	deny in tcp from any to any 443 cpy

    Also, you may want to consider using user-roles instead. Much easier.



  • 8.  RE: Aruba 3810M Wired Guest

    Posted May 01, 2017 07:07 PM

    Hi Tim,

     

    Thanks. I am out of site for couple of days. Will check and update you.



  • 9.  RE: Aruba 3810M Wired Guest

    Posted May 10, 2017 06:22 PM
    Hi Tim. Adding these statements made it work. Thanks..


    #AirheadsMobile