topic Re: Mac Binding + PPSK in Aerohive Migrated Content

Mac Binding + PPSK

pagella — Tue, 04 Dec 2018 21:32:47 GMT

Hey its me again 

im trying to use MAC Binding for my PPSK SSID. Is this even possible? The option is there but a dropdown menu shows up requiering for PPSK Server field which is blank.

What does it mean? I havent found any information about a PPSK Server. Is it possible to create a local one for the Mac Binding and maybe also for the PPSK registration?

Re: Mac Binding + PPSK

samantha_lynn — Tue, 04 Dec 2018 21:40:57 GMT

Hi again Antoniutz! You can certainly enable MAC binding with PPSK. That drop down menu should allow you to choose a connected AP to act as the PPSK server.

The PPSK server will store all of the PPSK users and what MAC addresses those users have been bound with, for other APs to contact when authentication requests are made. The AP needs to be at the location you are setting MAC binding up for.

If the drop down menu is blank, and we have devices connected to the HiveManager that are not already acting as PPSK or Radius servers, we would want to troubleshoot that further as that would not be expected behavior.

This page will tell you more about the MAC binding feature and explains the PPSK server (Expand the Private Pre-Shared Key section)- http://docs.aerohive.com/330000/docs/help/english/ng/Content/gui/configuration/configuring-wireless-ssid-settings.htm?Highlight=MAC%20binding

Re: Mac Binding + PPSK

pagella — Thu, 20 Dec 2018 00:00:32 GMT

Hi Sam, i finally found the time to do it.

I sucessfully used one AP as PPSK Server yet i got the next problem now 🙂

i get following message:

Could not modify the field MAC binding in SSID it.test since it was used in cwp

It seems like it is not possible to use the MAC Binding with the CWP + PPSK or did i miss something?

Re: Mac Binding + PPSK

samantha_lynn — Thu, 20 Dec 2018 00:39:57 GMT

You should be able to use a PPSK SSID with MAC binding and a CWP. I just set this up in my lab to be sure:

I was also able to adjust the MAC binding settings after saving the SSID the first time, just to be sure.

I'm not sure why you would get that error message, but if you'd like to add me as an external user so I can take a look that might help. My email for this process would be slynn@aerohive.com, and I would also need to know the Organization Name found in Global Settings> Account Details so I can be sure to look at the correct HiveManager instance. Please also let me know the Network Policy name and SSID name so I can focus on the objects you are working with here.

Re: Mac Binding + PPSK

pagella — Thu, 20 Dec 2018 18:14:27 GMT

Hi Sam u seem to have the captive portal on the ppsk ssid.

I have another scenario:

I have an open SSID for Registration

and a second ppsk ssid without captive portal

Another issue im having is that i cant seem to load the captive Portal from my AP used as PPSK Server.

I gave the AP a static IP

i selected the AP as PPSK Server in the Registration SSID

Now when a client connects to the Open SSID the redirect pages comes saying im going to be redirected and after that it tries to redirect me to the captive portal ON the PPSK AP

for example

10.10.10.10/ppsk/CWP/ppsk_index.cgi?url....

The site is not loading.

Do i need to "upload" or create the captive portal to the specific AP? Or somehow link it? Or should this be enough?

If that is enough why isnt it possible to open the captive portal after the redirect 😞

Re: Mac Binding + PPSK

pagella — Thu, 20 Dec 2018 18:27:51 GMT

Re: Mac Binding + PPSK

pagella — Fri, 21 Dec 2018 16:58:58 GMT

Sent u a pm

Re: Mac Binding + PPSK

samantha_lynn — Fri, 21 Dec 2018 22:34:17 GMT

Thanks for the access, I'm taking a look and I've noticed the following:

All of the user groups in the PPSK SSID it.test seem to be using "DEVICE" as the password DB. Self registration requires you use "CLOUD" for the password DB. When you have this option checked, you'll notice that there is a checkbox next to Enable CWP registration, you'll want to check this too.

Would you mind if I tried to enable MAC binding on it.test to see if I get the same error you do?

Re: Mac Binding + PPSK

pagella — Mon, 24 Dec 2018 17:53:16 GMT

Hi Sam, yeah thats right i was testing around. But i have the same result when using a Group in "CLOUD"

I have the Group "Besucher" which is the group where the visitors who can register themselfes should end up. which is a Cloud with the "Enable CWP Register" option checked. Same result with the MAC Binding.

The CWP Problem is solved that was a FW issue , my mistake 🙂

Re: Mac Binding + PPSK

samantha_lynn — Mon, 24 Dec 2018 21:33:56 GMT

Thanks for letting me try that on my side. After looking at everything, I'm wondering if we can't have the self reg PPSK server and a MAC binding function run on the same AP. Would you mind if I add another AP to your HiveManager from my lab temporarily to test this? I won't make any changes to your current APs, the test will be to add the device to your inventory and then to try and enable MAC binding within it.test using my AP as the MAC binding server, to see if we get the same error. If no error appears, I'd push your policy to my AP to test to see if I could register fully and connect with a single or multiple devices.

Re: Mac Binding + PPSK

pagella — Thu, 27 Dec 2018 18:14:00 GMT

Yes u can go ahead and add one. Feel free.

I will be back at work on monday i could add another one aswell then.

Re: Mac Binding + PPSK

samantha_lynn — Thu, 27 Dec 2018 21:44:20 GMT

Thank you, I added an AP but I did not have the option to use it for the PPSK server, so that doesn't seem to be our issue. I did notice that in the CWP on the Open SSID we are using AP-PPSK for the PPSK server, we typically recommend using cloud PPSK Registration Service for self registration SSIDs. Could we try that out on your set up?

Re: Mac Binding + PPSK

pagella — Wed, 02 Jan 2019 18:19:47 GMT

Nope same result. When i choose the cloud PPSK for the open SSID i cant choose the MAC Auth in the registration SSID.

Re: Mac Binding + PPSK

samantha_lynn — Thu, 03 Jan 2019 03:46:19 GMT

Thank you for letting me know. At this point I think we need to open a technical support case to troubleshoot this further. I will email you directly with further information about how to open a case from here.

Re: Mac Binding + PPSK

w1f1n00b — Mon, 07 Oct 2019 21:22:17 GMT

"The AP needs to be at the location you are setting MAC binding up for."

Does this mean that in order to use MAC binding, I would need to configure a unique SSID at each physical location where I want to use MAC binding?

Re: Mac Binding + PPSK

samantha_lynn — Mon, 07 Oct 2019 21:35:31 GMT

It must be an AP that is at the site to which you want to apply the SSID. Extreme Networks APs (PPSK authenticators) at the same site contact this AP acting as the PPSK Server when checking and requesting a binding of a user-submitted PPSK to the MAC address of the user's client, so they will need to be in the same subnet.

Re: Mac Binding + PPSK

w1f1n00b — Mon, 07 Oct 2019 21:59:59 GMT

This would require that I set up dozens of separate SSIDs (one for each site) if I wanted to use mac binding. Would this still work if I'm using a single network policy, and assigning seperate SSIDs via classification rules?

Is there any way to allow a Mac bound ppsk to work across multiple physical locations, or would a separate key be needed for each location?

Is there any plan to bring MAC binding to Cloud PPSK DBs?

Re: Mac Binding + PPSK

samantha_lynn — Mon, 07 Oct 2019 22:18:45 GMT

You can use classification to direct clients to different SSIDs based on their location, which I believe would be the way you'd have to set this up to cover multiple locations on the same network policy using MAC-Binding PPSK. I don't know of any plans to bring MAC binding to Cloud based PPSKs, but I would recommend filing that as a feature request with your sales engineer so we can see if we can get that added to a later release.