Configuring MAC Authentication with Captive Portal Authentication

This authentication method has the following features:



If the captive portal splash page type is Internal-Authenticated or External-RADIUS Server, MAC authentication reuses the server configurations.



If the captive portal splash page type is Internal-Acknowledged or External-Authentication Text and MAC authentication is enabled, a server configuration page is displayed.



If the captive portal splash page type is none, MAC authentication is disabled.



MAC authentication only role— You can use the WLAN wizard to configure the mac-auth-only role in the role-based access rule configuration section when MAC authentication is enabled with captive portal authentication.

Configuring MAC Authentication with Captive Portal Authentication

You can configure the MAC authentication with Captive Portal authentication for a network profile using the Instant UI or CLI.

In the Instant UI

1.

Select an existing wireless or wired profile for which you want to enable MAC with Captive Portal authentication. Depending on the network profile selected, the Edit <WLAN-Profile> or Edit Wired Network window is displayed.

You can configure MAC authentication with Captive Portal authentication, in the Access tab of the New WLAN and New Wired Network windows when configuring a new profile.

2.

In the Access tab, specify the following parameters for a network with Role-Based rules:

a.

Select the Enforce Machine Authentication checkbox when MAC authentication is enabled for Captive Portal. If the MAC authentication fails, the Captive Portal authentication role is assigned to the client.

b.

For wireless network profile, select Enforce MAC Auth Only Role checkbox when MAC authentication is enabled for Captive Portal. After successful MAC authentication, MAC auth only role is assigned to the client.

3.

Click Next and then click Finish to apply the changes.

In the CLI

To configure MAC authentication with Captive Portal authentication for a wireless profile:

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name>)# type <Guest>

(Instant AP)(SSID Profile <name>)# mac-authentication

(Instant AP)(SSID Profile <name>)# captive-portal <type> exclude-uplink <type>

(Instant AP)(SSID Profile <name>)# set-role-machine-auth <machine-authentication> <user-authentication>

(Instant AP)(SSID Profile <name>)# set-role-mac-auth <MAC-authentication-only>

(Instant AP)(SSID Profile <name>)# end

(Instant AP)# commit apply

 

To configure MAC authentication with Captive Portal authentication for a wired profile:

(Instant AP)(config)# wired-port-profile <name>

(Instant AP)(wired ap profile <name>)# type <guest>

(Instant AP)(wired ap profile <name>)# mac-authentication

(Instant AP)(wired ap profile <name>)# captive-portal <type>

(Instant AP)(wired ap profile <name>)# captive-portal <type> exclude-uplink {<3G>| <4G>| <Wifi> | Ethernet}

(Instant AP)(wired ap profile <name>)# set-role-machine-auth <machine-only> <user-only>

(Instant AP)(wired ap profile <name>)# set-role-mac-auth <mac-only>

(Instant AP)(wired ap profile <name>)# end

(Instant AP)# commit apply