Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Captive portal not showing when using different VLAN

This thread has been viewed 45 times

  • 1.  Captive portal not showing when using different VLAN

    MVP
    Posted Feb 12, 2023 02:24 AM

    Hi,

    I have APs managed by Aruba Central. I want to configure captive portal for guests and it is working when I am using the default vlan. But I want to use a different vlan for guest and when I put that vlan, the captive portal page is not coming. How can I solve it?

    Thanks,



  • 2.  RE: Captive portal not showing when using different VLAN

    EMPLOYEE
    Posted Feb 12, 2023 04:53 PM

    you need to ensure that the other VLAN that you are selecting is allowed on on the switch port that connects to the AP.

    The switch port should be configured for VLAN trunking 802.1Q 



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 3.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 13, 2023 12:29 AM

    The vlan is already tagged on the switch port. The vlan should have access to the controller virtual IP (different vlan) to get to the captive portal page?? I remember in physical controller, we have to assign IP address to the vlan interface for redirecting to captive portal, but in Aruba central I cannot see such option.

    Thanks,


    Original Message


  • 4.  RE: Captive portal not showing when using different VLAN

    EMPLOYEE
    Posted Feb 13, 2023 04:40 AM

    so with your current setup, the clients get IP address on this other vlan right?



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 5.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 14, 2023 10:41 AM

    Yes, the client is getting the IP from this new vlan when connected but not redirecting to captive portal for authentication. When we change to the native vlan and try connecting,  it's connecting and redirecting to captive portal without any issues. 


    Original Message


  • 6.  RE: Captive portal not showing when using different VLAN

    EMPLOYEE
    Posted Feb 14, 2023 04:50 PM

    does this new VLAN also has full internet connectivity? 



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 7.  RE: Captive portal not showing when using different VLAN

    Posted Feb 14, 2023 06:09 PM

    I believe we are doing something similar for some locations.  Where are you specifying the VLAN in central and how are you assigning it to the SSID?

     

    We were unable to use the default controller virtual IP NATing feature for guest access because it unfortunately uses the same MAC address for the virtual controller as it does for the physical accesspoint in the management VLAN and our Firewall did not like seeing the same MAC on separated VLANS.  So we connect the guest network via layer 2 vlan egressing at each AP to the firewall and let the firewall do the NATing and routing. 

     




    Original Message


  • 8.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 15, 2023 01:04 AM

    We have configured the swith port as trunk and assign the vlan id under the SSID settings. We are using internal captive portal for guests and is working on the default vlan. What access has to be given to the new vlan so that it is redirected to captive portal when a guest connects? I even created a policy to allow the new vlan to access the virtual IP of the AP. How can I make it work on this new vlan?!


    Original Message


  • 9.  RE: Captive portal not showing when using different VLAN

    Posted Feb 15, 2023 01:37 PM

    AjinS

     

    I'm not 100% sure this is what you are asking.  In my understanding the vlan is not assigned to the captive portal.  The captive portal is assigned to the WLAN.  And clients in that WLAN become members of the specified VLAN which become tagged when traffic egresses the AP.

     

    I don't know if there is a better way to do this or if this will work in your specific network; but this is the method Aruba support gave me a few years ago. 

     

    Your switch ports connected to each AP have to have the VLAN tagged on that port and there needs to be a gateway to the internet in that same VLAN.

     

    Un-intuitively you actually use a DHCP Scope which is poorly named because you also use it for defining Layer 2 or 3 and VLAN

    Devices > System > DHCP > Local DHCP Scopes

    There you create a new "Local DHCP Scope"

     

    Name : i.e. Guest Hotspot L2

    Type : Local,L2 (for layer 2)............ (Local,L3 works too if you need the AP to route to your gateway)

    VLAN : Your VLAN ID that you want to egress to

    Network| Netmask | Exclude Addresses if any : normal networking stuff

    Default Router : The IP address of the GW for your guests. i.e firewall "internal" interface IP for Guest LAN.  If you use Local,L3. I believe the VC will build a virtual routing interface using the IP address you use here acting like the DHCP server and gateway

    DNS Server | Domain Name | Lease Time : normal networking stuff

    VLAN IP | VLAN Mask | Option | not used

     

    Then under your Access Points > WLANs >  SSID > VLANS

    Client IP assignment : Instant AP Assigned

    Client VLAN Assignment : Custom

    VLAN ID : Guest Hotspot L2 [vlan:XX)

     

    And that's it.

     

    Also you may have to assign some network based access rules on the SSID to block guest access to other subnets in your network.

     

    I hope this helps.

     

    Jim G

     

     




    Original Message


  • 10.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 15, 2023 01:00 AM

    Yes, it has. We are using the internal captive portal and not the cloud guest feature. 


    Original Message


  • 11.  RE: Captive portal not showing when using different VLAN

    Posted Feb 15, 2023 01:28 AM

    Hi Ajin.

    Check the pre-login role the client is getting. Does it have the correct vlan? For captive portal to work, it need to limit access to necessary services like dhcp and dns and redirect to the captive portal. After successful login a new role need to grant required access to the internet and other services.

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Expert 2023
    ------------------------------

    Original Message


  • 12.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 15, 2023 01:40 AM

    Hi Gorazd,

    This is APs managed by Aruba central. And the guest access is working when the default vlan is set. Not working with new vlan which already has access to internet. 


    Original Message


  • 13.  RE: Captive portal not showing when using different VLAN

    Posted Feb 15, 2023 03:48 AM

    Hi Ajin.

    Yes, I'm aware that you are using Central managed APs.

    I just configured internal captive portal on Central and set it to nondefault vlan.

    I tagged vlan 100 to AP port. Client was connected to the portal without a problem.

     

    wlan ssid-profile internal-guest
 enable
 index 2
 type guest
 essid internal-guest
 utf8
 opmode enhanced-open
 max-authentication-failures 0
 vlan UserType1
 rf-band all
 captive-portal internal
 dtim-period 1
 broadcast-filter arp
 enforce-dhcp
 multicast-rate-optimization
 blacklist
 dynamic-multicast-optimization
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

    Interface setup on the switch is like:

    interface 21
       name "AP303-03-Lj"
       poe-lldp-detect enabled
       tagged vlan 100
       untagged vlan 1
       lldp top-change-notify
       lldp enable-notification
       exit



    ------------------------------
    Gorazd Kikelj
    MVP Expert 2023
    ------------------------------

    Original Message


  • 14.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 15, 2023 02:16 PM

    Thank you Gorazd. So you just introduced a new vlan and assigned to the SSID? There is no IP assigned anywhere in the controller for this vlan? I'll try again.


    Original Message


  • 15.  RE: Captive portal not showing when using different VLAN

    Posted Feb 15, 2023 04:24 PM

    Hi Ajin.

    Yes. As you already have an external dhcp server, there is no  need to complicate your life. Just tag this vlan to the switch ports were your APs are connected and make sure that your dhcp server provide the working dns address, can be public dns server.

    You need to create named vlan on access points so you can select it when creating ssid.   

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Expert 2023
    ------------------------------

    Original Message


  • 16.  RE: Captive portal not showing when using different VLAN

    EMPLOYEE
    Posted Feb 15, 2023 04:30 AM

    With a client on the non-default VLAN are they resolving DNS correctly? Properly working DNS is a requirement... AOS8 or AOS10? What is acting as the DHCP server? An external server or VC assigned IP addressing?

    If you place a client on an untagged switch port in the same VLAN are they able to reach DNS and other network resources / Internet?


    Original Message


  • 17.  RE: Captive portal not showing when using different VLAN

    MVP
    Posted Feb 15, 2023 02:38 PM

    I have created a rule for DNS access. It is AOS8. DHCP server is an external server. Is there any specific DNS entry that it has to resolve or just internet access is required?


    Original Message


  • 18.  RE: Captive portal not showing when using different VLAN

    Posted Feb 15, 2023 04:26 PM

    Hi Ajin.

    Just normal dns. You can use public ones like 1.1.1.1 or 8.8.8.8 if it is more convenient for you. Or you can use your local dns. No specific names need to be resolved.

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Expert 2023
    ------------------------------

    Original Message