topic Re: PPSK and Selfregistration / users assignement in Aerohive Migrated Content

PPSK and Selfregistration / users assignement

pagella — Mon, 08 Oct 2018 17:54:07 GMT

Hi there,

im not sure if its possible what i would like to do but ill just ask.

One SSID with multiple Passwords

based on the password OR based on the user group (but i would need an automatism that puts users with a certain email address in a specific group didnt find this option ) the user gets a specific VLAN

After the user is able to connect to the ssid, the users needs to sign up to gain access to the internet

Is that possible?

i found something similar but with one Open SSIDs i would rather have one SSID. I also dont like the fact that everybody is in the same VLAN by Default.

https://thehivecommunity.aerohive.com/s/article/Self-Registration-PPSK-SSID-in-Hivemanager

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Mon, 08 Oct 2018 20:03:29 GMT

Our Self Registration set up does require one Open SSID (for clients to connect to while they register) and one PPSK SSID (for clients to connect to once they've received their credentials). However, to get to the set up you are proposing here, I think you might do better with a normal PPSK set up instead.

If you set up a PPSK SSID, you can create different user groups for different users. Once you've created all your users, you can create the PPSK SSID and apply different user profiles to different users based on assignment rules. When you make the assignment rule, you can choose User Group as the classifying criteria. So you can say users in User Group A go on VLAN A with permission set A, while users in User Group B get on VLAN B with permission set B, etc. This is all set up ahead of time, so once you deploy you don't have to do anything else to classify users on to the correct VLANs, and all users connect to the same SSID with their own individual passwords.

Unfortunately there is no way to have them register after they connect. The closest we can get to that is to have them read and consent to a user policy agreement via a CWP after they connect and before they can browse. The only ways to have users sign up for connection is self registration (with 2 SSIDs), or a CWP using social login (not an option with a PPSK SSID, you'd have to use an Open SSID for this).

Does that answer your question? Is there anything I can clarify?

Re: PPSK and Selfregistration / users assignement

pagella — Mon, 08 Oct 2018 20:23:15 GMT

Yes thanks for the quick answer. I did configure the setup with one open SSID.

I can register users and all but as soon as i want to connect to the secured SSID it tells me that the authentification failed the Password is wrong. The user is approved and is in a group that is assigned to that SSID Captive Portal and all. I did it like the in the FAQ. Any idea what could cause that?

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Tue, 09 Oct 2018 02:59:31 GMT

Could you add me as an external user so I can review your configuration? I won't make any changes without prior express approval, I just want to make sure everything is where it needs to be. The email you would want to use for the external user is slynn@aerohive.com.

Re: PPSK and Selfregistration / users assignement

pagella — Tue, 09 Oct 2018 13:21:42 GMT

I added you. Is the Monitor Role enough? The open one is registration. and the other is g.

The other 3 are active SSIDS they work fine.

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Wed, 10 Oct 2018 03:45:12 GMT

Thanks for adding me, monitor should be fine for now. Could you confirm your Organization name (Global Settings> Account Details> Organization Name) so I can be sure to look at the correct VHM?

Re: PPSK and Selfregistration / users assignement

pagella — Wed, 10 Oct 2018 14:49:58 GMT

Sent u a pm

Re: PPSK and Selfregistration / users assignement

pagella — Fri, 12 Oct 2018 13:09:43 GMT

bump 🙂

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Sat, 13 Oct 2018 02:08:29 GMT

Thanks for checking in, I appreciate your patience while we looked in to this for you. I see you have Employee approval set up in the CWP but unfortunately I don't have a high enough access to see your credential distribution groups (Silhouette icon in the top right hand corner> Global Settings> Credential distribution groups). I need to see the guest management credential distribution group in particular.

If you have a self registration SSID set up and require employee approval, the clients will be able to register but they won't be able to use the credentials they are given until the employee approval goes through correctly.

Assuming that is set up correctly, I'd want to SSH in to an AP, run the follow commands, go through the entire registration process again as a new user, and then pull tech data.

Commands:

_debug auth info

_debug auth basic

After you've tried to register and log in, please pull tech data (Tools> Utilities> Get tech data> Check the box next to the AP you connected to> Get tech data (at the top of the page this time)) and email that over to me. Please also let me know the MAC address of the client you were testing with so I can be sure to look at the correct data in the tech data you send over.

Re: PPSK and Selfregistration / users assignement

pagella — Mon, 15 Oct 2018 17:06:54 GMT

Hi there,

there werent any credentials distribution groups beside the admin one.

I created a new one and assigned it. I registered a new User and it still gave me the wrong PW.

I gave u more rights now u should be able to see it now.

Edit-

I turned the debug on. and redid everything. Not working.

the mac address was 1c91480fa8dc

Thanks !

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Tue, 16 Oct 2018 01:32:05 GMT

Thank you for letting me know. I've taken a look and I see the Credential distribution group now, but it does not have employee approval enabled on it, where as your registration captive web portal does have employee approval turned on.

The link below is a guide that reviews the set up for an employee approval self registration SSID, I would recommend reviewing it side by side with your configuration to make sure all the necessary steps have been taken in your set up.

https://thehivecommunity.aerohive.com/s/article/Employee-Approval-with-Self-Registration-SSID-in-NG

Re: PPSK and Selfregistration / users assignement

pagella — Wed, 17 Oct 2018 17:40:18 GMT

Hi Sam thanks,

i redid everything from start.

Opened a SSID named it-test.reg

enabled Self Registration
enabled Return to Aerohive Private PSK
added CWP
- Approver Email Domain List with our domain
- PPSK Settings Choose Access SSID it-test
- PPKS Server --> Cloud PPSK

PPSK SSID it-test

Enabled CWP
Added Testgroup -> Credential User Group got Registration Operation Email --> Approval enabled and the Testgroup selected as Enabled

I even created a User for Guest Management.

I register my Phone:

i get an Email as User with the PSK,
- the Guest Management Mail i entered also gets an email with the approval link -> i approve the User

When i Login to the test-it SSID with the PSK i still get wrong Password.

When i check the User in the NGconnect he is listed as Approved by the Guest Management User.

I also tried to add a User manually with the same result. What am i doing wrong !?

Re: PPSK and Selfregistration / users assignement

pagella — Wed, 17 Oct 2018 19:19:24 GMT

I also just noticed that when i login as the Guest Management User, the approved User doesnt show up in the List.

But as Admin i can see him as approved by the Guest Management User.

That seems unusual.

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Wed, 17 Oct 2018 20:03:16 GMT

Thanks for the update, I took a look at the configuration again and it all looks good. Would you mind if I add an AP from my lab to your HiveManager so I can test this set up from my side? I won't make any changes to anything in the configuration, I'd just add an AP, push your configuration out to the AP, and try to register. You would likely have to approve my test user, and then we'll see if I can connect. Does that sound like a plan?

Re: PPSK and Selfregistration / users assignement

pagella — Wed, 17 Oct 2018 20:25:32 GMT

Yes u can do that. Thanks !

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Thu, 18 Oct 2018 02:24:39 GMT

Thanks for your patience, I think I've found the issue. The user group you've got added to the PPSK SSID is also in use in a couple other SSIDs. Could we make a new user group that is not in use in any other SSIDs and try again?

Re: PPSK and Selfregistration / users assignement

pagella — Thu, 18 Oct 2018 15:27:35 GMT

I created a new Group (Testgroup) and a new Credential Distribution Group (Test-CDG) but i get the same result.

What i also dont understand is:

In the Credential Distribution Group i have the Field "Guest Management User" where i should add an Email.

Is it needed to be the one of an existing User? In my case it is. Ive tried it with an Email of a Guest Management User and also as Admin.

As a Guest registering myself i can add an Email of the person im visiting. Independently of the Email entered in the Credential Distribution Group i can add any Email of my Company because of the rule in the CWP and the person will get the approval mail and can also approve of the guest.

Is that supposed to be like that?

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Thu, 18 Oct 2018 20:41:12 GMT

Would it be alright if I built a new network policy, new SSID, new user profile, and new user group? Ultimately, I'd like to build a self reg SSID that I can get working, then add in the employee sponsorship elements to see if that is what is causing these failures. I won't adjust any of your existing objects and I'll only push this out to my test AP from my lab. All configuration items I build will be named some variation of AerohiveTest, and we can delete it all when we're done.

The email you add to the Credential Distribution group needs to be the email of a guest management user that already exists in your administrators list.

Unfortunately we can't lock the employee approval down to a single user or list of users, it will allow all emails within one domain to approve user requests. If you'd like I can submit a feature request on your behalf to add in more granular control for employee approval settings?

Re: PPSK and Selfregistration / users assignement

pagella — Thu, 18 Oct 2018 20:49:22 GMT

Yes u can do that. That AP is the first im migrating to NGConnect so dont worry.

Whats the point of having a guest management User then if everyone is allowed to approve? I still dont understand it.

Yeah that would be nice i think that would make sense to breakt it down a little bit more.

Thanks for the support

Re: PPSK and Selfregistration / users assignement

samantha_lynn — Fri, 19 Oct 2018 01:58:37 GMT

Thanks for the access, I've been testing today and I was able to find the following:

Without employee approval added in to the mix:

Created a self reg Open SSID and PPSK SSID. I was able to register, I received credentials, but I was unable to log in (step 2 of the 4 way handshake failure).

Created a non-self reg PPSK SSID with the user group using the cloud database location. Same results, failure at step 2.

Created a non-self reg PPSK SSID with the user group using the local database location, and I was able to authenticate.

I created a lab on the same RDC you are using, and I had the same results there as well.

We are going to need to open a case for this issue, I've emailed you with our options for opening a case. Which ever way works for you, please let me know the case number so I can make sure the case gets where it needs to go.

Thank you very much for your patience with all of this, I appreciate you hanging in there with me.

To answer your question- Whats the point of having a guest management User then if everyone is allowed to approve?

We've had this feedback before, and the best answer I can give you is that it's for small offices with a small handful of employees who will know if they need to approve users or ignore them. It also allows any employee in the domain to be entered as the person the client is here to visit. For example a small law office with a few different lawyers working in the same office, if a user is here to see a specific lawyer then that lawyer can get the email notification to approve them.

That being said, I will certainly submit a feature request for you on this subject.