Security

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

I've got the MACAUTH service configured as that's part of the captive portal config, but I don't seem to be hitting that service:

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

I've got the MACAUTH service configured as that's part of the captive portal config, but I don't seem to be hitting that service:

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

And is deleting from the user table more involved then selecting 'Delete wireless client' here?

Because when I delete like this, and reconnect the test device, I still get WEBAUTH REJECT.

By-the-way, thanks for looking at this.

edit:

Prior to connecting the cluster member shows no client. Client connects, and gets dropped in the wrong role despite the correct role specified in the service

------------------------------
nathan millward

Original Message:
Sent: May 20, 2022 11:08 AM
From: Colin Joseph
Subject: Devices that can't register via captive portal

You will only hit that service on initial association of a device.  To get the device to do mac authentication again, for say testing, you would have to delete them from the controller's user table.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card

Original Message:
Sent: May 20, 2022 11:01 AM
From: nathan millward
Subject: Devices that can't register via captive portal

I've got the MACAUTH service configured as that's part of the captive portal config, but I don't seem to be hitting that service:

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

Thanks James.
To answer something from cjoseph earlier first, the WEBAUTH REJECT was a red herring because I was searching the access tracker on username, when I should have been using host MAC. I thought the host MAC was being used as username, but for the MAC Auth service that's not the case.
So I can now see that I do hit the Device MAC Auth policy element of the overall Guest-Wifi captive portal process:

But the role being given is not the role I assigned to the device in the csv upload.

So to your comments James, I used the MAC Caching template. I think I should be OK simply using the existing role (Guest-WiFi).
Even though the endpoint is known, the MAC Auth services defaults to the logon role, unless the conditions are met for [MAC Caching]

So does it stack up that I should be able to add a third condition here, ahead of current condition 2, to make the csv upload work?

I'll see if I can figure this condition out.

------------------------------
nathan millward

Original Message:
Sent: May 22, 2022 11:03 PM
From: James Andrewartha
Subject: Devices that can't register via captive portal

Which service template did you use? The "Guest Authentication with MAC Caching" service template doesn't allow for what you want. You need to either edit it (which I have done, including adding a new device role for this sort of device) or just add a new service based on the "Device MAC Authentication" template. I'm not sure on how the two would interact though.

------------------------------
James Andrewartha

Original Message:
Sent: May 20, 2022 10:24 AM
From: nathan millward
Subject: Devices that can't register via captive portal

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan

Thanks James.
To answer something from cjoseph earlier first, the WEBAUTH REJECT was a red herring because I was searching the access tracker on username, when I should have been using host MAC. I thought the host MAC was being used as username, but for the MAC Auth service that's not the case.
So I can now see that I do hit the Device MAC Auth policy element of the overall Guest-Wifi captive portal process:

But the role being given is not the role I assigned to the device in the csv upload.

So to your comments James, I used the MAC Caching template. I think I should be OK simply using the existing role (Guest-WiFi).
Even though the endpoint is known, the MAC Auth services defaults to the logon role, unless the conditions are met for [MAC Caching]

So does it stack up that I should be able to add a third condition here, ahead of current condition 2, to make the csv upload work?

I'll see if I can figure this condition out.

------------------------------
nathan millward

Original Message:
Sent: May 22, 2022 11:03 PM
From: James Andrewartha
Subject: Devices that can't register via captive portal

Which service template did you use? The "Guest Authentication with MAC Caching" service template doesn't allow for what you want. You need to either edit it (which I have done, including adding a new device role for this sort of device) or just add a new service based on the "Device MAC Authentication" template. I'm not sure on how the two would interact though.

------------------------------
James Andrewartha

Original Message:
Sent: May 20, 2022 10:24 AM
From: nathan millward
Subject: Devices that can't register via captive portal

I have a new Clearpass captive portal self-registration with self-sponsorship Guest-WiFi service configured. It's not been a pain free process, but it now works.
When a client first connects they given a guest-logon role, they complete the form, submit, get a new guest-access role with internet access and have 5 mins to click the link in their email to sponsor themselves to upgrade from 5 mins web access to 24 hours web access. So far so good.

Where I'm stuck is with devices that I need to register to this WiFi service (because they're not 802.1X compliant for our main WLAN). I just can't get my head round how to upload these devices so that they just connect and don't expire. In the device upload csv file I've set the guest-access role, but that doesn't work. I've created a sponsorship user and allocated the guest-access role, but still no good. Each attempt sees me hit with the WEBAUTH REJECT message, even though the device I'm testing with is known.

Anyone got any ideas on what I'm missing? 

Thanks

Nathan