topic Re: Captive Portal issue in Aerohive Migrated Content

Captive Portal issue

thomas_berthome — Mon, 08 Apr 2019 18:44:04 GMT

Hello,

I've followed the Self Registration PPSK SSID Hivemamanager without any issue.

I've created the 2 SSID (one with PPSK and the one with Captive Portal).

When I'm connected to the Captive Portal, I'm not redirected to a registration page (even when I'm going to a Web browser).

Impossible to have the Registration Page. I've my broswer loading in infinity loop. Any tips ?

The PPSK SSID is working fine and waiting PPSK Key, but obsviously without the Captive Portal I can't test.

On the captive Portal, when we choose a "Cloud PPSK Registration Server", do we need to open specific port on firewall point of view ?

Re: Captive Portal issue

samantha_lynn — Tue, 09 Apr 2019 16:59:07 GMT

Would you be able to add me as an external admin so I can take a look at the configuration? No changes will be made, I just want to see the set up we're working with currently. If you'd like to add me, please use slynn@aerohive.com. Also, if there are multiple network policies or SSIDs, please let me know which ones to focus on.

Re: Captive Portal issue

thomas_berthome — Tue, 09 Apr 2019 18:06:40 GMT

Hello,

Thank you for your answer.

I gave you Observer access on our Aerohive platform. The Network Policy we're using is Named SGS-FR.

You can send me directly an email on : thomas.berthome@sgs.com

Re: Captive Portal issue

samantha_lynn — Tue, 09 Apr 2019 19:47:48 GMT

Thank you for giving me access. I took a look at the configuration and everything looks fine. Could you tell me what client device OS types you've tested with; i.e android, apple, Mac, windows laptop, etc? Also, on a device we are testing with, after connecting to the SSID, could you try manually navigating to 1.1.1.1?

Re: Captive Portal issue

thomas_berthome — Tue, 09 Apr 2019 21:51:10 GMT

Hello,

I've tried to connect to our Captive Portal with :

Android phone : Samsung Galaxy S8
Computer on Windows 7-Windows 10
Iphone X

I've got always the same result : impossible to connect to it.

In the first implementation, I could connect to this SSID and receive an IP address on the good VLAN. Then, I was able to ping Internet (8.8.8.8) but not going through Web Browser.

Things to know on the Public SSID, I've assigned a specific VLAN (9). We're using the same port for all SSID, and I have configured trunk port on switch.

I think it's maybe link to to the DEVICE TEMPLATE I've created.

Re: Captive Portal issue

samantha_lynn — Tue, 09 Apr 2019 22:17:13 GMT

Thanks for letting me know. I checked your device template and I don't see anything in there that would stop clients from reaching the CWP (although we don't typically recommend trunking for all VLANs, we usually recommend you specify the ones you want). Could you confirm that any firewalls or content filters on the network are allowing traffic via UDP 2083?

Re: Captive Portal issue

ashley_finch — Tue, 09 Apr 2019 22:42:38 GMT

If you go to wifi123.org do you see the Captive Portal page? I normally use this one to test as it's a HTTP page so you should then hit the captive portal page. Else I'd check Sam's suggestions!

Re: Captive Portal issue

thomas_berthome — Wed, 10 Apr 2019 15:14:40 GMT

Of course, I'll let only allow specific VLAN to the port.

We have a proxy that filter all traffic, and UDP 2083 is not bypassed on this Proxy. This port is use for what ?

On the https://cloud.aerohive.com/support/Amsterdam.html, I've allowed only TCP 80/443 from 34.253.190.192 to 34.253.190.255

Re: Captive Portal issue

thomas_berthome — Wed, 10 Apr 2019 15:15:14 GMT

I'll try when I'll connect to our Captive Portal again. Currently, I'm not even able to do so...

Re: Captive Portal issue

samantha_lynn — Wed, 10 Apr 2019 17:07:22 GMT

UDP 2083 is used for most of the CWP traffic, so if no clients are able to reach the CWP, we like to make sure this port is allowing traffic.

Re: Captive Portal issue

thomas_berthome — Thu, 11 Apr 2019 20:21:10 GMT

Just a question : on this page https://cloud.aerohive.com/support/Amsterdam.html, I can see the traffic to the 2083 is on TCP. Can you confirm it's in TCP instead of UDP ?

I'm making my firewall opening request to my company.

Re: Captive Portal issue

samantha_lynn — Thu, 11 Apr 2019 21:39:04 GMT

My apologies, you are correct it needs to be TCP. Sorry for the confusion.

Re: Captive Portal issue

samantha_lynn — Fri, 12 Apr 2019 01:14:18 GMT

For ports 80 and 443, could you check HTTP and HTTPS as well?

Re: Captive Portal issue

thomas_berthome — Wed, 17 Apr 2019 15:18:16 GMT

Hello,

I have tested with my own personnal connexion, and it's working well (except the SMS. I don't receive any SMS with the password).

With our Guest user circuit, it's working also.

On my company network, I want to have only one link between my switch and my AP to bear all my VLAN and to isolate the traffic between guest and company's users.

Is it possible to have several Layer 3 VLAN on Aerohive AP ?

An alternative solution is to wire the second ETH port, but I'm not fan of that (too much switch's interface use).

Re: Captive Portal issue

samantha_lynn — Fri, 19 Apr 2019 03:29:51 GMT

We can host several VLANs on the APs, it's set through the user profile attached to the SSID, and we can even have multiple VLANs assigned to a single SSID.

Re: Captive Portal issue

thomas_berthome — Tue, 23 Apr 2019 22:21:31 GMT

Yeah, this is what I have done.

Except, when I'm using captive portal, I don't get any IP address on my other VLAN.

I have set a specific user access setting on my PPSK SSID, and my CWP use the PPSK SSID to connect.

When I tested directly with this specific VLAN, I was automatically redirected on the captive portal page.

On the current configuration, I don't get IP address so I can't be redirected on Captive portal page.

Re: Captive Portal issue

samantha_lynn — Tue, 23 Apr 2019 22:57:48 GMT

I think you might benefit most from a technical support case at this point, so a technician can schedule a call with you to review your configuration over a screen share session and troubleshoot from there.

Re: Captive Portal issue

thomas_berthome — Fri, 26 Jul 2019 15:49:16 GMT

Hello,

So I made a call with a Aerohive tech on the Captive Portal but without being able to solve the issue.

When I tried to test tcp port [TCP 2083, 20000 ~ 20256] on several of these addresses 34.253.190.192 ~ 34.253.190.255, I get nothing (unlike on tcp-80 and 443).

The addresses should answer to the TCP-port test ? Do you have test example ?

PS : My security team did confirm the port are open.

Re: Captive Portal issue

ashley_finch — Fri, 26 Jul 2019 15:57:26 GMT

Hi Thomas, I've tested against the IDM server as below: