Troubleshooting
Event Timestamp not working
Symptom
The client gets a credentials request on the web browser even though the valid credentials were already provided, or the client is not redirected to the Captive Portal.
Cause
ClearPass 6.5.x does not support the sending of
Event Timestamp
in automated workflows (manual via Access Tracker works).The switch will reject CoA requests when the time on CPPM is ahead of the switch time by even a second.
Action
Set the time-window security feature in PVOS to 0:
radius-server host<CLEARPASS-IP>
time-window 0
Cannot enable Captive Portal
Symptom
When running the aaa authentication
captive-portal enable
command, getting the following error
message:
Captive portal cannot be enabled when BYOD redirect, MAC authentication failure redirect, or web-based authentication are enabled.
Cause
The failure is due to a mutual exclusion restriction.
Action
Check which one of the following are enabled: BYOD redirect, MAC authentication failure redirect, or web-based authentication.
Disabled the enabled authentication method found in step 1.
Run the
aaa authentication captive-portal enable
command.
Unable to enable feature
Symptom
One of the following messages is displayed:
BYOD redirect cannot be enabled when captive portal is enabled.
MAC authentication failure redirect cannot be enabled when captive portal is enabled.
Web-based authentication cannot be enabled when captive portal is enabled.
V1 compatibility mode cannot be enabled when captive portal is enabled.
Authenticated user redirected to login page
Symptom
User is redirected back to the login page to submit credentials even after getting fully authenticated.
authentication command
Use the following authentication commands to configure ClearPass Captive Portal.
Command | Description |
---|---|
|
Enables redirection to a Captive Portal server for additional client authentication. |
or
|
Disables redirection to a Captive Portal server for additional client authentication. |
|
Configures a hash key used to verify the integrity of the portal URL. |
show command
Use the following show commands to view the various configurations and certificates.
Command | Description |
---|---|
|
Shows the running configuration. |
|
Shows the saved configuration. |
|
Shows the switch IP addresses. |
|
Captive portal configuration. |
|
Consolidated client view; the For the summary view (without the detailed option), only the untagged VLAN is displayed. |
|
Displays NAS identifier and data on the configured RADIUS server and switch interactions with this server. |
|
Statistics for Radius CoA and Disconnect. |
|
Statistics for Radius accounting. |
|
Installed certificates. |
Debug command
Use the debug
command to help
you debug your issues.
Command | Description |
---|---|
|
Enables debug logging for the Captive Portal sub-system. |
|
Enables debug logging for the MAC-auth sub-system. |
|
Enables debug logging for the 802.1X authenticator sub-system. |
|
Enables debug logging for the Radius sub-system. |
|
Prints debug messages to terminal. |
|
Sends debug messages to the syslog server. |
|
Prints debug messages to a buffer in memory. |