Concept Guide
Table Of Contents
- About this Guide
- About Instant
- Setting up a W-IAP
- Automatic Retrieval of Configuration
- Instant User Interface
- Initial Configuration Tasks
- Customizing W-IAP Settings
- Modifying the W-IAP Host Name
- Configuring Zone Settings on a W-IAP
- Specifying a Method for Obtaining IP Address
- Configuring External Antenna
- Configuring Radio Profiles for a W-IAP
- Configuring Uplink VLAN for a W-IAP
- Changing the W-IAP Installation Mode
- Changing USB Port Status
- Master Election and Virtual Controller
- Adding a W-IAP to the Network
- Removing a W-IAP from the Network
- VLAN Configuration
- IPv6 Support
- Wireless Network Profiles
- Configuring Wireless Network Profiles
- Configuring Fast Roaming for Wireless Clients
- Configuring Modulation Rates on a WLAN SSID
- Multi-User-MIMO
- Management Frame Protection
- Disabling Short Preamble for Wireless Client
- Editing Status of a WLAN SSID Profile
- Editing a WLAN SSID Profile
- Deleting a WLAN SSID Profile
- Wired Profiles
- Captive Portal for Guest Access
- Understanding Captive Portal
- Configuring a WLAN SSID for Guest Access
- Configuring Wired Profile for Guest Access
- Configuring Internal Captive Portal for Guest Network
- Configuring External Captive Portal for a Guest Network
- Configuring Facebook Login
- Configuring Guest Logon Role and Access Rules for Guest Users
- Configuring Captive Portal Roles for an SSID
- Configuring Walled Garden Access
- Authentication and User Management
- Managing W-IAP Users
- Supported Authentication Methods
- Supported EAP Authentication Frameworks
- Configuring Authentication Servers
- Understanding Encryption Types
- Configuring Authentication Survivability
- Configuring 802.1X Authentication for a Network Profile
- Enabling 802.1X Supplicant Support
- Configuring MAC Authentication for a Network Profile
- Configuring MAC Authentication with 802.1X Authentication
- Configuring MAC Authentication with Captive Portal Authentication
- Configuring WISPr Authentication
- Blacklisting Clients
- Uploading Certificates
- Roles and Policies
- DHCP Configuration
- Configuring Time-Based Services
- Dynamic DNS Registration
- VPN Configuration
- IAP-VPN Deployment
- Adaptive Radio Management
- Deep Packet Inspection and Application Visibility
- Voice and Video
- Services
- Configuring AirGroup
- Configuring a W-IAP for RTLS Support
- Configuring a W-IAP for Analytics and Location Engine Support
- Managing BLE Beacons
- Clarity Live
- Configuring OpenDNS Credentials
- Integrating a W-IAP with Palo Alto Networks Firewall
- Integrating a W-IAP with an XML API Interface
- CALEA Integration and Lawful Intercept Compliance
- Cluster Security
- W-IAP Management and Monitoring
- Uplink Configuration
- Intrusion Detection
- Mesh W-IAP Configuration
- Mobility and Client Management
- Spectrum Monitor
- W-IAP Maintenance
- Monitoring Devices and Logs
- Hotspot Profiles
- ClearPass Guest Setup
- IAP-VPN Deployment Scenarios
- Acronyms and Abbreviations

The client can connect to this SSID after authenticating with username and password. After a successful user
login, the captive portal role is assigned to the client.
In the CLI
To create a captive portal role:
(Instant AP)(config)# wlan access-rule <Name>
(Instant AP)(Access Rule <Name>)# captive-portal {external [profile <name>]|internal}
(Instant AP)(Access Rule <Name>)# end
(Instant AP)# commit apply
Configuring Walled Garden Access
On the Internet, a walled garden typically controls access to web content and services. The walled garden
access is required when an external captive portal is used. For example, a hotel environment where the
unauthenticated users are allowed to navigate to a designated login page (for example, a hotel website) and all
its contents.
The users who do not sign up for the Internet service can view the allowed websites (typically hotel property
websites). The website names must be DNS-based and support the option to define wildcards. When a user
attempts to navigate to other websites that are not in the whitelist of the walled garden profile, the user is
redirected to the login page. W-IAP supports walled garden only for the HTTP requests. For example, if you add
yahoo.com in walled garden whitelist and the client sends an HTTPS request (https://yahoo.com), the
requested page is not displayed and the users are redirected to the captive portal login page.
In addition, a blacklisted walled garden profile can also be configured to explicitly block the unauthenticated
users from accessing some websites.
You can create a walled garden access in Instant UI or the CLI.
In the Instant UI
To create a walled garden access:
1. Click the Security link at the top of the Instant main window. The Security window is displayed.
2. Click Walled Garden. The Walled Garden tab contents are displayed.
3. To allow the users to access a specific domain, click New and enter the domain name or URL in the
Whitelist section of the window. This allows access to a domain while the user remains unauthenticated.
Specify a POSIX regular expression (regex(7)). For example:
l yahoo.com matches various domains such as news.yahoo.com, travel.yahoo.com and
finance.yahoo.com
l www.apple.com/library/test is a subset of apple.com site corresponding to path /library/test/*
l favicon.ico allows access to /favicon.ico from all domains.
4. To deny users access to a domain, click New and enter the domain name or URL in the Blacklist section of
the window. This prevents the unauthenticated users from viewing specific websites. When a URL specified
in the blacklist is accessed by an unauthenticated user, W-IAP sends an HTTP 403 response to the client with
an error message. If the requested URL does not appear on the blacklist or whitelist, the request is
redirected to the external captive portal.
5. To modify the list, select the domain name/URL and click Edit . To remove an entry from the list, select the
URL from the list and click Delete.
6. Click OK to apply the changes.
In the CLI
To create a walled garden access:
Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Captive Portal for Guest Access | 137