Getting Captive Portal going wap150

[AJMo3079]

~I have been struggling and failing to get a captive portal working on our 3 cisco wap150s.

I think I have set it up in accordance with the admin guide but it doesn’t work. The relevant SSID appears that when clicked displays a dialog box saying  “Enter Network Security key” the key concerned being the wpa key, apparently, because  using this it connects but has no connectivity. No signs of the portal web page.

I attached images of relevant parts of the configuration with names changed

I would be grateful for suggestions how to progress this.

BTW the enable check box for the various tables page appears to be permanently set – is this relevant?

[marce1000]

 - Check logs on the wap 150 when trying to connect ; as far as the captive portal being used is concerned check it's http or https logs (look for activity , if any) ; also advising to use the latest firmware on the wap 150  , 

 M.

[AJMo3079]

Thanks your suggestions but have set logging to debug, only items of any interest were client auth/deauth,  connected/disconnected entries. Am running latest firmware 1.1.4.

[marce1000]

                                - You didn't respond to this part of my question :
 >as far as the captive portal being used is concerned check it's http or https logs (look for activity , if any) 

 M.

[AJMo3079]

Sorry, I don't fully understand that suggestion. I have looked at the system log and the only items were auth/deauth etc and ones pertaining to reconfiguration. The only anomaly is historical where the controller tries to deauth a client but cant find it. There was no reference to anything CP as far as I can see.



Thanks your replies

[marce1000]

                       >....Sorry, I don't fully understand that suggestion
 - Suppose the captive portal being used is called : mycaptiveportal.com ; what I was asking is to logon to mycaptiveportal.com , find where the logs from the webserver are and examine them if anything can be seen when a user tries to connect with WPA2 from the CBS.

 M.

[AJMo3079]

I think you are saying logon to the wap150 in the normal way, and then try to connect to the ssid of the portal with another client and then access the 150's logs. All of which I have done with no result.



By the "web server logs", do you mean the logs viewed on under the "notifications" tab on the 150 or somewhere else, if so where?



Grateful your continuing help.

[Rich R]

Unfortunately very few of us here have used the WAP products so are not familiar with them.
Have you followed the admin guide?
https://www.cisco.com/c/en/us/td/docs/wireless/access_point/csbap/wap150_361/Administration/Guide/EN-US/b_WAP150_361_Admin_Guide/b_WAP150_Admin_Guide_chapter_0111.html#id_104281

[AJMo3079]

OK understood, thanks anyway. One other offering follows and I would welcome you views.



I am beginning to wonder if the problem could be VLAN related.



The WAP150 has two VLAN related entries



untagged vlan ID = 1 &

Management VLAN Tagged or NO



The LAN connection from our internal network is a trunk link comprising VLAN ids 1, 100

Access to the WAP seems unaffected by the Management VLAN setting. I haven't tried changing the other.

I must admit I don't fully understand Vlan 1 being untagged, given that it is carried on the trunk.



I have looked, using wireshark, at the traffic when clicking connect on the laptop but with only 10% knowledge it's hard to come to any conclusion, saved that the correct network connection is being selected using the correct dhcp server. (the two dhcp servers on separate Vlans being a domain controller for internal traffic and an internet pointing router for external traffic.



I hope i have explained that sufficiently for you to offer an opinion.



Regards,

[Rich R]

Untagged = native VLAN.  Meaning any untagged traffic will be treated as if it was in that VLAN.  Generally speaking the untagged/native VLAN should match on both sides.  Tagged VLAN 1 traffic should still be accepted even if it's configured as untagged but some devices may require it to be untagged, and could drop the frames if they are tagged, so best just to make sure the settings match on both sides.