Security

 View Only

  • 1.  Captive Portal DUR - AOS

    Posted Feb 06, 2024 06:39 PM

    So close, yet so far - I am working to add the Captive Portal piece to our wired 802.1x implementation, but I keep striking out on getting the page to launch. I have it the 802.1x and MAC authentication working and they pull down DUR roles as needed and I am now trying to add that part with a captive portal (starting on AOS switches, but AOS-CX) will be next. I have it set that if the device falls to the bottom it should launch the RADIUS profile with the names in there being the DUR role, shown below and then the URL. It looks like it should load the DUR to the switch, and I have copied and pasted it directly on, but no luck in trying to bring it down - I get just an error the user role is invalid. The following is the DUR role;

    class ipv4 "DNS"
    10 match udp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 53
    exit
    class ipv4 "DHCP"
    10 match udp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 67
    exit
    class ipv4 "INTERNAL"
    10 match ip 0.0.0.0 255.255.255.255 10.0.0.0 0.255.255.255
    exit
    class ipv4 "WEB-TRAFFIC"
    10 match tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 80
    exit
    class ipv4 "CLEARPASS-WEB"
    10 match tcp 0.0.0.0 255.255.255.255 10.38.38.148 0.0.0.0 eq 80
    20 match tcp 0.0.0.0 255.255.255.255 10.38.38.148 0.0.0.0 eq 443
    exit
    policy user "CLEARPASS-REDIRECT"
    10 class ipv4 "DNS" action permit
    20 class ipv4 "DHCP" action permit
    30 class ipv4 "CLEARPASS-WEB" action permit
    40 class ipv4 "INTERNAL" action deny
    50 class ipv4 "WEB-TRAFFIC" action redirect captive-portal
    exit
    aaa authorization user-role name "GuestWired"
    captive-portal-profile "use-radius-vsa"
    policy "CLEARPASS-REDIRECT"
    reauth-period 86400
    vlan-name "WIRED"
    exit

    I feel like I have gone so far down the rabbit hole of trying to do this I am back at the start again. Any assistance would be appreciated.

    Thanks very much,



  • 2.  RE: Captive Portal DUR - AOS

    Posted Feb 06, 2024 07:16 PM

    can you post the clearpass access tracker output tab and its corresponding "show port-access client  detail" on the switch.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 3.  RE: Captive Portal DUR - AOS

    Posted Feb 06, 2024 08:11 PM

    Thanks for the reply. I have attached the image as requested for the output tab. On the switch, as the DUR does not download it is not showing there, but other DUR roles have been downloaded without issue. I have also included the Enforcement Profile for reference.

    Thanks very much again,

    Original Message


  • 4.  RE: Captive Portal DUR - AOS
    Best Answer

    Posted Feb 06, 2024 08:34 PM

    your screenshots indicates that you are using Local user role (LUR) not DUR

    check your configuration against this technote that covers LUR and DUR for AOS-S switches



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 5.  RE: Captive Portal DUR - AOS

    Posted Feb 06, 2024 08:47 PM
    Edited by Shadow101 Feb 06, 2024 11:52 PM

    Revised - thanks for the reply and link - I think I had gone so far along on this I was starting to mix LUR's with the preferred DUR method just to get something to work - makes sense why this would not install on the switch. I have reviewed the document and made some fairly sweeping changes based on the details. I will look to test the implementation tomorrow with the changes and fingers crossed.

    Thanks very much again,


    Original Message


  • 6.  RE: Captive Portal DUR - AOS

    Posted Feb 07, 2024 07:53 PM

    AWESOME document for the setup process. Went through and made changes on our side - moved the bar almost all the way across. Resolved issues with the page opening, can get the logon option, able to logon, get the port bounce but does not seem to be holding the roles for the end user. After the bounce it defaults the user back again to the captive portal page. Going to review again to make sure I crossed the T's and dotted the i's, but closing in on the finish line it seems.


    Original Message


  • 7.  RE: Captive Portal DUR - AOS

    Posted Feb 07, 2024 08:26 PM

    thats great. There is also a similar doc that I wrote covering CX switches.

    Search in community and you'll find it.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


Related Content