Bypass guest webauth for Blackberry Service

Hi Folks, Our wireless deployment has two wireless networks - one with 802.1x auth for corporate machines and the other is an open one with internet access for guests (but with a web auth page).
What I'd like to do is allow staff to connect their Blackberry handsets to the guest (open) wireless network to collect email from the Blackberry Enterprise Server (it's a lot easier that configuring 802.1x and getting users to roll their passwords each time), I think I can work around this with a pre-authentication ACL to bypass the webauth page for access to the Blackberry Enterprise Server, but I'm a bit confused over the direction of the access list entries. If I added an access list to the WLC which looks like the below - would that work or is the directionality wrong?
The example for the external webauth server I saw had the directionality the otherway around.
Action Source IP/Mask Destination IP/Mask Protocol Source Port Dest Port DSCP Direction
Permit 0.0.0.0 / 0.0.0.0 [the ip of my BES] / 255.255.255.255 IP Any Any Any Outbound
Permit [the ip of my BES] / 255.255.255.255 0.0.0.0 / 0.0.0.0 IP Any Any Any Inbound
Any advice that you can provide would be great
Thanks in advance
Kev

Never underestimate the help menu ;-)
Direction
Any, Inbound (from client), or Outbound (to client).
I think that this description is straighforward.
But you will probably notice that your blackberries are disconnected every 3 minutes from your SSID. I don't know if this is something they can tolerate.
Pre-auth ACL is made to give access to some ressources needed to authenticate on the web login page. Not to bypass it completely. So the WLC is kicking out clients that are connected since 3 minutes on the Webauth SSID but not autheneticated on the web page ...
Nicolas
===
don't forget to rate answers that you find useful

Similar Messages

Bypassing apps asking for data service

i have seen a thread somewhere that someone asked about bypassing the data service and someone said it is possible and he gave inrtusctions but it doesnt work for me. i.e. i reallllly wanna use the facebook app but all i have is wifi, no data plan so when i click on the facebook app that i downloaded, it says cannot connect, need data service...
so my quesiton is... is there any way u can make the phone recognize the wifi instead of the data service so i can use the apps i want that need internet to work?

1. The Facebook for BlackBerry application REQUIRES the BlackBerry Data Plan, no way around that.
You can use m.facebook.com for the mobile fb website.
2. Look for an application named something like "ForceWiFi" for apps that choose between BIS data vs. WiFi data connection. This will NOT still allow proprietary RIM application like the Facebook application to work on WiFi only.
Good luck.
1. If any post helps you please click the below the post(s) that helped you.
2. Please resolve your thread by marking the post "Solution?" which solved it for you!
3. Install free BlackBerry Protect today for backups of contacts and data.
4. Guide to Unlocking your BlackBerry & Unlock Codes
Join our BBM Channels (Beta)
BlackBerry Support Forums Channel
PIN: C0001B7B4 Display/Scan Bar Code
Knowledge Base Updates
PIN: C0005A9AA Display/Scan Bar Code

Guest Access for Windows Services

Hi,
I need to access my shared files through a "Guest" access, without a password. I understand it is not a safe way to work, but I do not have a choice : I am using a device named mediagate, which is supposed to be able to read the shared files on my computer, and this device can only connect to my computer using a "Guest" access.
I understand OS X server could do that (refering to http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c4wn14.html), but I am using OS X tiger 10.4.4 workstation. Is there anyway for me to do that ? Otherwise, the mediagate I bough is totally useless...
Thanks for your help !
iMac G5 Mac OS X (10.4.4)

Hi Marco,
This behavior is a limitation that we are looking into providing a solution in a future update.
Thanks,
Robert
Robert Bruckner http://blogs.msdn.com/robertbruckner
This posting is provided "AS IS" with no warranties, and confers no rights.

Blackberry service

has anyone used an e71 for blackberry service? i'm thinking of getting the e71. my current phone is the P1i---the last time i'm getting an ericsson--- and it works fine with smart's blackberry service. if the e71 is compatible then i'll get one in a jiffy.

Blackberry connect is not installable on the E71. Your only option is Mail for exchange.
Smitten by the E71.

Setting up webauth for guest wireless access

Hi there,
I'm trying to set up guest wireless access. having no experience with this at all, I'm beginning to struggle.
Equipment:
2x 3850 stacked and acting as one switch running 03.06.00E
4x 1602E AP's registered to the WLC running on the 3850
The infrastructure is sound and corporate wireless access works ok.
I need a config that allows a guest user to connect to the guest SSID, DHCP an address, then when they open a browser, they are automatically redirected to a splash screen for them to log on. Once they log on with the supplied username and password they are then forwarded to whatever site it is they wish to go to; So far my config looks like this (removed unnecessary parts for brevity);
Building configuration...
user-name test
creation-time 1414684496
privilege 0
password 7 051F031C35
type network-user description test guest-user lifetime year 0 month 0 day 0 hour 23 minute 59 second 4
aaa new-model
aaa authentication login aaa_guest_webauth local
aaa authentication login local_login local
aaa authorization exec local_authorise local
aaa authorization network guest_authorisation local
aaa authorization credential-download default local
aaa session-id common
switch 1 provision ws-c3850-24t
switch 2 provision ws-c3850-24t
service-template webauth-global-inactive
inactivity-timer 3600
service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
hw-switch switch 2 logging onboard message level 3
parameter-map type webauth global
virtual-ip ipv4 1.2.3.4
parameter-map type webauth guest-webauth
type webauth
redirect on-success http://www.google.com
banner text ^CC test text test ^C
custom-page login device flash-1:login.html
custom-page failure device flash-1:failed.html
class-map match-any non-client-nrt-class
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
interface VlanXXX
description "Guest-Access-VLAN"
ip address 10.x.x.126 255.255.255.128
ip helper-address x.x.x.x
ip helper-address x.x.x.x
line vty 0 4
exec-timeout 7 0
authorization exec local_authorise
login authentication local_login
transport input ssh
line vty 5 15
exec-timeout 7 0
authorization exec local_authorise
login authentication local_login
transport input ssh
wsma agent exec
profile httplistener
profile httpslistener
wsma agent config
profile httplistener
profile httpslistener
wsma agent filesys
profile httplistener
profile httpslistener
wsma agent notify
profile httplistener
profile httpslistener
wsma profile listener httplistener
transport http
wsma profile listener httpslistener
transport https
wireless mobility controller
wlan Wireless-Guest-Access 24 wireless-guest
client vlan Guest-Access-VLAN
ip access-group GUEST-ACCESS
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
security web-auth
security web-auth authentication-list aaa_guest_webauth
security web-auth parameter-map guest-webauth
session-timeout 1800
no shutdown
ap country GB
ap group default-group
ap group BUS-AP-Group
wlan Wireless-Corporate-Access
vlan BUS-CORP-DATA-VLAN
wlan Wireless-Guest-Access
vlan Guest-Access-VLAN
end
I carried out a wireshark trace and can see the dhcp ok, then see DNS queries to the DNS name serever and the replies, followed by a TCP SYN to the resolved IP of the website requested - but that's it, there is no SYN ACK reply or redirect to the login page which i have placed on the flash and specified under 'custom-page login'
I am under the impression that the way this should work is as follows;
1. Client connects to SSID and carries out DHCP DORA and is assigned an IP address
2. open browser on client and carry out name resolution
3. once name is resolved, carry TCP three way handshake with requested site (e.g. google)
4. once three way handshake is completed client carries out an HTTP GET request
5. WLC holds the response and redirects to the login page
6. on successful login, original requested page is forwarded to client.
I can't seem to get a response - even if I remove the ACL.
Am i heading in the right direction or am I trying to achieve something which is not possible with my setup?
Cheers

also, forgot to say, make sure your files are preceeded with webauth for your html and js and web_auth for image files
38725 -rw- 4265 Nov 4 2014 12:21:28 +00:00 webauth_login.html
38726 -rw- 6937 Nov 4 2014 12:11:03 +00:00 webauth_aup.html
38727 -rw- 1356 Nov 4 2014 12:11:30 +00:00 webauth_logout.html
38728 -rw- 662 Nov 4 2014 12:11:43 +00:00 webauth_failed.html
38729 -rw- 318 Nov 4 2014 12:11:58 +00:00 webauth_loginscript.js
38731 -rw- 82940 Nov 4 2014 12:12:28 +00:00 web_auth_image.jpg
CORE-SW01#sho run | s param
parameter-map type webauth global
type webauth
virtual-ip ipv4 1.1.1.1
custom-page login device flash:webauth_login.html
custom-page failure device flash:webauth_failed.html
parameter-map type webauth guest-webauth
type webauth
custom-page login device flash:webauth_login.html
custom-page failure device flash:webauth_failed.html
security web-auth parameter-map guest-webauth
CORE-SW01#

Current best practice for Time service settings for Hyper-V 2012 R2 Host and guest OS's

I am trying to find out what the current best practice is for Time service settings in a Hyper-V 2012 environment. I find conflicting information. Can anyone point me in the right direction. I have found some different sources (links below) but again the
are not consistent. Thanks
http://blogs.msdn.com/b/virtual_pc_guy/archive/2010/11/19/time-synchronization-in-hyper-v.aspx
http://technet.microsoft.com/en-us/library/virtual_active_directory_domain_controller_virtualization_hyperv(v=ws.10).aspx
http://social.technet.microsoft.com/wiki/contents/articles/12709.time-services-for-a-domain-controller-on-hyper-v.aspx

From the first link provided by Brian, it does state that the time service should be off, but then the update changes that statement. Still best to rely on the first link in the OP - it was written by the guy that has been responsible for much of what
gets coded into Hyper-V, starting from before there ever was a Hyper-V. I'd say that's a pretty reliable source.
Time service
For virtual machines that are configured as domain controllers, it is recommended that you disable time synchronization between the host system and guest operating system acting as a domain controller. This enables your guest domain controller to synchronize
time from the domain hierarchy.
To disable the Hyper-V time synchronization provider, shut down the VM and clear the Time synchronization check box under Integration Services.
Note
This guidance has been recently updated to reflect the current recommendation to synchronize time for the guest domain controller from only the domain hierarchy, rather than the previous recommendation to partially disable time synchronization between the
host system and guest domain controller.
. : | : . : | : . tim

KB05133 - Email reconciliation features for BlackBerry Internet Service

There are lots of questions about what reconciliation features / functionality options there are with BIS ... well, from the horse's mouth, here we go:
KB05133 - Email reconciliation features for BlackBerry Internet Service
I tried to copy / paste the table but I'm not nearly savvy enough to successfully do it; so, click away!
If you've found a solution through a post; please mark it as a solution.
If someone's was particularly helpful, give them kudo's!.
Get busy living, or get busy dying.
http://blog.port3101.org/hdawg/

Hi
drastikbb wrote:
In the second set of instructions, going directly to the BIS web page, I cant get past the login page, I have tried to register, I have tried to login, I have asked service provider for passwords and I get one dead end after another, I cannot login nor create an account to login to the BIS web site.
Any help would be appreciated, after 10 years as a loyal Nokia user I am now hoping that the decision to move to BB was not one I will live to regret.
Regards
DS
When you go the BIS account on the PC, is this the place you were told to go by your service provider? My own has my carriers' logo on the page and they provided me with the login details whilst I was on the phone to them. It is THEIR responsibility to set up your BIS and to assist you.
Whether you try OTA or on the PC, you must have access to your BIS and when you finally get it, setting up the email couldn't be easier.
I cannot see why upgrading to OS 6 would affect email set-up but as you suggest, the option to put email server details in may have been removed. They are not necessary with BIS.
Blackberry Best Advice - Back-up weekly
If I have helped you please check the "Kudos" star on the right >>>>

Blackberry is popular in Iran despite sanctions-a great market for blackberry

Iran is considered the largest market for cellular phones in the middle east [guardian].
Blackberry z10 sales have started since February in the world. There is no official Blackberry store in Iran, but market demand has made importers bypass restrictions to bring Blackberry z10 products into the country 48 hours after the canada!!!
Because of recent sanctions by usa, the price of dollors became triple since last year and Iranians have to pay more money to buy a smart phone. salary of an engineer in iran become $250 per month !! (I used this example to let you know about the situation). So number of selling smart phones reduced %50 and unfortunately Apple and Blackberry lost a huge market in middle east.Three another companies (samsung,LG and sony) still remain in iran and by financial supporting of iran's government and good relationship with japan and s-korea they have good market.
In middle of February the price of z10 was more than $1500 in iran (equal to 6 months salary of an engineer in iran!!) but fortunetly the price have decreased continuously since march. The BB z10 is selling about $600 in market now. However, I belived that most of them are refurbished and is sold to us as new one!!
There is a great potential for selling Blackberry in iran. About %40 of iranians are under 30 years old (about 30 million people) and most of them so interested in loyal and American smart phones such as iphone.
After coming BB z10 to iran, many people prefer to use it to iphone. a lot of stores started to sell BB z10 and many seller said iphone placement will replaced by BB z10. but after 1 month many customers returning their Z10s and they wanted to sell it with cheaper price.They said all services was blocked in iran. it was not possible to update BB OS, you can't to buy applicaions from app store, you can't to use BB email,BBM ,.... . Many buyer complained that the GPRS is deactive by BB and wifi disconnected continual by BB sever. so the BB services that you can use iran is equal to Nokia 1100.
Itunes and google play also have been closed their services to iranians. However, a lot of way exists to use their service . For example by changing IP, using VPN or rooting ( or jailbreaking) mobile phones you can access ti itunes. so BB will lost a great market in the world. I read a news about returning BB z10 in usa. If BB had official service and store in iran (similar to samsung,LG,sony), they would sold more than 1 million smart phone in iran.
The focus of the sanctions has been on Iran's banks and oil industry, Iranian individuals and companies that Western capitals believe are assisting what they suspect is Tehran's drive towards a nuclear weapons capability. However I belived that eventhough sanctions made a lot of problem for iranians in iran, a lot of problem also has been made for western companies such as BB which interest to be iran market.
at the end I have some suggestion for BB company, If they want to sell their mobile phones in iran:
1. please let iranians install application from app world and let get updates (do not fear!! no body use them for nuclear prog ram )
2. please add persian keyboard to your os (you can add 5 letter to arabic keyboard to convert it to persian, it is not difficult).
3. please add the name of iran to your country lists and let us to register in your website.
4. find a local distributor in iran and import your device legal. government give importer companies dollar with cheaper price, so company can sell smartphones with lower price in iran.
Mohammad

I think, i success.
App store of blackberry, Google, Apple will open to Iranians soon. USA omitted mobile phone sanctions two days ago. Also, North american companies could open local distributor in iran:
http://www.phonearena.com/news/Apple-iPhone-to-be-sold-in-Iran_id43543
I do not know, may they read my crying essay here and in following link and response to my request
http://forums.crackberry.com/blackberry-z10-f254/iran-great-market-blackberry-blackberry-popular-ira...

Blackberry service not working while internet is working

Hi,
I bought the blackberry tour 9630 last week online (v 5.0.0.975) and i am battling since then to register the blackberry service. I am new to the BB world , hence I will provide the details of the course of events:
-I called my network provider (Cell C of South Africa) and signed up for the BIS service. I was adviced to reboot my phone. I did so and I did the diagnostic test. It shows radio connectivity but the ICMP ping echo fails and blackberry registration =No, connected to BB=abort, PIN-PIN=abort. I tried rebooting the phone (some hard reset as well). same result except in some cases the ICMP ping test says=Yes. The MSISDN displayed there is not my number, it displays a number from India.
-I called up the operator and told them the problem. They linked the BB PIN with my own number on the BB server(I guess) and asked me to do a hard reset. I did so, but the result is the same, still the old MSISDN showing. The agent told me that Cell C (my operator) does not have an agreement with BB for this model (I doubt if she has full understanding of how BB devices supposed to work). I did check with the MEPD code that this device is unlocked (everything was displayed disabled).
-I then sent the 'register now' from the 'Host routing table'. I did not receive anything at that time, hence sent a couple of 'register now' request. The following day I started receiving the sms from Blackberry 'Your handheld has been registered with the wireless network'. I received couple of them, looks like every time I move from 2G to 3G or vice versa I receive that message.
-I tried the whole process of diagnostic testing again after receiving this message, still the same (BB registration fails).
-Itried changing the pre-defined MSISDN on the handheld from Advanced option>SIM card, it said 'error accessing SIM'.
Does anyone has any idea of what is going on? I need to know if the problem can be fixed before I send back the phone.

ironman54 wrote:
Why would un hooking the wires and re hooking then work ??? I have this same problem - have been working with electronics since early 60's and this 'fix' would never have occured to me ! It sound like what many guys do when their car won't start - open the hood, jiggle the battery cables, stare at the engine and then call for the tow truck ! LOL !! Is there some type of 'reset' function like unplugging a unit from the A/C for 10 seconds to 'reset' or similar ?? Otherwise I don't 'get' why thise would fix anything. Its great that it worked but quite frankly it doesn't make a whol;e lot of sense unless one or more wires had been disconnected to begin with.
You say this was a 'common sense' repair, care to elaborate please 'cause the cold weather is coming and the set up I have now will not be very practicle in the cold weather: I'm runnng an extension wire out through the window to the jack on the service box. All inside wiring appears to be 'dead'. This doesn't make sense to me either considering the house is relatively new construction. Not like the wiring is ancient or anyhting.....ok, please enlighten me !
Probably because somewhere one of the jacks has corrosion in it and is shorting. When removing the plugs check the connections pins for green copper salts and if you see any clean them up and also the corrosion that is probably on the rj11 jack connectors too.

Facebook and Twitter for Blackberry..

Is Facebook and Twitter for Blackberry fine? I tried to download it to my BB phone but it says it doesn't support it. Do I have to download a different link? I need help asap.
I love my BB!

I got mine working. If your service provider is globe you should use their service which is BB Social but 300 a month. BB SOCIAL ON send to 8888. You'll get confirmation messages and twitter, facebook and adding email will be no problem.
I love my BB!

How do I use hotmail via Blackberry services and not via phone network so not using up my data?

Hi,
I have a new Blackberry 9360 and am having trouble with it. They said in the shop that I can access my yahoo mail without using up my 250mb of internet data, so can access it using the Blackberry services rather than the internet. I can't work out how to do this and can only seem to use the email through the internet where the messages come into my 'Messages' on the 'Home' screen, therefore I'm using up my data every time I open an email message when it comes in.
Can anyone please help me as I'm wishing I could go back to Nokia at the mo!
Many thanks.

Hi, thanks for your reply.
They gave me the impresssion in the shop that I could access my existing yahoo hotmail, send and receive messages on it for free via the BlackBerry services and not use up my data allowance and they didn't mean the Blackberry email which is a different thing. Have they misled me with this?
Many thanks for any advice.

How to use ISE Guest Portal for AD users

Hi there,
As subject explains all, I want to use ISE Guest Portal for my domain users. I have tried many different ways to authenticate users and finally I came to the conclusion that ISE CWA works pretty well and is very stable. WLC Webauth sucks alot, does not redirect to the login page always.
Can you please share what other ways are stable ways to authenticate AD users? I know about WPA 802.1x authentication but that requires a CA in the network which is not available at the moment. So can you please Suggect?
Otherwise, I want to use ISE Guest Portal for my AD users as well. AD is already integrated to ISE, the issue happens when I attempt to athenticate using AD user account, the user gets authenticated but the Guest Portal redirects me to Device Provissioning page and there it shows an error saying "there is not policy to register the device, contact system admin"
Am I missing something??
I am running WLC 5760 with ISE 1.2
Thanks in advance..

Hi,
Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
Thanks,
Tarik Admani
*Please rate helpful posts*

Any roadmap to have to Lync client for Blackberry 10?

...with full feature support of course (phone, video, presence,...).
I know there are still some challenges like at current time with BB10 OS (like you must keep you app in an active frame), but these limitations will soon go away with the new OS version (http://devblog.blackberry.com/2013/05/blackberry-jam-headless-invoke/?CPID=E10C020,
new Background Services framework which allows developers to bundle a separate process with their application to run in the background without a UI)
The Lync for Mac version still lacks of some critical phone features not being implemented (delegate support, team-call group members, wireless QoS tagging 802.11e,...)

Hi,
There is currently no Lync client available for Blackberry (RIM) devices. Sorry to say I also did not find any roadmap about lync for Blackberry 10.
Kent Huang
TechNet Community Support

[Ask & Note] Feedback for BlackBerry 10

Hi,
I have some feedback for blackberry team but I don't know where to post it..
So I'll just post it here and please let me know if this room is not the place for my post.. Thanks..
I'm now using BB10 (Q10) and have some feedback for blackberry, so I hope this feedback can be used to improve BB10 features and also increase the easy to use and popularity of BB10
Here is the list:
1. Auto suggestion for email address (To/CC/BCC). Here I'd experienced that this features is useful and also very much annoying, why? because the list is come from the recent email address that we use to send and also from email address that have send email to us including the SPAM email (if coming to our BB Inbox), my suggestion is to make some feature/menu for user to have option for clean-up the list of email suggestion or user can delete some email in the list if they feel that email is not necessary to be there (like we will never send email to DoNotReply email from some company/domain).
2. Recent Updates in BBM. I'm one of some users that not using 'Recent Updates' feature in BBM, and this feature is one of the reason why my BB battery drain so fast.. Correct there is option to turn off the 'Recent Updates' but the way is so much not user friendly, I must tap and hold each and every one in my contact list updates and hide their updates from my BBM, why not just put one option in setting for turn off ALL Updates (like u have in old BBM)? I think it will be more acceptable in this world compared to hide one by one (imagine if you have more than 1000 contacts in your BBM) and you must do it every time you do complete clean firmware upgrade.
3. Mobile Network vs Wifi. I don't know this is just happen in my BB or other's too. My experience is, if I was connected to a wifi network and turned off my wifi, the connection supposed to be from Mobile Network, but what happened in my device is, the connection just shown E / 3G without BB logo (means no connection to Blackberry Service), it's happen until I manually turn off the Mobile Network and turn it on again or change my Network from 2G to 3G only vice versa. Please do check about this problem.
so far that's the feedbacks from me, please let me know if there is some mistake in my post..
Thanks a lot..
I hope Blackberry will grown up again and more bigger than before..
Best Regards and Thanks,
Hartawan

There is no link to suggest anything to BlackBerry but if any of the BlackBerry employees who browse these forums are going to look anywhere then it will be here...
http://supportforums.blackberry.com/t5/BlackBerry-10-Smartphone/Feature-Requests-for-BlackBerry10-OS...
If you've been helped click on , if you've been saved buy the app.
Developer of stokLocker, Sympatico and Super Sentences.

Why Mobilicity charges BIS for Blackberry 10 OS?

Hello,
I have data plan with Mobility Canada, when I changed from Android to Blackberry, the data doesn't work. I called my carrier a few times, they all told me the samething, they need to set up BIS for my phone, but when I explained to them that the 10 OS doesn't require BIS, they are clueless but insist to charge me extra to get it work.
Blackberry claimed that it will work with normal data plan, why it doesn't allow the user to change/update the APN instead let the carrier charge the user for a fee to fix it? Or even automatically update with whatever APN that works with the carrier?

Mobilicity wrote back to me:
"We are sorry that your were misinformed.
Mobilicity does not charge an additional cost for BlackBerry internet service for the BlackBerry Z10. If you purchase a third party BlackBerry Z10 you would be charged for the first month only."
I hope that explains things. If not, their number is 1-877-866-2458.
Cheers.
- If my response has helped you, please click "Options" beside my post and mark it as solved. Clicking the "thumbs up" icon near the bottom of my response would also be appreciated.

Bypass guest webauth for Blackberry Service

Similar Messages

Maybe you are looking for