topic Hi, in Wireless

Cisco WLC and Packetfence Captive Portal configuration Guide

Saad Raza Khan — Mon, 05 Jul 2021 13:19:03 GMT

Hello ,

i am configuring Cisco vWLC and its working fine ,internet is running smooth

I need to configure Packet fence Captive portal for my company Guest users.Captive portal via self registration and also interconnect with SMS gateway to provide credentials to guest users.

Any techie here install packet fence and any configuration examples have it.

Hi ,

Saad Raza Khan — Thu, 05 Jan 2017 11:28:23 GMT

Hi ,

Any one ,pls update on it.

Regards

Saad

Hi,

Michel Pedersen — Fri, 06 Jan 2017 10:18:32 GMT

Hi,

We have a working setup using Cisco WLC (wism2) running 7.6.130 with PacketFence 6.3 which works very well.

Authentication is done using webauth on the WLC's with a redirect to the captive portal on the packetfence server. We do not use the SMS authentication but use local users/active directory for authentication in our portal.

For setup instructions you should look at the packetfence documentation. They have good documentation on the WLC setup as well as what you need to do on the packetfence server:

https://packetfence.org/doc/PacketFence_Network_Devices_Configuration_Gu...

This explains the basics of what you need on the WLC as well as in packetfence to interact with the WLC.

Hi,

Saad Raza Khan — Fri, 06 Jan 2017 10:22:42 GMT

Hi,

I have the same document and configure the cisco WLC according to document. but confused about configuration on packetfence...I am looking for step by step configuration of Packetfence server.

Can you pls share the

Saad Raza Khan — Fri, 06 Jan 2017 10:28:34 GMT

Can you pls share the snapshot of your WLC and Packetfence server.i ll recheck my config.

I'll share a quick overview

Michel Pedersen — Fri, 06 Jan 2017 12:28:34 GMT

I'll share a quick overview of the basics from what we have setup.

First, define the packetfence server under SECURITY - > RADIUS on your WLC (in both authentication and accounting). Make sure that you enable support for RFC3576 (this is important! It is used for Radius CoA which packetfence uses to authorize/deauthorize users) As a side note on RFC3576, some WLC versions (atleast <8.x) use port 1700 instead of the standard port which is 3799. If your WLC uses 1700 then you'll need to set this on the packetfence server (see later in this text).

Once the radius servers are defined (for packetfence) you need to define two ACL lists under Security -> Access Control Lists -> Access Control Lists. These define what is allowed then the user is unregistered and what is allowed then user is registered.

I have two, Pre-Auth-For-WebRedirect which allows traffic to my packetfence portal as well as DNS, DHCP and ICMP.

Then we have an ACL to allow all traffic called Authorize_any

Define the wireless network you want to use the captive portal with.

Security is handled by MAC filtering (WLC 8.2 and higher can use WPA2-PSK in conjuction with mac filtering if needed).

Configure the Security settings for the SSID as follows

Under Advanced settings for the WLAN you need to make sure that NAC State is set to Radius NAC/ISE NAC (depending on which WLC version you are running. In 8.2 and higher I think it's ISE NAC)

Redirect to the captive portal is handling using the Radius NAC which sends the relevant URL to redirect.

Now that the WLC basics are setup you'll need to start looking at your packetfence server. I am assuming that you have a working packetfence installation (if not, set it up using the documentation on the packetfence.org webpage)

Under Configuration -> Network -> Switches you need to define your WLC's

Note that I have set Controller port to 1700 here since my WLC's are running 7.6 and this uses 1700 for CoA instead of 3799 which is the standard port (see previous comment about this)

Under Roles in the switch config you will need to define the vlans that are mapped to your roles

Then you define the ACL's that are used for each role when in that state:

And lastly you define the URL of the captive portal to redirect.

Use in the format : https://yourpacketfence.server/$session_id

Lastly go to the RADIUS settings on the switch and setup the Radius secret used for packetfence (which you'll use in your WLC to communicate with the radius server).

This should cover the basics. You will also need to configure your authentication sources in packetfence as well as your captive portal. All of this can be found in the packetfence documentation.

Hi,

Saad Raza Khan — Fri, 06 Jan 2017 12:42:07 GMT

Hi,

i ll apply this config and get back to you. what happened with this config

Good luck! One last thing, if

Michel Pedersen — Fri, 06 Jan 2017 12:52:08 GMT

Good luck! One last thing, if you use a production DHCP for IP assignment you'll need to forward these to the packetfence server.

I've done this by adding the packetfence server to the ip helpers setup on my guest vlan on the switch. This sends a copy of the dhcp request from the client to the packetfence server.

Packetfence needs to know this so make sure that it's set.

Hi Michel,

Farooq Muhammad — Mon, 09 Jan 2017 22:06:15 GMT

Hi Michel,

I am also setting up cisco wlc 5508 with packetfence for Guest access.Can you please share your email here i need to discuss more elaboration of the case.

Regards,

As I'm very busy with my

Michel Pedersen — Thu, 12 Jan 2017 09:05:55 GMT

As I'm very busy with my normal job I'm unable to do support on this. I will ofcourse try to answer what I can here on the forum so please post any questions you might have here.

The documentation provided by packetfence is quite good both with regards to the packetfence and cisco wlc configuration so if you haven't gone through that already I suggest that you do. If you are experiencing any specific issues I might be able to assist though if I've encountered the myself.

Also, the packetfence mailing list is very good with support from the Developers.

regards

Michel

Hi Michel,

Saad Raza Khan — Mon, 16 Jan 2017 08:27:09 GMT

Hi Michel,

I have configured the packetfence according to your guide and but when i go to connect the SSID. its directly connect and reach the internet and not redirected toward web auth page.

i cant find any logs and anything else to troubleshoot. pls check my config which i have shared in snapshot and suggest

Regards

Saad

I've sent you a message here

Michel Pedersen — Mon, 16 Jan 2017 09:22:32 GMT

I've sent you a message here so please read that. You'll find my email there if you'd like to contact me directly.

regards

Michel

Hi ,

Farooq Muhammad — Tue, 17 Jan 2017 09:11:51 GMT

Hi ,

Do you have any idea how to integrate WLC using routed network mode in packetfence ?

I have only used packetfence

Michel Pedersen — Tue, 17 Jan 2017 09:15:22 GMT

I have only used packetfence in out-of-band mode (webauth) so I don't have any experience with using it inline in routed mode. I suggest you try the packetfence mailing list or try to figure it out using the available documentation from packetfence.

Hi ,

Farooq Muhammad — Mon, 20 Feb 2017 07:53:01 GMT

Hi ,

Can you please paste snapshots or guide me about captive portal settings in packetfence.There is very little about the captive portal settings in the guides.

Hi Michel,

resourceproit — Thu, 23 Feb 2017 08:31:23 GMT

Hi Michel,

Would you mind share me the same message? We're currently deploying packet fence web-auth mode with WLC 2504 as well.

Thank you very much.

Helen

Re: I'll share a quick overview

pedroty01 — Wed, 05 Dec 2018 04:01:42 GMT

Hi Michel, how are You?

As I can see in Your post the registration and regular VLAN is the same, do You confirm? Or did You applied flex connect with different VLAN for registration and guest? Thanks a lot....

Re: I'll share a quick overview

sousavarela — Thu, 09 May 2019 10:41:10 GMT

Hi,
Excellent post, it helped me a lot, but still have some doubts.

do I need to configure Connection Profiles for this type of authentication?
You can do a print for security L2 in version 8.2, of the option that I tried none works.

Thanks

Re: Cisco WLC and Packetfence Captive Portal configuration Guide

jborthakur — Sun, 24 Jul 2022 18:38:32 GMT

Hi;

I want to enable Web Auth with Cisco Wireless controller 5508 (Sw Version8.5.135.0) for guest users. Packet fence we are using Version 11.2.0.

I have created a guest SSID in CISCO Wireless Controller as GUEST1 and as per the configuration recommended in technical doc trying to configure the same but it is creating some issues.

Here we want to create a captive portal for guests where they will only have to accept the terms and conditions prior to gaining network access, later we want to use it with guests to register endpoints using their email address. PacketFence sends a PIN code to the guest’s email address.

So kindly help me to achieve the same.

My configuration doc is attached with this email for your comments.

Re: Cisco WLC and Packetfence Captive Portal configuration Guide

in4939 — Tue, 30 Aug 2022 10:13:30 GMT

I had problems getting the captive portal to trigger until I allowed connections to 66.70.255.147 (the IP set in PacketFence Configuration > Advanced Access Configuration> Captive Portal) in the pre-auth acl on the WLC.