You are here: Captive Portal for Guest Access > Configuring Guest Logon Role and Access Rules for Guest Users
Previous TopicNext Topic

Configuring Guest Logon Role and Access Rules for Guest Users

For captive portal profile, you can create any the following types of roles:

A pre-authenticated role - This role is assigned before the captive portal authentication. The user can only access certain destinations with this role.
A guest role – This role is assigned after user authentication.
A captive-portal role - This role can be assigned to any network such as empolyee, voice, or guest. When the user is assigned with this role, a splash page is displayed after opening a browser and the users may need to authenticate.

You can configure up to 128 access rules for guest user roles through the Instant UI or CLI.

In the Instant UI

To configure roles and access rules for the guest network:

1. In the Access Rules tab, set the slider to any of the following types of access control:
Unrestricted— Select this to set unrestricted access to the network.
Network-based— Set the slider to Network-based to set common rules for all users in a network. The Allow any to all destinations access rule is enabled by default. This rule allows traffic to all destinations. To define an access rule:
a. Click New.
b. Select appropriate options in the New Rule window.
c. Click OK.
Role-based— Select Role-based to enable access based on user roles. For role-based access control:
n Create a user role if required. For more information, see Configuring User Roles.
n Create access rules for a specific user role. For more information, see Configuring Access Rules for Network Services. You can also configure an access rule to enforce captive portal authentication for an SSID with the 802.1X authentication method. For more information, see Configuring Captive Portal Roles for an SSID.
n Create a role assignment rule. For more information, see Configuring Derivation Rules. Instant supports role derivation based on the DHCP option for Captive Portal authentication. When the Captive Portal authentication is successful, a new user role is assigned to the guest users based on DHCP option configured for the SSID profile, instead of the pre-authenticated role.
2. Click Finish.

In the CLI

To configure access control rules for a WLAN SSID:

(Instant AP)(config)# wlan access-rule <name>

(Instant AP)(Access Rule <name>)# rule <dest> <mask> <match> {<protocol> <start-port> <end-port> {permit|deny|src-nat|dst-nat{<IP-address> <port>| <port>}}| app <app> {permit| deny}| appcategory <appgrp>| webcategory <webgrp> {permit| deny}| webreputation <webrep> [<option1....option9>]

(Instant AP)(Access Rule <name>)# end

(Instant AP)# commit apply

To configure access control based on the SSID:

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name># set-role-by-ssid

(Instant AP)(SSID Profile <name># end

(Instant AP)# commit apply

To configure role assignment rules:

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name># set-role <attribute>{{equals|not-equals|starts-with|ends-with|contains|matches-regular-expression}<operator><role>|value-of}

(Instant AP)(SSID Profile <name># end

(Instant AP)# commit apply

To configure a pre-authentication role:

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name># set-role-pre-auth <pre-authentication-role>

(Instant AP)(SSID Profile <name># end

(Instant AP)# commit apply

To configure machine and user authentication roles

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name># set-role-machine-auth <machine-authentication-only> <user-authentication-only>

(Instant AP)(SSID Profile <name># end

(Instant AP)# commit apply

To configure unrestricted access:

(Instant AP)(config)# wlan ssid-profile <name>

(Instant AP)(SSID Profile <name># set-role-unrestricted

(Instant AP)(SSID Profile <name># end

(Instant AP)# commit apply

Example

The following example configures access rules for the wireless network:

(Instant AP)(config)# wlan access-rule WirelessRule

(Instant AP)(Access Rule "WirelessRule")# rule 192.0.2.2 255.255.255.0 match 6 4343 4343 log classify-media

(Instant AP)(Access Rule "WirelessRule")# rule any any match app deny throttle-downstream 256 throttle-up 256

(Instant AP)(Access Rule "WirelessRule")# rule any any match appcategory collaboration permit

(Instant AP)(Access Rule "WirelessRule")# rule any any match webcategory gambling deny

(Instant AP)(Access Rule "WirelessRule")# rule any any match webcategory training-and-tools permit

(Instant AP)(Access Rule "WirelessRule")# rule any any match webreputation well-known-sites permit

(Instant AP)(Access Rule "WirelessRule")# rule any any match webreputation safe-sites permit

(Instant AP)(Access Rule "WirelessRule")# rule any any match webreputation benign-sites permit

(Instant AP)(Access Rule "WirelessRule")# rule any any match webreputation suspicious-sites deny

(Instant AP)(Access Rule "WirelessRule")# rule any any match webreputation high-risk-sites deny

(Instant AP)(Access Rule "WirelessRule")# end

(Instant AP)# commit apply