Creating OnGuard Custom Web Pages

OnGuard provides the ability to show end users a custom interface, or wizard, that guides them through the remediation process if their device is quarantined. When this feature is enabled and OnGuard needs to run a custom remediation script, the wizard tells the user why the device was denied network access, describes the tasks that are required to fix the problem, and lets the user choose whether to execute the remedial script or not. While the script is being executed and new health checks are run, progress messages are displayed.

The pages of the wizard are created using Policy Manager Guest’s Web Pages configuration forms, and can be customized with logo, text, and images (for details, refer to the Custom User Interface parameter in Table 1, the OnGuard Settings Parameters table).

Enabling the Show Custom User Interface for Custom Scripts Attribute

To configure the Show Custom UI for Custom Scripts attribute:

1. Navigate to Configuration > Enforcement > Profiles, then select or add the Agent Enforcement profile.

Figure 1  Agent Enforcement > Profile Tab

2. Configure the Agent Enforcement Profile as described in Agent Enforcement Profile.

3. Select the Attributes tab.

4. From the Attribute Name drop-down, select Show Custom UI for Custom Scripts.

Figure 2  Enabling the Show Custom UI for Custom Scripts Attribute

5. To set this attribute to True, click the Attribute Value check box.

Figure 3  Show Custom UI for Custom Scripts Attribute Enabled

6. If needed, complete the configuration for the Agent Enforcement Profile, then click Save.

7. Use the Agent Script Enforcement Profile to specify the Success Message, Failure Message, Progress Message, and Description parameters, as well as other script-related attributes (for configuration details, refer to Configuring Agent Script Enforcement Attributes).

This step is required because the attributes in the Agent Script Enforcement Profile are used when the Custom UI User Interface. for Custom Scripts is enabled.

Creating OnGuard Custom Web Pages

To create the OnGuard custom web pages:

1. Navigate to Administration > Agents and Software Updates > OnGuard Settings.

The OnGuard Settings page opens.

2. Scroll down to the Agent Remediation User Interface Customization section.

Figure 4  Agent Remediation User Interface Customization

3. To enable the Custom User Interface configuration, click (enable) the Configure check box.

The dialog is expanded to show the list of custom web pages you can configure, as well as options to define window behavior and managed interfaces.

Figure 5  Agent Remediation User Interface Customization Dialog

4. Configure window behavior as described in the following table:

Table 1: Configuring the Custom Web Page Advanced Settings Parameters

Parameter	Action/Description
Window Behavior	Enable one or more Window Behavior settings: Always on Top: The Custom User Interface window will always be on top of any other windows present. Allow Minimize: When set to True, the Custom User Interface window can be minimized. Allow Close: Prevents users from closing the Custom User Interface window. If set to True, users will be allowed to close the Custom User Interface window; however, the execution of custom scripts will continue in the background. NOTE: Even if the Allow Close option is enabled, OnGuard Agent disables the Close button of the custom custom user interface while it is loading a page.
Window Size	Specify the window height and width, as well as whether the window size should be a percentage of the the client's screen or defined by the size in pixels.
Native Dissolvable Agent Customization
Managed Interfaces	The Native Dissolvable Agent performs health checks for one of the selected interfaces. This feature ensures that, if both wired and wireless interfaces are connected, the OnGuard Agent will send health requests through the correct interface. Select the type(s) of managed interfaces that are supported for the Native Dissolvable Agent. Select the type(s) of interfaces that are supported for the Native Dissolvable Agent: Wired Wireless VPN Virtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. Other

5. Click the Create link for the OnGuard custom web page you want to create.

The Create Web Page (New) > Web Page Settings configuration dialog opens.

Figure 6  Configuring a New OnGuard Custom Web Page

6. Specify the required Create Web Page parameters as described in the following table:

Table 2: Configuring OnGuard Create Web Page Parameters

Attribute Name	Action/Description
Name	Enter a name for the web page. This name is shown only to administrators.
Page Name	Enter a page name for this web page. The web page will be accessible from “/guest/page_name.php."
Enabled	Click (enable) this check box to enable this web page.
Description	Optionally, enter comments or notes about this web page. This description is shown only to administrators.
Skin	From the Skin drop-down, select the skin to apply to this web page.
Title	Enter the title to be displayed on the web page.
HTML	Enter the required names for each OnGuard custom web page as well as the recommended HTML content. For details, see HTML Content for OnGuard Custom Web Pages below.

Advanced Settings and Access Control

To configure the Custom Web Page Advanced Settings and Access Control settings:

1. From the Create Web Page (New) dialog, check (enable) the Show advanced settings option.

The Advanced Settings section expands to show the full set of advanced options.

Figure 7  Custom Web Page Advanced Settings

2. Specify the Advanced settings and Access Control settings as described in the following table:

Table 3: Configuring the Custom Web Page Advanced Settings and Access Control Parameters

Parameter	Action/Description
Advanced Settings
Show advanced settings	To view the Advanced Settings, click the Show advanced settings check box.
Prevent CNA Captive Network Assistant. CNA is a popup page shown when joining a network that has a captive portal.	The Apple Captive Network Assistant (CNA Captive Network Assistant. CNA is a popup page shown when joining a network that has a captive portal.) is the pop-up browser shown when joining a network that has a captive portal A captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users.. Note that this option may not work with all vendors, depending on how the captive portal A captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. is implemented.
Translations	Enable this check box to skip automatic translation handling. Selecting this option keeps all the current text as the default. From Policy Manager Guest, many fields and pages have translations available under Configuration > Translations > Page Customizations.
Access Control
Allowed Access	Enter the IP addresses and networks from which access is permitted.
Denied Access	Enter the IP addresses and networks that are denied access.
Deny Behavior	From the drop-down, select one of the following responses to a request that is not permitted: Send HTTP Hypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. 404 Not Found status Show Access Denied page Show a blank page

3. Click Create Page.

The OnGuard custom web page is created.

HTML Content for OnGuard Custom Web Pages

This section provides the required names for each OnGuard custom web page as well as the recommended HTML content. Be sure to use the Page Names specified here as ClearPass Policy Manager and OnGuard Agent look for pages with these names. Text in italics should not be changed.

Important Points

Note the following OnGuard Agent behaviors when using the Custom User Interface for Custom Scripts.

1. OnGuard Agent checks the custom script's exit code to compute the custom script's status.

2. OnGuard Agent determines the final page based on the script's exit codes and the client's health status. For details, see the next section, OnGuard Custom Script Exit Codes.

3. This feature is not supported when OnGuard is running as a service.

4. The Custom User Interface loads a fresh web page from Policy Manager Guest every time. It does not cache the pages.

5. If the user closes the Custom User Interface while the script is executing, OnGuard Agent continues executing scripts without the Custom User Interface.

6. Administrators will have to refresh or open the OnGuard Settings page again after creating web pages in Policy Manager Guest (Administration > Agents and Software Updates > OnGuard Settings).

7. If the Policy Manager Server Certificate is not validated when Policy Manager loads the web page for the first time, the Custom User Interface displays the following security alert:

Figure 8  Server Certificate Not Validated Security Alert

8. A new option, Server Communication Mode, has been added in Global Agent Settings that you can configure to avoid receiving a Server Certificate security alert (see the Server Communication Mode parameter description in Global Agent Settings Parameters for OnGuard Agents).

OnGuard Custom Script Exit Codes

The OnGuard custom script exit codes are comprised of Success Codes and Failure Codes as described below: