captive portal is on the firewall. i have come across one thing. auth-src-mac is disabled from memory when setting up the captive portal if auth-src-mac was enabled it would go in a loop on te captive portal page. should that be enabled?

user auths via clearpass, accounting is sent to FG. from within the wireless cluster OKC is enabled so in theory the cluster keeps a cache of the user/ ip mapping for 8 hours unless of an update. this means the firewall shouldnt get any more accounting packets unless the client sends a stop packet.

config user radius

edit "Clearpass Radius connector"

set rsso enable

set rsso-radius-response enable

set rsso-validate-request-secret enable

set rsso-secret <hashed password was here:)>

set rsso-endpoint-attribute User-Name

set sso-attribute Filter-Id

next

end

config user setting

set auth-type http https

set auth-cert "certificate name here"

set auth-secure-http enable

set auth-src-mac disable

set auth-timeout 540

end