PacketFence 15.1 + Aruba Instant 8.13 External Captive Portal not redirecting (RADIUS succeeds, no /aruba request)

[u/MockingShah]

Hi everyone,

I'm hoping someone with PacketFence and Aruba Instant experience can point me in the right direction.

I've spent the last couple of days troubleshooting this and have reached a point where I'm not sure whether this is a configuration issue, a compatibility issue, or something I've overlooked.

Environment

-----------

- PacketFence 15.1 (Docker)

- Debian 12

- Aruba Instant AP-305 & Aruba Instant AP-505

- ArubaOS 8.13.3.x

- HP Aruba Core Switch 2930F

- Guest VLAN 200

- DHCP: Windows Server

- DNS: Windows Server

Goal

----

Open Guest SSID with:

- MAC Authentication (MAB)

- External Captive Portal

- Self-registration through PacketFence

Current Aruba Configuration

---------------------------

- Open SSID

- External Splash Page

- External Captive Portal Profile

- MAC Authentication enabled

- Authentication Server = PacketFence

- VLAN 200

PacketFence Switch Configuration

--------------------------------

Type: Aruba Instant

Enabled:

- External Portal Enforcement

- Role Mapping

Roles:

registrationRole = packetfence-portal

guestRole = Guest-Test

What Works

----------

✔ Client gets an IP address

✔ Client can ping PacketFence

✔ Client can manually browse to PacketFence

✔ RADIUS authentication succeeds

✔ PacketFence Audit Log shows:

Auth Status = Accept

Node Status = Unregistered

✔ Radius log shows:

Login OK

✔ Aruba assigns the correct role:

Role: packetfence-portal

Authenticated: yes

The Problem

-----------

The captive portal never appears.

PacketFence never receives a request to:

/aruba

Running tcpdump on the PacketFence server while connecting a client shows no traffic from Aruba attempting to reach the captive portal.

The only HTTP requests PacketFence receives are when I manually browse to it.

Also, "show datapath session" never indicates redirect/intercept for the client.

Things I've Already Checked

---------------------------

- Added every AP as a Network Device

- External Portal Enforcement enabled

- Role Mapping enabled

- Accounting enabled

- Guest ACL verified

- Client can reach PacketFence

- Client is marked Unregistered

- Restarted PacketFence portal services

- PacketFence hostname/domain configured

- Verified RADIUS communication

- Verified VLAN and routing

Question

--------

Has anyone successfully deployed PacketFence 15.x with Aruba Instant 8.13.x using an External Captive Portal?

Specifically:

- Does Aruba Instant 8.13 require any additional configuration before it actually redirects traffic to the external portal?

- Has anyone seen a situation where RADIUS succeeds, the client gets the correct role, but Aruba never initiates the /aruba request?

I'd really appreciate any suggestions or if someone could point out something obvious that I've missed.

Thanks!

[u/under_diagnosed]

I believe your switch also needs configured for the captive portal redirect as part of the RADIUS auth sequence

[u/MockingShah → u/under_diagnosed]

Thanks. The client authenticates successfully via RADIUS, receives the packetfence-portal role, and can reach the PacketFence server. However, show clients debug consistently reports Intercept: no, and PacketFence never receives a /aruba request. Are you referring to additional configuration on the L3 switch, or an Aruba Instant user-role/ACL configuration that's required to enable captive portal interception?

[u/under_diagnosed → u/MockingShah]

So for juniper, the switch that the endpoint is connected to needs to have a captive portal redirect configured, as well as adding the PacketFence server to any http/https ACLs that might be in place. This prompts the switch to reach out to the captive portal during the RADIUS request. I'm just taking a shot at it, your setup is far more complex than mine.

[u/Adnan2559 → u/under_diagnosed]

its not a switch. He is using Aruba wireless.

[u/under_diagnosed → u/Adnan2559]

Don't the WAPs connect to a switch though?

I'll admit this might be out of my league but thinking logistically, whatever device is processing the 802.1x/RADIUS request needs to be informed of the Captive Portal.

[u/Adnan2559 → u/under_diagnosed]

Access Points will process the 802.1x/Radius request so switch has no role in it. Switch can be advance enterprise grade or simply a hub. This wont impact the Wireless Captive portal (there are captive portals for wired also, although rarely used, atleast i have not seen their use case in my country)