Security

Hi community,

 

we have clearpass 6.5.5.78974 running with some Instant APs. We used the start here wizard to define a new service guest authentication with mac caching.

The guest comes, logon the wifi ssid and the captive portal is shown up, we use sms self registration for our guest, so far everything works fine. The guest ticket is running for one day, after this day the ticket expired. 

 

Now comes the problem:

The same guest comes two days later and connect to the guest ssd, but no captive portal is shown up, the guest is in the preauth role on the IAP and cannot surf in the internet...

The mac caching is so configured to that the mac cannot login when the ticket is expired.

 

We want that the guest logon the ssid and comes to the captive portal and can take a new ticket. But the captive portal is not shown up...

 

I have no idea what I can do.

 

I hope someone can help me with this problem.

 

thanks.

Hi,

 

What are the rights of the "preauth" role.

 

Also, does anything show in the access tracker?

 

 

Hi,

 

the rights from the preauth role are: allow http to clearpass, allow https to clearpass, allow dns 

thats it...

 

Are you just referring to the captive network assistant? When the user goes to browse somewhere, are they redirected?

No, users are not redirect. 

At the first time everything works fine... 

Does anything show in the access tracker.

Also, are users getting the exact same "preauth" role that works the first time?

I check the access tacker and send the infos.

 

yes it is the same prauth role at the first time logon.