Security

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

Thanks Carson 

You are the boss

We have been bundling everything under the submit url 

so the guest system could not pass the credentials to the AP

Will test this in the morning and revert

Just one question, what is the best way for users to access the captive portal? is it with the clearpass IP with the .php which exposes the name/ip of the clearpass server or with the fqdn of the cambium ap

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

Thanks, @chulcher 

I don't suppose you have any insight into the Cambium side as well? These are the current settings on the Cambium 'Guest Access' tab within the SSID. Can you see anything obviously wrong? 

Or @vovocals do you have any further info to add from the Cambium side?

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

Thanks, @chulcher 

I don't suppose you have any insight into the Cambium side as well? These are the current settings on the Cambium 'Guest Access' tab within the SSID. Can you see anything obviously wrong? 

Or @vovocals do you have any further info to add from the Cambium side?

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@Herman Robers - this is exactly what is happening. The client MAC address is included in the initial URL when accessing the captive portal but when selecting the Azure login button the MAC address is not included. If you then manually add the client MAC on a Windows laptop then you can reach the correct page and login in as expected using Azure credentials. Is there no way this can be rectified within ClearPass? Its my understanding that it is the AP (Cambium) at this stage which handles that functionality, therefore it would have to be a setting applied there, not on ClearPass?  

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

It's a bit hard to fully understand your workflow, and where it breaks, and for what reason, without seeing it happening.

My experience is that if the MAC address is in the initial request, it's remembered throughout the ClearPass Guest authentication session. Not sure if that's in a session state or in a cookie, but apparently that doesn't work like that for you.

If there is no MAC address in the initial redirect (or not in any redirect), you may use some javascript or redirect to get a dummy MAC address included to at least continue (if there is no mac address, there is something like 'Invalid parameter' displayed in one of the ClearPass screens). Note that this only works with controller initiated, not with server initiated (CoA, which requires the MAC address in the CoA).

Maybe your Aruba partner, or TAC is willing to have a look together with you?

@Herman Robers - this is exactly what is happening. The client MAC address is included in the initial URL when accessing the captive portal but when selecting the Azure login button the MAC address is not included. If you then manually add the client MAC on a Windows laptop then you can reach the correct page and login in as expected using Azure credentials. Is there no way this can be rectified within ClearPass? Its my understanding that it is the AP (Cambium) at this stage which handles that functionality, therefore it would have to be a setting applied there, not on ClearPass?  

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

@Herman Robers Sorry to chase - do you have any further comments regarding my previous reply regarding the client MAC address in the URL, please? 

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

It depends on where you need the Javascript. If you add it to the skin, it will be included in each page; probably adding it in the footer of one of the pages (where the issue starts, or the one before that point). As I don't know in which step of the workflow you see that error, it's hard to provide exact guidance.

Maybe your Aruba partner, or TAC is willing to have a look together with you?

@Herman Robers Sorry to chase - do you have any further comments regarding my previous reply regarding the client MAC address in the URL, please? 

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP

Thanks @Herman Robers. 

I have since added some custom JavaScript* to the skin of the page applied within the guest web login. It was successful in that it re-directed to the Entra login portal without producing the error 'required field unavailable' after selecting the Entra login button on the initial captive portal. However, after submitting the credentials the captive portal page just loops back to the initial landing page with no specific error associated and no record within ClearPass access tracker - so no RADIUS request is being sent as of yet.

*the JS is adding a randomised MAC address to the URL when selecting the Entra login button on the landing page. I wonder if the consequence of not using the actual client MAC is causing the auth flow to fail later down the line? 

Any thoughts as to why that loop might occur? I am going to move the JavaScript to the main web login page 'Header HTML' tomorrow and do some further testing, as I see in your previous comment regarding how adding the JavaScript to the skin means it'll be included in every page. Therefore, may be proving detrimental in this scenario?

It depends on where you need the Javascript. If you add it to the skin, it will be included in each page; probably adding it in the footer of one of the pages (where the issue starts, or the one before that point). As I don't know in which step of the workflow you see that error, it's hard to provide exact guidance.

Maybe your Aruba partner, or TAC is willing to have a look together with you?

@Herman Robers Sorry to chase - do you have any further comments regarding my previous reply regarding the client MAC address in the URL, please? 

I've seen this when the redirect doesn't include the client MAC address ( &mac=aa:bb:cc:dd:ee:ff ) in the redirect URL. Can you add that? If you can't add the client MAC address, you may try to add ?mac=00:00:00:00:00:00 to the redirect URL and see if the 'Required field unavailable' disappears. Some features may not work properly when the client's mac address is unavailable.

@chulcher the issue regarding the initial re-direct is now working - I am successfully getting the captive portal now and can authenticate using pre-created guest accounts. 

My issue is when selecting the Azure login button I get the 'Required Field Unavailable' - I do not get this on the Aruba solution. 

What error message?  The only one I'm seeing you mention is the "too many redirects" which is coming from the browser.

@Herman Robers - I have the solution working when using a pre-created guest account with the Cambium solution and the redirect works fine. 

I also have the option on the captive portal for MS Azure logins - I have this working perfectly on a complete Aruba solution. 

However, on the Cambium I get the 'Required Field Unavailable' when selecting the Azure icon. Previously I have  fixed this by adding further netdestinations for the specific Cloud ID provider like Facebook etc. But I have an extensive list of these URLs allowed on the Cambium pre-auth/DNS settings. So I think this is probably separate issue and how the Cambium interacts with the Entra application. I have verified my Entra application/ web login on ClearPass for correct tenancy, client ID and secret. The application refers to a separate web login too to the Aruba portal, using a different redirect URL which is correctly referenced within the application. I have also created a separate 'Cambium - Entra' authentication source linked to the other application (not that it's getting this far yet). 

I'm not getting much traction on any Cambium forums. 

Do you have any further information which could be causing the captive portal error message on ClearPass? 

In that case, try to add https:// in front of the clearpass.gmetrust.org/guest/guestwifi2.php to make it a full URL. It looks like the AP tries to redirect to a relative URL to the original captive portal test URL now, which makes the http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php instead of https://clearpass.gmetrust.org/guest/guestwifi2.php

This process will continue forever, or at least till you see the 'too many redirects'.

The URL displayed on the client device is:

http://www.msftconnecttest.com/clearpass.gmetrust.org/guest/guestwifi2.php?ga_ssid=Guest-WiFi&ga_ap_mac=BC-A9-93-0A-F8-6E&ga_nas_id=F47-0AF86E&ga_srvr=eu-w1-guest.cloud.cambiumnetworks.com&ga_cmac=A4-02-B9-65-78-3B 

I've also removed around 50 of the 'clearpass.gmetrust.org/guest' from the URL which was producing a 'too many redirects' error on the client - which may be a red herring. 

I'm getting nothing on access tracker, in a pcap or traffic on the firewall. There are no restrictions in place to block anything such as this. I have the subnet of the Cambium APs in the ClearPass device list, with the correct secret. 

ClearPass web login: 

Cambium: 

The "Submit URL" field defines where credentials are submitted by the client, that is an instruction sent from the captive portal to the client device to POST credentials.  That is not the ClearPass URL, the URL needs to be built dynamically as outlined in my first response.  Use the dynamic URL I provided, do not set a static.

"Extra Fields" are values that ClearPass is processing in the redirect from the AP, you shouldn't be specifying values as those will be read from the parameters in the URL.  I have zero idea what those last two fields are supposed to be, I cobbled this together to deploy for one project about six years ago from someone else's proof of concept document.

@chulcher 

Using your example for a ClearPass/ Cambium guest captive portal solution - are you able to elaborate on any of the following or if I am doing anything incorrectly. The screenshot looks slightly different - my guess this is a pre 6.11 release. I am running 6.11.9. 

-I have the ClearPass FQDN in the submit method URL currently. 

-In the extra fields I won't be able to populate the 'ga_ap_mac' or 'ga_nas_id' as this will be deployed to a building of APs. So I cannot specify either of these fields in reality. How necessary are they? 

-Can you explain what 'ga_cmac' and 'ga_Qv' relate to and how necessary these fields are to be populated? 

Thanks, Adam

http://{$extra_fields.ga_srvr}:880/cgi-bin/hotspot_login.cgi

You have to use a custom setup for the captive portal for the credentials to be submitted back to the correct AP.  Make sure to populate the "Extra Fields" input with the required information.  Note, the screenshot was setup against a single AP.  Use the URL from above as the "Submit URL" so that the proper IP address gets used.

ga_ssid!=
ga_ap_mac!=
ga_nas_id!=
ga_srvr!=
ga_cmac!=
ga_Qv!=

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: May 14, 2024 03:47 PM
From: vovocals
Subject: Guest Self Registration with Cambium AP

Greetings 

Has anyone been able to integrate cambium AP's with clearpass for Guest Self Registration?

Basically we have everything setup according however it appears there seems to be some issues but i have some questions to ask 

We are using the IP address of the cambium AP on the guest self registration on clearpass and not the certificate FQDN as we have not introduced the certificate

The users can sign in with the clearpass ipaddress/guest/guestuser_3.php create a user and then login but cannot browse. We can see the user creation on manage account on clearpass and also see some audit on the audit viewer but nothing on the access tracker, so in my view this process in itself isn't communicating with the AP

We have everything setup properly in the cambium albeit we are not sure if we have the correct Postback URL of the cambium AP