Cisco Spaces Captive Portal Runbook

Click here for a video guided demo

Step 1: Edit / Create SSID in Meraki

This step is needed if a new SSID needs to be created for a Captive Portal, so that it can be imported into Cisco Spaces.

1. In the Meraki Dashboard, Navigate to the Wireless > Access Control
   

2. Create or edit the SSID that is needed for Captive Portal access.

3. In the Security area, choose Mac-based access control (no encryption).

4. In the Splash page area, choose Click-through.
   

Step 2: Import the SSID in Cisco Spaces

1. In Cisco Spaces dashboard, navigate to Captive Portals application:

2. Then: SSID -> Import / Configure SSID -> Meraki
   Choose the organization.

3. If the synch is completed and SSIDs are visible, choose the SSID and click Import.

4. Once imported, click Configure Manually and choose the appropriate Wireless Infrastructure for relevant instructions. In this case, it will be Cisco Meraki.

5. Click the Configure SSID tab and note important information regarding Wall garden and the Custom Splash Page URL. These details will need to be configured on the Meraki dashboard in later steps.
   
   Wall Garden

   

   Splash Page URL

   

6. Click the Configure Radius Server tab and note details of the Radius authentication and accounting servers for configuration in the following steps.

Radius Authentication

Radius Accounting

Step 3: Configuration in Meraki

1. In the Meraki dashboard, navigate to Wireless > Access Control Radius servers area, click Add server, and in the fields that appear configure the radius server details for authentication. Add the following servers separately:

2. In the Radius accounting servers area, click Add server, and in the fields that appear configure the radius server details for accounting. Add the following servers separately:
   

3. From the "Radius attribute specifying group policy name" drop-down list, choose Filter-Id.

4. Under Advanced splash settings, enter the Walled garden details.
   

5. Save the changes

6. Navigate to Wireless > Configuration > Splash Page. Choose the correct SSID for configuring.

7. In the Custom Splash URL area, choose “Or provide a URL where users will be redirected” and paste the Splash page URL copied earlier from Cisco Spaces.
   

8. Save the changes.
   

Step 4: Configuration in Meraki

1. In the Cisco Meraki dashboard, click Network-wide > Group Policies

2. Click Add a Group

3. In the New Group window that appears, enter a name for the group. Note this name exactly, since it will be needed in Cisco Spaces rules when provisioning seamless authentication.

4. From the Bandwidth drop-down list, choose the required option, and specify the Internet bandwidth to be provisioned for the customers.

5. From the Splash drop-down list, choose Bypass.

6. Save Changes
   

For detailed instructions on setting on Cisco Spaces Captive Portal with Catalyst 9800 WLC, please refer to the configuration guide here.

Click here for a video guided demo

Create the Access Control List

1. Log into Catalyst 9800 Wireless Controller.

2. Create the ACL by adding URL filters.
   a. Choose Configuration > Security > URL Filter.
   b. In the URL Filters window, click Add.
   c. In the List Name field, enter the list name.
   d. Change the status of Action to Permit.
   e. In the URLs field, enter the splash page domain, found in Cisco Spaces Captive Portals > SSIDs > Catalyst 9800 Wireless Controller > SSIDs > Configure Manually.

   
   Add the following domains, if you want to enable social authentication:
   *.fbcdn.net
   *.licdn.com
   *.licdn.net
   *.twimg.com
   *.gstatic.com
   *.twitter.com
   *.akamaihd.net
   *.facebook.com
   *.facebook.net
   *.linkedin.com
   ssl.gstatic.com
   *.googleapis.com
   *.googleapis.com
   static.licdn.com
   *.accounts.google.com
   *.connect.facebook.net
   oauth.googleusercontent.com
   
   f. Choose Configuration > Tags and Profiles > Policy.
   g. In the Policy Profile window, click default-policy-profile.
   h. In the Edit Policy Profile window, click the Access Policies tab.
   i. In the URL Filters area, from the Pre Auth drop-down list, choose the previously created ACL.
   j. Click Update & Apply to Device.
   g. In the URL field that appears, enter the Cisco Spaces splash URL (for your organisation) - the same as the one in the previous step 2e:
   
   https://splash.dnaspaces.io/**/*******

Create the URL Filter Configuration

1. Log into Catalyst 9800 Wireless Controller.

2. Navigate to Configuration -> Security -> URL Filters, click +Add and configure the list name, select PRE-AUTH as the type, action as PERMIT and the URL splash.dnaspaces.io (or .eu if you are using the EMEA portal or splash.ciscospaces.sg for APAC portal)

Create the Web Auth Parameter (without RADIUS Server on Cisco Spaces)

To create the Web Auth Parameter Map , perform the following steps:

1. Navigate to Configuration > Security > Web Auth, Click +Add to create a new parameter map. In the window that pops-up configure the parameter map name, and select Consent as the type.

2. Click on the parameter map configured in the previous step, navigate to the Advanced tab, and enter the Redirect for log-in URL, Append for AP MAC Address, Append for Client MAC Address, Append for WLAN SSID and portal IPv4 Address as follows and then click Update & Apply.

a. Redirect for Log-in = <Specific URL for the customer tenant goes here>

b. Redirect Append for AP MAC Address = ap_mac

c. Redirect Append for Client MAC Address = client_mac

d. Redirect Append for WLAN SSID = wlan

e. Portal IPV4 Address = 34.235.248.212 (please perform an nslookup to splash.dnaspaces.io and use one of these values)

Create the Web Auth Parameter Map (with RADIUS Server on Cisco Spaces)

To create the Web Auth Parameter Map , perform the following steps:

1. Navigate to Configuration > Security > Web Auth, Click +Add, and configure the parameter map name, and select webauth as the type.

2. Click on the parameter map configured in the previous step, navigate to the Advanced tab, and enter the Redirect for log-in URL, Append for AP MAC Address, Append for Client MAC Address, Append for WLAN SSID and portal IPv4 Address as follows and then click Update & Apply.

a. Redirect for Log-in = <Specific URL for the customer tenant goes here>

b. Redirect Append for AP MAC Address = ap_mac

c. Redirect Append for Client MAC Address = client_mac

d. Redirect Append for WLAN SSID = wlan

e. Portal IPV4 Address = 34.235.248.212 (please perform an nslookup to splash.dnaspaces.io and use one of these values)

Create the SSID

1. Choose Configuration > Tags and Profiles > WLANs.

2. Click Add.

3. On the General tab, in the Profile Name field, enter the profile name.

4. In the SSID field, enter the SSID name defined at Step 1.

5. Set the status as Enabled.

6. Click the Security tab, and then click the Layer2 tab.

7. From the Layer 2 Security Mode drop-down list, choose None.

8. Click the Layer3 tab.

9. Check the Web Policy check box.

10. From the WebAuth Parameter Map drop-down list, choose the Web Auth Parameter Map created at step 2.

11. Click Save & Apply to Device.

Configure Radius Server

To provide an additional layer of security for your portal, the Cisco Spaces supports radius-authentication for the internet provisioning on the captive portals.

Step 1 - Configure Radius Server

1. Log into Catalyst 9800 Wireless Controller.

2. Configure the RADIUS server.

3. Choose Configuration > Security > AAA.

4. In the Authentication Authorization and Accounting window, click the Servers/Groups tab.

5. Choose Radius > Servers, and click Add.

6. In the Name field, enter a name for the radius server.

7. In the IPv4 / IPv6 Server Address field, enter the radius server address.
   

8. In the Key field, enter the key: ************* and confirm it in the Confirm Key field.

9. In the Auth Port field, enter 1812.

10. In the Acct Port field, enter 1813.

11. Click Save & Apply to Device. The server added will be available in Servers list.

12. Choose Radius > Server Groups, and click Add.

13. In the Name field, enter a name.

14. From the MAC-Delimiter drop-down list, choose hyphen.

15. From the MAC-Filtering drop-down list, choose mac.

16. Move the radius server previously created from “Available Servers” to “Assigned Servers” using the arrow button.

17. Click Save & Apply to Device.

18. In the Authentication Authorization and Accounting window, click the AAA Method List tab.

19. Click Authentication, and click Add and specify the following details:

    1. In the Method List Name field, enter the method list name.

    2. From the Type drop-down list, choose Login

    3. From the Group Type drop-down list, choose Group.

    4. Move the server group created earlier (point 12. to point 17.) from Available Server Groups to Assigned Servers Groups, and click Save & Apply to Device.

20. On the AAA Method List tab, click Authorization, and click Add, and specify the following details:

    1. In the Method List Name field, enter the method list name.

    2. From the Type drop-down list, choose Network.

    3. From the Group Type drop-down list, choose group.

    4. Move the server group previously created (point 12. to point 17.) from Available Servers to Assigned Servers using the arrow button, and click Save & Apply to Device.

21. On the AAA Method List tab, click Accounting, and click Add, and specify the following details:

    1. In the Method List Name field, enter the method list name.

    2. From the Type drop-down list, choose Identity.

    3. From the Group Type drop-down list, choose group.

    4. Move the server group previously created (point 12. to point 17.) from Available Servers to Assigned Servers using the arrow button, and click Save & Apply to Device.
       
       

Step 2 - Enable L3 and L2 authentication (Mac Filtering)

Make sure Type is selected as webauth in parameter-map for RADIUS Authentication.

1. Choose Configuration > Tags and Profiles > WLANs.

2. Click the SSID for which you want to configure L2 and L3 Authentication.

3. In the Edit WLAN window, click the Security tab.

4. On the Layer3 tab, from the Authentication drop-down list, choose the radius authentication configured previously.

5. On the Layer2 tab, to enable Mac Filtering, check the MAC Filtering check box.

6. From the Authorization List drop-down list that appears, choose the authorization server created previously.

7. Click Show Advanced Settings.

8. Check the On Mac Filter Failure check box.

9. Click Update & Apply to Device.

10. Choose Configuration > Tags and Profiles > Policy.

11. Click default-policy-profile.

12. On the Advanced tab, in the AAA Policy area, check the Allow AAA Override check box.

13. Ensure that default aaa policy is selected from the Policy Name drop-down list.

14. Click Update & Apply to Device.
    
    

Step 3 - Enable Radius Accounting

1. Choose Configuration > Tags and Profiles > Policy.

2. Click default-policy-profile.

3. On the Advanced tab, from the Account List drop-down list, choose the accounting server created previously.

4. Click Update & Apply to Device.