topic data usage bypassing sponsored guest in Wireless

data usage bypassing sponsored guest

zrunner626 — Wed, 24 Jul 2019 21:23:50 GMT

We recently implemented "Sponsored Guest" splash page. I have noticed some users mobile phones have data usage though they are not authorized. I tried it myself and was able to connect to the network but not go through the portal and it will allow some app usage to pull data as long as it's not through the browser. Any thoughts on how to cut this off?

Here are my access control settings:

Association Requirements - Open

Splash Page - Sponsored Guest Login

Email Domains - Our corporate domain

Duration - 1 day

NAC - Disabled

Group Policies - Disabled

Captive Portal Strength - Block all access until sign-on is complete

Walled Garden is enabled

Walled Garden ranges - Our DHCP/DNS server

Controller Disconnection Behavior - REstricted

IP Assignment - Bridge mode

VLAN tagging - On - Use a vlan that is segmented to only allow Inet traffic and no access to internal networks other than dhcp.

Content filtering - Off

Bonjour off

Re: data usage bypassing sponsored guest

Philip D'Ath — Wed, 24 Jul 2019 21:35:40 GMT

Set this option under the SSID settings.

Re: data usage bypassing sponsored guest

zrunner626 — Wed, 24 Jul 2019 21:37:22 GMT

Thanks for the quick reply. It is already set.

Re: data usage bypassing sponsored guest

Philip D'Ath — Thu, 25 Jul 2019 00:54:45 GMT

Are you sure the phone hasn't failed over to 4G?

How do you know the apps are able to pull data? I think I would do a packet capture on the AP of the client to confirm this.

Re: data usage bypassing sponsored guest

AjitKumar — Thu, 25 Jul 2019 05:09:51 GMT

Hi @zrunner626

I have not seen any of our clients wireless network with this behavior.

As @Philip D'Ath suggested "Block all access until sign-on is complete" should do the job.

A piece of information from the below url says

Once a device is authorized this method will not ask for authentication again for the permitted duration.

May be your devices are already authorized. Could you verify this please?

https://documentation.meraki.com/MR/Encryption_and_Authentication/Sponsored_Guest

If a user disconnects and reconnects within the approved time, the device will automatically get internet access. If the user reconnects to the SSID after the approval period is expired the whole process will be repeated again. This function is currently limited to a maximum of 1 day (24 hours) per authorization.

Note: Devices that have been authenticated for a specified duration cannot have their authentication manually revoked, and admins will have to wait for the authorized duration to end for access to expire. Devices are authorized by user accounts, and authorization applies to any device using the approved credentials.

Re: data usage bypassing sponsored guest

zrunner626 — Thu, 25 Jul 2019 14:22:49 GMT

Ok, so a packet capture on myself shows outbound traffic captured but nothing is coming back inbound. I guess the usage showing in the Meraki dashboard under clients > show detail while "not authorized" would be previous days usage though they are not authorized for today. I think it was a view issue on my part since the portal lasts for 24 hours and I had client usage view set to 1 week. I thought it odd but didn't have a chance to chase it down. Thanks for the direction!