Dell W-ClearPass Virtual Appliances User guide

Dell Networking W-ClearPass

Guest 6.6.0

User Guide

2 | Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Copyright Information

are trademarks of Dell Inc.

Originated in the USA. All other trademarks are the property of their respective owners.

Open Source Code

This product includes code licensed under the GNU General Public License, the GNU Lesser General Public

License, and/or certain other open source licenses. You may request a copy of this source code free of charge

at HPE-Aruba-gplquery@hpe.com. Please specify the product and version for which you are requesting source

code.

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 3

Contents

About this Guide 17

Audience 17

Sponsored Guest Access 34

Self Provisioned Guest Access 35

Active Sessions Management 35

Session States 37

4 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

RFC 3576 Dynamic Authorization 37

Filtering the List of Active Sessions 38

Disconnecting Multiple Active Sessions 39

Sending Multiple SMS Alerts 39

About SMS Guest Account Receipts 40

Using Standard Guest Management Features 41

Creating a Guest Account 42

Changing a Guest Account Role 44

Creating a Guest Account Receipt 44

Creating a Device 45

Creating Devices Manually in W-ClearPass Guest 45

Creating Devices During Self-Registration - MAC Only 48

Creating Devices During Self-Registration - Paired Accounts 49

Creating Multiple Guest Accounts 50

Creating Multiple Guest Account Receipts 52

Creating a Single Password for Multiple Accounts 54

Exporting Guest Account Information 57

About CSV and TSV Exports 58

About XML Exports 58

Importing Guest Accounts 59

Managing Single Guest Accounts 63

Changing a Guest Account Role 68

Managing Devices 68

Changing a Device’s Expiration Date 69

Disabling and Deleting Devices 71

Activating a Device 71

Editing a Device 72

Viewing Current Sessions for a Device 74

Printing Device Details 74

Viewing Device Details 75

Managing Multiple Guest Accounts 75

Changing a Guest Account Role 77

AirGroup Device Registration 77

Registering Groups of Devices or Services 78

Registering Personal Devices 81

AirGroup Time-Based Sharing Syntax Examples 84

Time-Based Syntax Reference 87

About AirGroup Time-Based Sharing 88

Basics of Time-Based Sharing Setup 89

MAC Authentication in W-ClearPass Guest 90

MAC Address Formats 90

Automatically Registering MAC Devices in W-ClearPass 91

Importing MAC Devices 91

Advanced MAC Features 92

User Detection on Landing Pages 92

Click-Through Login Pages 92

Onboard 95

Accessing Onboard 95

About W-ClearPass Onboard 96

Onboard Deployment Checklist 97

Onboard Feature List 99

Supported Platforms 100

Public Key Infrastructure for Onboard 101

Certificate Hierarchy 101

Certificate Configuration in a Cluster 102

Revoking Unique Device Credentials 102

Revoking Credentials to Prevent Network Access 102

Re-Provisioning a Device 103

Network Requirements for Onboard 103

Using Same SSID for Provisioning and Provisioned Networks 104

Using Different SSID for Provisioning and Provisioned Networks 104

Configuring Online Certificate Status Protocol 104

Configuring Certificate Revocation List (CRL) 104

Providing MAC Addresses for Android 6 Devices 105

Network Architecture for Onboard 105

Network Architecture for Onboard when Using W-ClearPass Guest 106

The W-ClearPass Onboard Process 107

Devices Supporting Over-the-Air Provisioning 107

Devices Supporting Onboard Provisioning 109

Configuring the User Interface for Device Provisioning 112

Using the {nwa_mdps_config} Template Function 112

Onboard Troubleshooting 113

iOS Device Provisioning Failures 113

Hostname-to-Certificate Match Failures 114

Onboard Interface Not Displayed 114

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 5

6 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Certificate Renewal through OS X Mavericks 115

Certificate Authorities 115

Creating a New Certificate Authority 116

Editing Certificate Authority Settings 120

Requesting a Certificate for the Certificate Authority 125

Installing a Certificate Authority’s Certificate 125

The Trust Chain and Uploading Certificates for the CA 127

Considerations for iOS Devices 130

Using Microsoft Active Directory Certificate Services 130

Management and Control 133

Device Management (View by Device) 133

Device Management (View by Username) 137

Certificate Management (View by Certificate) 140

Searching for Certificates in the List 142

Working with Certificates in the List 142

Working with Certificate Signing Requests 145

Importing a Code-Signing Certificate 149

Importing a Trusted Certificate 150

Creating a Certificate 151

Requesting a Certificate 155

Onboard Usage 158

Onboard Configuration 159

Network Settings 159

Configuring Basic Network Access Settings 160

Configuring Enterprise Protocol Settings 163

Configuring Device Authentication Settings 166

Configuring Certificate Trust Settings 167

Configuring Windows-Specific Network Settings 170

Configuring Proxy Settings 171

iOS Settings 173

Configuring ActiveSync Settings 174

Configuring AirPlay Settings 177

Configuring AirPrint Settings 179

Configuring APN Settings 180

Configuring Calendar (CalDAV) Settings 181

Configuring Contacts (CardDAV) Settings 183

Configuring Device Restrictions Settings 185

Configuring Email Settings 193

Configuring an iOS Device Passcode Policy 196

Configuring Calendar Subscription Settings 199

Configuring an iOS Device VPN Connection 200

Configuring Web Clips 209

Windows Applications 210

Configuring App Sets 211

Deployment and Provisioning 212

Configuration Profiles 212

Creating and Editing Configuration Profiles 213

Provisioning Settings 216

About Configuring Provisioning Settings 217

Configuring General Provisioning Settings 218

Configuring Provisioning Settings for Supported Devices 223

Configuring Provisioning Settings for the Web Login Page 225

Configuring Provisioning Settings for Instructions and Messages 233

Configuring Provisioning Settings for iOS and OS X Profiles 253

Configuring Options for Onboard Client Devices 255

Configuring Provisioning Settings for Sponsorship Confirmation 258

About the Self-Service Portal 261

Configuration 263

Accessing Configuration 263

Configuring W-ClearPass Guest Authentication 265

Content Manager 265

Managing Content: Private Files and Public Files 266

Uploading Content 267

Downloading Content 268

Creating a New Content Directory 268

Configuring Guest Manager 269

Default Settings for Account Creation 269

About Fields, Forms, and Views 276

Business Logic for Account Creation 276

Verification Properties 276

Basic User Properties 277

Visitor Account Activation Properties 278

Visitor Account Expiration Properties 279

Other Properties 279

Standard Forms and Views 280

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 7

8 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Configuring Access Code Logins 281

Customize Random Username and Passwords 281

Create the Print Template 281

Customize the Guest Accounts Form 283

Create the Access Code Guest Accounts 283

Pages 286

Customizing Fields 286

Creating a Custom Field 287

Customizing AirGroup Registration Forms 293

Customizing Forms and Views 296

Editing Forms and Views 297

Editing Forms 299

Form Field Editor 300

Form Display Properties 301

Form Validation Properties 316

Examples of Form field Validation 318

Advanced Form Field Properties 321

Creating a Single Password for Multiple Accounts 322

Form Field Validation Processing Sequence 323

Editing Views 326

View Field Editor 328

Customizing Guest Self-Registration 331

Accessing the Guest Self-Registration Customization Forms 331

Self-Registration Sequence Diagram 335

Editing Self-Registration Pages 336

Creating a Self-Registration Page 337

Configuring Basic Properties for Self-Registration 339

Editing Registration Page Properties 342

Editing the Default Self-Registration Form Settings 344

Editing Guest Receipt Page Properties 346

Editing Receipt Actions 347

Editing Sponsor Confirmation 354

Editing Login Page Properties 362

Editing Social Logins Properties 369

Enabling and Editing NAS Login Properties 372

Self-Service Portal Properties 375

Resetting Passwords with the Self-Service Portal 382

Managing Web Logins 384

Creating and Editing Web Login Pages 385

About Multi-Factor Authentication 399

Managing Web Pages 401

The Web Page Templates 402

Creating and Editing Simple Web Pages 404

Receipts 406

Digital Passes 407

About Digital Passes 407

Viewing Digital Pass Certificates 411

Installing Digital Pass Certificates 412

Managing Digital Passes 413

Creating and Editing a Digital Pass Template 414

Example Template Code Variables 420

Images in Digital Passes 421

Email Receipts and SMTP Services 422

About Email Receipts 422

Configuring Email Receipts 425

Email Receipt Options 425

About Customizing SMTP Email Receipt Fields 427

Customizing SMS Receipt 429

SMS Receipt Fields 430

Customizing Print Templates 431

Creating New Print Templates 432

Print Template Wizard 435

Modifying Wizard-Generated Templates 438

Setting Print Template Permissions 438

SMS Services 440

Viewing SMS Gateways 441

Creating or Editing an SMS Gateway 441

Sending an SMS 447

About SMS Credits 447

About SMS Guest Account Receipts 448

About SMS Receipt Options 449

Working with the Mobile Carriers List 449

About Translations 452

Translation Packs 453

Creating and Editing Translation Packs 454

Translation Assistant 455

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 9

10 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Customizing Translated User Interface Text 456

Advertising Services 461

About Advertising Services 461

Materials 461

Promotions 461

Campaigns 462

Spaces 462

Pages 462

Advertising Services Process Overview 462

About the Tutorial 462

Navigating the Tutorial 463

Advertising Pages 464

Editing Advertising Pages 465

The nwa_adspace Smarty Template Tag 469

Advertising Spaces 472

Creating and Editing Advertising Spaces 474

"Other Location" Example 476

"Maximum Height" Example 478

"Maximum Width" Example 479

Advertising Campaigns 480

Creating and Editing Advertising Campaigns 481

Campaign Rank and Weight 484

Advertising Promotions 484

Creating and Editing Advertising Promotions 485

Using Labels in Advertising Services 489

Advertising Materials 490

Creating and Editing Advertising Materials 491

Hotspot Manager 495

Accessing Hotspot Manager 495

About Hotspot Management 496

Managing the Hotspot Sign-up Interface 496

Captive Portal Integration 499

Managing Hotspot Plans 499

Editing or Creating a Hotspot Plan 500

Managing Transaction Processors 504

Creating a New Transaction Processor 505

Managing Customer Information 509

Managing Hotspot Invoices 509

Customizing the User Interface 511

Customizing Visitor Sign-Up Page One 511

Customizing Visitor Sign-Up Page Two 514

Customizing Visitor Sign-Up Page Three 518

Viewing the Hotspot User Interface 519

Administration 521

Accessing Administration 521

AirGroup Services 522

AirGroup Controllers 523

Creating and Editing AirGroup Controllers 524

Configuring AirGroup Services 526

AirGroup Diagnostics 528

Creating AirGroup Administrators 529

Creating AirGroup Operators 530

Authenticating AirGroup Users via LDAP 530

Configuring LDAP User Search for AirGroup 530

LDAP User Search Architecture for AirGroup 530

User Search Workflow for AirGroup 531

Configuration Summary for AirGroup 531

Basic LDAP Server Settings for AirGroup 531

User Search Settings for AirGroup 533

Configuring the AirGroup Shared User Field 534

Select2 Options Details 536

Select2 Hook Details 537

MACTrac Services 538

Creating MACTrac Operators 539

Managing MACTrac Devices 540

Registering MACTrac Devices 543

About MAC Addresses 544

Automatically Supplying the MACTrac Device Address 544

API Services 545

API Clients 545

Creating and Editing API Clients 547

API Explorer 549

Setting API Privileges in Operator Profiles 549

About OAuth 551

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 11

12 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

OAuth Basics 551

OAuth2 Client or App for OAuth 552

Client ID and Secret for OAuth 552

Redirect URI 552

Authorization Grant Types for OAuth 552

Application Service Accounts for OAuth 554

SOAP Web Services and API 554

Viewing Available Web Services 555

SOAPAPIIntroduction 557

Audience 557

API Documentation Overview 557

Disclaimer 557

About the SOAPAPI 557

Using the SOAPAPI 559

Integration Example 562

API Documentation 567

The XML-RPC Interface and API 582

About the XML-RPC API 582

Accessing the API 585

Invoking the API 588

Method Summary 589

API Documentation 589

Data Retention 607

3.9 Configuration Import 607

Creating a Customized Configuration Backup 608

Uploading the 3.9 Backup File 608

Restoring Configuration Items 610

Viewing Imported Item Details 611

Import Information for Specific Import Items 613

Import Information: AirGroup Services 614

Import Information: Cisco IP Phones 614

Import Information: Guest Manager 614

Import Information: High Availability (HA) 615

Import Information: Hotspot Manager 615

Import Information: Onboard 616

Import Information: Operator Logins 616

Import Information: Palo Alto Network Services 616

Import Information: RADIUSServices 616

Import Information: Reporting Manager Definitions 617

Import Information: Server Configuration 618

Import Information: SMSServices 619

Import Information: SMTP Services 619

Plugin Manager 620

Viewing Available Plugins 620

Configuring Plugins 621

Configuring AirGroup Services 623

Configuring the API Framework Plugin 624

Configuring the DELL W-ClearPass Skin Plugin 626

Configuring the Guest Manager Plugin 628

Configuring the IP Phone Services Plugin 635

Configuring the Kernel Plugin 636

Configuring the MAC Authentication Plugin 637

Configuring the Platform Services Plugin 638

Configuring the SMS Services Plugin 639

Configuring the SMTP Services Plugin 642

Configuring the Translations Plugin 644

Configuring the Web Analytics Plugin 645

Configuring the SOAP Web Services Plugin 646

Support Services 647

Viewing the Application Log 648

Exporting the Application Log 650

Contacting Support 651

Viewing Documentation 651

Operator Logins 653

Accessing Operator Logins 653

About Operator Logins 653

Role-Based Access Control for Multiple Operator Profiles 654

Operator Logins Configuration 654

Operator Login UI Area 654

Advanced Options Area 656

Operator Profiles 657

Creating an Operator Profile 659

Operators Supported in Filters 662

Configuring the User Interface 662

Operator Profile Privileges 665

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 13

14 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Configuring AirGroup Operator Device Limit 665

Local Operator Authentication 666

Creating a New Operator 666

External Operator Authentication 667

Managing LDAP Operator Authentication Servers 667

Viewing the LDAP Server List 667

Creating an LDAP Server 670

Advanced LDAP URL Syntax 673

LDAP Operator Server Troubleshooting 674

Testing Connectivity 674

Testing Operator Login Authentication 674

Looking Up Sponsor Names 675

Troubleshooting Error Messages 675

LDAP Translation Rules 677

Configuring LDAP Translation Rules 678

Custom LDAP Translation Processing 680

Reference 683

Basic HTML Syntax 683

Standard HTML Styles 684

Smarty Template Syntax 686

Basic Template Syntax 686

Text Substitution 686

Template File Inclusion 686

Comments 686

Variable Assignment 686

Conditional Text Blocks 687

Script Blocks 687

Repeated Text Blocks 687

Foreach Text Blocks 687

Modifiers 688

Predefined Template Functions 689

dump 689

nwa_commandlink 689

nwa_iconlink 690

nwa_icontext 690

nwa_quotejs 691

nwa_radius_query 691

Advanced Developer Reference 698

nwa_assign 698

nwa_bling 698

nwa_makeid 698

nwa_nav 699

nwa_plugin 700

nwa_privilege 701

nwa_replace 701

nwa_text 701

nwa_userpref 701

nwa_youtube 702

Date/Time Format Syntax 702

nwadateformat Modifier 702

nwatimeformat Modifier 703

Date/Time Format String Reference 704

Programmer’s Reference 705

NwaAlnumPassword 705

NwaBoolFormat 705

NwaByteFormat 706

NwaByteFormatBase10 706

NwaComplexPassword 706

NwaCsvCache 706

NwaDigitsPassword($len) 706

NwaDynamicLoad 706

NwaGeneratePictureString 707

NwaGenerateRandomPasswordMix 707

NwaLettersDigitsPassword 707

NwaLettersPassword 707

NwaMoneyFormat 707

NwaParseCsv 708

NwaParseXml 708

NwaPasswordByComplexity 709

NwaSmsIsValidPhoneNumber 709

NwaStrongPassword 709

NwaVLookup 709

NwaWordsPassword 710

Field, Form, and View Reference 710

GuestManager Standard Fields 711

Dell Networking W-ClearPass Guest 6.6.0 | User Guide Contents | 15

16 | Contents Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Hotspot Standard Fields 719

SMS Services Standard Fields 720

SMTP Services Standard Fields 720

Format Picture String Symbols 722

Form Field Validation Functions 723

Form Field Conversion Functions 728

Form Field Display Formatting Functions 729

View Display Expression Technical Reference 730

LDAP Standard Attributes for User Class 732

Regular Expressions 732

Chromebook in Onboard 735

About Chromebook in Onboard 735

Caveats and Recommendations 736

Google Admin Chromebook License is Required 736

Managed Chromebook Deployment is Required 736

Chrome Extension is Required 736

Chromebook Release 37 or Later is Required 736

Chromebook Supports Only “Created by Device” Certificates 737

A Separate Provisioning SSID is Required 737

Directory-Based Authentication Source is Recommended 738

Onboard Configuration for Chromebook 738

Enable Chromebook Provisioning 738

Configure Instructions and Messages 739

Google Admin Configuration for Chromebook 739

Configuring the Chrome extension 739

Configuring Network Settings 741

Glossary 745

Index 761

Dell Networking W-ClearPass Guest 6.6.0 | User Guide About this Guide | 17

Chapter 1

About this Guide

Dell Networking W-ClearPass Guest 6.6 provides a simple and personalized user interface through which

operational staff can quickly and securely manager visitor network access.

Audience

This User Guide is intended for system administrators and people who are installing and configuring Dell

Networking W-ClearPass Guest 6.6 as their visitor management solution. It describes the installation and

configuration process.

Related Documents

The following documents are part of the complete documentation set for the W-ClearPass platform:

l W-ClearPass Guest 6.6 User Guide

l W-ClearPass Policy Manager 6.6 User Guide

l W-ClearPass Deployment Guide

l W-ClearPass 6.6.x Release Notes

l W-ClearPass Insight 6.6 User Guide

l W-ClearPass Policy Manager 6.6 Getting Started Guide

l W-ClearPass Policy Manager Configuration API Guide

l W-ClearPass Policy Model: An Introduction

l Tech Note: Installing or Upgrading W-ClearPass 6.6 on a Virtual Machine

l Tech Note: Upgrading to W-ClearPass 6.6

l Tech Note: Cluster Upgrade Tool, W-ClearPass 6.6

Conventions

The following conventions are used throughout this guide to emphasize important concepts:

Type Style Description

Italics

This style is used to emphasize important terms and to mark the titles of books.

System items

This fixed-width font depicts the following:

l Sample screen output

l System prompts

l Filenames, software devices, and specific commands when mentioned in the text

Commands

In the command examples, this bold font depicts text that you must type exactly as

Table 1: Typographical Conventions

18 | About this Guide Dell Networking W-ClearPass Guest 6.6.0 | User Guide

Type Style Description

shown.

<Arguments> In the command examples, italicized text within angle brackets represents items that

you should replace with information appropriate to your specific situation. For example:

# send <text message>

In this example, you would type “send” at the system prompt exactly as shown, followed

by the text of the message you wish to send. Do not type the angle brackets.

[Optional]

Command examples enclosed in brackets are optional. Do not type the brackets.

{Item A |

Item B}

In the command examples, items within curled braces and separated by a vertical bar

represent the available choices. Enter only one choice. Do not type the braces or bars.

The following informational icons are used throughout this guide:

Indicates helpful suggestions, pertinent information, and important things to remember.

Indicates a risk of damage to your hardware or loss of data.

Indicates a risk of personal injury or death.

Contacting Dell

Web Site Support

Main Website dell.com

Contact Information dell.com/contactdell

Support Website dell.com/support

Documentation Website dell.com/support/manuals

Table 2: Dell Support

Dell Networking W-ClearPass Guest 6.6.0 | User Guide W-ClearPass Guest Overview | 19

Chapter 2

W-ClearPass Guest Overview

This chapter explains the terms, concepts, processes, and equipment involved in managing visitor access to a

network, and helps you understand how Dell Networking W-ClearPass Guest 6.6 can be successfully integrated

into your network infrastructure. It is intended for network architects, IT administrators, and security

consultants who are planning to deploy visitor access, or who are in the early stages of deploying a visitor

access solution.

This chapter includes the following sections:

l "About Dell Networking W-ClearPass Guest" on page 19

l "Visitor Access Scenarios" on page 20

l "Reference Network Diagram" on page 21

l "Key Interactions" on page 22

l "AAA Framework" on page 23

l "Key Features" on page 24

l "Visitor Management Terminology" on page 25

l "W-ClearPass Guest Deployment Process" on page 26

l "AirGroup Deployment Process" on page 28

l "Documentation and User Assistance" on page 29

l "Use of Cookies" on page 30

About Dell Networking W-ClearPass Guest

Dell Networking W-ClearPass Guest 6.6 provides a simple and personalized user interface through which

operational staff can quickly and securely manage visitor network access. It gives your non-technical staff

controlled access to a dedicated visitor management user database. Through a customizable Web portal, your

staff can easily create an account, reset a password, or set an expiry time for visitors. Access permissions to

W-ClearPass Guest functions are controlled through an operator profile that can be integrated with an LDAP

server or Active Directory login.

Visitors can be registered at reception and provisioned with an individual guest account that defines their

visitor profile and the duration of their visit. The visitor can be given a printed customized receipt with account

details, or the receipt can be delivered wirelessly using the integrated SMS services. Companies are also able to

pre-generate custom scratch cards, each with a defined network access time, which can then be handed out in

a corporate environment or sold in public access scenarios.

You can use the customization features to define settings that allow your visitors to self-provision their own

guest accounts. Visitors register through a branded and customized Web portal, ensuring a streamlined and

professional experience. Surveys can also be presented during the self-registration process and the data stored

for later analysis and reporting, providing additional insight to your visitors and their network usage.

20 | W-ClearPass Guest Overview Dell Networking W-ClearPass Guest 6.6.0 | User Guide

W-ClearPass Guest integrates with all leading wireless and NAC solutions through a flexible definition point,

W-ClearPass Policy Manager. This ensures that IT administrators have a standard integration with the network

security framework, but gives operational staff the user interface they require.

Visitor Access Scenarios

The following figure shows a high-level representation of a typical visitor access scenario.

Figure 1 Visitor Access Using W-ClearPass Guest

In this scenario, visitors are using their own mobile devices to access a corporate wireless network. Because

access to the network is restricted, visitors must first obtain a username and password. A guest account may

be provisioned by a corporate operator such as a receptionist, who can then give the visitor a print receipt that

shows their username and password for the network.

When visitors use self-registration, as might be the case for a network offering public access, the process is

broadly similar but does not require a corporate operator to create the guest account. The username and

password for a self-provisioned guest account may be delivered directly to the visitor’s Web browser, or sent

via SMS or email.

Page is loading ...

Dell W-ClearPass Virtual Appliances, W-ClearPass Hardware Appliances User guide

Related papers

Other documents