cancel
Showing results for 
Search instead for 
Did you mean: 

Extreme Wireless Controller Redirect to External Captive Portal

Extreme Wireless Controller Redirect to External Captive Portal

Michael_Kirchne
Contributor
Hi Extreme experts,

I have a question regarding (Firewall friendly) External Captive Portal Redirection.

First my goal:
I need to integrate the Extreme Wireless Controller into an external Captive Portal System.
- The Portal System first needs a MAC Authentication Request via RADIUS (like Extreme NAC) - which is accepted.
- The Portal expects a URL-Request: "https://:8443/ahsfasdzfgfaszdfd&mac=00-11-22-33-44-55" where 00-11-22-33-44-55 is the MAC of the Client.

The Extreme Wireless Controller should do the following:
1) Send MAC Authentication Request to Portal-System
2) Redirect any HTTP/HTTPS request to "https://:8443/ahsfasdzfgfaszdfd&mac=00-11-22-33-44-55"
3) After successfull authentication the Role of the client should be changed via RADIUS-CoA.

What I tried is the Firewall Friendly External Captive Portal with the following settings:

30fb81785a8d4dd7b033fed27d38bd8d_RackMultipart20151108-14809-sh0neq-FF_Redirect_inline.png


30fb81785a8d4dd7b033fed27d38bd8d_RackMultipart20151108-9621-u67b12-FF_Redirect_2_inline.png



But unfortunately that configuration does not work.
1) If MAC Authentication is enabled no redirection is performed (The return Policy role is identical to the Unauthenticated Role in VNS settings). If I disable the MAC Authentication on the WLAN Service URL-Redirection is performed but with unexpected attributes:

30fb81785a8d4dd7b033fed27d38bd8d_RackMultipart20151108-9621-1w85xzp-FF_Redirect_3_inline.png



Is there any way to disable the unwanted attributes dst, token and wlan?
How can I perform MAC Authentication and Redirection?

Any ideas?

Best Regards
Michael
9 REPLIES 9

Drew_C
Valued Contributor III
Hi Michael,
Were you able to get this working?

Gareth_Mitchell
Extreme Employee
Hi

Firstly if you haven't already I would recommend you study the guide found in this article: https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-a-Firewall-Friendly-External-Captive-...

It would be interesting to note the state of the client in the report after MBA (MAC based auth) has completed, in the left column is a padlock that indicates the various states the client is in, hanging your mouse over the padlock will give further details of the state.

As you will see in the guide, the unwanted attributes you inquired about are mandatory.

As Joseph said, check that your rule allows the client to reach the external web server on the ports you have configured, along with having dns/dhcp working and denying everything else.

I would also consider working on getting the authentication piece working first, then add in the MBA.

-Gareth

Michael

Could you not, for example, use the VNS name attribute as an identifier?

At this point I would probably recommend you get a case opened for this so we can track it and make sure we are fully understanding your requirements.

-Gareth

Hi Gareth

"ahsfasdzfgfaszdfd" is just a place holder for a static reference. The portal system in this case can handle multiple mandators, so for each portal a spespific mandadtor reference needs to be included in the redirect URL - but that reference is static.

Best Regards

Michael

GTM-P2G8KFN