Captive Portal Policy Basic Configuration

Procedure

  1. Select Add to create a new captive portal policy, Edit to modify an existing policy, or Delete to remove an existing captive portal policy.
    Select Copy to create a copy of an existing captive portal policy and use it for further customization. Select Rename to change the name of an existing policy or copy a policy to a different location.

    Select Replace to replace an existing captive portal policy with another captive portal policy.

    A Basic Configuration screen displays by default. Define the policy‘s security, access, and whitelist basic configuration before actual HTML pages can be defined for guest user access requests.

    Click to expand in new window
    Captive Portal Policy - Add/Edit - Basic Configuration Tab
    GUID-07D59F98-8A0A-4A52-BD4E-03DF5020F712-low.png
  2. Define the following captive portal policy Settings:
    Captive Portal Policy If you are creating a new policy, assign a name representative of its access permissions, location or intended wireless client user base. If you are editing an existing captive portal policy, the policy name cannot be modified. The name cannot exceed 32 characters.
    Captive Portal Server Mode Set the mode as either Internal (Self), Centralized or Centralized Controller. Select the Internal (Self) radio button to maintain the captive portal configuration (Web pages) internally. Select the Centralized radio button if the captive portal is supported on an external server. Select the Centralized Controller radio button if the captive portal is supported on a centralized controller or service platform. The default value is Internal (Self).
    Hosting VLAN Interface When Centralized is selected as the Captive Portal Server Mode, specify the VLAN (between 0 and 4096) for client communication. Select 0 to use the default client VLAN. 0 is the default setting.
    Captive Portal Server Host When Centralized is selected as the Captive Portal Server Mode, set a numeric IP address (or DNS hostname) for the server validating guest user permissions for the captive portal policy.

    When Centralized Controller is selected, use this field to provide the hostname of the controller or controllers acting as the captive portal server host.
    Captive Portal IPv6 Server

    When using Centralized mode, select this option to define an IPv6 formatted address of the controller, service platform or access point resource hosting the captive portal.
    Connection Mode Select either HTTP or HTTPS to define the connection medium to the Web server. We recommend the use of HTTPS because it affords some additional data protection HTTP cannot provide. The default value, however, is HTTP.
    Simultaneous Access Select this check box and use the spinner control to set from 1-8192 users (client MAC addresses) allowed simultaneous access to the captive portal and its resources.
  3. Use the AAA Policy drop-down menu to select the AAA policy used to validate user credentials and provide captive portal access to the network.
    If no AAA policies exist, one must be created by selecting the Create icon, or an existing AAA policy can be selected and modified by selected it from the drop-down menu and selecting the Edit icon.
  4. Set the following Access parameters to define captive portal access, RADIUS lookup information, and whether the Login pages contain agreement terms that must be accepted before access is granted to controller or service platform resources using the captive portal:
    Access Type Select the authentication scheme applied to clients requesting captive portal guest access to the WiNG network. Within the WiNG UI there are six options. The WiNG CLI uses five options. User interface options include:
    • No authentication required - Requesting clients are redirected to the captive portal Welcome page without authentication.
    • RADIUS Authentication - A requesting client‘s user credentials require authentication before access to the captive portal is permitted. This is the default setting.
    • Registration - A requesting client‘s user credentials require authentication through social media credential exchange.
    • Email Access - Clients use E-mail username and passwords for authenticating their captive portal session. Optionally set whether E-mail access requests are RADIUS validated.
    • Mobile Access - Mobile clients use their device‘s access permissions for authenticating their captive portal session. Optionally set whether mobile access requests are RADIUS validated.
    • Other Access - Requesting guest clients use a different means of captive portal session access (aside from E-mail or mobile device permissions). Optionally set whether these other access requests are RADIUS validated.
    Terms and Conditions page Select this option (with any access type) to include terms that must be adhered to for clients requesting captive portal access. These terms are included in the Terms and Conditions page when No authentication required is selected as the access type, otherwise the terms appear in the Login page. The default setting is disabled.
    Frictionless Onboarding Select this option to enable wireless clients, associated with guest WLANs, to self-register with the ExtremeGuest server. In other words, this feature enables frictionless on-boarding of guest users to the ExtremeGuest server.

    It also provides an integration API, as a means of on-boarding guest users through a loyalty application.

    In the captive portal, set access-type as ‘Registration‘, enable ‘Frictionless Onboarding‘, and provide the Localization URL to trigger a one-time redirect on demand. The defined URL is triggered from a mobile application to derive location information from the wireless network so an application can be localized to a particular store or region.

    Note: If enabling this feature, in the WLAN (using this captive-portal) set the following parameters: authentication-type as ‘MAC‘ and registration-mode as ‘device‘. Enable the ‘External Controller‘ and ‘Follow AAA‘ options. Use the AAA Policy drop-down menu to specify the AAA policy. In the AAA policy, ensure that the authentication server configuration points to the ExtremeGuest server.
  5. Set the following Social Media Authentication parameters to utilize a requesting client‘s social media profile for captive portal registration:
    Facebook If selected, the requesting client‘s guest user Facebook social media profile (collected from the social media server) is registered on the device. Captive portal authentication then becomes a fallback mechanism to enforce guest registration through social authentication. This option is disabled by default.
    Google If selected, the requesting client‘s guest user Google social media profile (collected from the social media server) is registered on the device. Captive portal authentication then becomes a fallback mechanism to enforce guest registration through social authentication. This option is disabled by default.
  6. Refer to the Bypass field to enable or disable Bypass Captive Portal Detection capabilities.
    If enabled, captive portal detection requests are bypassed. This feature is disabled by default.
  7. Set the following Client Settings to define client VLAN assignments, how long clients are allowed captive portal access, and when clients are timed out due to inactivity:
    RADIUS VLAN Assignment

    Select this option to enable client VLAN assignments using the RADIUS server. If, as part of the authentication process, the RADIUS server returns a client‘s VLAN-ID in a RADIUS access-accept packet, and this feature is enabled, all client traffic is forwarded on the post authentication VLAN. If disabled, the RADIUS server‘s VLAN assignment is ignored and the VLAN configuration defined within the WLAN configuration is used instead. This feature is disabled by default.
    Post Authentication VLAN When this option is selected, a specific VLAN is assigned to the client upon successful authentication. The available range is from 1 - 4,096.
    Client Access Time Use the spinner control to define the duration wireless clients are allowed access to using the captive portal policy when there is no session time value defined for the RADIUS response. Set an interval from 10 - 10,800 minutes. The default interval is 1,440 minutes.
    Inactivity Timeout Use the drop-down menu to specify an interval in either minutes (1 - 1,440) or seconds (60 - 86,400) that, when exceeded, times out the session. The default is 10 minutes.
  8. Define the following Loyalty App settings to allow administrators to detect and report a captive portal client‘s usage of a selected (preferred) loyalty application:
    Enable Select this option to report a captive portal client‘s loyalty application presence and store this information in the captive portal‘s user database. The client‘s loyalty application detection occurs on the access point to which the client is associated and allows a retail administrator to assess whether a captive portal client is using specific retail (loyalty) applications in their captive portal. This setting is enabled by default.
    App Name Use the drop-down menu to select an existing application to track for loyalty utilization by captive portal clients. This enables an administrator to assess whether patrons are accessing an application as expected in specific retail environments. To create an application if none exists suiting the specific reporting needs of captive portal clients, see Create a Custom Application Definition.
  9. Use the DNS Whitelist parameter to create a set of allowed destination IP addresses for the captive portal.
    These allowed DNS destination IP addresses are called a whitelist.

    To effectively host captive portal pages on an external web server, the IP addresses of the destination web servers should be in the whitelist.

    1. Refer to the drop-down menu of existing DNS Whitelist entries to select a policy to be applied to this captive portal policy.
      If no DNS Whitelist entries exist, select the Create or Edit icons and do the following.
    2. If creating a new Whitelist, assign it a name up to 32 characters.
      Use the + Add Row button to populate the Whitelist with Host and IP Index values.
      Click to expand in new window
      Captive Portal Policy - Basic Configuration - Add DNS Whitelist Screen
      GUID-511EAC7F-8366-414E-962F-0A6B2D8C602A-low.png
    3. Provide a numerical IP address or Hostname within the DNS Entry parameter for each destination IP address or host included in the whitelist.
      Hostnames cannot contain underscores.
    4. Use the Match Suffix parameter to match any hostname or domain name as a suffix.
      The default setting is disabled.
    5. If necessary, select the radio button of an existing whitelist entry and select the Delete icon to remove the entry from the whitelist.
  10. Set the following Accounting parameters to define how accounting is conducted for clients entering and exiting the captive portal.
    Accounting is the method of collecting and sending security server information for billing, auditing and reporting user data; such as captive portal start and stop times, executed commands (such as PPP), number of packets and number of bytes. Accounting enables wireless network administrators to track captive portal services users are consuming.
    Enable RADIUS Accounting Select this option to use an external RADIUS resource for AAA accounting. When selected, a AAA Policy field displays. This setting is disabled by default.
    Enable Syslog Accounting Select this option to log information about the use of remote access services by users using an external syslog resource. This information is of great assistance in partitioning local versus remote users. Remote user information can be archived to an external location for periodic network and user administration. This feature is disabled by default.
    Syslog Host When syslog accounting is enabled, use the drop-down menu to determine whether an IP address or Hostname is used as a syslog host. The IP address or hostname of an external server resource is required to route captive portal syslog events to that destination external resource destination. A hostname cannot contain an underscore.
    Syslog Port When syslog accounting is enabled, define the numerical syslog port the used to route traffic with the external syslog server. The default port is 514.
  11. Set the following Data Limit parameters values to define a data limit for clients accessing the network using the restrictions of a captive portal:
    Limit Select this option to enable data limits for captive portal clients. Specify the maximum amount of data, in megabytes, allowed for each captive portal client. When a user reaches this threshold, from 1 and 102,400 megabytes, it triggers the specified action.
    Action When a captive portal client reaches its data usage limit, a specified log action is executed. Choose from one of the following:
    • Log Only — Logs the event
    • log-and-disconnect — Logs the event and disconnects the user

    When Log Only is selected, an entry is added to the log file whenever a captive portal client exceeds the data limit. When log-and-disconnect is selected, an entry is added to the log file when the data limit is exceeded and the client is disconnected from the captive portal.
  12. Set the Logout FQDN as the fully qualified domain name (FQDN) of the domain where the user will be redirected after logging out of the captive portal.
    Example: logout.guest.com
  13. Set the following Localization settings to add a URL to trigger a one-time redirect on demand.
    The defined URL is triggered from a mobile application to derive location information from the wireless network so an application can be localized to a particular store or region.
    FQDN Provide the FQDN address (for example, local.guestaccess.com) used to obtain localization parameters for a client.
    Response Enter a response message (512-character maximum) directed back to the client for localization HTTP requests.
  14. Refer to the Destination Ports for Redirection parameter (within the Redirection Ports field), and enter destination ports (separated by commas, or using a dash for a range) for consideration when re-directing client connections.
    Standard ports 80 and 443 are always considered for client connections regardless of what‘s entered by the administrator.
  15. Select OK to save the changes made within the Basic Configuration screen.
    Select Reset to revert to the last saved configuration.
9036512-00 Rev AA