Objective
This guide explains how to configure Aruba Networks device in the "Controller - AP" architecture, in order to use each Access Point as Hotspot for IPERA Guest Engagement Platform.
Please note that the images contained in this article may contain outdated configuration data. Therefore, please check the data contained in the article "Parameters for the Configuration" at the bottom of the page, as they are certainly up to date.
Architecture
Prerequisites
This guide applies to the ARUBA Controller version 6.3.1.9 or later.
To use an Aruba Networks device as a Hotspot, the controller and Access Points must be connected to the Internet. The Access Points must be configured to correctly point to the controller.
Accessing the controller
ARUBA Controller can be access through the web UI.
Add RADIUS Servers
To add RADIUS servers click on the Configuration > Security > Authentication and then choose the Servers tab.
Expand the RADIUS server section, as below.
Now you must add a new RADIUS server to your list by entering a new name and clicking Add.
By clicking a name of a RADIUS server, you can edit its configuration: you must set the following data with the values indicated in the paragraph "Parameters for the Configuration".
- Host
- Key
- Auth Port
- Acct Port
Then, in the same Security > Authentication > Servers page, under the same Servers tab, expand the RFC 3576 Server section. and enter the RADIUS server also there.
Please note that it is necessary to retype the Key of the RADIUS server.
Then, in the same Security > Authentication > Servers page, under the same Servers tab, expand the Server Group section and create one item.
Here, in the drop-down menu, you have to add the RADIUS Server previously created (in this case "IPERA Radius").
Then go to the AAA Profiles tab and expand the AAA section.
Then create a profile (in this case called "IPERA_AAA_Profile") by clicking the Add button under the list of profiles. Expand the profile just created and select RADIUS Accounting Server Group.
Here you have to select the Server Group "IPERA" previously created and set the RADIUS Server create above (in this case "IPERA") as accounting.
Then, under the same AAA Profiles tab, move to RFC 3576 servers tab and add a new profile.
Then you will see your profile in the list under RFC 3576 under IPERA_AAA_Profile.
Setting access policies
You must set the ACL for your device. You can do this by clicking the Configuration tab in the main page and then, under Security, clicking Access Control and choosing the Policies tab.
You have to create a new ACL set as the picture below allowing HTTP and HTTPS traffic from the device to IPERA.
Setting captive portal configuration
To configure the captive portal you have to choose the Configuration tab in the main page. Then, under Security you have to click Authentication and then choose the L3 Authentication tab. Then expand the Captive Portal Authentication section and create your configuration profile.
By clicking the name of a profile, you can edit its configuration: you must set the following data with the values indicated in the paragraph "Parameters for the Configuration".
- Login page
- Welcome page
- Redirect URL
You can also configure the walled garden for your device here, this is mentioned later in this article, in the paragraph "Walled garden".
Then you have to apply the Server Group previously created (in this case "IPERA") to the configuration profile just created.
Setting network configuration
First, you must choose the Configuration tab in the main page. Then, under Wireless you have to click AP Configuration and then choose the AP Group tab. Then create your AP Group.
By expanding the Wireless LAN section and then Virtual AP, you can find your AP Group previously created.
Here you can apply any AAA Profile and SSID Profile.
Provisioning
When installing the Access Point for the first time, it is necessary to associate it to the AP group containing all the settings configured above. You can do this by clicking the Configuration tab in the main page and then, under Wireless, clicking AP installation and choosing the Provisioning tab. Then you have to click the Provision button.
Then you have to select the correct AP group (e.g.: IPERA).
In the AP list you will see your Access Point. Please note that the value displayed as AP Name is the identifier to enter in the Control Panel.
Walled garden
In the Configuration tab in the main page. Under Advanced Services you have to click Stateful Firewall and then select the Destination tab. Then create a new destination profile.
After that you can click the profile and specify all the domains included.
In the Configuration tab on the main page. Under Security you have to click Authentication and then choose the L3 Authentication tab.
Going back to your profile previously created, you can add sites or domains to the walled garden of your device.
Retrieving the identifier for the Control Panel
In order to integrate the Access Point with the Solution, it is necessary to enter its details into the Control Panel.
In the Control Panel, a field called Identifier will be required by the web interface.
For Aruba Networks products it corresponds to the AP Name displayed in the Wireless > AP Installation > Provision page (please check the "Provisioning" paragraph above).
Please note that this value must be unique for all the devices entered in the Control Panel. Otherwise, the Hotspot will be not correctly integrated with the Solution.
Parameters for the Configuration
The parameters indicated above for the Services > Hotspot page are mandatory for proper functioning. The necessary parameters to integrate the device with the Solution are the following:
For AWS
Primary Radius Server
Login page: https://engage.iperawifi.com/onboarding/?acmac=<controller-mac>
(i.e. https://engage.iperawifi.com/onboarding/?acmac=00-0B-86-6E-C5-F8)
Welcome page: https://engage.iperawifi.com/onboarding/?res=success&acmac=<controller-mac>
(i.e. https://engage.iperawifi.com/onboarding/?res=success&acmac=00-0B-86-6E-C5-F8)
Redirect URL: https://engage.iperawifi.com/onboarding/?res=success
If the controller switch URL is different from the default URL, which is securelogin.arubanetworks.com, then &switch_url=URL needs to be added to the Login Page and Redirect URL.
Login Page: https://engage.iperawifi.com/onboarding/?switch_url=https://securelogin.iperawifi.com/cgi-bin/login
Redirect URL: https://engage.iperawifi.com/onboarding/?res=success&switch_url=https://securelogin.iperawifi.com/cgi-bin/login
For Azure
Primary Radius Server
Login page: https://me.iperawifi.com/onboarding/?acmac=<controller-mac>
(i.e. https://me.iperawifi.com/onboarding/?acmac=00-0B-86-6E-C5-F8)
Welcome page: https://me.iperawifi.com/onboarding/?res=success&acmac=<controller-mac>
(i.e. https://me.iperawifi.com/onboarding/?res=success&acmac=00-0B-86-6E-C5-F8)
Redirect URL: https://me.iperawifi.com/onboarding/?res=success
If the controller switch URL is different from the default URL, which is securelogin.arubanetworks.com, then &switch_url=URL needs to be added to the Login Page and Redirect URL.
Login Page: https://me.iperawifi.com/onboarding/?switch_url=https://securelogin.iperawifi.com/cgi-bin/login
Redirect URL: https://me.iperawifi.com/onboarding/?res=success&switch_url=https://securelogin.iperawifi.com/cgi-bin/login
Any changes on the above parameters and values will be communicated with IPERA customers in advance.
Comments
0 comments
Please sign in to leave a comment.