Wing Ap410 Captive portal

[Radoslaw]

 Hi,

I want to implement two Wifi with captive portal on three AP410. On one AP410 i got working everything ok, this AP is work as controller. DHCP, Captive Portal, Radius. But on other two AP only work DHCP, but i can’t connect with webpage to authorization.

Can you tell me what i miss? Any sugestion?

Conception draft

My configuration:

!
! Configuration of AP410 version 7.3.0.0-038R
!
!
version 2.7
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
aaa-policy default-onboard
 authentication server 1 onboard self
!
captive-portal default-onboard
 server host guest-access.net
 webpage internal org-name Startowa
 use aaa-policy default-onboard
 webpage internal registration field city type text enable label "City" placeholder "Enter City"
 webpage internal registration field street type text enable label "Address" placeholder "123 Any Street"
 webpage internal registration field name type text enable label "Full Name" placeholder "Enter First Name, Last Name"
 webpage internal registration field zip type number enable label "Zip" placeholder "Zip"
 webpage internal registration field via-sms type checkbox enable title "SMS Preferred"
 webpage internal registration field mobile type number enable label "Mobile" placeholder "Mobile Number with Country code"
 webpage internal registration field age-range type dropdown-menu enable label "Age Range" title "Age Range"
 webpage internal registration field email type e-address enable mandatory label "Email" placeholder "you@domain.com"
 webpage internal registration field via-email type checkbox enable title "Email Preferred"
!
captive-portal default-onboard2
 connection-mode https
 server host guest-access.net
 webpage internal org-name Startowa
 webpage internal login description Proszę wpisać Login i Hasło
 webpage internal login header Witamy w sieci Startowa Gosc
 use aaa-policy default-onboard
 webpage internal registration field city type text enable label "City" placeholder "Enter City"
 webpage internal registration field street type text enable label "Address" placeholder "123 Any Street"
 webpage internal registration field name type text enable label "Full Name" placeholder "Enter First Name, Last Name"
 webpage internal registration field zip type number enable label "Zip" placeholder "Zip"
 webpage internal registration field via-sms type checkbox enable title "SMS Preferred"
 webpage internal registration field mobile type number enable label "Mobile" placeholder "Mobile Number with Country code"
 webpage internal registration field age-range type dropdown-menu enable label "Age Range" title "Age Range"
 webpage internal registration field email type e-address enable mandatory label "Email" placeholder "you@domain.com"
 webpage internal registration field via-email type checkbox enable title "Email Preferred"
!
wlan wlan1
 ssid ST-EDU
 vlan 2
 bridging-mode local
 encryption-type none
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 use captive-portal default-onboard
 captive-portal-enforcement
!
wlan wlan2
 ssid ST-Gosc
 vlan 3
 bridging-mode local
 encryption-type none
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 use captive-portal default-onboard2
 captive-portal-enforcement
!
smart-rf-policy default
 no select-shutdown
 no smart-sensor
 smart-sensor auto-trigger
 smart-sensor band smart-band-5GHz
!
radius-group ST-Gosc
 guest
 policy vlan 3
 policy ssid ST-Gosc
 rate-limit from-air 100000
 rate-limit to-air 100000
!
radius-group default
!
radius-user-pool-policy default
 user Gosc password 0 654321 group default
 user r.duszczyk password 0 123456 group default
!
radius-server-policy default
 use radius-user-pool-policy default
!
dhcp-server-policy default
 dhcp-pool DHCP-EDU-Vlan2
  network 10.10.10.0/24
  address range 10.10.10.20 10.10.10.200
  default-router 10.10.10.11
  dns-server  10.10.10.11
 dhcp-pool DCHP-Gosc-Vlan3
  network 10.10.11.0/24
  address range 10.10.11.20 10.10.11.200
  lease 0 1
  default-router 10.10.11.11
  dns-server  10.10.11.11
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 ssh
 user admin password 1 bffa8-----------------------------------7199 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
event-system-policy default
!
profile ap410 default-ap410
 ip name-server 8.8.8.8
 ip name-server 8.8.4.4
 ip default-gateway 192.168.1.254
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan wlan1 bss 2 primary
  wlan wlan2 bss 3 primary
  antenna-mode 2x2
 interface radio2
  wlan wlan1 bss 1 primary
  wlan wlan2 bss 2 primary
  antenna-mode 2x2
 interface radio3
 interface bluetooth1
  shutdown
  mode le-sensor
 interface ge1
  switchport mode trunk
  switchport trunk allowed vlan 1-3
 interface ge2
 interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
 interface vlan2
  description "Cap ST-EDU"
  ip nat inside
 interface vlan3
  description "Cap ST-Gosc"
  ip nat inside
 use firewall-policy default
 use client-identity-group default
 logging on
 ip nat inside source list BROADCAST-MULTICAST-CONTROL precedence 1 interface vlan1 overload
 service pm sys-restart
 router ospf
 adoption-mode controller
 !
rf-domain default
 location Hol
 contact mail@wp.pl
 timezone Etc/GMT+1
 country-code pl
 !
 ap410 AA-AA-AA-AA-AA-AA
 use profile default-ap410
 use rf-domain default
 hostname ST-AP01
 area 2C
 floor Ip
 use radius-server-policy default
 interface radio1
  shutdown
 interface radio2
  shutdown
 interface vlan1
  ip address 192.168.1.13/24
  ip address zeroconf secondary
 interface vlan2
  ip address 10.10.10.13/24
 interface vlan3
  ip address 10.10.11.13/24
 use dhcp-server-policy default
 use captive-portal server default-onboard
 use captive-portal server default-onboard2
 ip dns-server-forward
 !
ap410 BB-BB-BB-BB-BB-BB
 use profile default-ap410
 use rf-domain default
 hostname ST-AP01
 area Wysoki
 floor Ip
 use radius-server-policy default
 interface radio1
  shutdown
 interface radio2
  shutdown
 interface vlan1
  ip address 192.168.1.12/24
  ip address zeroconf secondary
 interface vlan2
  ip address 10.10.10.12/24
 interface vlan3
  ip address 10.10.11.12/24
 use dhcp-server-policy default
 use captive-portal server default-onboard
 use captive-portal server default-onboard2
 ip dns-server-forward
 !
ap410 CC-CC-CC-CC-CC-CC
 use profile default-ap410
 use rf-domain default
 hostname ST-CON0
 area Aula
 floor Parter
 use radius-server-policy default
 interface radio1
  no shutdown
 interface radio2
  no shutdown
 interface vlan1
  description "Virtual Interface for LAN by Wizard"
  ip address 192.168.1.11/24
  no ip dhcp client request options all
  no ip nat
 interface vlan2
  ip address 10.10.10.11/24
 interface vlan3
  ip address 10.10.11.11/24
 use dhcp-server-policy default
 use captive-portal server default-onboard
 use captive-portal server default-onboard2
 virtual-controller
 rf-domain-manager capable
 ip dns-server-forward
 no adoption-mode
 !
 !
 end

[Radoslaw]

Hi, thanks for help. The biggest problem was on switch, it not allow communication on diffrent Vlan than 1. At now every think work OK. 🙂

[Ovais_Qayyum · Accepted solution]

Hi Radoslaw,

You shouldn’t have to point the captive portal server host to the IP address of the controller, this is required for the captive portal “centralized mode” where the captive portal runs on a central controller. In case of “internal(self)” the captive portal runs on the AP, and the AP will use the IP interface of the VLAN which is defined in the SSID settings for capture and redirection. If the VLAN IP interface is not defined on the AP and there is no virtual server host FQDN configured, the captive portal will use the IP address of 1.1.1.1 to perform redirection. As IP 1.1.1.1 has now got resolvable to CloudFare, it’s best practice to update the captive portal Server hostname to make sure that process is working correctly.

Looks like you have an IP conflict due to your configuration; both APs have the same IP addresses for VLAN2 and VLAN3. This would also create problems with the captive portal capture and redirection on interface VLAN2 and VLAN3. I would say you fix the IPs, set the virtual server host settings in the captive portal back to the FQDN you had earlier instead of pointing it to the VLAN1 IP of the controller AP, and it should work.   

ap410 AA-AA-AA-AA-AA-AA
 use profile default-ap410
 use rf-domain default
 hostname ST-AP01
 area Wysoki
 floor Ip
 interface radio1
  no shutdown
 interface radio2
  no shutdown
 interface vlan1
  ip address 192.168.1.12/24
  ip address zeroconf secondary
 interface vlan2
  ip address 10.10.10.12/24
  no ip nat
 interface vlan3
  ip address 10.10.11.12/24
 ip dns-server-forward
 !
ap410 BB-BB-BB-BB-BB-BB
 use profile default-ap410
 use rf-domain default
 hostname ST-AP01
 area Wysoki
 floor Ip
 interface radio1
  no shutdown
 interface radio2
  no shutdown
 interface vlan1
  ip address 192.168.1.12/24
  ip address zeroconf secondary
 interface vlan2
  ip address 10.10.10.12/24
  no ip nat
 interface vlan3
  ip address 10.10.11.12/24
 ip dns-server-forward
 

Regards,

Ovais

[Radoslaw]

Hi Ovais

Adoption look ok.
I corrected configuration.
I think I found the problem.
I created third wlan with captive portal on vlan 1 and I set the captive portal on ip of controler AP. Everything is working correctly.
I think the issue in vlan 2 and 3, between APs i cant ping the sets IP on interfaces. Can you look why the vlans is not availible between APs?

[Ovais_Qayyum]

Radoslaw,

Can you confirm if the other two APs are running the same firmware version as the VC controller AP? you can run the command “show adoption status” on the controller AP and check if any of the APs display “version-mismatch”. If yes, then you need to upgrade the APs to the same version. Why is it important? APs that are not on the same version as the controller won’t receive configuration updates, this could be one of the reasons why the captive portal and radius configuration is not pushed to the APs.

Additionally, following is your profile config for the VLAN interfaces, I noticed that the interface NAT configuration conflicts with your AP device config for the same VLANs:

Profile configuration:

interface vlan1 (add “IP nat outside” for VLAN 1)
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
 interface vlan2
  description "Cap ST-EDU"
  ip nat inside
 interface vlan3
  description "Cap ST-Gosc"
  ip nat inside

APs’ device context:

 interface vlan2
  ip address 10.10.10.12/24
  no ip nat

 interface vlan2
  ip address 10.10.10.12/24
  no ip nat

 interface vlan1
  description "Virtual Interface for LAN by Wizard"
  ip address 192.168.1.11/24
  no ip dhcp client request options all
  no ip nat

Regards,

Ovais