Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Captiv portal and vouchers integration with ssid on wlc 9800

    Scheduled Pinned Locked Moved Captive Portal
    69 Posts 3 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jozy @Gertjan
      last edited by

      @Gertjan Something which is very interesting i that I can access to pfsense as you can see bellow
      1ea21a71-33c2-49de-9312-bfa6097908df-image.png d8a9fa62-eaad-422d-9b8b-1f5e30bb2622-image.png
      but I should be redirected to captive portal not pfsense page.
      After page appear I can easily type username and password of the pfsense and get in which is not something I want.

      You can see bellow picture taken from wlc/ssid which redirect me to 10.223.100.180
      a844c43a-0c12-46e6-926f-73b9b7420e15-image.png

      Why redirection to captive portal not working it is weird or should I use some other "redirect URL for login" on wlc?
      Anyway I have enable captiv portal and voucher and not working. Can it be some bug on software since Im using it on VMware or?

      d6db8971-ca2c-4e89-abdf-68c134d0645c-image.png

      c527b2fc-5966-4252-a444-b6504116b8ed-image.png

      30d3c8aa-6eb6-40ac-bb72-022dd7b4ab8c-image.png

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @Jozy
        last edited by

        @Jozy

        What is thsi :

        c155b137-4392-4ad3-9c54-b275b04860c3-image.png

        Are you using some sort of captive portal behind another captive portal ?

        Just use 'simple' access points, and it will work ?!

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        J 1 Reply Last reply Reply Quote 0
        • J
          Jozy @Gertjan
          last edited by Jozy

          @Gertjan its virtual ip address configured on wlc, with or without that address it is the same end.
          What do you mean saying "simple" access point?
          What would be that simple access point? 😀

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @Jozy
            last edited by

            @Jozy

            These, I guess.
            I mention these as they work fine for me, I use them.

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            J 1 Reply Last reply Reply Quote 0
            • J
              Jozy @Gertjan
              last edited by

              @Gertjan Unfortunately I have Cisco wlc and have to try setup it with that one :)

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @Jozy
                last edited by

                @Jozy

                TO set up the captive portal, do as the doc and videos tell you.
                You don't need any access point or whatever. A captive portal with wired device will also work just fine.
                Hook up a dumb switch into the captive portal interface, and hook up a laptop or a desktop PC into the switch.
                Now you have everything you need to make it work.

                When then pfSEnse captive portal works, only then you start to use the "wlc 9800".
                If at that moment the captive portal stops working, call Cisco ;

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jozy @Gertjan
                  last edited by

                  @Gertjan Captiv Portal is working now. Problem was with WAN interface and DNS forwarder.

                  Best regards,
                  Jozy

                  J 1 Reply Last reply Reply Quote 1
                  • J
                    Jozy @Jozy
                    last edited by

                    @Gertjan @johnpoz Hi guys, here I am again.
                    So, if you know or had the similar situation.

                    As I mentioned above Captive Portal is working fine, but only working when Im connected to the same network not when enable wifi adapter.

                    When I try to reach CP while trying to connect to wifi it isnt reachable.
                    I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone=CaptivPortal& which is Captiv Portal it isnt working.
                    Whan I try to paste http://10.223.103.230:8002/index.php?zone=CaptivPortal&?switch_url=https://192.0.2.1/login.html&redirect=<website-name> while using the same network (10.223.103.58) it is working fine.
                    c95c7848-e04a-4999-b390-f8ef2b6b20a3-image.png
                    I have to monition that 10.223.103.x is wifi subnet.

                    Problem starts when I try to reach Captiv portal while trying to enable wifi adapter and test SSID on both cell phone or PC not working, it doesnt redirects me to nowhere, I just get ip adress over DHCP which is configure on win server and other setup but CP not opening.

                    Do you know what could be the problem?

                    Best regards,
                    Jozy

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Jozy
                      last edited by

                      @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                      I have Cisco WLC configured and redirections to http://10.223.103.230:8002/index.php?zone

                      You shouldn't be doing anything with captive portal on your wlc if you want pfsense to handle it - if your wifi devices are on a different network then on that network in pfsense setup the captive portal.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        Jozy @johnpoz
                        last edited by

                        @johnpoz How should I reach Captiv portal over wifi if I dont put on SSID on WLC redirects me to http://10.223.103.230:8002/index.php?zone=CaptivPortal& ?

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Jozy
                          last edited by

                          @Jozy your wifi should just connect your wifi to a wired network on pfsense. No captive portal in your wlc - just setup a ssid, and have your clients connect..

                          Their dhcp should come from pfsense. On whatever network this is - setup pfsense captive portal on that network.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            Jozy @johnpoz
                            last edited by Jozy

                            @johnpoz I have wlc where all access points are added and managed by wlc.

                            So, what would be right setup? Since it is virtual macine where L3 interface would be, on my network l3 router?
                            For example if I have range 10.223.103.0 for dhcp, lan adress on pfsense it 10.223.103.10
                            Anyway I have to configure l3 and vlan on trunk and wlc to have access to that dhcp, once I try establish connection over ssid, right?
                            In that case i should configure Lan ip address as my dhcp relay, right?

                            Jozy

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @Jozy
                              last edited by

                              @Jozy that is fine you use wlc to control you wifi, why not just use the captive portal features in wlc? But if you want to leverage captive portal in pfsense then the clients need to be on the same L2 network as a pfsense interface.. How they get dhcp be it from your wlc or pfsense doesn't really matter.. But they need to be on the pfsense network.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                Jozy @johnpoz
                                last edited by

                                @johnpoz we want to use pfsense captiv portal due to vouchers which can be generated on pfsense.

                                Currently they are on the same L2 network, only difference is that dhcp is on win server and clients get ip add from that range but wlc redirection to pfsense captiv portal not working

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Jozy
                                  last edited by johnpoz

                                  @Jozy said in Captiv portal and vouchers integration with ssid on wlc 9800:

                                  dd from that range but wlc redirection to pfsense captiv portal not working

                                  What part are you not understanding??? If the clients are on a pfsense network, and they have to point to pfsense as their gateway. Your captive portal would be setup on pfsense on this network the clients are on.. There would be no redirection or setup of any captive portal anything in your wlc.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    Jozy @johnpoz
                                    last edited by

                                    @johnpoz im not talking on setup any captiv portal on wlc but wlc is controller for all access points, so wlc is place where ssid is cofigured and there is policy you configure your clients to use pfsense captiv portal.
                                    So, I dont understand if I need to have L3 configured on router, there are some details missing but dont know what? :)
                                    What is right conf step by step?

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Jozy
                                      last edited by johnpoz

                                      @Jozy who cares what setups up the wifi, doesn't matter if its a wlc that manages multiple AP, or stand alone AP or some wifi router being used as an AP.

                                      When it comes down to it the AP is a bridge from your wifi to your wired network..

                                      You have a network 192.168.100.0./24 -- your wifi clients are on this 192.168.100.0 network.. When they try and go to the internet via pfsense as say 192.168.100.1 pfsense captive portal says hey need to auth.

                                      That is all there is too it.. The whatever that gets your wifi client on this network is not part of this process..

                                      Yes you need to have an L3 on pfsense - how else would it route traffic for your wifi clients?? That are on this network..

                                      If you want devices to use pfsense as the captive portal - they should use pfsense as their gateway, and dns most likely too. if pfsense is not the gateway off this whatever network it has zero to do with controlling any thing else on the network.. It can only control who can talk to it to go to some other network.. So yes it needs an L3, and these clients need to be on this same L2/L3 network if you expect to use pfsense as a captive portal.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      J 1 Reply Last reply Reply Quote 0
                                      • J
                                        Jozy @johnpoz
                                        last edited by

                                        @johnpoz I have configured DHCP on pfsense and clients get ip address from that range "10.223.160.0/24".

                                        When trying ping outside from that interface i cant, pictures below.

                                        37bd14f2-13d5-4e1c-be00-f6814e288a12-image.png

                                        e577f0be-bacc-4bee-9d7b-995d688f84c7-image.png
                                        From other interfaces it works fine:

                                        f4a9c12a-dd4d-4d9a-a4b3-375828d5c955-image.png
                                        Whatever NAT or rule I configure it doesnt have access to outside.

                                        Second thing is:
                                        When PC gets IP address over DHCP it can go to captiv portal is case I manually type URL of Captiv Portal but when tyring to connect to CP over WiFi it is not working.
                                        Anyway, when I remove redirections from the WLC and try to connect to WiFI it doesnt redirects me to CP anymore.
                                        9447684b-adcb-4a15-9b87-532e9760270e-image.png

                                        WiFi on pfsense - 10.223.160.229
                                        DCHP for clients and Gateway is as well 10.223.160.229

                                        ?

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Jozy
                                          last edited by johnpoz

                                          @Jozy are your clients using pfsense as dns? Did you create rules on your interface to allow internet? What nat rules - did you edit your outbound nat to not be auto?

                                          First thing I would do is make sure your connection is working before attempting to enable captive portal

                                          That redirection sure doesn't look correct - where did that 192.0.2.1 come from? You still trying to redirect in wlc - that sure doesn't look like pfsense captive portal setup.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            Jozy @johnpoz
                                            last edited by Jozy

                                            @johnpoz Yes, after chnaning NAT rule to below it started pinging outside.
                                            Hybrid Outbound NAT rule generation.
                                            (Automatic Outbound NAT + rules below)

                                            Anyway, when I get IP address over WiFi on my cell phone or PC over DHCP from pfsense I can not ping 10.223.160.229 whic is interface for WiFi configured on pfSense, but when I get ip address over DHCP on wired network I can ping 10.223.160.229.

                                            Btw, i cant ping deafulr gateway as well for even if I can ping 8.8.8.8 form the LAN interface.

                                            regarding 192.0.2.1 it is mandatory since if I dont configure it it redirects me to WLC captiv portal
                                            c6d9331a-f052-44fe-a3cf-d7bcbba9c5f3-image.png
                                            It is very weird that I have to use redirection on WLC to pfSense Captiv Portal. Shouldn't pfSense be one who will do it if DHCP is configured there?

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.