Nortel Networks NN47250-500 External Captive Portal

Nortel WLAN—Security Switch 2300 Series Configuration Guide

External Captive Portal

You can redirect Web portal authentication to a Web server on a network rather than a local WSS database or

RADIUS. It has the following features:

• You can connect to the local WSS with Web portal enabled.

• The WSS redirects you through http or https to an external authentication Web server.

• Once your credentials are verified, the external server sends a Change of Attribute (CoA) to the WSS.

The CoA requests a change in the session username on the WSS.

• The Web server can also change or set any other allowed CoAs at the same time.

To display user session information for Web Portal Web-based AAA users, use the following command:

You can determine whether a Web Portal Web-based AAA user has completed the authentication and authori-

zation process, based on the username displayed in the session table. The following command shows the

sessions for SSID mycorp.

User Sess IP or MAC VLAN Port/

Name ID Address Name Radio

------------------------------ ---- ----------------- --------------- -----

alice 4* 192.168.12.101 corpvlan 3/1

web-portal-mycorp 5 192.168.12.102 corpvlan 3/1

2 sessions total

This example shows two sessions. The session for alice has the user’s name and is flagged with an asterisk ( *

). The asterisk indicates that the user has completed authentication and authorization. The session for

web-portal-mycorp indicates that a Web-based AAA user is on the network but is still being authenticated. The

user alice has all the access privileges configured for the user, whereas the user who is still on the portal

session with the name web-portal-mycorp has limited access to resources. By default, this user can send and

receive DHCP traffic only. Everything else is captured by the web portal.

After authentication and authorization are complete, the web-portal-mycorp username is replaced with the

username entered by the Web-based AAA user during login. The following example shows session informa-

tion for the same user, but after the user is authorized to access resources on the network:

User Sess IP or MAC VLAN Port/

Name ID Address Name Radio

------------------------------ ---- ----------------- --------------- -----

alice 4* 192.168.12.101 corpvlan 3/1

bob 5* 192.168.12.102 corpvlan 3/1

2 sessions total