Guest access – Juniper Mist

In this topic, you will learn how to configure access points managed by Juniper Mist to work together with the Portnox™ Cloud captive portal for guest user authentication.

Before you begin configuring your guest SSID, you must configure the guest network in Portnox Cloud and note down the values of the fields: IP (for walled garden) and Captive Portal URL. You will fill in the Shared Secret field of the guest network later, using the API secret that Mist generates for your guest SSID.

Note:
Unlike many other manufacturers, which use RADIUS to authorize guests after they log in to the captive portal, Juniper Mist uses an API secret shared between Mist and Portnox Cloud. You do not need to configure any RADIUS servers for this guest SSID. Mist does not use RADIUS for this guest portal in any way.
Important:
This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.
Important:
All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.
Note:
This configuration was tested on Juniper Mist with an AP36 access point running firmware 0.15.34533. The capabilities and the user interface on other versions of the platform may differ.
  1. In the left-hand side menu of the Mist Cloud, click on the following menu options: Site > WLANs.

  2. In the WLANs pane, click on the Add WLAN button in the top-right corner.

  3. In the New WLAN pane, in the SSID field, type the SSID of your new guest WLAN.

  4. Deactivate the Wi-Fi features that limit the available security options:
    Note:
    If the 6 GHz checkbox is active or Wi-Fi 7 is enabled, the WPA2 and Open Access options are not available in the Security section.
    1. In the Radio Band section, deactivate the 6 GHz checkbox.

    2. In the Wi-Fi Protocols section, make sure that the Disabled option is selected in the Wi-Fi 7 row.

  5. In the Security section, click on the Open Access tile.

  6. In the Guest Portal section, select the Forward to external portal option.

  7. Enter the details of the Portnox Cloud captive portal:

    1. In the Portal URL field, paste the Captive Portal URL that you obtained when you configured the guest network in Portnox Cloud.
    2. In the Allowed Subnets field, enter the addresses from the IP (for walled garden) field in Portnox Cloud. Add /32 at the end of each address, and separate the addresses with commas.
      Warning:
      The NAS device must be able to communicate with the walled garden IP addresses at all times. If this communication is blocked in any way, the captive portal will not work, and guest devices will be unable to connect to the network. Before you proceed, verify that all firewalls, ACLs, and any other security measures that could interfere with this communication are configured to explicitly allow the walled garden IP addresses.

      For example, if the IP (for walled garden) field contains the addresses 20.85.190.232 and 20.67.6.144, enter: 20.85.190.232/32, 20.67.6.144/32.

    3. In the Allowed Hostnames field, enter the guest portal hostname of your Mist cloud environment. To get this hostname, replace manage with portal in the address of the Mist Cloud in your browser.

      After the guest logs in to the Portnox Cloud captive portal, the browser goes to this Mist hostname to authorize the guest. For a list of Mist cloud environments, see the following page: Juniper Mist Firewall Ports and IP Addresses.

      For example, if you access the Mist Cloud at manage.ac2.mist.com, enter portal.ac2.mist.com. If you access it at manage.mist.com, enter portal.mist.com.

  8. In all other sections of the New WLAN pane, either leave the default values or configure the values as required for your WLAN environment. These fields are not related to Portnox Cloud or RADIUS authentication.
  9. Click on the Create button in the top-right corner of the New WLAN pane to create the new WLAN.

  10. In the WLANs pane, which opens after you create the WLAN, click on the name of the guest SSID that you created.

  11. In the Guest Portal section, copy the value of the API Secret field.

  12. In Portnox Cloud, go to Settings > Services > CAPTIVE PORTAL SERVICE, edit your guest network configuration, paste the API secret in the Shared Secret field, and save the configuration.

    Note:
    Do not confuse the captive portal’s shared secret with the RADIUS server’s shared secret. These are two different values.

Result: Your guest users can now access the guest Wi-Fi network, using the Portnox Cloud guest network management functionality.