I'll share a quick overview of the basics from what we have setup.
First, define the packetfence server under SECURITY - > RADIUS on your WLC (in both authentication and accounting). Make sure that you enable support for RFC3576 (this is important! It is used for Radius CoA which packetfence uses to authorize/deauthorize users) As a side note on RFC3576, some WLC versions (atleast <8.x) use port 1700 instead of the standard port which is 3799. If your WLC uses 1700 then you'll need to set this on the packetfence server (see later in this text).
Once the radius servers are defined (for packetfence) you need to define two ACL lists under Security -> Access Control Lists -> Access Control Lists. These define what is allowed then the user is unregistered and what is allowed then user is registered.
I have two, Pre-Auth-For-WebRedirect which allows traffic to my packetfence portal as well as DNS, DHCP and ICMP.
Then we have an ACL to allow all traffic called Authorize_any
Define the wireless network you want to use the captive portal with.
Security is handled by MAC filtering (WLC 8.2 and higher can use WPA2-PSK in conjuction with mac filtering if needed).
Configure the Security settings for the SSID as follows
Under Advanced settings for the WLAN you need to make sure that NAC State is set to Radius NAC/ISE NAC (depending on which WLC version you are running. In 8.2 and higher I think it's ISE NAC)
Redirect to the captive portal is handling using the Radius NAC which sends the relevant URL to redirect.
Now that the WLC basics are setup you'll need to start looking at your packetfence server. I am assuming that you have a working packetfence installation (if not, set it up using the documentation on the packetfence.org webpage)
Under Configuration -> Network -> Switches you need to define your WLC's
Note that I have set Controller port to 1700 here since my WLC's are running 7.6 and this uses 1700 for CoA instead of 3799 which is the standard port (see previous comment about this)
Under Roles in the switch config you will need to define the vlans that are mapped to your roles
Then you define the ACL's that are used for each role when in that state:
And lastly you define the URL of the captive portal to redirect.
Use in the format : https://yourpacketfence.server/$session_id
Lastly go to the RADIUS settings on the switch and setup the Radius secret used for packetfence (which you'll use in your WLC to communicate with the radius server).
This should cover the basics. You will also need to configure your authentication sources in packetfence as well as your captive portal. All of this can be found in the packetfence documentation.
