I am implementing a ClearPass Onboard in a Hospital who owns Aruba 205 IAPs and HPE 460 APs. ClearPass Onboard is working fine with Aruba Instant APs but I am having problems with the HPE side. They have an HPE Unified Wireless Controllers and about 200 APs. The problem is happening during the onboarding process of android devices.
I setup some portal free rules to allow users connected to the onboard SSID to download de QuickConnec from Play Google Play store. I have tried the usual rules showed below but its not working.
portal user-url *.ggpht.com free portal user-url android.clients.google.com freeportal user-url *.play.googleapis.com free portal user-url www.googleapis.com free
portal user-url *.gvt1.com
portal free-rule 10 source ip any destination ip 126.96.36.199 mask 255.255.255.255
portal free-rule 11 source ip any destination ip 188.8.131.52 mask 255.255.255.0
portal free-rule 12 source ip any destination ip 184.108.40.206 mask 255.255.255.0
portal free-rule 13 source ip 220.127.116.11 mask 255.255.255.0 destination ip 18.104.22.168 mask 255.255.0.0
22.214.171.124 is customer's DNS address126.96.36.199 is the subnet from CPPM Subnet188.8.131.52 /24 is Onboarding Subnet184.108.40.206 /16 is one of the google domain subnets
I have associated these rules to my Interface Vlan 131
interface Vlan-interface131description Onboardip address 220.127.116.11 255.255.255.0portal server CPPM2 method directportal domain cppmportal url-param include user-url
I have also tried the
After connecting to the Onboarding SSID it opens the Onboard Portal and after authenticating with AD credenciasl it prompts for the QuickConnect installs but can't download it.
Just to confirm that problem was caused by Unified fireeall I added a portal rule allowing subnet 18.104.22.168 /24 to any and QuickConnect was download without any problem
Does anyone have a sucessfull implemention of ClearPass Onboard with HPE Unified controllers that can be shared with me ?
I am not having problems onboarding Windows devices.
I am attching a screenshow showing where the downloading process stops.
It is missing some google playstore to be allowed on the Controller.
Any ideas ?
(HPE/Aruba Partner Sâo Paulo Brazil)
Tim. I will add the ones that is missing.
Thanks a lot !!
Hi Tim, I've added the rules, but I'm still having trouble downloading QuickConnect from Google Play.
I have debugged the controller portal and checked all the subnets / urls used to download QuickConnect.
I added each of them individually and even then I did not succeed.
In the past, I have had some similar problems with this controller using IMC UAM software because of bug. I think again it's the same problem
We are negotiating with them an update to a newer version; Currently they are using the 5.20p41 code and the latest code is 5.20p63 !!!
The way the 20G controller works with the portal firewall is different from Aruba. I can't , at least with the current version, impose a rule to force the portal as we have in Aruba. Depending on the URLs or subnets configured on the free rules, the portal is ignored and the Onboard process does not work.
I'm going to run new tests with updated code to see if I can fix this.
If I can I will share it here with you.
If anyone else here at Airheads has already solved this please share with me !!
At Aruba, we believe that the most dynamic customer experiences happen at the Edge. Our mission is to deliver innovative solutions that harness data at the Edge to drive powerful business outcomes.
© Copyright 2021 Hewlett Packard Enterprise Development LPAll Rights Reserved.