Guest access – Arista CV-CUE

In this topic, you will learn how to configure Arista™ CloudVision Cognitive Unified Edge (CV-CUE) to work together with the Portnox™ Cloud captive portal for guest user authentication.

Before you begin, configure the guest network in Portnox Cloud, generate a random shared secret of up to 40 characters (for example, using a password manager), edit the captive portal, enter the shared secret in the Shared Secret field, and save the configuration. Note down the shared secret and the values of the IP (for walled garden) and Captive Portal URL fields, since you will need them later.

Important:
This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.
Important:
All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.
Note:
This topic assumes that you already have at least one Arista access point registered and assigned to your Arista Cloud tenant. To access CV-CUE, log in to Arista Launchpad and click on the CV-CUE tile under Dashboard. CV-CUE opens in a new tab.
Important:
CV-CUE organizes configuration by locations (a tree of folders and floors). A location inherits its parent’s configuration, but a child location can have a customized configuration of its own. If a child location is customized, an SSID that you create at the parent is not automatically active there – you must turn it on, or configure it directly, at that location too. If Wi-Fi clients cannot see an SSID that you configured, check whether their location has a customized configuration.

Create RADIUS server entries

In this section, you will create RADIUS server entries for the Portnox™ Cloud RADIUS servers. You will use these servers later when you configure your SSIDs.

  1. In the left-hand side menu of CV-CUE, click on the following menu options: Configure > Network Profiles > RADIUS.

  2. Click on the Add RADIUS Server button in the top-right corner.

  3. Configure the new RADIUS server:

    1. In the RADIUS Server Name field, enter a display name for this server, for example, the name of the corresponding Portnox Cloud RADIUS server.
    2. In the IP Address/FQDN field, enter the Cloud RADIUS IP value from Portnox Cloud.
    3. In the Authentication Port and Accounting Port fields, enter the Authentication Port and Accounting Port values from Portnox Cloud.
    4. In the Shared Secret field, enter the Shared Secret value from Portnox Cloud.
    5. Click on the Save button.
  4. If you use two Cloud RADIUS servers in both regions, repeat the above steps for the second RADIUS server.

    The above screenshot shows an example configuration with two added RADIUS servers, one for each Cloud RADIUS region. Adjust the names, IP addresses, and port numbers to your tenant configuration.

Create the guest SSID

In this section, you will create a new open SSID for guest access, and configure it to redirect guests to the Portnox™ Cloud captive portal.

  1. In the left-hand side menu of CV-CUE, click on the following menu options: Configure > WiFi.

  2. Click on the Add SSID button in the top-right corner.

  3. On the Basic tab, in the SSID Name field, enter the network name that guests see when they search for Wi-Fi networks. In the Profile Name field, enter a name for this profile that is only used internally by CV-CUE. Then, in the Select SSID Type section, select the Guest option.

  4. Leave the settings on the Security and Network tabs at their default values.

    A new SSID uses the Open security level by default. The Wi-Fi 6E standard requires WPA3 or Enhanced Open (OWE) on the 6 GHz band, so open SSIDs do not work on 6 GHz radios.

  5. On the Captive Portal tab, configure the captive portal:

    1. Activate the Captive Portal checkbox.
    2. In the list below the checkbox, select the Third-Party Hosted option.
    3. Activate the With RADIUS Authentication checkbox.
    4. In the Splash Page URL field, paste the Captive Portal URL that you obtained when you configured the guest network in Portnox Cloud.
    5. In the Shared Secret field, enter the shared secret that you generated earlier.
      Note:
      Do not confuse the captive portal’s shared secret with the RADIUS server’s shared secret. These are two different values.
  6. Click on the RADIUS Settings link next to the With RADIUS Authentication checkbox, and in the RADIUS Settings pane, configure the RADIUS servers:

    1. On the Primary tab, in the Authentication Server and Accounting Server fields, select the RADIUS server that you created earlier.
    2. Optional: If you use two Cloud RADIUS servers, click on the Additional tab and select the second RADIUS server there.
    3. Click on the Save button.

      Result: The RADIUS Settings pane closes, and you return to the Captive Portal tab.

  7. In the Websites that users can access before login section, add the addresses from the IP (for walled garden) field that you obtained when you configured the guest network in Portnox Cloud:

    Note:
    CV-CUE does not accept a list of addresses separated by commas. Every address must appear as a separate entry.
    Warning:
    The NAS device must be able to communicate with the walled garden IP addresses at all times. If this communication is blocked in any way, the captive portal will not work, and guest devices will be unable to connect to the network. Before you proceed, verify that all firewalls, ACLs, and any other security measures that could interfere with this communication are configured to explicitly allow the walled garden IP addresses.
    1. Enter one address in the text box.
    2. Click anywhere outside the text box.

      Result: CV-CUE converts the address into a separate entry and adds ports 80 and 443 to it, for example, 20.85.190.232:80,443.

    3. Repeat for each remaining address.
  8. Optional: In the Post Login section, in the Redirect URL field, enter the address of the page that guests see after they authenticate.
  9. Leave the remaining settings at their default values unless your environment requires otherwise, and click on the Save & Turn SSID On button.

Result: You created an open SSID that redirects guests to the Portnox Cloud captive portal for authentication.