How to integrate Aruba Central with Cloudi-Fi

Set up a Radius-based captive portal with Aruba Central and Cloudi-Fi for user authentication.

Use case:

This guide provides step-by-step instructions for integrating the Cloudi-Fi captive portal with Aruba Central Network. This setup enables Radius-based user authentication, ensuring a secure and seamless network access experience. 

Prerequisites:

Before starting, ensure you have the following prerequisites:

• Administrator login credentials on HPE Greenlake
• Administrator login credentials to Cloudi-Fi administration GUI
• Cloudi-Fi Radius IPs and Secret
• Knowledge of your network’s IP addressing scheme
• Firewall
  • Before beginning, please check that the following Firewall rules are active on the site :
    • Allow HTTP and HTTPS traffic for captive portal redirection: Traffic on ports 80 (TCP) and 443 (TCP) is allowed to any destination,
    • Allow RADIUS traffic to Cloudi-Fi’s IPs for authentication and accounting: Traffic on ports 1812-1813 (UDP) is allowed to Cloudi-Fi’s IP addresses.
    • Allow DNS service for name resolution.
    • Allow the Syslog server for log collection to activate the compliance feature.

1. Get Cloudi-Fi required URL

Go to the "Location" section in the Cloudi-fi Admin interface.
Create New Location and enter the required details for the new location:

• Location Name
• Type (Redirect URL)
• Portal template
• Country 

Location URL: this URL will be used to configure an External Captive Portal

https://login.cloudi-fi.net/start/ch/ebd2egzrfgrgq2/lh/qgrzqrgegs/sp/spsomething.com

https://login.cloudi-fi.net/start/ch/ebd2egzrfgrgq2/lh/qgrzqrgegs/sp/sparuba.com

2. Get Radius information

You will need the Radius information (Server IPs, Secret, Ports) to set up.

1. IPs address of the Radius servers
2. Ports: UDP 1812 (Authentication) & 1813 (Accounting)
3. The Secret (provided by Cloudi-Fi Support)

You can get the Secret by asking in the Chatbot, Cloudi-Fi’s Support team will provide you with the necessary information.

What is shared secret is used for the Radius server? (Please save this confidential information securely, and do not share it publicly.)

3. Configure a group

Once on the Aruba Central interface, we suggest you group your devices by location for simplified management and configuration.

1. Start by selecting "Global" and then click on "Groups" located at the top left.
2. Proceed to create a new group by clicking the "+" symbol. We suggest generating a group for each specific location.
3. Assign a name to the group as "your_Group."
4. Choose "Access Point" to indicate that this group will encompass Access Points.
5. To continue, click the "Next" button.

You can adapt the configuration to your network and equipment by clicking “Add“.

Note: The access point architectures of both ArubaOS 8 and ArubaOS 10 are compatible.

4. Create an SSID 

At this level, you’ll create a new SSID and configure it as a network for guests or employees.

To create a new SSID:

Navigate to Devices, then Access Points.

Enable config mode

Click on "Add SSID."

Name your SSID and then select "Next." 

Configure your network preferences and click "Next" to proceed. 

5. Configure the SSID Security Level

Opt for the "Visitors" Security Level.

Pick the "External Captive Portal" type.

6. Configure the Radius Server and the Captive Portal

Select the type "External Captive Portal."

Click on the button "+"

• Name : Give it a name
• IP or hostname: login.cloudi-fi.net
• URL: Paste your modified portal URL from “/start/ch“ for instance

  • /start/ch/************/lh/qgrzqrgegs/sp/sparuba.com

• Port: 443
• HTTPS Select: “Use HTTPS“ and “Automatic URL. Allow listing“ if available.
• Redirect URL : https://login.cloudi-fi.net/success.php

Configure the primary and secondary Radius:

You will need the server IPs.

Select Primary Server

Click on the "+" sign next to Primary Server.

• Server type: RADIUS
• Name: Select Primary
• IP Address/FQDN: Click here to obtain the IP
• Share key: Provided by Cloudi-Fi
• Auth port: 1812
• Accounting port: 1813
• Retry count: 3
• Timeout: 5
• Service Type Framed User: MAC/Captive Portal
• Query Status of RADIUS Servers(RFC 5997): Authentication and Accounting

Add the "Secondary server" following the same configuration as the primary server.

7. Configure the Access rules

Then choose the "Role-based" access rules 

Configure a pre-auth access rule

Create a "Pre-authentication" role that should allow connections to a domain name:  login.cloudi-fi.net, before the authentication, allowing the end user to get the captive portal.

Click on Add Role and set a name to your role (e.g. Pre_auth_CFI)

Then edit the Access rules for this role

• Rule Type : Access Control
• Service : Network
• Action : Any - Allow
• Destination : To a Domain Name
• Domain Name : login.cloudi-fi.net
• Log : enable 

Then, scroll down, go to Assign Pre-Authentication Role and select the "Pre-authentication" you just created.

Configure a post-auth access rule (optional)

Create a "Post-authentication" role that should allow to customise the access for different profile of Guest user after Cloudi-Fi authentication. It is possible, within the same captive portal, to assign different user profiles depending on the chosen authentication method. If you would like to know the name of the profile assigned to each authentication method, feel free to contact Cloudi-Fi Support.

In the example below, we will use a simple case with the default Guest profile.

Click on Add Role and set a name to your role (e.g. Post_auth_Guest_CFI)

Then edit the Access rules for this role

• Rule Type : Access Control
• Service : Network
• Action : Any - Allow
• Destination : To all destination (here you can customise the access according to your need)
• Log : enable 

Then, scroll down, click on add role assignment

• Attribute : Aruba-User_role
• Operator : equals
• String : cloudifi-guest
• Role : the access role you created previously (e.g. Post_auth_Guest_CFI)

And save

Click on “Next“ to finish.

8. Configure the Syslog Server

Ensure you are part of the appropriate group before configuring the Syslog server.

Click on "Device", followed by "System" and then “Logging".

Put the Syslog IPs for Cloudi-Fi's server. 

Then select "User" and "User-debug" as "Syslog Facility Levels" with debug level and warning or critical for everything else.

9. Configure an SSL Certificate (Optional)

Certificates ensure data is transmitted privately, without modification, loss, or theft.

Adding a certificate to your Aruba controller can ensure a more secure Internet experience for your users.

We suggest creating a .PEM file containing your server, intermediate and root CA.

Important: the order of certificates is critical. The server certificate must be first, followed by intermediate certificates, and finally the root certificate.

If you have a key validation error, you should add you .key file at the top of your .PEM file.

To import a certificate into your group:

1. Click on “Organization“ on the left panel and then click on “Certificates“.
2. Add a new certificate by clicking“+“.

To ensure that the newly added certificate is recognised, applying it to the captive portal is necessary. Apply the following settings:

1. Go to Devices > Config > Security > Certificate usage > Certificate Usage
2. Click on "Portal Captive" and select "your_certificate" to apply for the added certificate.
3. After successfully adding and applying the certificate, connect to the SSID.

10. Troubleshooting

Firewall problem

1. Before beginning, please check that the following Firewall rules are active, as mentioned in the Solution prerequisites section.
2. If you still encounter problems after following all the configuration steps, follow the steps below and provide it to the Cloudi-Fi support team:
3. Make a web capture of your browser
4. Share with the Cloudi-Fi support team
5. The URL of the captive portal configured on Aruba
6. User ID facing the error page Aruba troubleshooting command lists

Captive portal display issue before or after authentication

1. The problem may be related to DHCP or DNS.

   • Check that your IP private address is valid.
   • Check that login.cloudi-fi.net is resolved.

   Assuming the DNS and IP address function correctly, you still have a captive portal problem.

2. Type http://neverssl.com on your browser to apply the redirection on the portal.
3. If the captive portal still does not appear, check the authorisations in "Access".
4. Click on "Your_Group" > Device > Config > WLANs > Access > Rule
5. Follow the path below and check if Cloudi-Fi's domains or IPs are authorized before authentication.

Error after authentication on the page

1. Once connected to the SSID, if you notice a Cloudi-Fi error page instead of your captive portal, check the configuration of the Radius server:
   • The IP address of RADIUS • RADIUS port (default port 1812)
   • The shared password
2. Check the availability of the RADIUS server:
   • In your Aruba central, Under Tools, click the Console tab. The Remote Console Session page is displayed, and the New Session tab is selected by default.
   • From the Device Type drop-down list, select the device type.
     • Select the device.
     • Enter the username and password, and click Create Session.
   • Ping <IP_RADIUS_Server ou FQDN>
   • Test the accessibility of the RADIUS server
     • Enter aaa test-server <server_name> username <user> password <oudhbdfga> authtype pap
       • If you have a “timeout “ as below, this is an Invalid Pre-shared key

What's next?

Aruba Central's Role Assignment Rule is a prominent feature that enables the dynamic allocation of roles to users based on specific criteria. This feature can be further enhanced through Radius filter IDs. By leveraging these capabilities, administrators can create highly granular access control policies that help to ensure network security, simplify network management, and enhance user productivity.

Cloudi-Fi facilitates administrators in defining user profiles, which can be seamlessly shared with Aruba Central via the Radius filter ID. This integration empowers administrators to establish customised roles and policies tailored to different user types. For example, two Role Assignment Rules can be implemented to assign the "Guest" or "Employee" role to users who connect through the captive portal. Employees may require access to specific applications or resources, while the Guest group may need limited privileges. With Aruba Central, administrators can create customized roles and policies for each group, ensuring that users have the appropriate level of access to network resources.

For more information on Cloudi-Fi's solution partnership with Aruba, visit our integration page.