Aerohive

To configure the captive portal on a specific network / SSID with the HiveManager NG solution, follow the guide below to create or edit a specific Network Policy in the graphical interface of the Hive Manager NG platform. To create the profile go to the Configure > Networks Policies menu and create a new Network Policy by clicking on Add Network Policy.

After creating the new Network Policy, in the first tab of the configuration (Policy Details) just add the name of the Network Policy and click "SAVE".

In the section Wireless Network, please click on Add other Networks (standard) to add a new SSID profile.

First, we have to choose the Name of the wireless network and later the Broadcast Name that guests will see:

• Enable Captive Web Portal

• User Auth on Captive Web Potal

• Redirect to External URL for Authentication

Then it is necessary to configure the external captive portal parameters. To add a new captive portal profile, please click on the ADD button next to the text Default Captive Web Portal.

• User Auth on Captive Web Portal: ON

• Login Page: set up the following configuration:

  • Login URL (check section 2.2 for the URL redirection to be http or https.)

  • Http option: http://<captive_portal_domain>/login/hotspot/aerohive

  • Https option: https://<captive_portal_domain>/login/hotspot/aerohive

  • Password Encryption: No Encryption (Plaintext Password)

• Authentication Method: PAP

• Success Page: choose the option Redirect clients after a successful login attempt and click in the option To a specified URL to type the URL which the users will be redirected to after their successful authentication. If you want to configure the redirection web site in the WIFI platform you have to fill this gap with the following URL, which can be found in Octopus Platform, in the WLAN section of the Location:

  • http Option: http://<captive_portal_domain>/login/hotspot/landing/wifiarea/WIFIAREA_ID/WLAN_ID

  • https Option: https://<captive_portal_domain>/login/hotspot/landing/wifiarea/WIFIAREA_ID/WLAN_ID

• Failure Page: select the option Redirect clients after a failed login attempt and choose the option to redirect the users To the login page.

Finally, it is necessary to add the domains that the users will be able to visit without being authenticated in the captive portal. Click on the Add button to include all the required domains.

• Name: RADIUS1_WIFI

• IP address Host Name: <IP_Radius_1>

• Authentication port: 1812

• Accounting port: 1813

• Shared secret: <Secret>

• Name: RADIUS2_WIFI

• IP address Host Name: <IP_Radius_2>

• Authentication port: 1812

• Accounting port: 1813

• Shared secret: <Secret>

Then access to Wireless Network > User Access Settings inside SSID that we are configuring to define the proffile associated to the clients that connect to it. For example the vlan which will be assigned to the users.

Finally it is necessary to link the previous added Radius servers in the SSID configuration. For that, access to Authenticate via RADIUS Server and add a new RADIUS Server Group named RADIUS_GROUP and click on Select to select the 2 servers previously created:

Finally, all the configuration made must be deployed to the APs of the installation. To apply these changes, please access to the Deploy Policy tab, select the APs from the list and click on the Upload button to deploy the new configuration in these access points.

In the popup window, select Complete Configuration Update to make a full upgrade of the configuration deployed in the APs. Click on Perform Update to execute the update.

If the IP network automatically assigned to the Wifi interface matches the network 1.1.1.0/24, it is necessary to modify this IP address as it might conflict with a public IP address.

Firstly, it is necessary to load a new certificate in the HiveManager associated to the subdomain name to make the login. This can be done in Configure > Common Objects > Certificate > Certificate Management.

• File: select the file provided

• File Type: CERT_KEY

After click on Save, the new certificate will appear in the available certificates list:

• Enable HTTPS: enable this option.

• HTTPS certificate: select the previously imported file.

• Override Web server domain name with CN value in the certificate: enable this option

In order to allow the users to authenticate themselves in the captive portal correctly, it is necessary to identify the NAS that will send the authentication requests to the Radius Server. In this case you have to add all the MAC addresses asigned to the Wifi interface of the APs that will radiate the configured SSID. In order to do that, once all the configuration has been uploaded, access to all the APs to verify the MAC assigned on the Wifi interface for 2.4GHz and 5GHz.

To obtain these MAC addresses, open a SSH connection with each AP and execute the command show interface. Using this command you will be able to see the MAC address assigned to the radio interface of each SSID in 2.4GHz and 5GHz.

To crate the profile access Configure > Networks Policies and create a new Network Policy by clicking on Add Network Policy:

After creating the new Network Policy, in the first tab of the configuration (Policy Details) just add the name of the Network Policy and click "SAVE".

Next, under Wireless Networks we add a new SSID with the All other Networks (standard) option.

First, we choose a name for the WiFi network and then the name that it will radiate, for example, Mac_Auth_Guest

• Enable MAC Authentication

• Authenticate via RADIUS Server: Link the radius servers created in point 2.1(radius) of this guide

To do this within Deploy Policy select the APs from the list and click on the Upload button to load the new configuration.

Example of an Access Profile configuration with the attributes explained above: