Dell W-ClearPass Hardware Appliances User guide

Dell Networking W-ClearPass

Guest 6.4

User Guide

2 | Dell Networking W-ClearPass Guest 6.4 | User Guide

Copyright

®

, Aruba

Wireless Networks

®

, the registered Aruba the Mobile Edge Company logo, and Aruba Mobility Management System

®

.

Dell™, the DELL™ logo, and PowerConnect™ are trademarks of Dell Inc.

Originated in the USA. All other trademarks are the property of their respective owners.

Open Source Code

Certain Aruba products include Open Source software code developed by third parties, including software code subject

to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open Source

code used can be found at this site:

http://www.arubanetworks.com/open_source

Legal Notice

The use of Aruba Networks, Inc. switching platforms and software, by all individuals or corporations, to terminate

other vendors’ VPN client devices constitutes complete acceptance of liability by that individual or corporation for

this action and indemnifies, in full, Aruba Networks, Inc. from any and all legal actions that might be taken against it

with respect to infringement of copyright on behalf of those vendors.

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 3

Contents

About this Guide 17

Audience 17

Conventions 17

Contacting Support 18

W-ClearPass Guest Overview 19

About Dell Networking W-ClearPass Guest 19

Visitor Access Scenarios 20

Reference Network Diagram 21

Key Interactions 22

AAA Framework 23

Key Features 24

Visitor Management Terminology 25

W-ClearPass Guest Deployment Process 26

Operational Concerns 26

Network Provisioning 26

Site Preparation Checklist 27

Security Policy Considerations 27

AirGroup Deployment Process 28

Documentation and User Assistance 29

User Guide and Online Help 29

Context-Sensitive Help 29

Field Help 29

Quick Help 30

If You Need More Assistance 30

Use of Cookies 30

W-ClearPass Guest Manager 31

Accessing Guest Manager 31

About Guest Management Processes 32

Sponsored Guest Access 32

Self Provisioned Guest Access 32

Active Sessions Management 33

Session States 35

RFC 3576 Dynamic Authorization 35

4 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Filtering the List of Active Sessions 36

Disconnecting Multiple Active Sessions 37

Sending Multiple SMS Alerts 37

About SMS Guest Account Receipts 38

Using Standard Guest Management Features 38

Creating a Guest Account 39

Creating a Guest Account Receipt 41

Creating a Device 41

Creating Devices Manually in W-ClearPass Guest 42

Creating Devices During Self-Registration - MAC Only 44

Creating Devices During Self-Registration - Paired Accounts 44

Creating Multiple Guest Accounts 45

Creating Multiple Guest Account Receipts 47

Creating a Single Password for Multiple Accounts 48

Exporting Guest Account Information 50

About CSV and TSV Exports 51

About XML Exports 51

Importing Guest Accounts 52

Managing Single Guest Accounts 55

Managing Devices 59

Changing a Device’s Expiration Date 60

Disabling and Deleting Devices 61

Activating a Device 61

Editing a Device 62

Viewing Current Sessions for a Device 63

Printing Device Details 64

Viewing Device Details 64

Managing Multiple Guest Accounts 64

AirGroup Device Registration 66

Registering Groups of Devices or Services 67

Registering Personal Devices 69

AirGroup Time-Based Sharing Syntax Examples 71

Time-Based Syntax Reference 73

About AirGroup Time-Based Sharing 75

Basics of Time-Based Sharing Setup 75

MAC Authentication in W-ClearPass Guest 76

MAC Address Formats 76

Automatically Registering MAC Devices in W-ClearPass Policy Manager 76

Importing MAC Devices 77

Advanced MAC Features 77

User Detection on Landing Pages 77

Click-Through Login Pages 78

Onboard 79

Accessing Onboard 79

About W-ClearPass Onboard 80

Onboard Deployment Checklist 81

Onboard Feature List 83

Supported Platforms 84

Public Key Infrastructure for Onboard 85

Certificate Hierarchy 85

Certificate Configuration in a Cluster 86

Revoking Unique Device Credentials 86

Revoking Credentials to Prevent Network Access 86

Re-Provisioning a Device 87

Network Requirements for Onboard 87

Using Same SSID for Provisioning and Provisioned Networks 87

Using Different SSID for Provisioning and Provisioned Networks 88

Configuring Online Certificate Status Protocol 88

Configuring Certificate Revocation List (CRL) 88

Network Architecture for Onboard 89

Network Architecture for Onboard when Using W-ClearPass Guest 90

The W-ClearPass Onboard Process 91

Devices Supporting Over-the-Air Provisioning 91

Devices Supporting Onboard Provisioning 93

Configuring the User Interface for Device Provisioning 95

Using the {nwa_mdps_config} Template Function 95

Onboard Troubleshooting 96

iOS Device Provisioning Failures 96

Hostname-to-Certificate Match Failures 97

Onboard Interface Not Displayed 97

Certificate Renewal through OS X Mavericks 97

Certificate Authorities 97

Creating a New Certificate Authority 98

Editing Certificate Authority Settings 101

Requesting a Certificate for the Certificate Authority 105

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 5

6 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Installing a Certificate Authority’s Certificate 105

Using Microsoft Active Directory Certificate Services 107

Management and Control 109

Device Management (View by Device) 110

Device Management (View by Username) 113

Certificate Management (View by Certificate) 115

Searching for Certificates in the List 116

Working with Certificates in the List 116

Working with Certificate Signing Requests 119

Importing a Code-Signing Certificate 122

Importing a Trusted Certificate 123

Creating a Certificate 123

Requesting a Certificate 126

The Trust Chain and Uploading Certificates for the CA 128

Considerations for iOS Devices 130

Onboard Configuration 130

Network Settings 130

Configuring Basic Network Access Settings 131

Configuring Enterprise Protocol Settings 134

Configuring Device Authentication Settings 135

Configuring Certificate Trust Settings 136

Configuring Windows-Specific Network Settings 138

Configuring Proxy Settings 139

iOS Settings 140

Configuring ActiveSync Settings 141

Configuring AirPlay Settings 143

Configuring AirPrint Settings 144

Configuring APN Settings 145

Configuring Calendar Settings 145

Configuring Contacts Settings 147

Configuring Email Settings 148

Configuring Global HTTP Proxy Settings 151

Configuring an iOS Device Passcode Policy 152

Configuring Single Sign-On Settings 154

Configuring Calendar Subscription Settings 155

Configuring an iOS Device VPN Connection 156

Configuring Web Clips 160

Configuring Web Content Filter Settings 161

Windows Applications 163

Configuring App Sets 163

Deployment and Provisioning 164

Configuration Profiles 165

Creating and Editing Configuration Profiles 165

Provisioning Settings 168

About Configuring Provisioning Settings 169

Configuring Basic Provisioning Settings 170

Configuring Provisioning Settings for the Web Login Page 174

Configuring Provisioning Settings for iOS and OS X 176

Configuring Provisioning Settings for Legacy OS X Devices 178

Configuring Provisioning Settings for Windows Devices 179

Configuring Provisioning Settings for Android Devices 180

Configuring Provisioning Settings for Ubuntu 181

Configuring Provisioning Settings for Chromebook 182

Configuring Options for Onboard Client Devices 184

About the Self-Service Portal 185

Configuration 187

Accessing Configuration 187

Configuring W-ClearPass Guest Authentication 188

Content Manager 189

Managing Content: Private Files and Public Files 189

Uploading Content 190

Downloading Content 191

Creating a New Content Directory 191

Configuring Guest Manager 192

Default Settings for Account Creation 192

About Fields, Forms, and Views 198

Business Logic for Account Creation 198

Verification Properties 198

Basic User Properties 198

Visitor Account Activation Properties 199

Visitor Account Expiration Properties 200

Other Properties 200

Standard Forms and Views 201

Configuring Access Code Logins 202

Customize Random Username and Passwords 202

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 7

8 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Create the Print Template 202

Customize the Guest Accounts Form 204

Create the Access Code Guest Accounts 204

Pages 206

Customizing Fields 206

Creating a Custom Field 206

Duplicating a Field 208

Editing a Field 208

Deleting a Field 208

Displaying Forms that Use a Field 209

Displaying Views that Use a Field 209

Customizing AirGroup Registration Forms 209

Customizing Forms and Views 212

Editing Forms and Views 213

Duplicating Forms and Views 213

Editing Forms 214

Form Field Editor 215

Form Display Properties 215

Form Validation Properties 227

Examples of Form field Validation 228

Advanced Form Field Properties 230

Form Field Validation Processing Sequence 231

Editing Views 233

View Field Editor 234

Customizing Guest Self-Registration 235

Accessing the Guest Self-Registration Customization Forms 236

Self-Registration Sequence Diagram 239

Editing Self-Registration Pages 240

Creating a Self-Registration Page 241

Configuring Basic Properties for Self-Registration 243

Editing Registration Page Properties 245

Editing the Default Self-Registration Form Settings 245

Creating a Single Password for Multiple Accounts 247

Editing Guest Receipt Page Properties 248

Editing Receipt Actions 248

Enabling and Editing NAS Login Properties 253

Editing Login Page Properties 254

Self-Service Portal Properties 257

Resetting Passwords with the Self-Service Portal 258

Managing Web Logins 260

Creating and Editing Web Login Pages 261

Receipts 270

Digital Passes 271

About Digital Passes 271

Viewing Digital Pass Certificates 274

Installing Digital Pass Certificates 275

Managing Digital Passes 276

Creating and Editing a Digital Pass Template 277

Example Template Code Variables 283

Images in Digital Passes 283

Email Receipts and SMTP Services 284

About Email Receipts 284

Configuring Email Receipts 285

Email Receipt Options 286

About Customizing SMTP Email Receipt Fields 288

Customizing SMS Receipt 290

SMS Receipt Fields 290

Customizing Print Templates 291

Creating New Print Templates 292

Print Template Wizard 293

Modifying Wizard-Generated Templates 294

Setting Print Template Permissions 294

SMS Services 296

Viewing SMS Gateways 296

Creating a New SMS Gateway 297

Editing an SMS Gateway 301

Sending an SMS 303

About SMS Credits 303

About SMS Guest Account Receipts 304

SMS Receipt Options 305

Working with the Mobile Carriers List 305

About Translations 307

Translation Packs 308

Creating and Editing Translation Packs 308

Translation Assistant 310

Customizing Translated User Interface Text 311

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 9

10 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Advertising Services 313

About Advertising Services 313

Materials 313

Promotions 313

Campaigns 314

Spaces 314

Pages 314

Advertising Services Process Overview 314

About the Tutorial 314

Navigating the Tutorial 315

Advertising Pages 315

Editing Advertising Pages 316

The nwa_adspace Smarty Template Tag 320

Advertising Spaces 323

Creating and Editing Advertising Spaces 324

"Other Location" Example 326

"Maximum Height" Example 327

"Maximum Width" Example 328

Advertising Campaigns 329

Creating and Editing Advertising Campaigns 329

Campaign Rank and Weight 332

Advertising Promotions 332

Creating and Editing Advertising Promotions 333

Using Labels in Advertising Services 336

Advertising Materials 337

Creating and Editing Advertising Materials 338

Hotspot Manager 341

Accessing Hotspot Manager 341

About Hotspot Management 342

Managing the Hotspot Sign-up Interface 342

Captive Portal Integration 343

Web Site Look-and-Feel 344

SMS Services 344

Managing Hotspot Plans 344

Editing or Creating a Hotspot Plan 345

Managing Transaction Processors 346

Creating a New Transaction Processor 347

Managing Existing Transaction Processors 348

Managing Customer Information 348

Managing Hotspot Invoices 348

Customizing the User Interface 349

Customizing Visitor Sign-Up Page One 349

Customizing Visitor Sign-Up Page Two 351

Customizing Visitor Sign-Up Page Three 354

Viewing the Hotspot User Interface 355

Administration 357

Accessing Administration 357

AirGroup Services 358

AirGroup Controllers 358

Creating and Editing AirGroup Controllers 359

Configuring AirGroup Services 361

AirGroup Diagnostics 362

Creating AirGroup Administrators 363

Creating AirGroup Operators 364

Authenticating AirGroup Users via LDAP 364

Configuring LDAP User Search for AirGroup 364

LDAP User Search Architecture 364

User Search Workflow 364

Configuration Summary 365

Basic LDAP Server Settings 365

User Search Settings 366

Configuring the AirGroup Shared User Field 367

Select2 Options Details 368

Select2 Hook Details 369

MACTrac Services 370

Creating MACTrac Operators 371

Managing MACTrac Devices 371

Registering MACTrac Devices 373

About MAC Addresses 374

Automatically Supplying the MACTrac Device Address 374

API Services 375

API Clients 375

Creating and Editing API Clients 376

Configuring the API Framework Plugin 378

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 11

12 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Setting API Privileges in Operator Profiles 379

About OAuth 380

OAuth Basics 380

OAuth2 Client or App 381

Client ID and Secret 381

Redirect URI 381

Authorization Grant Types for OAuth 381

Application Service Accounts for OAuth 383

SOAP Web Services and API 383

Viewing Available Web Services 384

Configuring Web Services 385

SOAPAPIIntroduction 385

Audience 386

API Documentation Overview 386

Disclaimer 386

About the SOAPAPI 386

Using the SOAPAPI 388

Integration Example 391

API Documentation 395

The XML-RPC Interface and API 408

About the XML-RPC API 408

Accessing the API 411

Invoking the API 413

Method Summary 414

API Documentation 414

Data Retention 431

3.9 Configuration Import 432

Creating a Customized Configuration Backup 432

Uploading the 3.9 Backup File 433

Restoring Configuration Items 434

Viewing Imported Item Details 435

Import Information for Specific Import Items 437

Import Information: Advertising Services 438

Import Information: AirGroup Services 438

Import Information: Cisco IP Phones 438

Import Information: Guest Manager 438

Import Information: High Availability (HA) 439

Import Information: Hotspot Manager 439

Import Information: Onboard 440

Import Information: Operator Logins 440

Import Information: Palo Alto Network Services 440

Import Information: RADIUSServices 440

Import Information: Reporting Manager Definitions 441

Import Information: Server Configuration 442

Import Information: SMSServices 443

Import Information: SMTP Services 443

Plugin Manager 444

Viewing Available Plugins 444

Configuring Plugins 445

Configuring the Kernel Plugin 446

Configuring the ArubaW-ClearPass Skin Plugin 447

Configuring the SMS Services Plugin 448

Configuring the IP Phone Services Plugin 449

Configuring the Translations Plugin 450

Support Services 450

Viewing the Application Log 451

Exporting the Application Log 452

Viewing Documentation 453

Contacting Support 453

Operator Logins 455

Accessing Operator Logins 455

About Operator Logins 455

Role-Based Access Control for Multiple Operator Profiles 456

Operator Logins Configuration 456

Custom Login Message 457

Advanced Operator Login Options 458

Automatic Logout 458

Operator Profiles 458

Creating an Operator Profile 458

Configuring the User Interface 461

Customizing Forms and Views 462

Operator Profile Privileges 462

Managing Operator Profiles 463

Configuring AirGroup Operator Device Limit 464

Local Operator Authentication 464

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 13

14 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Creating a New Operator 464

External Operator Authentication 465

Manage LDAP Operator Authentication Servers 465

Viewing the LDAP Server List 466

Creating an LDAP Server 467

Advanced LDAP URL Syntax 469

LDAP Operator Server Troubleshooting 469

Testing Connectivity 470

Testing Operator Login Authentication 470

Looking Up Sponsor Names 470

Troubleshooting Error Messages 471

LDAP Translation Rules 472

Custom LDAP Translation Processing 474

Reference 477

Basic HTML Syntax 477

Standard HTML Styles 478

Smarty Template Syntax 480

Basic Template Syntax 480

Text Substitution 480

Template File Inclusion 480

Comments 480

Variable Assignment 480

Conditional Text Blocks 481

Script Blocks 481

Repeated Text Blocks 481

Foreach Text Blocks 481

Modifiers 482

Predefined Template Functions 482

dump 483

nwa_commandlink 483

nwa_iconlink 484

nwa_icontext 484

nwa_quotejs 485

nwa_radius_query 485

Advanced Developer Reference 491

nwa_assign 492

nwa_bling 492

nwa_makeid 492

nwa_nav 493

nwa_plugin 494

nwa_privilege 494

nwa_replace 495

nwa_text 495

nwa_userpref 495

nwa_youtube 495

Date/Time Format Syntax 496

nwadateformat Modifier 496

nwatimeformat Modifier 497

Date/Time Format String Reference 497

Programmer’s Reference 498

NwaAlnumPassword 499

NwaBoolFormat 499

NwaByteFormat 499

NwaByteFormatBase10 499

NwaComplexPassword 500

NwaCsvCache 500

NwaDigitsPassword($len) 500

NwaDynamicLoad 500

NwaGeneratePictureString 500

NwaGenerateRandomPasswordMix 500

NwaLettersDigitsPassword 501

NwaLettersPassword 501

NwaMoneyFormat 501

NwaParseCsv 501

NwaParseXml 502

NwaPasswordByComplexity 502

NwaSmsIsValidPhoneNumber 503

NwaStrongPassword 503

NwaVLookup 503

NwaWordsPassword 504

Field, Form, and View Reference 504

GuestManager Standard Fields 504

Hotspot Standard Fields 512

SMS Services Standard Fields 513

SMTP Services Standard Fields 513

Dell Networking W-ClearPass Guest 6.4 | User Guide Contents | 15

16 | Contents Dell Networking W-ClearPass Guest 6.4 | User Guide

Format Picture String Symbols 515

Form Field Validation Functions 516

Form Field Conversion Functions 521

Form Field Display Formatting Functions 522

View Display Expression Technical Reference 523

LDAP Standard Attributes for User Class 525

Regular Expressions 526

Chromebook in Onboard 527

About Chromebook in Onboard 527

Caveats and Recommendations 528

Google Admin Chromebook License is Required 528

Managed Chromebook Deployment is Required 528

Chrome Extension is Required 528

Chromebook Release 37 or Later is Required 528

Chromebook Supports Only “Created by Device” Certificates 528

A Separate Provisioning SSID is Required 529

Directory-Based Authentication Source is Recommended 530

Onboard Configuration for Chromebook 530

Google Admin Configuration for Chromebook 531

Configuring the Chrome extension 531

Configuring Network Settings 533

Glossary 535

Index 545

Dell Networking W-ClearPass Guest 6.4 | User Guide About this Guide | 17

Chapter 1

About this Guide

Dell Networking W-ClearPass Guest provides a simple and personalized user interface through which

operational staff can quickly and securely manager visitor network access.

Audience

This User Guide is intended for system administrators and people who are installing and configuring Dell

Networking W-ClearPass Guest as their visitor management solution. It describes the installation and

configuration process.

Conventions

The following conventions are used throughout this guide to emphasize important concepts:

Type Style Description

Italics

This style is used to emphasize important terms and to mark the titles of books.

System items

This fixed-width font depicts the following:

l Sample screen output

l System prompts

l Filenames, software devices, and specific commands when mentioned in the text

Commands

In the command examples, this bold font depicts text that you must type exactly as

shown.

<

Arguments

> In the command examples, italicized text within angle brackets represents items that

you should replace with information appropriate to your specific situation. For example:

# send <text message>

In this example, you would type “send” at the system prompt exactly as shown, followed

by the text of the message you wish to send. Do not type the angle brackets.

[Optional]

Command examples enclosed in brackets are optional. Do not type the brackets.

{Item A |

Item B}

In the command examples, items within curled braces and separated by a vertical bar

represent the available choices. Enter only one choice. Do not type the braces or bars.

Table 1: Typographical Conventions

18 | About this Guide Dell Networking W-ClearPass Guest 6.4 | User Guide

The following informational icons are used throughout this guide:

Indicates helpful suggestions, pertinent information, and important things to remember.

Indicates a risk of damage to your hardware or loss of data.

Indicates a risk of personal injury or death.

Contacting Support

Web Site Support

Main Website dell.com

Support Website

dell.com/support

Documentation Website

dell.com/support/manuals

Dell Networking W-ClearPass Guest 6.4 | User Guide W-ClearPass Guest Overview | 19

Chapter 2

W-ClearPass Guest Overview

This chapter explains the terms, concepts, processes, and equipment involved in managing visitor access to a

network, and helps you understand how Dell Networking W-ClearPass Guest can be successfully integrated

into your network infrastructure. It is intended for network architects, IT administrators, and security

consultants who are planning to deploy visitor access, or who are in the early stages of deploying a visitor

access solution.

This chapter includes the following sections:

l "About Dell Networking W-ClearPass Guest" on page 19

l "Visitor Access Scenarios" on page 20

l "Reference Network Diagram" on page 21

l "Key Interactions" on page 22

l "AAA Framework" on page 23

l "Key Features" on page 24

l "Visitor Management Terminology" on page 25

l "W-ClearPass Guest Deployment Process" on page 26

l "AirGroup Deployment Process" on page 28

l "Documentation and User Assistance" on page 29

l "Use of Cookies" on page 30

About Dell Networking W-ClearPass Guest

Dell Networking W-ClearPass Guest provides a simple and personalized user interface through which

operational staff can quickly and securely manage visitor network access. It gives your non-technical staff

controlled access to a dedicated visitor management user database. Through a customizable Web portal, your

staff can easily create an account, reset a password, or set an expiry time for visitors. Access permissions to W-

ClearPass Guest functions are controlled through an operator profile that can be integrated with an LDAP

server or Active Directory login.

Visitors can be registered at reception and provisioned with an individual guest account that defines their

visitor profile and the duration of their visit. The visitor can be given a printed customized receipt with account

details, or the receipt can be delivered wirelessly using the integrated SMS services. Companies are also able to

pre-generate custom scratch cards, each with a defined network access time, which can then be handed out in

a corporate environment or sold in public access scenarios.

You can use the customization features to define settings that allow your visitors to self-provision their own

guest accounts. Visitors register through a branded and customized Web portal, ensuring a streamlined and

professional experience. Surveys can also be presented during the self-registration process and the data stored

for later analysis and reporting, providing additional insight to your visitors and their network usage.

W-ClearPass Guest integrates with all leading wireless and NAC solutions through a flexible definition point, W-

ClearPass Policy Manager. This ensures that IT administrators have a standard integration with the network

security framework, but gives operational staff the user interface they require.

20 | W-ClearPass Guest Overview Dell Networking W-ClearPass Guest 6.4 | User Guide

Visitor Access Scenarios

The following figure shows a high-level representation of a typical visitor access scenario.

Figure 1 Visitor access using W-ClearPass Guest

In this scenario, visitors are using their own mobile devices to access a corporate wireless network. Because

access to the network is restricted, visitors must first obtain a username and password. A guest account may

be provisioned by a corporate operator such as a receptionist, who can then give the visitor a print receipt that

shows their username and password for the network.

When visitors use self-registration, as might be the case for a network offering public access, the process is

broadly similar but does not require a corporate operator to create the guest account. The username and

password for a self-provisioned guest account may be delivered directly to the visitor’s Web browser, or sent

via SMS or email.

Page is loading ...

Dell W-ClearPass Hardware Appliances User guide

This manual is also suitable for

Dell W-ClearPass Hardware Appliances User guide

Related papers

Other documents