Configure the URL key
You can optionally configure a URL hash key to provide some security for the Captive Portal exchange with
CPPM. The key is a shared secret between CPPM and the switch. When configured, the switch generates a
HMAC-SHA1 hash of the entire redirect URL, and appends the hash to the URL to be sent to CPPM as part of the
HTTP redirect. If CPPM is configured to check the hash, it will generate the hash of the URL using its version of
the URL hash key and compare against the value provided by the switch. The action taken by CPPM upon a
match or mismatch is determined by what is configured on CPPM.
CPPM provides the following options:
• Do not check - login will always be permitted
• Deny login on validation error - login will not be permitted
The URL hash key is globally configured and will be used for all redirects to Captive Portal. This key is not
configured on a per CPPM or RADIUS server basis. If the key is not specified, the hash is not added to the URL.
The URL hash key is an ASCII string with a maximum length of 64 characters.
The URL key supports the FIPS certification feature encrypt-credentials and can optionally be encrypted for more
robust security. This option is only available when the global encrypt-credentials is enabled.
To configure a plain text captive-portal URL key:
switch(config)# aaa authentication captive-portal url-hash-key plaintext <KEY>
To configure an encrypted captive-portal URL key when encrypt-credentials is enabled:
switch(config)# aaa authentication captive-portal url-hash-key encrypted <ENCRYPTED-KEY>
To clear a captive-portal URL key:
switch(config)# no aaa authentication captive-portal url-hash-key
Configuring a certificate for Captive Portal usage
HTTPS support requires the use of a certificate. If a certificate for Captive Portal does not exist, the certificate
designated for all use is used instead.
To create a certificate signing request for Captive Portal, enter:
switch(config)# crypto pki create-csr certificate-name <cert-name> usage captive-portal
To create a self-signed certificate for Captive Portal, enter:
switch(config)# crypto pki enroll-self-signed certificate-name
Display Captive Portal configuration
To display the Captive Portal configuration settings, enter the show captive-portal command:
switch(config)# show captive-portal
Captive Portal Configuration
Redirection Enabled : Yes
216 Aruba 2530 Management and Configuration Guide for
ArubaOS-Switch 16.05
To Next Page