Dell W-ClearPass Hardware Appliances User guide

Dell Networking W-ClearPass

Guest 6.5.0

User Guide

Dell Networking W- ClearPass Guest 6.5 | User Guide 0511206-05| February 2015

Copyright

®

, Aruba

Wireless Networks

®

, the registered Aruba the Mobile Edge Company logo, and Aruba Mobility Management

System

®

. Dell™, the DELL™ logo, and PowerConnect™ are trademarks of Dell Inc.

Originated in the USA. All other trademarks are the property of their respective owners.

Open Source Code

Certain Aruba products include Open Source software code developed by third parties, including software code

subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open

Source code used can be found at this site:

http://www.arubanetworks.com/open_source

Legal Notice

The use of Aruba Networks, Inc. switching platforms and software, by all individuals or corporations, to

terminate other vendors’ VPN client devices constitutes complete acceptance of liability by that individual or

corporation for this action and indemnifies, in full, Aruba Networks, Inc. from any and all legal actions that

might be taken against it with respect to infringement of copyright on behalf of those vendors.

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 3

Contents

About this Guide 17

Audience 17

Sponsored Guest Access 34

Self Provisioned Guest Access 35

Active Sessions Management 35

Session States 37

4 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

RFC 3576 Dynamic Authorization 37

Filtering the List of Active Sessions 38

Disconnecting Multiple Active Sessions 39

Sending Multiple SMS Alerts 39

About SMS Guest Account Receipts 40

Using Standard Guest Management Features 40

Creating a Guest Account 41

Creating a Guest Account Receipt 43

Creating a Device 44

Creating Devices Manually in W-ClearPass Guest 44

Creating Devices During Self-Registration - MAC Only 46

Creating Devices During Self-Registration - Paired Accounts 48

Creating Multiple Guest Accounts 48

Creating Multiple Guest Account Receipts 50

Creating a Single Password for Multiple Accounts 52

Exporting Guest Account Information 54

About CSV and TSV Exports 55

About XML Exports 55

Importing Guest Accounts 56

Managing Single Guest Accounts 59

Managing Devices 63

Changing a Device’s Expiration Date 65

Disabling and Deleting Devices 65

Activating a Device 66

Editing a Device 67

Viewing Current Sessions for a Device 69

Printing Device Details 69

Viewing Device Details 69

Managing Multiple Guest Accounts 69

AirGroup Device Registration 72

Registering Groups of Devices or Services 72

Registering Personal Devices 74

AirGroup Time-Based Sharing Syntax Examples 76

Time-Based Syntax Reference 79

About AirGroup Time-Based Sharing 80

Basics of Time-Based Sharing Setup 81

MAC Authentication in W-ClearPass Guest 82

MAC Address Formats 82

Automatically Registering MAC Devices in W-ClearPass Policy Manager 82

Importing MAC Devices 83

Advanced MAC Features 83

User Detection on Landing Pages 83

Click-Through Login Pages 84

Onboard 85

Accessing Onboard 85

About W-ClearPass Onboard 86

Onboard Deployment Checklist 87

Onboard Feature List 89

Supported Platforms 89

Public Key Infrastructure for Onboard 90

Certificate Hierarchy 90

Certificate Configuration in a Cluster 91

Revoking Unique Device Credentials 91

Revoking Credentials to Prevent Network Access 91

Re-Provisioning a Device 92

Network Requirements for Onboard 92

Using Same SSID for Provisioning and Provisioned Networks 93

Using Different SSID for Provisioning and Provisioned Networks 93

Configuring Online Certificate Status Protocol 93

Configuring Certificate Revocation List (CRL) 93

Network Architecture for Onboard 94

Network Architecture for Onboard when Using W-ClearPass Guest 95

The W-ClearPass Onboard Process 96

Devices Supporting Over-the-Air Provisioning 96

Devices Supporting Onboard Provisioning 98

Configuring the User Interface for Device Provisioning 101

Using the {nwa_mdps_config} Template Function 101

Onboard Troubleshooting 102

iOS Device Provisioning Failures 102

Hostname-to-Certificate Match Failures 103

Onboard Interface Not Displayed 103

Certificate Renewal through OS X Mavericks 103

Certificate Authorities 103

Creating a New Certificate Authority 105

Editing Certificate Authority Settings 108

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 5

6 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Requesting a Certificate for the Certificate Authority 113

Installing a Certificate Authority’s Certificate 113

Using Microsoft Active Directory Certificate Services 115

Management and Control 118

Device Management (View by Device) 118

Device Management (View by Username) 122

Certificate Management (View by Certificate) 124

Searching for Certificates in the List 125

Working with Certificates in the List 126

Working with Certificate Signing Requests 128

Importing a Code-Signing Certificate 131

Importing a Trusted Certificate 132

Creating a Certificate 132

Requesting a Certificate 136

The Trust Chain and Uploading Certificates for the CA 138

Considerations for iOS Devices 140

Onboard Usage 140

Onboard Configuration 141

Network Settings 141

Configuring Basic Network Access Settings 142

Configuring Enterprise Protocol Settings 146

Configuring Device Authentication Settings 147

Configuring Certificate Trust Settings 149

Configuring Windows-Specific Network Settings 151

Configuring Proxy Settings 152

iOS Settings 153

Configuring ActiveSync Settings 154

Configuring AirPlay Settings 156

Configuring AirPrint Settings 157

Configuring APN Settings 158

Configuring Calendar Settings 159

Configuring Contacts Settings 161

Configuring Device Restrictions Settings 162

Configuring Email Settings 168

Configuring an iOS Device Passcode Policy 171

Configuring Single Sign-On Settings 173

Configuring Calendar Subscription Settings 175

Configuring an iOS Device VPN Connection 176

Configuring Web Clips 181

Windows Applications 182

Configuring App Sets 183

Deployment and Provisioning 184

Configuration Profiles 184

Creating and Editing Configuration Profiles 185

Provisioning Settings 188

About Configuring Provisioning Settings 189

Configuring General Provisioning Settings 190

Configuring Provisioning Settings for Supported Devices 195

Configuring Provisioning Settings for the Web Login Page 197

Configuring Provisioning Settings for Instructions and Messages 202

Configuring Provisioning Settings for iOS and OS X Profiles 221

Configuring Options for Onboard Client Devices 223

Configuring Provisioning Settings for Sponsorship Confirmation 226

About the Self-Service Portal 228

Configuration 231

Accessing Configuration 231

Configuring W-ClearPass Guest Authentication 232

Content Manager 233

Managing Content: Private Files and Public Files 233

Uploading Content 235

Downloading Content 235

Creating a New Content Directory 236

Configuring Guest Manager 237

Default Settings for Account Creation 237

About Fields, Forms, and Views 243

Business Logic for Account Creation 243

Verification Properties 243

Basic User Properties 243

Visitor Account Activation Properties 244

Visitor Account Expiration Properties 244

Other Properties 245

Standard Forms and Views 246

Configuring Access Code Logins 247

Customize Random Username and Passwords 247

Create the Print Template 247

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 7

8 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Customize the Guest Accounts Form 249

Create the Access Code Guest Accounts 249

Pages 252

Customizing Fields 252

Creating a Custom Field 253

Duplicating a Field 254

Editing a Field 255

Deleting a Field 255

Displaying Forms that Use a Field 255

Displaying Views that Use a Field 255

Customizing AirGroup Registration Forms 255

Customizing Forms and Views 258

Editing Forms and Views 259

Duplicating Forms and Views 260

Editing Forms 261

Form Field Editor 262

Form Display Properties 263

Form Validation Properties 276

Examples of Form field Validation 277

Advanced Form Field Properties 279

Creating a Single Password for Multiple Accounts 280

Form Field Validation Processing Sequence 281

Editing Views 284

View Field Editor 284

Customizing Guest Self-Registration 286

Accessing the Guest Self-Registration Customization Forms 286

Self-Registration Sequence Diagram 290

Editing Self-Registration Pages 291

Creating a Self-Registration Page 292

Configuring Basic Properties for Self-Registration 294

Editing Registration Page Properties 296

Editing the Default Self-Registration Form Settings 297

Editing Guest Receipt Page Properties 299

Editing Receipt Actions 300

Editing Login Page Properties 306

Editing Social Logins Properties 311

Self-Service Portal Properties 314

Resetting Passwords with the Self-Service Portal 316

Enabling and Editing NAS Login Properties 318

Managing Web Logins 318

Creating and Editing Web Login Pages 319

Managing Web Pages 331

The Web Page Templates 331

Creating and Editing Simple Web Pages 334

Receipts 336

Digital Passes 337

About Digital Passes 337

Viewing Digital Pass Certificates 340

Installing Digital Pass Certificates 341

Managing Digital Passes 342

Creating and Editing a Digital Pass Template 343

Example Template Code Variables 349

Images in Digital Passes 350

Email Receipts and SMTP Services 351

About Email Receipts 351

Configuring Email Receipts 352

Email Receipt Options 353

About Customizing SMTP Email Receipt Fields 355

Customizing SMS Receipt 357

SMS Receipt Fields 357

Customizing Print Templates 358

Creating New Print Templates 359

Print Template Wizard 361

Modifying Wizard-Generated Templates 362

Setting Print Template Permissions 362

SMS Services 364

Viewing SMS Gateways 364

Creating a New SMS Gateway 365

Editing an SMS Gateway 370

Sending an SMS 372

About SMS Credits 373

About SMS Guest Account Receipts 373

SMS Receipt Options 374

Working with the Mobile Carriers List 374

About Translations 377

Translation Packs 377

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 9

10 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Creating and Editing Translation Packs 378

Translation Assistant 380

Customizing Translated User Interface Text 381

Advertising Services 385

About Advertising Services 385

Materials 385

Promotions 385

Campaigns 386

Spaces 386

Pages 386

Advertising Services Process Overview 386

About the Tutorial 386

Navigating the Tutorial 387

Advertising Pages 387

Editing Advertising Pages 388

The nwa_adspace Smarty Template Tag 393

Advertising Spaces 396

Creating and Editing Advertising Spaces 398

"Other Location" Example 399

"Maximum Height" Example 401

"Maximum Width" Example 402

Advertising Campaigns 403

Creating and Editing Advertising Campaigns 404

Campaign Rank and Weight 406

Advertising Promotions 407

Creating and Editing Advertising Promotions 408

Using Labels in Advertising Services 412

Advertising Materials 413

Creating and Editing Advertising Materials 413

Hotspot Manager 417

Accessing Hotspot Manager 417

About Hotspot Management 418

Managing the Hotspot Sign-up Interface 418

Captive Portal Integration 420

Web Site Look-and-Feel 420

SMS Services 420

Managing Hotspot Plans 421

Editing or Creating a Hotspot Plan 421

Managing Transaction Processors 423

Creating a New Transaction Processor 423

Managing Existing Transaction Processors 426

Managing Customer Information 426

Managing Hotspot Invoices 426

Customizing the User Interface 428

Customizing Visitor Sign-Up Page One 428

Customizing Visitor Sign-Up Page Two 430

Customizing Visitor Sign-Up Page Three 433

Viewing the Hotspot User Interface 434

Administration 435

Accessing Administration 435

AirGroup Services 436

AirGroup Controllers 436

Creating and Editing AirGroup Controllers 438

Configuring AirGroup Services 439

AirGroup Diagnostics 441

Creating AirGroup Administrators 442

Creating AirGroup Operators 442

Authenticating AirGroup Users via LDAP 443

Configuring LDAP User Search for AirGroup 443

LDAP User Search Architecture 443

User Search Workflow 443

Configuration Summary 444

Basic LDAP Server Settings 444

User Search Settings 445

Configuring the AirGroup Shared User Field 447

Select2 Options Details 448

Select2 Hook Details 450

MACTrac Services 450

Creating MACTrac Operators 451

Managing MACTrac Devices 452

Registering MACTrac Devices 453

About MAC Addresses 454

Automatically Supplying the MACTrac Device Address 455

API Services 455

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 11

12 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

API Clients 456

Creating and Editing API Clients 457

API Explorer 459

Setting API Privileges in Operator Profiles 459

About OAuth 460

OAuth Basics 461

OAuth2 Client or App 461

Client ID and Secret 462

Redirect URI 462

Authorization Grant Types for OAuth 462

Application Service Accounts for OAuth 464

SOAP Web Services and API 464

Viewing Available Web Services 465

SOAPAPIIntroduction 466

Audience 466

API Documentation Overview 466

Disclaimer 466

About the SOAPAPI 467

Using the SOAPAPI 469

Integration Example 471

API Documentation 476

The XML-RPC Interface and API 491

About the XML-RPC API 491

Accessing the API 494

Invoking the API 497

Method Summary 498

API Documentation 498

Data Retention 515

3.9 Configuration Import 516

Creating a Customized Configuration Backup 516

Uploading the 3.9 Backup File 517

Restoring Configuration Items 518

Viewing Imported Item Details 519

Import Information for Specific Import Items 521

Import Information: Advertising Services 522

Import Information: AirGroup Services 522

Import Information: Cisco IP Phones 522

Import Information: Guest Manager 522

Import Information: High Availability (HA) 523

Import Information: Hotspot Manager 523

Import Information: Onboard 524

Import Information: Operator Logins 524

Import Information: Palo Alto Network Services 524

Import Information: RADIUSServices 524

Import Information: Reporting Manager Definitions 525

Import Information: Server Configuration 526

Import Information: SMSServices 527

Import Information: SMTP Services 527

Plugin Manager 528

Viewing Available Plugins 528

Configuring Plugins 529

Configuring the API Framework Plugin 531

Configuring the DELL W-ClearPass Skin Plugin 532

Configuring the IP Phone Services Plugin 534

Configuring the Kernel Plugin 535

Configuring the SMS Services Plugin 536

Configuring the Translations Plugin 537

Configuring the Web Analytics Plugin 538

Configuring the SOAP Web Services Plugin 538

Support Services 539

Viewing the Application Log 540

Exporting the Application Log 541

Contacting Support 542

Viewing Documentation 542

Operator Logins 543

Accessing Operator Logins 543

About Operator Logins 543

Role-Based Access Control for Multiple Operator Profiles 544

Operator Logins Configuration 544

Custom Login Message 545

Advanced Operator Login Options 546

Automatic Logout 546

Operator Profiles 546

Creating an Operator Profile 547

Configuring the User Interface 550

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 13

14 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Customizing Forms and Views 551

Operator Profile Privileges 552

Managing Operator Profiles 552

Configuring AirGroup Operator Device Limit 553

Local Operator Authentication 553

Creating a New Operator 553

External Operator Authentication 554

Manage LDAP Operator Authentication Servers 555

Viewing the LDAP Server List 555

Creating an LDAP Server 556

Advanced LDAP URL Syntax 559

LDAP Operator Server Troubleshooting 559

Testing Connectivity 559

Testing Operator Login Authentication 559

Looking Up Sponsor Names 560

Troubleshooting Error Messages 561

LDAP Translation Rules 562

Custom LDAP Translation Processing 564

Reference 567

Basic HTML Syntax 567

Standard HTML Styles 568

Smarty Template Syntax 570

Basic Template Syntax 570

Text Substitution 570

Template File Inclusion 570

Comments 570

Variable Assignment 570

Conditional Text Blocks 571

Script Blocks 571

Repeated Text Blocks 571

Foreach Text Blocks 571

Modifiers 572

Predefined Template Functions 572

dump 573

nwa_commandlink 573

nwa_iconlink 574

nwa_icontext 574

nwa_quotejs 575

nwa_radius_query 575

Advanced Developer Reference 581

nwa_assign 582

nwa_bling 582

nwa_makeid 582

nwa_nav 583

nwa_plugin 584

nwa_privilege 584

nwa_replace 585

nwa_text 585

nwa_userpref 585

nwa_youtube 585

Date/Time Format Syntax 586

nwadateformat Modifier 586

nwatimeformat Modifier 587

Date/Time Format String Reference 587

Programmer’s Reference 588

NwaAlnumPassword 589

NwaBoolFormat 589

NwaByteFormat 589

NwaByteFormatBase10 589

NwaComplexPassword 590

NwaCsvCache 590

NwaDigitsPassword($len) 590

NwaDynamicLoad 590

NwaGeneratePictureString 590

NwaGenerateRandomPasswordMix 590

NwaLettersDigitsPassword 591

NwaLettersPassword 591

NwaMoneyFormat 591

NwaParseCsv 591

NwaParseXml 592

NwaPasswordByComplexity 592

NwaSmsIsValidPhoneNumber 593

NwaStrongPassword 593

NwaVLookup 593

NwaWordsPassword 594

Dell Networking W-ClearPass Guest 6.5.0 | User Guide Contents | 15

16 | Contents Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Field, Form, and View Reference 594

GuestManager Standard Fields 594

Hotspot Standard Fields 602

SMS Services Standard Fields 603

SMTP Services Standard Fields 603

Format Picture String Symbols 605

Form Field Validation Functions 606

Form Field Conversion Functions 611

Form Field Display Formatting Functions 612

View Display Expression Technical Reference 613

LDAP Standard Attributes for User Class 615

Regular Expressions 616

Chromebook in Onboard 617

About Chromebook in Onboard 617

Caveats and Recommendations 618

Google Admin Chromebook License is Required 618

Managed Chromebook Deployment is Required 618

Chrome Extension is Required 618

Chromebook Release 37 or Later is Required 618

Chromebook Supports Only “Created by Device” Certificates 619

A Separate Provisioning SSID is Required 619

Directory-Based Authentication Source is Recommended 620

Onboard Configuration for Chromebook 620

Enable Chromebook Provisioning 620

Configure Instructions and Messages 621

Google Admin Configuration for Chromebook 621

Configuring the Chrome extension 621

Configuring Network Settings 623

Glossary 627

Index 643

Dell Networking W-ClearPass Guest 6.5.0 | User Guide About this Guide | 17

Chapter 1

About this Guide

Dell Networking W-ClearPass Guest 6.5 provides a simple and personalized user interface through which

operational staff can quickly and securely manager visitor network access.

Audience

This User Guide is intended for system administrators and people who are installing and configuring Dell

Networking W-ClearPass Guest 6.5 as their visitor management solution. It describes the installation and

configuration process.

Related Documents

The following documents are part of the complete documentation set for the W-ClearPass platform:

l ClearPass Guest 6.5 User Guide

l ClearPass Policy Manager 6.5 User Guide

l ClearPass 6.5.x Release Notes

l ClearPass Insight 6.5 User Guide

l ClearPass Policy Manager 6.5 Getting Started Guide

l ClearPass Policy Manager Configuration API Guide

l ClearPass Policy Model: An Introduction

l Tech Note: Installing or Upgrading ClearPass 6.5 on a Virtual Machine

l Tech Note: Upgrading to ClearPass 6.5

Conventions

The following conventions are used throughout this guide to emphasize important concepts:

Type Style Description

Italics

This style is used to emphasize important terms and to mark the titles of books.

System items

This fixed-width font depicts the following:

l Sample screen output

l System prompts

l Filenames, software devices, and specific commands when mentioned in the text

Commands

In the command examples, this bold font depicts text that you must type exactly as

shown.

<

Arguments

> In the command examples, italicized text within angle brackets represents items that

you should replace with information appropriate to your specific situation. For example:

# send <text message>

Table 1: Typographical Conventions

18 | About this Guide Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Type Style Description

In this example, you would type “send” at the system prompt exactly as shown, followed

by the text of the message you wish to send. Do not type the angle brackets.

[Optional]

Command examples enclosed in brackets are optional. Do not type the brackets.

{Item A |

Item B}

In the command examples, items within curled braces and separated by a vertical bar

represent the available choices. Enter only one choice. Do not type the braces or bars.

The following informational icons are used throughout this guide:

Indicates helpful suggestions, pertinent information, and important things to remember.

Indicates a risk of damage to your hardware or loss of data.

Indicates a risk of personal injury or death.

Contacting Support

Web Site Support

Main Website dell.com

Support Website dell.com/support

Documentation Website dell.com/support/manuals

Dell Networking W-ClearPass Guest 6.5.0 | User Guide W-ClearPass Guest Overview | 19

Chapter 2

W-ClearPass Guest Overview

This chapter explains the terms, concepts, processes, and equipment involved in managing visitor access to a

network, and helps you understand how Dell Networking W-ClearPass Guest 6.5 can be successfully integrated

into your network infrastructure. It is intended for network architects, IT administrators, and security

consultants who are planning to deploy visitor access, or who are in the early stages of deploying a visitor

access solution.

This chapter includes the following sections:

l "About Dell Networking W-ClearPass Guest" on page 19

l "Visitor Access Scenarios" on page 20

l "Reference Network Diagram" on page 21

l "Key Interactions" on page 22

l "AAA Framework" on page 23

l "Key Features" on page 24

l "Visitor Management Terminology" on page 25

l "W-ClearPass Guest Deployment Process" on page 26

l "AirGroup Deployment Process" on page 28

l "Documentation and User Assistance" on page 29

l "Use of Cookies" on page 30

About Dell Networking W-ClearPass Guest

Dell Networking W-ClearPass Guest 6.5 provides a simple and personalized user interface through which

operational staff can quickly and securely manage visitor network access. It gives your non-technical staff

controlled access to a dedicated visitor management user database. Through a customizable Web portal, your

staff can easily create an account, reset a password, or set an expiry time for visitors. Access permissions to

W-ClearPass Guest functions are controlled through an operator profile that can be integrated with an LDAP

server or Active Directory login.

Visitors can be registered at reception and provisioned with an individual guest account that defines their

visitor profile and the duration of their visit. The visitor can be given a printed customized receipt with account

details, or the receipt can be delivered wirelessly using the integrated SMS services. Companies are also able to

pre-generate custom scratch cards, each with a defined network access time, which can then be handed out in

a corporate environment or sold in public access scenarios.

You can use the customization features to define settings that allow your visitors to self-provision their own

guest accounts. Visitors register through a branded and customized Web portal, ensuring a streamlined and

professional experience. Surveys can also be presented during the self-registration process and the data stored

for later analysis and reporting, providing additional insight to your visitors and their network usage.

W-ClearPass Guest integrates with all leading wireless and NAC solutions through a flexible definition point,

W-ClearPass Policy Manager. This ensures that IT administrators have a standard integration with the network

security framework, but gives operational staff the user interface they require.

20 | W-ClearPass Guest Overview Dell Networking W-ClearPass Guest 6.5.0 | User Guide

Visitor Access Scenarios

The following figure shows a high-level representation of a typical visitor access scenario.

Figure 1 Visitor access using W-ClearPass Guest

In this scenario, visitors are using their own mobile devices to access a corporate wireless network. Because

access to the network is restricted, visitors must first obtain a username and password. A guest account may

be provisioned by a corporate operator such as a receptionist, who can then give the visitor a print receipt that

shows their username and password for the network.

When visitors use self-registration, as might be the case for a network offering public access, the process is

broadly similar but does not require a corporate operator to create the guest account. The username and

password for a self-provisioned guest account may be delivered directly to the visitor’s Web browser, or sent

via SMS or email.

Page is loading ...

Dell W-ClearPass Hardware Appliances User guide

This manual is also suitable for

Dell W-ClearPass Hardware Appliances User guide

Related papers

Other documents