topic Redirecting Open SSID to Extreme Control in ExtremeControl

Redirecting Open SSID to Extreme Control

RobertD1 — Wed, 02 Mar 2022 16:57:05 GMT

Hello,

I've configured an Open SSID on a network profile in XIQ and it is visible from my AP. If I connect to the SSID a web page pops up prompting me to Connect to a Wi-Fi hotspot and Connect to a sign in page. When I click Connect nothing happens at this point. This is in Windows 10. Not sure if the issue is with Control or XIQ? I see my machine in End-Systems against Open SSID and it hits Unregistered rule. I'm expecting a registration page?

Thanks,
Rob

Re: Redirecting Open SSID to Extreme Control

RobertD1 — Wed, 02 Mar 2022 20:34:45 GMT

On a different laptop I see in the URL display a connection to my EAC with Called-Station-Id (my MAC blacked out below) and a Welcome to the Enterprise Registration Center. Access Granted. If I click Click here to connect it redisplays the same screen. Again, not prompted to enter user details and register.

Finishes with Service Unavailable 503.

Re: Redirecting Open SSID to Extreme Control

RobertD1 — Fri, 04 Mar 2022 12:10:47 GMT

Is the idea that the AP redirects web traffic to access control using the IP Firewall object? This removes the need for a core router with PBR configured. All of my network is VLAN 1 and not routed, does this matter?

Re: Redirecting Open SSID to Extreme Control

RobertD1 — Fri, 04 Mar 2022 17:39:09 GMT

After a lot of trial and error I have Guest Registration working. My environment is at home and there was a DNS issue. My test PC gets DHCP and DNS from my home router. So, after adding a host entry in my hosts file it all worked as expected.

Re: Redirecting Open SSID to Extreme Control

Ryan_Yacobucci — Tue, 08 Mar 2022 17:37:11 GMT

Hello,

Thanks for posting all of this detail. There are many moving parts when it comes to successful captive portal.

To answer your question:

That is correct. There must be SOME mechanism in the network to redirect client traffic in order for NAC to send it's captive portal. Traditionally that was a PBR in the core router to send internet bound traffic to the NAC.

Mostly today we see AP/Controller based redirection mechanisms that perform this task.

https://extremeportal.force.com/ExtrArticleDetail?an=000082067

The AP/Controller will spoof the destination site and send back a redirect error code with the a new URL that is the NAC appliance. The browser will them directly contact the NAC to display the captive portal.

Thanks
-Ryan