topic Re: Open Captive Web Portal for Private PSK - Default User Profile in Aerohive Migrated Content

Open Captive Web Portal for Private PSK - Default User Profile

george_margarit — Tue, 16 Jul 2019 04:50:15 GMT

Captive Web Portal with Return Aerohive Private PSK, sets Default User Profile to "default-profile".

However, "default-profile" has no firewall policies, allowing users to directly connect to the network.

Is it possible to configure a different User Profile, so we can apply the default firewall policy "Redirect-Only"?

This is possible with all other CWP options, but is overwritten when PPSK is selected.

Re: Open Captive Web Portal for Private PSK - Default User Profile

ashley_finch — Tue, 16 Jul 2019 17:42:06 GMT

Hello George,

Yes this should be possible. I can't quite work out where you're seeing the user profile overwritten when the PPSK option is selected however. For instance I have an Open SSID for self reg, then a PPSK SSID with different user profiles associated with it.

This guide may help: https://thehivecommunity.aerohive.com/s/article/Self-Registration-PPSK-SSID-in-Hivemanager

Re: Open Captive Web Portal for Private PSK - Default User Profile

george_margarit — Tue, 16 Jul 2019 18:11:09 GMT

Hello Ashley, and thanks for coming back to me.

I have followed this guide, but it doesn't answer the problem.

The issue can be notices on the User profiles sections, as being used by the self-registration SSID:

Actually, it goes away, the minute I select CWP

Before Selecting "Return Aerohive Private PSK:

.. and after selecting Return PPSK, the option to select user profile is gone:

In reality, users end up on the PPSK SSID user profile and not the default, as i can see they are getting an IP address on the subnet of the PPSK SSID.

Even worse, without being able to have a specific User Profile and VLAN for the Open SSID, I cannot enforce any security policies and the users, can actually access anything apart from HTTP/HTTPS, as for example they can establish a VPN...

we are on 19.5.1.7-NGVA

Re: Open Captive Web Portal for Private PSK - Default User Profile

ashley_finch — Tue, 16 Jul 2019 18:11:38 GMT

Ah yes I see exactly what you mean now, I was looking on the PPSK rather than the Registration SSID, I see the same on the Cloud version of HiveManager.

I'm not sure as to why these options become unavailable so I'll leave that for Aerohive...

The only thing I can think of that may help is that if it is using the default user profile from the PPSK SSID, are you able to change this to a specific VLAN, security policies etc, and then apply a different profile for users when they actually receive a PPSK such as this?:

Re: Open Captive Web Portal for Private PSK - Default User Profile

george_margarit — Tue, 16 Jul 2019 18:15:04 GMT

Unfortunately, not.

"This is a default object and cannot be modified."

Re: Open Captive Web Portal for Private PSK - Default User Profile

ashley_finch — Tue, 16 Jul 2019 18:19:39 GMT

It's correct that you cannot change the default profile object, however you should be able to set which object the SSID is using and create a new one if required.

For instance, my screenshot above is using a customer User Profile (Internal-UP) from within configure > policy > self reg SSID > scroll to the "user access settings" > click add to create a new user profile, or select one if you already have one preconfigured.

Re: Open Captive Web Portal for Private PSK - Default User Profile

george_margarit — Tue, 16 Jul 2019 19:01:15 GMT

well, the "user access settings" are just not there. Something for @Aerohive Support to look at maybe.

Re: Open Captive Web Portal for Private PSK - Default User Profile

samantha_lynn — Tue, 16 Jul 2019 19:30:28 GMT

When you set the SSID up as a Registration SSID the user profile settings do go away because this isn't a full SSID, it's meant for registration only and not browsing. Users should only be able to reach the CWP to register, but they shouldn't be able to browse anywhere else. If they are able to browse before they connect to the PPSK SSID, that would be something you'd want to open a technical support case about since that is not intended functionality.

If you'd like to add me to the HiveManager as an external user with the email slynn@aerohive.com, I can take a look at the set up and see if there is anything out of place. If you do want me to take a look, please let me know your VHM Organization name (found by clicking the silhouette icon in the top right corner> Global Settings> Account Details> About half way down the page will be your organization name) and the name of the Network Policy you'd like me to focus on.

Re: Open Captive Web Portal for Private PSK - Default User Profile

george_margarit — Wed, 17 Jul 2019 16:45:58 GMT

OK, I believe I have found the solution for this, thanks Ashley for sharing the screenshot, it helped me figure it out.

The Open SSID is using the "Default User Profile" that is configured on the linked PPSK SSID.

I have created a new "captive-portal" user profile, which is linked to a new dedicated VLAN, which I can firewall accordingly on the network.

On the PPSK SSID, I have set the Default User profile to the new captive portal rdg-captiveportal.

Then I used Apply a different user profile to various clients and user groups and i have created an assignment policy, that would allow any registered user group to be assigned to the working Guest User profile.

Thank you