Security

I've setup ClearPass Guest with a simple Web Login page that clients get redirected to by an Aruba captive portal profile.

All is working as expected with iPhones and an old Android device using stock browser - clients get redirected to the original page they were trying to browse to with no issues.

Google chrome on android device, and IE 11 on Win 7 attempt to redirect the client to the originally requested URL, however they are appending '&arubalp=<various hex> and the client receives a 'Page not found' error.

Has anyone seen this behaviour before? Is there a known solution?

Hi chrispchikin,

What role does the user have when they authenticate? I assume that this is different than your captive portal role?

-Mike

Yes different roles, post authentication is effectively the allowall role.

Strange thing is, it doesn't always happen...

Hi chrispchikin,

Can you share your Role Mapping and your Enforcement Policy tabs for this service?

Also, what version of ClearPass are you currently running?

-Mike

Details below:

CPPM version is 6.5.3.76733

What is the default role for the Captive Portal profile in Aruba OS? Also, what Aruba user role is set by your "IP-Guest Guest Profile" Enforcement Profile?

-Mike

The Guest enforcement profile sends a 'Guest-authenticated' user role attribute which is effectively the allowall role.

Default role in captive portal profile is denyall.

Have you tried to remove the MAC address entry for the iPhone and the Android device from the Endpoints Repository? I would then remove the entry from the user-table on the controller. This will effectively zero out the IPhone and Android device and it will start the process from scratch. At that point, can you go through the process and see if you get presented a portal page?

Thanks!

-Mike

Yes, been having to do that in order for the devices to not just be MAC authenticated.

Are you mobile devices just MAC authenticating and not connecting to the Portal service? If so, can you share the Role Mapping and Enforcement Profile from that service?

-Mike

Its setup pretty much as per the template, initial logon is captive portal w/ web login.

Subsequent authorisations use MAC auth.

We're not even getting to the MAC auth stage, the problem is occuring after web login so not really relevant.

can you share your controller captive portal profile?

Sure, config below:

are you sure that works at all? denyall as role after auth doesn't feel correct.

have you checked with browser debug tools (IE F12) where the extra info is added?

duh, hadn't considered that one.

im kinda out of ideas, like mentioned try to use browser debug tools to find a difference in behaviour and which element causes it.

TAC case is also always an option.