External Portal How to tell the AP that user is allowed

[sascha_mueller]

Im evaluting the cloud features and have set up an external CaptivePortal as well as external radius server. The SSID is open and when I log on the WLAN im redirected to the external web page. I can also see accounting packets coming in to the radius. Though no authenticaton or authorization requests.

Where I'm stuck now is how to tell the cloud or ap that the client is approved. I found some api calls to setup users but that would mean that the client has to enter them. What I want is just after accpting our terms of WLAN usage that the captive portal tells the cloud or AP that the client is allowed to venture onward.

[sascha_mueller]

As of now i use my external portal to make the client sent a request to NAS-IP-Address (1.1.1.1) taken from GET. The client can reach the destination but i get back "Unkown error". Thus I have to find the right values for the post request so reg.php is happy. But thats for tommorow.

Thank you this far.

[samantha_lynn]

The standard UPA CWP is hosted on the AP, so you can change the address from 1.1.x.x to something else, but it would need to be an internal IP address and we can't reach an external page that way, as the clients are technically still in a walled garden until they pass the CWP. We can point users to an external URL for authentication, but it has to be Radius authentication for that function, so we can't use an external UPA on it's own. If you want to build a custom page via an HTML file, you can import that in to the CWP, but I think that's as close as we can get to your use case.

[sascha_mueller]

Would that UPA CWP be on my external webserver? If that be the case thats what i want.

While trying some I set "Enable UPA" and the client gets redirected to 1.1.101.1/reg.php which shows me the policies and allows to accept them. After that i was able to use the WLAN to its full extend. Could i (mis)use the 1.1.101.1/reg.php to use my external portal to register the client to the ap? Or is it solely reacable over the WLAN port?

[samantha_lynn]

We can set up a UPA CWP, that would funnel users to a page where they accept your usage policy, and after that they are allowed on to the network. Is that what you're looking for?