Cisco Spaces Captive Portal Runbook

Click here for a video guided demo

Step 1: Edit / Create SSID in Meraki

This step is needed if a new SSID needs to be created for a Captive Portal, so that it can be imported into Cisco Spaces.

1. In the Meraki Dashboard, Navigate to the Wireless > Access Control
   

2. Create or edit the SSID that is needed for Captive Portal access.

3. In the Security area, choose Mac-based access control (no encryption).

4. In the Splash page area, choose Click-through.
   

Step 2: Import the SSID in Cisco Spaces

1. In Cisco Spaces dashboard, navigate to Captive Portals application:

2. Then: SSID -> Import / Configure SSID -> Meraki
   Choose the organization.

3. If the synch is completed and SSIDs are visible, choose the SSID and click Import.

4. Once imported, click Configure Manually and choose the appropriate Wireless Infrastructure for relevant instructions. In this case, it will be Cisco Meraki.

5. Click the Configure SSID tab and note important information regarding Wall garden and the Custom Splash Page URL. These details will need to be configured on the Meraki dashboard in later steps.
   
   Walled Garden

   These two IP addresses will be used as inputs in a later step: 34.235.248.212/32 & 52.55.235.39/32

   

   Splash Page URL

   

6. Click the Configure Radius Server tab and note details of the Radius authentication and accounting servers for configuration in the following steps.

Radius Authentication

Radius Accounting

Step 3: Configuration in Meraki

1. In the Meraki dashboard, navigate to Wireless > Access Control Radius servers area, click Add server, and in the fields that appear configure the radius server details for authentication. Add the following servers separately:

2. In the Radius accounting servers area, click Add server, and in the fields that appear configure the radius server details for accounting. Add the following servers separately:
   

3. From the "Radius attribute specifying group policy name" drop-down list, choose Filter-Id.

4. Scroll back up to the Advanced splash settings (directly above Radius configuration) and click it. Enter the Walled garden details there using the two IP addresses noted in an earlier step: 34.235.248.212/32 & 52.55.235.39/32
   

5. Save the changes

6. Navigate to Wireless > Configuration > Splash Page. Choose the correct SSID for configuring.

7. In the Custom Splash URL area, choose “Or provide a URL where users will be redirected” and paste the Splash page URL copied earlier from Cisco Spaces.
   

8. Save the changes.
   

Step 4: Configuration in Meraki

1. In the Cisco Meraki dashboard, click Network-wide > Group Policies

2. Click Add a Group

3. In the New Group window that appears, enter a name for the group. Note this name exactly, since it will be needed in Cisco Spaces rules when provisioning seamless authentication.

4. From the Bandwidth drop-down list, choose the required option, and specify the Internet bandwidth to be provisioned for the customers.

5. From the Splash drop-down list, choose Bypass.

6. Save Changes
   

For detailed instructions on setting on Cisco Spaces Captive Portal with Catalyst 9800 WLC, please refer to the configuration guide here.

Click here for a video guided demo

Create the Captive Portal SSID on Cisco Spaces

1. In Cisco Spaces dashboard, navigate to Captive Portals application:

2. Then: SSID -> Import / Configure SSID -> AireOS Controller / Catalyst 9800 Wireless Controller
   Choose the organization.

3. Create the SSID that you will use for the Captive Portal and click Add at the bottom.
   

4. Click View Config Guide to access key information needed for next steps.

Get Splash Page URL details

The Splash Page URL details are needed to redirect login to the Splash page. The URL is required to configure WebAuth paramaters in a later step.

1. After clicking View Config Guide (from the previous step), navigate to Catalyst 9800 Wireless Controllers -> Configure SSID → Creating the Access Control List.

2. Under the section Creating the Access Control List, scroll down to Step 2g. and the Cisco Spaces splash URL for your tenant will be there. It will appear as:
   
   https://splash.dnaspaces.io/**/*******

3. Make a note of this URL to set in the WebAuth parameter later.

Create the Access Control List (if required)

By default, the 9800 creates hardcoded pre-auth ACLs when you setup a web-auth WLAN. These hardcoded ACLs allow DHCP, DNS, and traffic to the external web auth server. All the rest is redirected like any http traffic.

However, if you need to allow specific non-HTTP traffic type through, you can configure a pre-auth ACL. You would then need to imitate the content of the existing hardcoded pre-auth ACL and augment it to your needs. Please refer to the ACL configuration guide.

Create the URL Filters List

Pre-authentication ACL is used in web authentication to allow certain types of traffic before the authentication is complete. This allows the clients limited access to particular network resources before authentication.

1. Log into Catalyst 9800 Wireless Controller.

2. Create the ACL by adding URL filters.
   a. Choose Configuration > Security > URL Filters.
   b. In the URL Filters window, click Add.
   c. In the List Name field, enter the list name.
   d. Keep Type as PRE-AUTH
   e. Change the status of Action to Permit.
   f. In the URLs field, enter the URL splash.dnaspaces.io (or splash.dnaspaces.eu if you are using the EMEA portal; or splash.ciscospaces.sg or for APAC portal)

   g. In addition to the splash domain configured in step f., add the following domains if you want to enable social authentication for the Captive Portal:
   
   *.fbcdn.net
   *.licdn.com
   *.licdn.net
   *.twimg.com
   *.gstatic.com
   *.twitter.com
   *.akamaihd.net
   *.facebook.com
   *.facebook.net
   *.linkedin.com
   ssl.gstatic.com
   *.googleapis.com
   static.licdn.com
   *.accounts.google.com
   *.connect.facebook.net
   oauth.googleusercontent.com
   

   h. Click Update & Apply to Device

Captive Portal - when to use a RADIUS server?

The SSID can be configured to use a RADIUS Server or without it. There are some differences in configuration depending on whether RADIUS is used or not. Both scenarios will be covered in the following sections.

If the Session Duration, Bandwidth Limit, or Seamlessly Provision Internet is configured in the Actions section of the Cisco Spaces Captive Portal Rule configuration, the SSID needs to be configured with a RADIUS Server, otherwise, there is no need to use the RADIUS Server. All kinds of portals on Spaces are supported on both configurations.

Before getting into specific RADIUS / non-RADIUS configurations, ensure base settings like virtual IPs and trustpoint certificate are correct in the Global Web Auth Parameter.

Configure Global Web Auth Parameter

Configure the Global Web Auth Parameter to ensure the default base settings are correct.

1. Navigate to Configuration > Security > Web Auth, Click the ‘global’ parameter name to edit settings.
   

   

2. Ensure both IPv4 and IPv6 are present with the default addresses.

3. Catalyst 9800 Wireless Controller must have a signed trusted certificate installed tied to the virtual int ip/dns entry. If this is not set, clients will get an untrusted server error. For information about certificates on Catalyst 9800, refer to https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213917-generate-csr-for-third-party-certificate.html#anc5

4. Check the Disable Success Window and Disable Logout Window checkboxes (otherwise the Captive Portal will redirect to the local WLC version)

5. Click Update & Apply to Device to save changes.

Configuring Captive Portal without RADIUS Server

Create the Web Auth Parameter (without RADIUS Server on Cisco Spaces)

A parameter map for web-based authentication sets parameters that can be applied to subscriber sessions during authentication. If you do not create a parameter map, the policy uses default parameters.

To create the Web Auth Parameter Map , perform the following steps:

1. Navigate to Configuration > Security > Web Auth, Click +Add to create a new parameter map. In the window that pops-up configure the parameter map name, and select Consent as the type and check the Disable Success Window and Disable Logout Window checkboxes (otherwise the Captive Portal will redirect to the local WLC version).
   

2. Still in the Web Auth Parameter settings, navigate to the Advanced tab, and enter the Redirect for log-in URL, Append for AP MAC Address, Append for Client MAC Address, Append for WLAN SSID and portal IPv4 Address as follows and then click Update & Apply to Device.

a. Redirect URL for Log-in = <Specific URL for the customer tenant goes here> (refer to Get Splash Page URL details section)

b. Redirect Append for AP MAC Address = ap_mac

c. Redirect Append for Client MAC Address = client_mac

d. Redirect Append for WLAN SSID = wlan

e. Portal IPV4 Address = 34.235.248.212 (please perform an nslookup to the appropriate domain - e.g. splash.dnaspaces.io and use one of the values. Alternatively, refer to table below)

f. Click Update & Apply

Configure Policy Profile on the 9800 Controller

Policy profile contains policy to be associated with the WLAN. It specifies the settings for client VLAN, URL filters, session and idle timeout settings and so on.

1. Navigate to Configuration > Tags & Profiles > Policy and use the default policy, or create a new Policy Profile. Alternatively, clone the default-policy-profile to customise settings by clicking the checkbox on the left-hand side and then clicking Clone.

2. In the Access Policies tab, configure the client VLAN and add the URL Filters (created previously in Create the URL Filters List).

Create the SSID on the 9800 Controller

1. Choose Configuration > Tags and Profiles > WLANs.

2. Click Add.

3. On the General tab, in the Profile Name field, enter the profile name.

4. In the SSID field, enter the Captive Portal SSID name (ensuring that it matches exactly the Captive Portal SSID created in Cisco Spaces).
   

   

5. Set the status as Enabled.

6. Click the Security tab, and then click the Layer2 tab.

7. From the Layer 2 Security Mode drop-down list, choose None.

8. Ensure MAC Filtering is unchecked

9. Uncheck OWE Transition Mode
   

   

10. Click the Layer3 tab.

11. Check the Web Policy check box.

12. From the WebAuth Parameter Map drop-down list, choose the Web Auth Parameter Map created previously (in section Create the Web Auth Parameter (without RADIUS Server on Cisco Spaces)).
    

    

13. Click on the Add to Policy Tags tab

14. Link the Policy Tag with the Policy Profile
    

    

15. Click Save & Apply to Device.

Apply Policy Tag to the AP

The Policy Tag configured in the previous step should be applied to the AP to broadcast the SSID.

1. Navigate to Configuration > Wireless > Access Points

2. Select the AP in question and add the Policy Tag

Configuring Captive Portal with RADIUS Server

Create the Web Auth Parameter Map (with RADIUS Server on Cisco Spaces)

A parameter map for web-based authentication sets parameters that can be applied to subscriber sessions during authentication. If you do not create a parameter map, the policy uses default parameters.

To create the Web Auth Parameter Map, perform the following steps:

1. Navigate to Configuration > Security > Web Auth, Click +Add to create a new parameter map. In the window that pops-up configure the parameter map name, and select Webauth as the type and check the Disable Success Window and Disable Logout Window checkboxes (otherwise the Captive Portal will redirect to the local WLC version).
   

   

2. Still in the Web Auth Parameter, navigate to the Advanced tab, and enter the Redirect for log-in URL, Append for AP MAC Address, Append for Client MAC Address, Append for WLAN SSID and portal IPv4 Address as follows and then click Update & Apply to Device.
   

a. Redirect for Log-in = <Specific URL for the customer tenant goes here> (refer to Get Splash Page URL details section)

b. Redirect Append for AP MAC Address = ap_mac

c. Redirect Append for Client MAC Address = client_mac

d. Redirect Append for WLAN SSID = wlan

e. Portal IPV4 Address = 34.235.248.212 (please perform an nslookup to the appropriate domain - e.g. splash.dnaspaces.io and use one of the values. Alternatively, refer to table below)

f. Click Update & Apply



Configure Radius Server

To provide an additional layer of security for your portal, the Cisco Spaces supports radius-authentication for the internet provisioning on the captive portals.

1. Log into Catalyst 9800 Wireless Controller. Cisco Spaces acts as the RADIUS server for user authentication and it can respond to two IP addresses.

2. Configure the RADIUS server.

3. Choose Configuration > Security > AAA.

4. In the Authentication Authorization and Accounting window, click the Servers/Groups tab.

5. Choose Radius > Servers, and click Add.

6. In the Name field, enter a name for the radius server.

7. In the IPv4 / IPv6 Server Address field, enter the radius server address.
   
   Radius Servers
   
   Only Cisco Spaces RADIUS servers can be configured. The servers are listed below.

8. In the Key field, enter the key: ************* and confirm it in the Confirm Key field.

9. In the Auth Port field, enter 1812.

10. In the Acct Port field, enter 1813.

11. Click Save & Apply to Device. The server added will be available in Servers list.

12. Repeat step 5. if a second Radius server is desired, otherwise proceed to creating a Server Group in the next step.
    

    

13. Choose Radius > Server Groups, and click Add.

14. In the Name field, enter a name.

15. From the MAC-Delimiter drop-down list, choose hyphen.

16. From the MAC-Filtering drop-down list, choose mac.

17. Move the radius server previously created from “Available Servers” to “Assigned Servers” using the arrow button.

18. Click Save & Apply to Device.
    

    

19. In the Authentication Authorization and Accounting window, click the AAA Method List tab.

20. Click Authentication, and click Add and specify the following details:

    1. In the Method List Name field, enter the method list name.

    2. From the Type drop-down list, choose Login

    3. From the Group Type drop-down list, choose Group.

    4. Move the server group created earlier from Available Server Groups to Assigned Servers Groups, and click Save & Apply to Device.
       
       

       

21. On the AAA Method List tab, click Authorization, and click Add, and specify the following details:

    1. In the Method List Name field, enter the method list name.

    2. From the Type drop-down list, choose Network.

    3. From the Group Type drop-down list, choose group.

    4. Move the server group previously created (point 12. to point 17.) from Available Servers to Assigned Servers using the arrow button, and click Save & Apply to Device.
       

       

Configure Policy Profile on the 9800 Controller

Policy profile contains policy to be associated with the WLAN. It specifies the settings for client VLAN, URL filters, session and idle timeout settings and so on.

1. Navigate to Configuration > Tags & Profiles > Policy and create a new Policy Profile or use the default Policy Profile.
   

   

2. In the Access Policies tab, configure the client VLAN and add the URL filter.

   

3. In the Advanced tab, in the AAA Policy area, check the Allow AAA Override check box

4. Click Update & Apply to Device.
   

   

Create the SSID

1. Choose Configuration > Tags and Profiles > WLANs.

2. Click Add.

3. On the General tab, in the Profile Name field, enter the profile name.

4. In the SSID field, enter the Captive Portal SSID name (ensuring that it matches exactly the Captive Portal SSID created in Cisco Spaces).
   

   

5. Set the status as Enabled.

6. Click the Security tab, and then click the Layer2 tab.

7. From the Layer 2 Security Mode drop-down list, choose None.

8. Enable MAC Filtering, uncheck OWE Transition Mode and add the Authorization List
   
   

   

9. Click the Layer3 tab.

10. Check the Web Policy check box.

11. From the WebAuth Parameter Map drop-down list, choose the Web Auth Parameter Map created previously.

12. From the Authentication List drop-down list, choose the Authentication Server created previously.

13. Check the On Mac Filter Failure check box.

14. If Pre-authentication ACLs were needed and created previously, you can select them here.

15. Click on the Add to Policy Tags tab

16. Link the Policy Tag with the Policy Profile
    

    

17. Click Save & Apply to Device.

Apply Policy Tag to AP to Broadcast SSID

1. Navigate to Configuration > Wireless > Access Points

2. Select the AP in question

3. Add the Policy Tag.

4. Click Update & Apply to Device