Clearpass guests captive portal with Meraki.

[JakubR]

Hi Team,

I'm experiencing an issue with the ClearPass guest captive portal when integrated with Meraki. After successful authentication, users have to manually disconnect and reconnect to gain proper access.

Although I am sending a CoA to update the user's role, and I can see the client disconnecting and reconnecting as expected, the problem is that the client sends a DHCP Request instead of a Discover. Since the user is moved to a different role (and VLAN), the client should be initiating a Discover to obtain an IP address from the new subnet, but that doesn't happen.

Any ideas on how to improve the setup to force the client to properly initiate a DHCP Discover after the VLAN change?

[alemabrahao]

You should be using a Disconnect, not a CoA. In the web login configuration, you can increase the login delay to accommodate for the network change.

[JakubR]

Yes, I am using Disconnect to be exact, following this:

Name: [Meraki - Terminate Session] Description: System-defined profile to disconnect user (Meraki) Type: RADIUS_DynAuthZ Action: Disconnect Device Group List: -

Attributes:   Type Name   Value 1. Radius:IETF Calling-Station-Id = %{Radius:IETF:Calling-Station-Id} 2. Radius:IETF Acct-Session-Id = %{Radius:IETF:Acct-Session-Id} 3. Radius:IETF Event-Timestamp = %{Radius:IETF:Event-Timestamp}

[alemabrahao]

I suggest you open a support case.

[JakubR]

I opened one, they said is the client issue, eventhough no matter what type of client is trying it is always DHCP request rather than DISCOVERY 😞