Contents

Configure Captive Portal for Guest with Aruba Instant AP

You are here:
← All Topics

Steps on how to configure Captive Portal for Guest with Aruba Instant AP

Captive Portal for Guest with Internal – Acknowledged

Guest users are required to accept the terms and conditions to access the Internet.

Configure a new SSID Profile (Network)

  • vlan guest – Virtual Controller Managed VLAN
  • vlan x – VLAN x is assigned and VLAN tagging need to be configured on uplink port
  • deny-inter-user-bridging – Isolated individual guest user to prevent them from accessing to each other
IAP315 (config) # wlan ssid-profile GUEST
IAP315 (SSID Profile "GUEST") # enable
IAP315 (SSID Profile "GUEST") # type guest
IAP315 (SSID Profile "GUEST") # essid GUEST
IAP315 (SSID Profile "GUEST") # captive-portal internal 
IAP315 (SSID Profile "GUEST") # vlan guest
IAP315 (SSID Profile "GUEST") # deny-inter-user-bridging

Logon Role and Access Rules

Create an access rules for SSID PROFILE = GUEST with Full Access

IAP315 (config) # wlan access-rule GUEST
IAP315 (Access Rule "GUEST") # rule any any match any any any permit

Customize Rule to deny SSH (Port 22) to 192.168.1.238 for reference

rule <DESTINATION IP> <SUBNET MASK> match 6 <START-PORT> <END-PORT> <ACTION> log

IAP315 (Access Rule "GUEST") # rule 192.168.1.238 255.255.255.255 match 6 22 22 deny log

Check the log with show log security 10 (For the last 10 events only)

IAP315# show log security 10

Mar 18 16:07:48  stm[5552]: <124006> <WARN> |AP [email protected] stm|  TCP srcip=192.168.1.132 srcport=53644 dstip=192.168.1.238 dstport=22, action=deny

To customize internal captive portal splash page

Refer to link here to found out the Decimal value of color code for background-color & banner-color

IAP315 (config) # wlan captive-portal
IAP315 (Captive Portal) # background-color 13487359
IAP315 (Captive Portal) # banner-color 0
IAP315 (Captive Portal) # redirect-url "https://aventistech.com"
IAP315 (Captive Portal) # banner-text "Welcome to Guest Network"
IAP315 (Captive Portal) # terms-of-use "This network is not secure, and use is at your own risk"
IAP315 (Captive Portal) # use-policy "Please read terms and conditions before using Guest Network"

To upload logo to portal

IAP315 # copy config tftp <ip-address> <filename> portal logo  

Replace the Default SSL Certificate for Captive Portal to avoid guest users to see the certification error message

Guest users will be redirected to the page below when they are connecting to GUEST WIFI

Captive Portal for Guest with Aruba

Disconnect users from Aruba AP

List all connected users, and disconnect user based on their MAC Address

IAP315# show datapath user
Datapath User Table Entries
---------------------------
Flags: P - Permanent
       R - ProxyARP to User, N - VPN, L - local, I - Intercept, D - Deny local routing
       M - User Media Classified, K - OS known
FM(Forward Mode): S - Split, B - Bridge, N - N/A

       IP              MAC           ACLs      Contract   Location  Age    Sessions   Flags     Vlan  FM  MediaSessCnt
---------------  -----------------  ---------  ---------  --------  -----  ---------  -----     ----  --  ------------
192.168.1.240    A8:BD:27:C1:7B:F8  105/0/0       0/0     0         0        0/65535  P           1   B          0
0.0.0.0          A8:BD:27:C1:7B:F8  105/0/0       0/0     0         0        0/65535  P           1   B          0
172.16.10.1      A8:BD:27:C1:7B:F8  105/0/0       0/0     0         0        0/65535  P        3333   B          0
0.0.0.0          DC:FB:48:65:9E:97  155/0/0       0/0     0         0        0/65535  PK          1   B          0
192.168.1.132    DC:FB:48:65:9E:97  155/0/0       0/0     0         0        8/65535  K           1   B          0
192.168.1.125    A8:BD:27:C1:7B:F8  105/0/0       0/0     0         0        7/65535  P           1   B          0

IAP315# disconnect-user mac DC:FB:48:65:9E:97

Captive Portal for Guest with Internal Authenticated

Guest users are required to authenticate in the captive portal page to access the Internet

Create some local user account for guest

IAP315 (config) # user guest1 [email protected]

Create a new SSID-Profile

Enable Authentication with auth-server InternalServer with local Database

IAP315 (config) # wlan ssid-profile GUEST
IAP315 (SSID Profile "GUEST") # enable
IAP315 (SSID Profile "GUEST") # type guest
IAP315 (SSID Profile "GUEST") # essid GUEST
IAP315 (SSID Profile "GUEST") # captive-portal internal 
IAP315 (SSID Profile "GUEST") # vlan guest
IAP315 (SSID Profile "GUEST") # auth-server InternalServer

Logon Role and Access Rules

Reuse the previously configured Access Rule GUEST

IAP315 (config) # wlan access-rule GUEST
IAP315 (Access Rule "GUEST") # rule any any match any any any permit

Enable Authentication in Captive Portal

wlan captive-portal
 background-color 13487359
 banner-color 0
 redirect-url "https://aventistech.com"
 banner-text "Welcome to Guest Network"
 terms-of-use "This network is not secure, and use is at your own risk"
 use-policy "Please read terms and conditions before using Guest Network"
 authenticated

Guest users will be redirected to the authentication page below when they are connecting to GUEST WIFI

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top