arubanetworks captive portal

2021-12-02 · 3 min read


Captive Portal #

Captive portal authentication is a Layer 3 authentication method that redirects users to a captive portal page when they start a web session. The captive portal page can be used for various purposes, such as authenticating the guest using a user name and password, providing an acceptable use policy, or self registration with an email address.

Authentication Process #

Captive portal is a Layer 3 authentication, which requires that the devices connect to the network and obtain an IP address and related DNS information before authenticating through the captive portal. The following steps explain the entire captive portal process when the native ArubaOS is used for captive portal authentication:

  1. The device that is associating to the guest SSID is assigned an initial role (guest-logon role in the example configuration). This initial role allows DHCP, so the user gets an IP address.
  2. The user opens a browser and makes an HTTP (or HTTPS) request to some destination (for example,
  3. The resolver in the device sends a DNS request to resolve the The initial role (guest-logon role) permits DNS services, so the resolver can communicate with the DNS server.
  4. The DNS server replies with the correct address to
  5. The resolver tells the browser which IP address to use based on the DNS reply.
  6. The browser initiates a TCP connection to port 80 of the address.
  7. The controller intercepts the connection and spoofs the initial TCP handshakes of the HTTP process. At this moment, the client browser thinks it is communicating with the server.
  8. When the browser sends the HTTP GET request for the web page, the controller replies saying that has “temporarily moved” to[string that identifies client].
  9. The browser closes the connection.
  10. The browser attempts to connect with[string that identifies client], but it first needs to send a DNS request for the address.
  11. The actual DNS server responds that it cannot resolve, but the controller intercepts that reply and changes the packet to say that is at the IP address of the controller itself. Remember that it is critical that the DNS server sends back a reply to the query.  It is only then that the controller can spoof the reply back from the DNS server.  Sending a DNS request without receiving a reply is not sufficient, since without a reply the controller will never help the client resolve
  12. The browser initiates an HTTPS connection to address of controller, which responds with the captive portal login page, where the guest authenticates.
  13. After successful authentication, the user is assigned the post authentication role (auth-guest role in the example configuration). This is the default role in the captive portal profile.
  14. After authentication, the browser is redirected to at the address originally resolved by the DNS. Alternatively, if a welcome page is configured, the browser is redirected to the welcome page.
  15. To successfully redirect to the original web page the controller spoofs a reply from to tell the client that has “permanently moved” to This step corrects the “temporary relocation” that occurred as part of the captive portal login.
  16. This causes the client to re-query DNS for the address of
  17. The browser starts to communicate with the actual server.