Deploying a Captive Portal Solution

You do not need to deploy all of the redirection types. Each type of TCP redirection is independent of the others. To eliminate a redirection type from the captive portal solution, you can do any of the following:

• Turn off the redirection type in the captiveportal.xml file.
  
  
• During captive portal installation, you can uncheck the enable box for any redirection type.
  
  
• After installation, you can set to false the appropriate attribute by editing the captiveportal.xml file.
  
  
• Do not configure the redirection type on the SSG.
  
  

The web server container in which the captive portal application runs is configured with a separate listener for each TCP redirect port you configured. That is, separate listeners exist for user redirections, each service redirection, a default service redirection, initial logon redirections, and advertising redirections. If you do not implement all of the redirection types, you might want to edit the captiveportal.jetty.xml file to disable the unnecessary listeners. This is optional.

You can deploy one or many content applications. You might have a single content application that handles all types of redirection, or you might have a different application for each type of redirection, including a different application for each configured service redirection. The content applications do not need to be SESM applications. The SESM Captive Portal application can redirect to any web application.

Using a Different Captive Portal Application

• It is an efficient, small footprint, application.
  
  
• By acting as a gateway to any number of other applications with varying functions, it isolates common functionality into a single application.
  
  
• It simplifies configuration when you want to add or change content applications to your solution. In those cases, you add or change configuration parameters in the Captive Portal application configuration file (an XML file) to point to the new content applications. This is much easier than changing the captive portal group configuration on the SSG, which requires that you enter Cisco IOS commands on each SSG host device.
  
  

You can configure the TCP redirect feature to redirect directly to an application that provides content to the subscriber. For example:

The following information concerning captive portal installation is important:

captiveportal
config   captiveportal.xml   ssgconfig.txt webapp docs
messageportal
config   messageportal.xml webapp docs

The installation procedure also adds startup scripts and container configuration files for Captive Portal and Message Portal to the jetty directory under your SESM installation directory:

jetty
bin   startCAPTIVEPORTAL   startMESSAGEPORTAL config   captiveportal.jetty.xml   messageportal.jetty.xml

captiveportal
config   ssgconfig.txt

---

Note   The installation displays default inputs for captive portal group names and port numbers. These defaults correspond to values used in the TCP redirect commands in the ssgconfig.txt file. If you change these captive portal group names or port numbers, you must make corresponding changes to the port numbers in the ssgconfig.txt file.

---

• You must edit the placeholder IP addresses. Change them to the actual network IP addresses you entered during captive portal installation.
  
  
• If you changed the displayed defaults for captive portal group names or the incoming port numbers, then you must edit those values in ssgconfig.txt to match the values you entered during captive portal installation.
  
  

Step 5   On the SSG host device, enter the contents of ssgconfig.txt to update the Cisco IOS running-config file.

Step 6   Save running-config.

In LDAP mode, create some basic subscriber profiles using CDAT. You can then use the NWSP account management feature to modify interests (hobbies) or add subscriptions.

You might want to change the configuration so that each service redirection is assigned a unique redirection destination.

To change a destination URL for service redirections, follow these procedures:

Step 1   Open the captiveportal.xml file in a text editor. The location is:

config
captiveportal.xml

Step 2   Locate the service redirect definition. For example:

---

Note   When the second argument is empty (or its system property default is empty), the value in the serviceRedirectDefaultURL attribute is used. By using a default page in serviceRedirectDefaultURL attribute, you do not have to enter the same URL for all the service redirections. The default value provided by the installation program for the serviceRedirectDefaultURL attribute is the NWSP /serviceRedirect page.

---

SESM duration must be equal to or longer than the SSG duration. Otherwise, redirections that SESM attempts to perform are too early and do not take place.

On the SSG side, the message duration controls the length of time the SSG holds the browser to the message page before allowing the browser to display any other URL. If the subscriber or any web application (such as the SESM message portal application) attempts to redirect the browser before the SSG duration time has elapsed, the attempt fails. On the SSG side, duration is specified as follows:

• In the SSG TCP redirect commands.
  
  
• In the subscriber profile. The duration attributes are optional in a subscriber profile. If provided, they override the values specified in the SSG TCP commands.
  
  

Durations on the SESM Side

On the SESM side, the message duration controls how long the content application waits before attempting to redirect the browser from the message page to the subscriber's originally intended URL or to a default URL. (If the redirect feature is turned off in the messageportal.xml file, then the SESM duration attributes are ignored.) On the SESM side, duration is specified as follows:

• In the captiveportal.xml file
  
  

• In the messageportal.xml file
  
  

If you do not configure a captive portal group to handle TCP packets from unauthenticated users, SSG discards packets from unauthenticated users. To obtain the SESM logon page, subscribers must enter the URL of the SESM web server.

Subscribers who are connecting to SSG over a PPP connection are already authenticated. The SSG accepts this authentication and creates the host object for the subscriber. If the subscriber logs out of SESM but does not log off of the PPP connection, the host object is marked inactive, and then unauthenticated redirection applies. When the PPP subscriber logs back into SESM (reauthenticates), the host object is active again.

Cisco IOS Configuration Commands

Use the following command to specify which captive portal group will handle unauthenticated user redirections.

The following commands from ssgconfig.txt create a captive portal group named userRedirect. The group consists of one web server whose IP address is 10.0.1.4, with a listener on port 8090. (In the sample solution, this must be the IP address of the web server for the SESM captive portal application. The port must match the port you configured for unauthenticated user redirections in the captiveportal.xml file.) The userRedirect group is associated with unauthenticated user redirections. A port list cannot be assigned to this type of redirection—user redirection applies to all TCP packets that are not authenticated.

server-group userRedirect server 10.0.1.4 8090 redirect unauthenticated-user to userRedirect

Otherwise, service redirection redirects a TCP packet if all of the following conditions are true:

• The packet is destined for a service in a configured port-list. For example, you could configure a port-list that makes TCP packets destined for FTP (port 70) and HTTP (port 80) candidates for redirection.
  
  
• The packet is destined for a network in a configured network list. For example, you can limit access to specific networks for each service. The SSG rejects packets destined for other networks, unless you configure a default service redirection to redirect the packets destined for other networks.
  
  
• The subscriber is not authorized to use the service. Reasons for not being authorized are:
  
  
• Not subscribed to the service
  
  
• Not logged into the service
  
  
• If the SSG prepaid feature is configured, not enough funds in the account
  
  

Cisco IOS Configuration Commands

The following IOS commands from ssgconfig.txt configure three specific service redirections and a default service redirection. All of the service redirections are applied only to traffic coming into ports 80 and 8080. Each type of service redirection uses a different port on the same web server (the web server at IP address 10.0.1.4, which is the web server in which the SESM Captive Portal application is running).

It is possible for some services to share some of their address space. For example, consider an Internet service with allowable networks of 0.0.0.0 and a mask 0.0.0.0. (In effect, any address is permissible.) An IPTV service would have a much smaller network space—for example, 1.2.3.0 with a mask of 255.255.255.0). In this situation, having access to the Internet service should not automatically give access to the IPTV service.

You can configure the SSG to handle the situation described above by configuring a specific service redirection for the narrow address space. This takes precedence over the wider address space, thus ensuring that the specific service redirection occurs.

• A globally set parameter set by the Cisco IOS command described below.
  
  
• Subscriber-specific values set in the subscriber profiles. The profile value, if it exists, overrides the global value.
  
  

---

Note   The SESM captive portal solution also uses duration parameters. See the "Message Duration ParametersSummary" section for more information.

---

Cisco IOS Configuration Commands

The following commands from ssgconfig.txt create a port list named ports and a captive portal group named initialCaptivate. The group consists of one web server whose IP address is 10.0.1.4, with a listener on port 8091. (In the sample solution, this must be the IP address of the web server for the SESM captive portal application. The port must match the port you configured for initial logon redirections in the captiveportal.xml file.) The initialCaptivate group is associated with initial logon redirections. The message captivation lasts for 10 seconds, unless the subscriber profile overrides that value. Redirections to this group are applied to TCP packets arriving on the SSG at ports 80 or 8080, as specified in the port list.

port-list ports
port 80 port 8080
server-group initialCaptivate
server 10.0.1.4 8091
redirect port-list ports to initialCaptivate redirect captivate initial default group initialCaptivate duration 10

• Globally set parameters set by the Cisco IOS command described below.
  
  
• Subscriber-specific values set in the subscriber profiles. The profile value, if it exists, overrides the global value.
  
  

The frequency is approximate, because redirection can occur only when a TCP packet is initiated by the subscriber.

Note   The Message Portal application also accepts a duration attribute. See the "Message Duration ParametersSummary" section for more information.

Cisco IOS Configuration Commands

The following commands from ssgconfig.txt create a port list named ports and a captive portal group named advertisingCaptivate. The group consists of one web server whose IP address is 10.0.1.4, with a listener on port 8092. (In the sample solution, this must be the IP address of the web server for the SESM captive portal application. The port must match the port you configured for advertising redirections in the captiveportal.xml file.) The advertisingCaptivate group is associated with advertising redirections. The captivation lasts for 5 seconds and occurs every 60 seconds, unless the subscriber profile overrides those values. Redirections to this group are applied to TCP packets arriving on the SSG at ports 80 or 8080, as specified in the port list.

port-list ports
port 80 port 8080
server-group advertisingCaptivate
server 10.0.1.4 8092
redirect port-list ports to advertisingCaptivate redirect captivate advertising default group advertisingCaptivate duration 5 frequency 60

For example, suppose you want to establish service redirections for a service on network 10.1.1.1. If you define the incoming destination network that is eligible for redirections as follows:

ssg tcp-redirect network-list serviceNetwork1
network 10.1.1.0 255.255.255.0

then you must define the service route for the service using the same IP address and mask (10.1.1.0 and 255.255.255.0).

If you define the service route differently (for example, you use 10.1.1.1 and 255.255.255.255), then the service redirection occurs repeatedly. After the first and required service redirection, any subsequent requests are subject to the service redirection, even though the service is connected.

The symptom of this misconfiguration is the continuous redisplay of the redirect URL. For example, in the sample SESM solution, the NWSP service logon page appears each time you click the OK button, even though the service is already connected.

HTTP1.1 persists connections. The persistent connection causes the SSG to continue redirecting for subsequent requests because it is still handling the same connection. The SSG continues redirecting even after the mapping times out on the SSG. This behavior is particularly noticeable for initial captivation, where one would expect the redirection to occur only one time.