Controllerless Networks

I'm an Aruba newbie and need some help. We have 30+ locations plus our home office. We would like to roll out guest wifi in each location and our home office. For guests to use the wifi, we are wanting them to connect to our guest wifi SSID, which should then open up a web page where they fill out their email address, accept the terms and conditions and has a box they can check to opt-into our marketing campaign. We then would want to collect the email address for marketing purposes and also for those who opt-in, we will then take those emails and start sending them our marketing emails.

We have Aruba AP's at each location and home office and we also use ClearPass for our NAC solution.

I recently went through all of the Aruba ClearPass Workshop Wireless #1-4 and also the Guest #1-6, that are listed here: https://community.arubanetworks.com/t5/Security/Aruba-ClearPass-Workshop-Video-series/td-p/291597

After following those videos and basically following Herman Robers step by step and attempting to get it to work, i'm not having any luck. I am able to get the SSID up, have the web page pop up, enter email, accept T&C's, then the guest login page comes up and you can login, but after that, it does not go to the internet and goes to our clearpass site. It's getting and IP but no internet. I'm pretty sure it's ClearPass that's rejecting the device and won't allow it internet.

Anyway, after fighting with this, I was wondering...For what i'm needing, am i even going about it the correct way? Is there a better way of setting up guest wifi and collecting email addresses that can be easily rolled out to all locations?

Luke

Which user role (acl) does a user get before and after authenication against the portal in your wlan controller.

When using guest mail addresses for marketing campaign be sure your are GDPR complaint.

Dear Luke, 

There could be number of reasons that users are not getting on the internet. I suggest you share the snapshot of the services that were created for you and also the self registration page you created in CPPM. Below are some of the points you should look out for

1) There will be 2 roles for guest to work. One is the captive portal role (allowing only http/https access to CPPM and IAP IP, DNS and DHCP)

Other is the guest role which allows access to internet (deny all internal IPs, allow all)

2) You must have working DNS (reachable via captive portal role)

3) You must upload Public or Private certificate for IAP.

4) The FQDN (CN of certificate uploaded on IAP) must be resolvable by clients in captive role

Let us know if all above is met.

Sorry for the late response but i did eventually get it working. Like everything i had read before posting this, the issue was the url for the cert. I changed it back to the default one aruba had, securelogin.arubanetworks.com and it worked. I thought i had the cert figured out, apparently i did not. Thanks for the feedback.