Captiv portal and vouchers integration with ssid on wlc 9800
-
@Gertjan nice write up..
@Jozy you could always just have the wlc do the captive portal as well, the one reason I could see having pfsense doing it is if you also had wired devices on this same network that you wanted to have to use the captive portal as well.
Personally I have little use for captive portal.. For my guests that want to use my guest wifi network I just hand them a card with a qr code on it to get them on the network.. They would hate how long and complex the psk is to type in ;) hehehe
They really only make sense when you need to time limit someones access, or have them pay for access, or can not in anyway just let them know the psk, etc. There are plenty of use cases where it makes sense, but in a home or smb sort of setup not really.
-
@johnpoz said in Captiv portal and vouchers integration with ssid on wlc 9800:
I could see having pfsense doing it is if you also had wired devices on this same network that you wanted to have to use the captive portal as well.
Actually, wireless or wired devices, it's all the same.
After all, captive portal support is mostly handled by the connecting device, not the router/firewall, like pfSense. -
@Gertjan my point was if all he has was wireless devices he wanted on it he could just use the wlc.. Not sure how the wlc would work for wired device on the same vlan as the wifi?
-
@johnpoz
I really dont know what the exact issue is here.
Customer is looking for voucher on Guest SSID and it should be setup but now this is not working. :( -
@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:
Customer is looking for voucher on Guest SSID
What do you man by that ? The customer doesn't have a voucher ? He lost it ?
Or do you mean : he doesn't know what to do with it ?
Or does the login screen not show up ?Normally, when installing a captive portal, set up one without any "users" or "vouchers", just this :
and make sure everything works first.
This 'everything' is actually a lot already.See also here for help : Troubleshooting Captive Portal
@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:
but now this is not working.
It worked before ?
-
@Gertjan No, Im trying to configure it first locally at my company environment, then provide it to the customer, since they are looking for that solution.
Anyway, after configuring CaptivPortal, what URL should I use to get CaptivPortal, since port 80 should redirect me to CP but not working.
-
@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:
Anyway, after configuring CaptivPortal, what URL
Initially, None.
When set up correctly, a confection device is redirected to the captive portal login page. This user will never know - and doesn't need to know the port (8002, or up) used.Later on, you will want to use https login, as it look 'better' ( and nothing is really http based anymore ).
Then you will have to deal with a domain name, certificates and so on. That is the moment a host name (URL) is mandatory, like "portal.your-domain.tld".
The portal user doesn't have to know this host name (URL) is he will get redirected to it automatically.There are a couple of captive portal videos here https://www.youtube.com/@NetgateOfficial/videos - they are old but still very valid.
-
@Gertjan Something which is very interesting i that I can access to pfsense as you can see bellow
but I should be redirected to captive portal not pfsense page.
After page appear I can easily type username and password of the pfsense and get in which is not something I want.You can see bellow picture taken from wlc/ssid which redirect me to 10.223.100.180
Why redirection to captive portal not working it is weird or should I use some other "redirect URL for login" on wlc?
Anyway I have enable captiv portal and voucher and not working. Can it be some bug on software since Im using it on VMware or?
-
What is thsi :
Are you using some sort of captive portal behind another captive portal ?
Just use 'simple' access points, and it will work ?!
-
@Gertjan its virtual ip address configured on wlc, with or without that address it is the same end.
What do you mean saying "simple" access point?
What would be that simple access point?
-
These, I guess.
I mention these as they work fine for me, I use them. -
@Gertjan Unfortunately I have Cisco wlc and have to try setup it with that one :)
-
TO set up the captive portal, do as the doc and videos tell you.
You don't need any access point or whatever. A captive portal with wired device will also work just fine.
Hook up a dumb switch into the captive portal interface, and hook up a laptop or a desktop PC into the switch.
Now you have everything you need to make it work.When then pfSEnse captive portal works, only then you start to use the "wlc 9800".
If at that moment the captive portal stops working, call Cisco ; -
@Gertjan Captiv Portal is working now. Problem was with WAN interface and DNS forwarder.
Best regards,
Jozy -
@Gertjan @johnpoz Hi guys, here I am again.
So, if you know or had the similar situation.As I mentioned above Captive Portal is working fine, but only working when Im connected to the same network not when enable wifi adapter.
When I try to reach CP while trying to connect to wifi it isnt reachable.
I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone=CaptivPortal& which is Captiv Portal it isnt working.
Whan I try to paste http://10.223.103.230:8002/index.php?zone=CaptivPortal&?switch_url=https://192.0.2.1/login.html&redirect=<website-name> while using the same network (10.223.103.58) it is working fine.
I have to monition that 10.223.103.x is wifi subnet.Problem starts when I try to reach Captiv portal while trying to enable wifi adapter and test SSID on both cell phone or PC not working, it doesnt redirects me to nowhere, I just get ip adress over DHCP which is configure on win server and other setup but CP not opening.
Do you know what could be the problem?
Best regards,
Jozy -
@Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:
I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone
You shouldn't be doing anything with captive portal on your wlc if you want pfsense to handle it - if your wifi devices are on a different network then on that network in pfsense setup the captive portal.
-
@johnpoz How should I reach Captiv portal over wifi if I dont put on SSID on WLC redirects me to http://10.223.103.230:8002/index.php?zone=CaptivPortal& ?
-
@Jozy your wifi should just connect your wifi to a wired network on pfsense. No captive portal in your wlc - just setup a ssid, and have your clients connect..
Their dhcp should come from pfsense. On whatever network this is - setup pfsense captive portal on that network.
-
@johnpoz I have wlc where all access points are added and managed by wlc.
So, what would be right setup? Since it is virtual macine where L3 interface would be, on my network l3 router?
For example if I have range 10.223.103.0 for dhcp, lan adress on pfsense it 10.223.103.10
Anyway I have to configure l3 and vlan on trunk and wlc to have access to that dhcp, once I try establish connection over ssid, right?
In that case i should configure Lan ip address as my dhcp relay, right?Jozy
-
@Jozy that is fine you use wlc to control you wifi, why not just use the captive portal features in wlc? But if you want to leverage captive portal in pfsense then the clients need to be on the same L2 network as a pfsense interface.. How they get dhcp be it from your wlc or pfsense doesn't really matter.. But they need to be on the pfsense network.
