How to Aruba captive portal and MAC Caching

Bo Nielsen, CCIE #53075 (Sec)

Oktober 2016, V1.00
How to Aruba captive portal and MAC Caching

Overview
The principle of captive portal is that the user to start with is approved unconditionally, but it is at
first http request that the authorization actually begins. The approval is done with a captive portal
where the user must enter a login. If login is approved the user can use the wireless network. After
approval there are several options with the time frame for access to the wireless network.

 Session-Timeout from RADIUS accept.

 MAC caching, and it means that the MAC address of the endpoint is approved.

MAC caching can be permanent or with a time frame, and it depends on the setup.

The process of external web authentication is illustrated:

Instant AP DNS Web Auth

URL = /guest/login.php

10.100.200.78
DNS for www.dr.dk

http://www.dr.dk

Redirect = https://10.100.200.78/guest/login.php

Aruba Clearpass

Get = https://10.100.200.78/guest/login.php

Post = https://10.100.200.78/guest/login.php
Option
Pre-check

Post = https://securelogin.arubanetworks.com

DNS for securelogin.arubanetworks.com

IP = 172.31.98.1

Authentication
Aruba Clearpass Win-AD
source for
172.31.98.1 application service

Logging in, please wait ...

https://securelogin.arubanetworks.com/cgi-bin/ www.dr.dk
login RADIUS LDAP
LDAPS
PAP
Success page

http://www.dr.dk

Bo Nielsen, CCIE #53075 (Sec) Side 1

How to Aruba captive portal and MAC Caching

The purpose of captive portal between Aruba Instant AP and Aruba ClearPass is:

1. The user connects to the wireless network.

2. The first time the user wants to access something with http, then the AP will provide a redirect
to the captive portal.
3. The user enters the login. It will often be a guest account, but it can also be a user name and
password from the Windows AD.
4. An option with captive portal is to approve the login as a pre-check to avoid sending a RADIUS
request with an incorrect login. The ability to pre-check is by default selected, but can be
disabled if desired.
5. Web page for the captive portal will return login credentials to the user's browser and ask the
browser to use the website securelogin.arubanetworks.com to login. This part is carried out
behind the back, and the user will see it as part of the approval without making further.
6. The user's endpoint will send a DNS query for securelogin.arubanetworks.com and the AP will
spoof a DNS reply to the IP address 172.31.98.1. This IP address is the website login for the AP.
7. When AP receives a login on 172.31.98.1, the AP sends a RADIUS request with the user-name set
to the login name and the password is sent encrypted.
8. RADIUS service will approve the login and return a session timeout and a role name to the AP.

There are three parameters to the captive portal that are important to clarify the use of external
weblogin when Aruba ClearPass is the external web server.

Captive portal as http or https

Login as http or https for the captive portal web page. It is important that the certificate to Aruba
ClearPass HTTPS service is a SAN certificate, where the IP address is included. The setup for captive
portal on the AP can be an IP address or FQDN. If the FQDN is used, the certificate common name
has to match the FQDN, and the user's endpoint must be able to resolve the FQDN.

ClearPass Guest -> Configuration -> Authentication

Bo Nielsen, CCIE #53075 (Sec) Side 2

How to Aruba captive portal and MAC Caching

Pre-check

The user's login to captive portal can be checked by the web application. The essence of this option
is that in Aruba ClearPass must always create a service rule for the web applicationen with an
authentication source. In practice pre-check is recommended and here a successful login from the
web application results in a RADIUS request from the AP. If pre-check is deselected the web
application just returns the login credentials from captive portal and the browser sends a HTTP Post
to securelogin.arubanetworks.com and this is followed by a RADIUS request from the AP.

ClearPass Guest -> Configuration ->Pages -> Web Logins

Aruba Securelogin

The user's login from captive portal is sent as an HTTP Post to securelogin.arubanetworks.com, and
the AP will spoof DNS query in order to receive the comming login. It is possible to use http or https,
where the certificate for https is provided by AP and this certificate is issued by Geotrust DV SSL CA.

ClearPass Guest -> Configuration -> Pages -> Web Logins

Bo Nielsen, CCIE #53075 (Sec) Side 3

How to Aruba captive portal and MAC Caching

Aruba Instant AP
This example creates an SSID named Ford and Aruba ClearPass is the RADIUS with an external
captive portal to the IP address 10.100.200.78. Note that there is always created a role with the
same name as the SSID, and in this example the role of Ford is granted to authorized guest users.

RADIUS server

Security -> Authentication Servers -> New

Captive portal

Security -> External Captive Portal -> New

Redirection is here active on port 80. Redirection to https is not used.

URL must always begin with /guest and then the name of weblogin with .php as extension.

Bo Nielsen, CCIE #53075 (Sec) Side 4

How to Aruba captive portal and MAC Caching

Roles

In this example the role Guest_logon and Ford is used to grant access to the network before and
after login via captive portal. The role Ford is created automatically when you create an SSID with
this name. By default network access for this role is set to all destinations.

Security -> Roles

The role Guest_logon is here limited to access the captive portal website, DNS and DHCP.

Create SSID

New

Bo Nielsen, CCIE #53075 (Sec) Side 5

How to Aruba captive portal and MAC Caching

Next step is to create an external website for captive portal with the URL /guest/login.php.

Bo Nielsen, CCIE #53075 (Sec) Side 6

How to Aruba captive portal and MAC Caching

Aruba Clearpass Guest Web Login

ClearPass Guest -> Configuration -> Pages -> Web Logins -> Create a new web login page

From the above example the name login sets the URL to /guest/login.php

Other options with external web captive portal are:

 The use of HTTP or HTTPS for captive portal (default is https)

 The use of HTTP or HTTPS for securelogin.arubanetworks.com (default is https)

 Use of pre-check (default is that the web application checks login from captive portal)

Bo Nielsen, CCIE #53075 (Sec) Side 7

How to Aruba captive portal and MAC Caching

Guest access using session timeout

The most simple form for guest access is to approve a guest user and provide a time limited access.
The time limited access is set with the session timeout value, and will only be applicable to the AP,
where the user has been approved. If the user moves to another AP, the user must be approved
again via the captive portal. The process is:

1. The user connects to the SSID and gets an IP address with the settings for DNS.
2. AP (here Aruba Instant) is set to use external captive portal and not MAC authentication.
3. The first time the user tries to access a webpage, the user is sent to the captive portal.
4. The user enters the guest login (the web application service).
5. For pre-check the user login is validated before sending a RADIUS request from the AP.
6. AP sends a RADIUS request with login from captive portal (securelogin.arubanetworks.com).
7. Aruba ClearPass approves the access with a RADIUS accept where the Session-Timeout value sets
the time frame before the user must re-enter login using the captive portal.

Web application
http/https
Service
”Ford-APPL-service”

Application Name = WebLogin Guest User Repository

Enforcement policy
”Ford-APPL-enforcement”

Day-of-Week: Monday-Sunday

Enforcement profile
”[Allow Application Access Profile]”

RADIUS

Authentication method
PAP

NAS-Port-Type = Wireless-802.11
AP Service-Type = Login-User Service
(NAD) ”Ford user auth service”
Aruba-Essid-Name = Ford
Guest User Repository

Role = user authenticated

Enforcement policy
AccountEnable = true
”Ford user auth enforcementt”
AccountExpired = false

Enforcement profile RADIUS:IETF

”Ford user auth profile” Session-Timeout = 3600

Important: The setting for MAC authentication on the AP must be deselected (disabled).

Bo Nielsen, CCIE #53075 (Sec) Side 8

How to Aruba captive portal and MAC Caching

Service rule for Web application

Enforcement policy

Bo Nielsen, CCIE #53075 (Sec) Side 9

How to Aruba captive portal and MAC Caching

Service rule for RADIUS

Enforcement policy

Bo Nielsen, CCIE #53075 (Sec) Side 10

How to Aruba captive portal and MAC Caching

Enforcement profile

Verification

Monitoring -> Live Monitoring -> Access Tracker

Bo Nielsen, CCIE #53075 (Sec) Side 11

How to Aruba captive portal and MAC Caching

Guest access by MAC Caching

Guest access can be authorized using the status of the MAC address. This gives the advantage that
the user can move to another AP without using captive portal to get on the network again.

The principle is called MAC caching and in order to remember the settings and status through
RADIUS request, we need some extra parameters for the MAC address that belongs to the user's
endpoint. The extra parameters are:

 Guest Role ID (1=Contractor, 2=Guest og 3=Employee)

 MAC-Auth-Expiry
 Username

Example from an endpoint that is approved and ready for MAC caching:

Additionally the status as Known or Unknown is used to determine whether the user should be sent
to the captive portal or use network as Guest, Employee or Contractor role.

Example for an endpoint with the status Known:

The values for the Status, Guest Role ID, MAC-Auth Expiry and Username is added and set with a
Post_Authentication profile, when the guest user is authenticated via captive portal.

The easy way is to use the wizard from Start Here.

Bo Nielsen, CCIE #53075 (Sec) Side 12

How to Aruba captive portal and MAC Caching

The wizard creates in total 3x service rule, 3x enforcement policy and 8x enforcement profile and 2x
role mapping. Run the wizard for:

 Guest Access - Web Login

 Guest Authentication with MAC Caching

Important: The setting for MAC authentication on the AP must be selected (enabled).

Guest Access - Web Login

Configuration -> Start Here -> Guest Access - Web Login

1. Enter a prefix - here "Ford".

2. Select the name of the captive portal (Web Logins from ClearPass Guest) from the list.

3. Accept the default settings for access.

4. Click Add Service, and the service rule "Ford Guest Access - Web Login" is created.

Bo Nielsen, CCIE #53075 (Sec) Side 13

How to Aruba captive portal and MAC Caching

Guest Authentication with MAC Caching

Configuration -> Start Here -> Guest Authentication with MAC Caching

1. Enter a prefix - here "Ford".

2. Enter the name of the SSID to be used for guest access - here "Ford".

3. Accept the default settings for what happens when the guest account expires. The expire date is
determined by the creation date of the guest user plus the duration (1 day, 1 week etc.).

4. Accept the default settings for posture (default = unchecked).

5. Enter Aruba roles for the roles to be used. Here I will used the guest role only, and that role will
be named "Ford " in the RADIUS accept.

6. Click Add Service and the service rule "Ford MAC Authentication" and "Ford User Authentication
with MAC Caching" is created.

Bo Nielsen, CCIE #53075 (Sec) Side 14

How to Aruba captive portal and MAC Caching

Summary for the wizard

Ford Guest Access - Web Login (application)

Purpose: The user gets a captive portal and enter login. The pre-check validates the login and a
wrong login is referred to the same webpage again in order to re-enter a new login. Approved login
(only for pre-check) or simply login credentials (if pre-check is deselected) is returned to the user's
browser, and the browser will automatically send login to securelogin.arubanetworks.com as a HTTP
Post command.
Service Application Name = WebLogin
Application:Clearpass Page-Name = login
Authentication Guest User Repository
Roles [Guest Roles] 1 = Contractor
2 = Guest
3 = Employee
Enforcement Date: Day-of-Week Monday - Sunday

Ford User Authentication with MAC Caching (RADIUS)

Purpose: AP sends a RADIUS request when the user has entered a login from captive portal. The
RADIUS request is the user's login with user-name and encrypted password. If login approved then
the MAC address of the endpoint is set to the status Known and adds three additional parameters to
authorize access based on the MAC address (guest user re-connect to the wireless network).
Service Radius:IETF Calling-Station-Id Exists
Connection Client-Mac-Address != %{Radius:IETF:User-Name}
Radius:Aruba Aruba-Essid-name = Ford
Authentication Authentication Methods PAP, MSCHAP, CHAP
Authentication Sources [Guest User Repository]
Authorization Authorization Sources [Endpoint Repository]
[Time Source]
Roles Ford User Authentication with GuestUser:Role ID = 1 then [Contractor]
MAC Caching Role Mapping GuestUser:Role ID = 2 then [Guest]
GuestUser:Role ID = 3 then [Employee]
Enforcement Role = Guest and Ford MAC Caching Timeout
Date: Day-of-Week = Mon-Sun Ford MAC Caching Bandwidth Limit
Ford MAC Caching Session Limit
Ford MAC Caching Do Expire
Ford MAC Caching Expire Post Login
Ford Guest Profile
Ford Guest MAC Caching
[Update Endpoint Known]

Bo Nielsen, CCIE #53075 (Sec) Side 15

How to Aruba captive portal and MAC Caching

Ford MAC Authentication

Purpose: If the MAC address of the RADIUS request is found in the endpoint database, and the
account is still active, then access is granted with the Aruba role of "Ford". If the MAC address has
the status Unknown a RADIUS reject is send from Aruba ClearPass. This gives HTTP-redirect via AP.
Service Client-Mac-Address = %{Radius:IETF:User-Name}
Aruba-Essid-Name = Ford
Authentication Authentication Methods [MAC AUTH]
Authentication Sources [Endpoint Repository]
Authorization Authorization Sources [Endpoint Repository]
[Time Source]
Roles Time Source Now DT < %{Endpoint:MAC-Auth-Expiry} &&
Guest User Repository AccountExpired = false &&
Guest User Repository AccountEnabled = true then [MAC Caching]
Guest Role ID If 1 then [Contracor]
If 2 then [Guest]
If 3 then [Employee]
Enforcement Role = [MAC Caching] && [Allow Access Profile]
[Guest] && [User Authenticated] Ford Guest Profile

Role = [Guest] || [Contractor] [Allow Access Profile]

|| [Employee] Ford Captive Portal Profile

Two profiles have a special significance: "Ford Captive Portal Profile" and "Ford Guest Profile".

Aruba role before the user is authenticated and the role after the user is authenticated:

Bo Nielsen, CCIE #53075 (Sec) Side 16

How to Aruba captive portal and MAC Caching

Verification
The endpoint has the MAC address 00:13:E8:80:F5:C5

Before approval

Bo Nielsen, CCIE #53075 (Sec) Side 17

How to Aruba captive portal and MAC Caching

After approval and ready for MAC Caching

Bo Nielsen, CCIE #53075 (Sec) Side 18

How to Aruba captive portal and MAC Caching

The guest user re-connects to the wireless network:

Bo Nielsen, CCIE #53075 (Sec) Side 19