topic Re: MSM760 Staff HTML web page AD authentication on iPad in M and MSM Series

MSM760 Staff HTML web page AD authentication on iPad

michelle79 — Mon, 06 Feb 2012 06:20:16 GMT

Hi all, we have an MSM760 running software version 5.5.2.1-01-10012 and I am trying to get HTML authentication to work so that staff login to the network via a webpage that would automatically pop up when they connect to the VSC.

I have ticked the HTML based user logins option, both local (for testing) and remote AD, but not getting a login page when I connect to the VSC from my iPad. It just lets me in without authenticating! Is there a trick to this? I am a bit confused about using the LAN port for HTML authentication as most of the doco I've read discusses the internet port and guest access but I only want to use this VSC for private staff access so the guest setup seems irrelevant.

On another note, I'm setting this VSC up primarily so that staff can self server and enroll their mobile devices on our new airwatch server. I figure if the connection details are handed to them on a platter then support they require from us is reduced. If anyone has any better suggestions or have ideas on how to fix this then please let me know. I would be most appreciative.

Cheers,

Michelle

Re: MSM760 Staff HTML web page AD authentication on iPad

Fredrik Lönnman — Mon, 06 Feb 2012 14:08:06 GMT

Is the VSC configured with Use Controller for: Authentication and Access control

Re: MSM760 Staff HTML web page AD authentication on iPad

yuuls_01 — Mon, 06 Feb 2012 19:49:31 GMT

hi all

I have the same problem when the VCS authenticate in webportal on the LAN, I enabled the two options but still giving me error

plaese, can you guide me?

Re: MSM760 Staff HTML web page AD authentication on iPad

michelle79 — Tue, 07 Feb 2012 05:12:03 GMT

I wish it were that easy Fredrik. Both those options have to be ticked in order for the HTML authentication options to be visible, so yes, the VSC does have them enabled. I have attached a screen dump of all the settings just to make sure my settings are ok.

Any other ideas? Is it supposed to be easy to configure? Some docs seem convoluted but others seem very straight forward. I wish I could see where I was going wrong... very frustrating!

Re: MSM760 Staff HTML web page AD authentication on iPad

Fredrik Lönnman — Tue, 07 Feb 2012 06:29:50 GMT

So the VSC settings looks about right, allthough I dont see any DHCP server settings on the bottom of the page. How are you getting an IP address in the VSC? Its not that well documented, but for the HTML auth page to work the controller has to be both DNS and default GW and route all the traffic.

Re: MSM760 Staff HTML web page AD authentication on iPad

fernando_ — Tue, 07 Feb 2012 19:49:28 GMT

Hi Fredrik,

I have the same problem as michelle79

the configuration of the VCS is the same

I comment you that the DNS and default GW are obtained from the network that is designed for guests who shared the network DHCP

The Guest Vlan is different that the Vlan where the MSM760 is connected

I hope you can help me because I have several days in this and the manuals are not very clear

Re: MSM760 Staff HTML web page AD authentication on iPad

michelle79 — Tue, 07 Feb 2012 22:17:26 GMT

Hmmmm ok... So the DNS and GW settings would be applied to all VSCs configured? Not really ideal. But perhaps I can just mimic our corporatte settings... Unless you have a better way to achieve the wifi hotspot scenario I need? I preferred to use HTML authentication because users are forced to change passwords regularly and the current wifi uses 802.1x which stops working on most smartphones after their password changes.

Thanks for all your input Fredrik! Much appreciated.

Michelle

Re: MSM760 Staff HTML web page AD authentication on iPad

Fredrik Lönnman — Wed, 08 Feb 2012 11:59:19 GMT

Hi,

For the captive portal redirection to work the controller HAS to function as the DNS server for the clients. Common for all my installations is that the controller is configured as DHCP server, DNS and default gw for the guest VSCs, all guests gets tunneled to the controller, controller is their default gw and they're following the controllers internal routing via its default gateway which points out the Internet port.

Depending how your infrastructure looks 'beyond' the Internet port you could fix the return traffic with either a static route or NAT on the Internet port. The main thing is that the controller has to handle the routing for the whole guest net.

Example:

Guest VSC configured as DHCP server in network 10.10.10.0/24, default gw and DNS 10.10.10.1 (the controller will bind whatever IP you configure as the defGW and DNS in the VSC DHCP configurations <- this is not really obvious in the docs). The Internet port is connected via a VLAN directly to a firewall for guest access, the transport ip subnet is say 192.168.1.0/24, the firewall with .1 and the controller has .2. Default GW in the controller sould be set to 192.168.1.1 and the firewall should have a static route pointing out that 10.10.10.0/24 resides at 192.168.1.2 (for the return traffic TO the guest).

Since the controller is acting more like a DNS-proxy, it has to have valid DNS settings internaly to be able to serve it to the guests also.

Makes sense? :)

Re: MSM760 Staff HTML web page AD authentication on iPad

tschaps — Wed, 08 Feb 2012 20:12:13 GMT

"The DHCP server feature is not supported when controller teaming is active."

You don't run into that problem, or you ignore the message? Or you never have any teamed installations, perhaps? I'd like to use the built-in DHCP server for the guest network, but that help notice says otherwise.

*grumble*

Re: MSM760 Staff HTML web page AD authentication on iPad

Fredrik Lönnman — Wed, 08 Feb 2012 20:54:49 GMT

@tschaps wrote:
"The DHCP server feature is not supported when controller teaming is active."

You don't run into that problem, or you ignore the message? Or you never have any teamed installations, perhaps? I'd like to use the built-in DHCP server for the guest network, but that help notice says otherwise.

*grumble*

Yeah right, forgot about that one. When using teaming you have to use a external dhcp server and the built in dhcp-relay function, but you still have to use the controller as defgw, dns etc.

Re: MSM760 Staff HTML web page AD authentication on iPad

tschaps — Wed, 08 Feb 2012 21:39:22 GMT

aha-- well, that explains why my testing isn't working. I'm using a test VSC but on the same subnet/egress as another in-service VSC, and it gets an IP address, but no connectivity. I need a different DHCP scope for this which gives the Teaming IP (I assume) as the gateway and DNS. I guess I can try that with static settings on a client before configuring. Thanks.

Re: MSM760 Staff HTML web page AD authentication on iPad

mfordtoday — Mon, 13 Feb 2012 20:56:14 GMT

I had the same problem and the session page was the issue.

If you want to suppress the Session Page, you need to modify the “sessionwindow.js”, under Public AccessàWeb Content….

1. Remark out (using ‘//’) or you can remove the first function in the “sessionwindow.js file;

check out image 1

Go to Public Access à Attributes, and press the Retrieve Now button, and this will re-load the internal pages, and your changes;

check out image 2

You can also disable the Welcome page, by disabling it on the Public Access àWeb Content page;

check out image 3