Wireless Access

does anyone know how to configure guest user idle timeout on ClearPass 6.5.5.78974 (CP-HW-5K platform).?

Tim,

Guest users have to re-authenticate after a short period of time (5mins).  Guest users authenticate throught a portal page and accounts are set to expire at 1 day

You would typically use the mac-caching functionality to achieve that.

Otherwise you can override the global timeout in the captive portal profile on the controller and set it to something appropriate.

Mac-caching is configured, but I don't see anything about idle timeout and session time out

When the client initially connects to the SSID, they will fall into the initial Role and hit the captive portal. On successfull CP auth, the uses MAC address will be cached on the Clearpass server and when the next time the users try to connect to the SSID, they will pass MAC auth and will fall into the mac-auth default role. 

Is MAC authenticated configured for the Guest SSID?

What is the MAC auth default role?

@skrishnamoorthy, would guest authentication for SSID be configured on controller or CP?  I do not have access to the controllers, they are managed by another team.  Can you tell me where to check MAC default role?

John,

When the client connects to the wireless, they will fall into the initial role (user-role) which is configured on the controller. The user-role on the controller will have captive portal ACL's & captive portal profile which will redirect them to the clearpass guest login page. User sends the user name and password for the captive portal to the controller which is forwarded to the clearpass for authentication. Once authenticated, the client will fall into a different user-role on the controller(post-auth) which will allow the clients to get to the internet.

Answering your questions:

For guest authentication, we need to Profiles, policies and services needs to be created on both clearpass and controller. 

You can view the mac-default role by checking the aaa profile on the controller.

#show aaa profile <profile name>

skrishnamoorthy,

Thank you for info, I will have to get configs for controllers to better troubleshoot this.

Check the below link for CP workflow and config.

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/Step-by-Step-Controller-CPPM-6-5-Captive-Portal-authentication/td-p/229740

Michael,

Does controllers handle session timeout and idle timeout even when users authenticate using CPPM & Radius?