Dell W-ClearPass Virtual Appliances User guide

Dell Networking W-ClearPass

Guest 6.6

User Guide

2 | Dell Networking W-ClearPass Guest 6.6 | User Guide

Copyright Information

are trademarks of Dell Inc.

Originated in the USA. All other trademarks are the property of their respective owners.

Open Source Code

This product includes code licensed under the GNU General Public License, the GNU Lesser General Public

License, and/or certain other open source licenses. You may request a copy of this source code free of charge

at HPE-Aruba-gplquery@hpe.com. Please specify the product and version for which you are requesting source

code.

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 3

Contents

About this Guide 17

Audience 17

Sponsored Guest Access 34

Self Provisioned Guest Access 35

Active Sessions Management 35

Session States 37

4 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

RFC 3576 Dynamic Authorization 37

Filtering the List of Active Sessions 38

Disconnecting Multiple Active Sessions 39

Sending Multiple SMS Alerts 39

About SMS Guest Account Receipts 40

Using Standard Guest Management Features 41

Creating a Guest Account 42

Changing a Guest Account Role 44

Creating a Guest Account Receipt 44

Creating a Device 45

Creating Devices Manually in W-ClearPass Guest 45

Creating Devices During Self-Registration - MAC Only 48

Creating Devices During Self-Registration - Paired Accounts 49

Creating Multiple Guest Accounts 50

Creating Multiple Guest Account Receipts 52

Creating a Single Password for Multiple Accounts 54

Exporting Guest Account Information 58

About CSV and TSV Exports 59

About XML Exports 59

Importing Guest Accounts 60

Managing Single Guest Accounts 64

Changing a Guest Account Role 69

Managing Devices 69

Changing a Device’s Expiration Date 70

Disabling and Deleting Devices 72

Activating a Device 72

Editing a Device 73

Viewing Current Sessions for a Device 75

Printing Device Details 75

Viewing Device Details 76

Managing Multiple Guest Accounts 76

Changing a Guest Account Role 78

AirGroup Device Registration 78

Registering Groups of Devices or Services 79

Registering Personal Devices 82

AirGroup Time-Based Sharing Syntax Examples 85

Time-Based Syntax Reference 88

About AirGroup Time-Based Sharing 89

Basics of Time-Based Sharing Setup 90

MAC Authentication in W-ClearPass Guest 91

MAC Address Formats 91

Automatically Registering MAC Devices in W-ClearPass 92

Importing MAC Devices 93

Advanced MAC Features 93

User Detection on Landing Pages 93

Click-Through Login Pages 94

Onboard 95

Accessing Onboard 95

About W-ClearPass Onboard 96

Onboard Deployment Checklist 97

Onboard Feature List 99

Supported Platforms 100

Public Key Infrastructure for Onboard 101

Certificate Hierarchy 101

Certificate Configuration in a Cluster 102

Revoking Unique Device Credentials 102

Revoking Credentials to Prevent Network Access 102

Re-Provisioning a Device 103

Network Requirements for Onboard 103

Using Same SSID for Provisioning and Provisioned Networks 104

Using Different SSID for Provisioning and Provisioned Networks 104

Configuring Online Certificate Status Protocol 104

Configuring Certificate Revocation List (CRL) 104

Providing MAC Addresses for Android 6 Devices 105

Network Architecture for Onboard 105

Network Architecture for Onboard when Using W-ClearPass Guest 106

The W-ClearPass Onboard Process 107

Devices Supporting Over-the-Air Provisioning 107

Devices Supporting Onboard Provisioning 109

Configuring the User Interface for Device Provisioning 112

Using the {nwa_mdps_config} Template Function 112

Onboard Troubleshooting 113

iOS Device Provisioning Failures 113

Hostname-to-Certificate Match Failures 114

Onboard Interface Not Displayed 115

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 5

6 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Certificate Renewal through OS X Mavericks 115

Certificate Authorities 115

Creating a New Certificate Authority 117

Editing Certificate Authority Settings 122

Requesting a Certificate for the Certificate Authority 128

Installing a Certificate Authority’s Certificate 128

The Trust Chain and Uploading Certificates for the CA 130

Considerations for iOS Devices 133

Using Microsoft Active Directory Certificate Services 133

Management and Control 136

Device Management (View by Device) 136

Device Management (View by Username) 141

Certificate Management (View by Certificate) 144

Searching for Certificates in the List 146

Working with Certificates in the List 146

Working with Certificate Signing Requests 149

Importing a Code-Signing Certificate 153

Importing a Trusted Certificate 154

Creating a Certificate 155

Requesting a Certificate 159

Onboard Usage 162

Onboard Configuration 163

Network Settings 163

Configuring Basic Network Access Settings 164

Configuring Enterprise Protocol Settings 167

Configuring Device Authentication Settings 170

Configuring Certificate Trust Settings 171

Configuring Windows-Specific Network Settings 174

Configuring Proxy Settings 175

iOS Settings 177

Configuring ActiveSync Settings 178

Configuring AirPlay Settings 181

Configuring AirPrint Settings 183

Configuring APN Settings 184

Configuring Calendar (CalDAV) Settings 185

Configuring Contacts (CardDAV) Settings 187

Configuring Device Restrictions Settings 189

Configuring Email Settings 197

Configuring an iOS Device Passcode Policy 200

Configuring Calendar Subscription Settings 203

Configuring an iOS Device VPN Connection 204

Configuring Web Clips 213

Windows Applications 214

Configuring App Sets 215

Deployment and Provisioning 216

Configuration Profiles 216

Creating and Editing Configuration Profiles 217

Provisioning Settings 220

About Configuring Provisioning Settings 221

Configuring General Provisioning Settings 222

Configuring Provisioning Settings for Supported Devices 227

Configuring Provisioning Settings for the Web Login Page 229

Configuring Provisioning Settings for Instructions and Messages 238

Configuring Provisioning Settings for iOS and OS X Profiles 258

Configuring Options for Onboard Client Devices 260

Configuring Provisioning Settings for Sponsorship Confirmation 263

About the Self-Service Portal 266

Configuration 269

Accessing Configuration 269

Configuring W-ClearPass Guest Authentication 271

Content Manager 271

Managing Content: Private Files and Public Files 272

Uploading Content 273

Downloading Content 274

Creating a New Content Directory 274

Configuring Guest Manager 275

Default Settings for Account Creation 275

About Fields, Forms, and Views 282

Business Logic for Account Creation 282

Verification Properties 283

Basic User Properties 283

Visitor Account Activation Properties 284

Visitor Account Expiration Properties 285

Other Properties 285

Standard Forms and Views 286

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 7

8 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Configuring Access Code Logins 287

Customize Random Username and Passwords 287

Create the Print Template 287

Customize the Guest Accounts Form 289

Create the Access Code Guest Accounts 289

Pages 292

Customizing Fields 292

Creating a Custom Field 293

Customizing AirGroup Registration Forms 300

Customizing Forms and Views 303

Editing Forms and Views 304

Editing Forms 306

Form Field Editor 307

Form Display Properties 308

Form Validation Properties 323

Examples of Form field Validation 325

Advanced Form Field Properties 328

Creating a Single Password for Multiple Accounts 329

Form Field Validation Processing Sequence 330

Editing Views 335

View Field Editor 337

Customizing Guest Self-Registration 339

Accessing the Guest Self-Registration Customization Forms 340

Self-Registration Sequence Diagram 344

Editing Self-Registration Pages 345

Creating a Self-Registration Page 346

Configuring Basic Properties for Self-Registration 348

Editing Registration Page Properties 351

Editing the Default Self-Registration Form Settings 353

Editing Guest Receipt Page Properties 355

Editing Receipt Actions 356

Editing Sponsor Confirmation 363

Editing Login Page Properties 371

Editing Social Logins Properties 378

Enabling and Editing NAS Login Properties 382

Self-Service Portal Properties 384

Resetting Passwords with the Self-Service Portal 392

Managing Web Logins 394

Creating and Editing Web Login Pages 395

About Multi-Factor Authentication 410

Managing Web Pages 412

The Web Page Templates 413

Creating and Editing Simple Web Pages 415

Receipts 417

Digital Passes 418

About Digital Passes 418

Viewing Digital Pass Certificates 422

Installing Digital Pass Certificates 423

Managing Digital Passes 424

Creating and Editing a Digital Pass Template 425

Example Template Code Variables 431

Images in Digital Passes 432

Email Receipts and SMTP Services 433

About Email Receipts 433

Configuring Email Receipts 436

Email Receipt Options 436

About Customizing SMTP Email Receipt Fields 439

Customizing SMS Receipt 440

SMS Receipt Fields 441

Customizing Print Templates 442

Creating New Print Templates 443

Print Template Wizard 446

Modifying Wizard-Generated Templates 449

Setting Print Template Permissions 449

SMS Services 451

Viewing SMS Gateways 452

Creating or Editing an SMS Gateway 452

Sending an SMS 458

About SMS Credits 458

About SMS Guest Account Receipts 459

About SMS Receipt Options 460

Working with the Mobile Carriers List 460

About Translations 463

Translation Packs 464

Creating and Editing Translation Packs 465

Translation Assistant 466

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 9

10 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Customizing Translated User Interface Text 467

Advertising Services 471

About Advertising Services 471

Materials 471

Promotions 471

Campaigns 472

Spaces 472

Pages 472

Advertising Services Process Overview 472

About the Tutorial 472

Navigating the Tutorial 473

Advertising Pages 474

Editing Advertising Pages 475

The nwa_adspace Smarty Template Tag 479

Advertising Spaces 482

Creating and Editing Advertising Spaces 484

"Other Location" Example 486

"Maximum Height" Example 488

"Maximum Width" Example 489

Advertising Campaigns 490

Creating and Editing Advertising Campaigns 491

Campaign Rank and Weight 494

Advertising Promotions 494

Creating and Editing Advertising Promotions 495

Using Labels in Advertising Services 499

Advertising Materials 500

Creating and Editing Advertising Materials 501

Hotspot Manager 505

Accessing Hotspot Manager 505

About Hotspot Management 506

Managing the Hotspot Sign-up Interface 506

Captive Portal Integration 509

Managing Hotspot Plans 509

Editing or Creating a Hotspot Plan 510

Managing Transaction Processors 514

Occupied Room List 516

Re-Synchronizing Rooms 517

Creating a New Transaction Processor 518

Managing Customer Information 522

Managing Hotspot Invoices 522

Customizing the User Interface 524

Customizing Visitor Sign-Up Page One 524

Customizing Visitor Sign-Up Page Two 527

Customizing Visitor Sign-Up Page Three 531

Viewing the Hotspot User Interface 532

Administration 535

Accessing Administration 535

AirGroup Services 536

AirGroup Controllers 537

Creating and Editing AirGroup Controllers 538

Configuring AirGroup Services 540

AirGroup Diagnostics 542

Creating AirGroup Administrators 543

Creating AirGroup Operators 544

Authenticating AirGroup Users via LDAP 544

Configuring LDAP User Search for AirGroup 544

LDAP User Search Architecture for AirGroup 544

User Search Workflow for AirGroup 545

Configuration Summary for AirGroup 545

Basic LDAP Server Settings for AirGroup 545

User Search Settings for AirGroup 547

Configuring the AirGroup Shared User Field 548

Select2 Options Details 550

Select2 Hook Details 551

MACTrac Services 552

Creating MACTrac Operators 553

Managing MACTrac Devices 554

Registering MACTrac Devices 557

About MAC Addresses 558

Automatically Supplying the MACTrac Device Address 558

API Services 559

API Clients 559

Creating and Editing API Clients 561

API Explorer 563

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 11

12 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Setting API Privileges in Operator Profiles 564

About OAuth 565

OAuth Basics 565

OAuth2 Client or App for OAuth 566

Client ID and Secret for OAuth 566

Redirect URI 566

Authorization Grant Types for OAuth 567

Application Service Accounts for OAuth 568

SOAP Web Services and API 569

Viewing Available Web Services 569

SOAPAPIIntroduction 571

Audience 571

API Documentation Overview 571

Disclaimer 571

About the SOAPAPI 571

Using the SOAPAPI 574

Integration Example 576

API Documentation 581

The XML-RPC Interface and API 596

About the XML-RPC API 596

Accessing the API 599

Invoking the API 602

Method Summary 603

API Documentation 603

Data Retention 621

3.9 Configuration Import 621

Creating a Customized Configuration Backup 622

Uploading the 3.9 Backup File 622

Restoring Configuration Items 625

Viewing Imported Item Details 626

Import Information for Specific Import Items 629

Import Information: AirGroup Services 629

Import Information: Cisco IP Phones 629

Import Information: Guest Manager 629

Import Information: High Availability (HA) 630

Import Information: Hotspot Manager 631

Import Information: Onboard 631

Import Information: Operator Logins 631

Import Information: Palo Alto Network Services 631

Import Information: RADIUSServices 631

Import Information: Reporting Manager Definitions 633

Import Information: Server Configuration 633

Import Information: SMSServices 634

Import Information: SMTP Services 634

Plugin Manager 635

Viewing Available Plugins 635

Configuring Plugins 636

Configuring AirGroup Services 638

Configuring the API Framework Plugin 639

Configuring the DELL W-ClearPass Skin Plugin 641

Configuring the Guest Manager Plugin 643

Configuring the IP Phone Services Plugin 650

Configuring the Kernel Plugin 651

Configuring the MAC Authentication Plugin 653

Configuring the Platform Services Plugin 654

Configuring the SMS Services Plugin 654

Configuring the SMTP Services Plugin 657

Configuring the Translations Plugin 659

Configuring the Web Analytics Plugin 660

Configuring the SOAP Web Services Plugin 661

Support 662

Viewing the Application Log 663

Exporting the Application Log 665

Contacting Support 666

Viewing Documentation 666

Operator Logins 667

Accessing Operator Logins 667

About Operator Logins 667

Role-Based Access Control for Multiple Operator Profiles 668

Operator Logins Configuration 668

Operator Login UI Area 668

Advanced Options Area 670

Operator Profiles 671

Creating an Operator Profile 673

Operators Supported in Filters 676

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 13

14 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Configuring the User Interface 676

Operator Profile Privileges 679

Configuring AirGroup Operator Device Limit 679

Local Operator Authentication 680

Creating a New Operator 680

External Operator Authentication 681

Managing LDAP Operator Authentication Servers 681

Viewing the LDAP Server List 681

Creating an LDAP Server 684

Advanced LDAP URL Syntax 687

LDAP Operator Server Troubleshooting 688

Testing Connectivity 688

Testing Operator Login Authentication 688

Looking Up Sponsor Names 689

Troubleshooting Error Messages 689

LDAP Translation Rules 691

Configuring LDAP Translation Rules 692

Custom LDAP Translation Processing 694

Reference 697

Basic HTML Syntax 697

Standard HTML Styles 698

Smarty Template Syntax 700

Basic Template Syntax 700

Text Substitution 700

Template File Inclusion 700

Comments 700

Variable Assignment 700

Conditional Text Blocks 701

Script Blocks 701

Repeated Text Blocks 701

Foreach Text Blocks 701

Modifiers 702

Predefined Template Functions 703

dump 703

nwa_commandlink 703

nwa_iconlink 704

nwa_icontext 704

nwa_quotejs 705

nwa_radius_query 705

Advanced Developer Reference 712

nwa_assign 712

nwa_bling 712

nwa_makeid 712

nwa_nav 713

nwa_plugin 714

nwa_privilege 715

nwa_replace 715

nwa_text 715

nwa_userpref 715

nwa_youtube 716

Date/Time Format Syntax 716

nwadateformat Modifier 716

nwatimeformat Modifier 717

Date/Time Format String Reference 718

Programmer’s Reference 719

NwaAlnumPassword 719

NwaBoolFormat 719

NwaByteFormat 720

NwaByteFormatBase10 720

NwaComplexPassword 720

NwaCsvCache 720

NwaDigitsPassword($len) 720

NwaDynamicLoad 720

NwaGeneratePictureString 721

NwaGenerateRandomPasswordMix 721

NwaLettersDigitsPassword 721

NwaLettersPassword 721

NwaMoneyFormat 721

NwaParseCsv 722

NwaParseXml 722

NwaPasswordByComplexity 723

NwaSmsIsValidPhoneNumber 723

NwaStrongPassword 723

NwaVLookup 723

NwaWordsPassword 724

Dell Networking W-ClearPass Guest 6.6 | User Guide Contents | 15

16 | Contents Dell Networking W-ClearPass Guest 6.6 | User Guide

Field, Form, and View Reference 724

GuestManager Standard Fields 725

Hotspot Standard Fields 733

SMS Services Standard Fields 734

SMTP Services Standard Fields 734

Format Picture String Symbols 736

Form Field Validation Functions 737

Form Field Conversion Functions 744

Form Field Display Formatting Functions 745

View Display Expression Technical Reference 747

LDAP Standard Attributes for User Class 748

Regular Expressions 749

Chromebook in Onboard 751

About Chromebook in Onboard 751

Caveats and Recommendations 752

Google Admin Chromebook License is Required 752

Managed Chromebook Deployment is Required 752

Chrome Extension is Required 752

Chromebook Release 37 or Later is Required 752

Chromebook Supports Only “Created by Device” Certificates 753

A Separate Provisioning SSID is Required 753

Directory-Based Authentication Source is Recommended 754

Onboard Configuration for Chromebook 754

Enable Chromebook Provisioning 754

Configure Instructions and Messages 755

Google Admin Configuration for Chromebook 755

Configuring the Chrome extension 755

Configuring Network Settings 758

Glossary 761

Index 777

Dell Networking W-ClearPass Guest 6.6 | User Guide About this Guide | 17

Chapter 1

About this Guide

Dell Networking W-ClearPass Guest 6.6 provides a simple and personalized user interface through which

operational staff can quickly and securely manager visitor network access.

Audience

This User Guide is intended for system administrators and people who are installing and configuring Dell

Networking W-ClearPass Guest 6.6 as their visitor management solution. It describes the installation and

configuration process.

Related Documents

The following documents are part of the complete documentation set for the W-ClearPass platform:

l W-ClearPass Guest 6.6 User Guide

l W-ClearPass Policy Manager 6.6 User Guide

l W-ClearPass Deployment Guide

l W-ClearPass 6.6.x Release Notes

l W-ClearPass Insight 6.6 User Guide

l W-ClearPass Policy Manager 6.6 Getting Started Guide

l W-ClearPass Policy Manager Configuration API Guide

l W-ClearPass Policy Model: An Introduction

l Tech Note: Installing or Upgrading W-ClearPass 6.6 on a Virtual Machine

l Tech Note: Upgrading to W-ClearPass 6.6

Conventions

The following conventions are used throughout this guide to emphasize important concepts:

Type Style Description

Italics

This style is used to emphasize important terms and to mark the titles of books.

System items

This fixed-width font depicts the following:

l Sample screen output

l System prompts

l Filenames, software devices, and specific commands when mentioned in the text

Commands

In the command examples, this bold font depicts text that you must type exactly as

shown.

Table 1: Typographical Conventions

18 | About this Guide Dell Networking W-ClearPass Guest 6.6 | User Guide

Type Style Description

<Arguments> In the command examples, italicized text within angle brackets represents items that

you should replace with information appropriate to your specific situation. For example:

# send <text message>

In this example, you would type “send” at the system prompt exactly as shown, followed

by the text of the message you wish to send. Do not type the angle brackets.

[Optional]

Command examples enclosed in brackets are optional. Do not type the brackets.

{Item A |

Item B}

In the command examples, items within curled braces and separated by a vertical bar

represent the available choices. Enter only one choice. Do not type the braces or bars.

The following informational icons are used throughout this guide:

Indicates helpful suggestions, pertinent information, and important things to remember.

Indicates a risk of damage to your hardware or loss of data.

Indicates a risk of personal injury or death.

Contacting Dell

Web Site Support

Main Website dell.com

Contact Information dell.com/contactdell

Support Website dell.com/support

Documentation Website dell.com/support/manuals

Table 2: Dell Support

Dell Networking W-ClearPass Guest 6.6 | User Guide W-ClearPass Guest Overview | 19

Chapter 2

W-ClearPass Guest Overview

This chapter explains the terms, concepts, processes, and equipment involved in managing visitor access to a

network, and helps you understand how Dell Networking W-ClearPass Guest 6.6 can be successfully integrated

into your network infrastructure. It is intended for network architects, IT administrators, and security

consultants who are planning to deploy visitor access, or who are in the early stages of deploying a visitor

access solution.

This chapter includes the following sections:

l "About Dell Networking W-ClearPass Guest" on page 19

l "Visitor Access Scenarios" on page 20

l "Reference Network Diagram" on page 21

l "Key Interactions" on page 22

l "AAA Framework" on page 23

l "Key Features" on page 24

l "Visitor Management Terminology" on page 25

l "W-ClearPass Guest Deployment Process" on page 26

l "AirGroup Deployment Process" on page 28

l "Documentation and User Assistance" on page 29

l "Use of Cookies" on page 30

About Dell Networking W-ClearPass Guest

Dell Networking W-ClearPass Guest 6.6 provides a simple and personalized user interface through which

operational staff can quickly and securely manage visitor network access. It gives your non-technical staff

controlled access to a dedicated visitor management user database. Through a customizable Web portal, your

staff can easily create an account, reset a password, or set an expiry time for visitors. Access permissions to

W-ClearPass Guest functions are controlled through an operator profile that can be integrated with an LDAP

server or Active Directory login.

Visitors can be registered at reception and provisioned with an individual guest account that defines their

visitor profile and the duration of their visit. The visitor can be given a printed customized receipt with account

details, or the receipt can be delivered wirelessly using the integrated SMS services. Companies are also able to

pre-generate custom scratch cards, each with a defined network access time, which can then be handed out in

a corporate environment or sold in public access scenarios.

You can use the customization features to define settings that allow your visitors to self-provision their own

guest accounts. Visitors register through a branded and customized Web portal, ensuring a streamlined and

professional experience. Surveys can also be presented during the self-registration process and the data stored

for later analysis and reporting, providing additional insight to your visitors and their network usage.

20 | W-ClearPass Guest Overview Dell Networking W-ClearPass Guest 6.6 | User Guide

W-ClearPass Guest integrates with all leading wireless and NAC solutions through a flexible definition point,

W-ClearPass Policy Manager. This ensures that IT administrators have a standard integration with the network

security framework, but gives operational staff the user interface they require.

Visitor Access Scenarios

The following figure shows a high-level representation of a typical visitor access scenario.

Figure 1 Visitor Access Using W-ClearPass Guest

In this scenario, visitors are using their own mobile devices to access a corporate wireless network. Because

access to the network is restricted, visitors must first obtain a username and password. A guest account may

be provisioned by a corporate operator such as a receptionist, who can then give the visitor a print receipt that

shows their username and password for the network.

When visitors use self-registration, as might be the case for a network offering public access, the process is

broadly similar but does not require a corporate operator to create the guest account. The username and

password for a self-provisioned guest account may be delivered directly to the visitor’s Web browser, or sent

via SMS or email.

Page is loading ...

Dell W-ClearPass Virtual Appliances, W-ClearPass Hardware Appliances User guide

Related papers

Other documents