Wireless Access

Hello,

I have a screnario at a school which the students are given access to the WiFi network using Captiv portal, please find the below details:

- Controller 3400

- Most APs are 105 and 93

- Captive portal users are created manually by the IT team

It is required that students have the ability to reset their passwords through web without getting back to IT department again, also each student is allowed to login using one device only and should logout before log in using another device.

Is the above mentioned requirements achievable, if so how is it configured on the controller.

You should really consider Clearpass guest for these requirements.  Not only can students self-register but they can also have complete control with a self-service portal for resetting passwords, etc...

In addition, you can write policy to limit the amount of devices per account as well as cache the MAC address so that for the duration of the account's validity, the student wouldn't have to re-login to the captive portal.  

Finally, in 6.4, Clearpass can even notify the student when the account will expire.

I guesse clearpass is the only solution, i was hoping there would be a work around...

Is there any guide on how to configure a poilicy to limit the number of devices per account ?

Also how would the user log out in order to use another device ? or just simply disconnecting from the SSID would be considered as logout

In Clearpass, when you walk through the service templates ("start here" under configuration), there is a section which asks how many devices per guest.

Oh.. seems i miss understood you, so limiting the number of devices per user also needs clearpass as well

There is no way it can be done using the controller firewall ?

Another option if you're using AOS 6.4.x+, and you want to limit the account to one device, you can use the "Allow only one active user session" in the captive portal profile.

"If you do not want multiple guest users to share the same guest account concurrently, navigate to the Captive Portal Authentication and select the “Allow only one active user session” option. If a guest user authenticates successfully but the controller detects there is already a guest session with the same guest username, the second login is rejected."