Users Guide

174 | Remote Access Points Dell PowerConnect ArubaOS 5.0 | User Guide
z Connect the remote AP to the available public network (for example, a hotel or airport network).
The remote AP advertises the backup SSID so the wireless client can connect and obtain an IP address from
the available DHCP server.
After obtaining an IP address, the wireless client can connect and access the corporate network and bring up
the configured corporate SSIDs.
The following is a high-level description of what is needed to configure the remote AP to pass through a captive
portal and access the corporate controller This information assumes you are familiar with configuring session
ACLs, AAA profiles, virtual APs, and AP system profiles and highlights the modified parameters.
Using the WebUI to configure the session ACL
1. Navigate to the Configuration > Security > Access Control > Policies page.
2. Click Add to crete a new policy.
3. Enter the policy name in the Policy Name field.
4. From the Policy Type drop-down list, select IPv4 Session.
5. To create the first rule:
a. Under Rules, click Add.
b. Under Source, select any.
c. Under Destination, select any.
d. Under Service, select service. In the service drop-down list, select svc-dhcp.
e. Under Action, select permit.
f. Click Add.
6. To create the next rule:
a. Under Rules, click Add.
b. Under Source, select any.
c. Under Destination, select any.
d. Under Service, select any.
e. Under Action, select route, and select the src-nat checkbox.
f. Click Add.
7. Click Apply
.
8. Click the User Roles tab.
a. Click Add.
b. Enter the Role Name.
c. Click Add under Firewall Policies.
d. In the Choose from Configured Policies menu, select the policy you just created.
e. Click Done.
Note: The remote AP can obtain an IP address from the public network, for example a hotel or airport, or from the DHCP server on
the remote AP.
Note: If you use a local DHCP server to obtain IP addresses, you must define one additional ACL to permit traffic between clients
without source NATing the traffic. Add user alias internal-network any permit before any any any route src-nat.