Hotspot Manager. Configuration guide for Cisco WLC. ADIPSYS SAS 2405 route des Dolines Valbonne Sophia-Antipolis

Transcription

1 Hotspot Manager Configuration guide for Cisco WLC ADIPSYS SAS 2405 route des Dolines Valbonne Sophia-Antipolis ADIPSYS Configuration guide for Cisco WLC v1.5 1

2 Summary I. Introduction... 3 II. Cisco WLC configuration... 3 A. General Configuration... 3 B. Radius Server Authentication Accounting... 6 C. Access Lists... 6 D. Web redirection... 8 E. SSID configuration... 9 III. Cisco WLC configuration in Hotspot Manager A. Add the controller in HM B. Hotspot Configuration IV. Hotspot Manager Compliancy Matrix ADIPSYS Configuration guide for Cisco WLC v1.5 2

3 I. Introduction This document describes the configuration of a Cisco Wireless LAN Controller with Hotspot Manager Platform. The reference equipments used to write this guide are : Cisco WLC 2504 Wireless LAN Controller AIR-LAP1142N-E-K9 Dual band 2.4GHz 5GHz - Tests have been executed with firmware version The solution has also been validated on other WLC : 2125, 4404, 5508, 6500, Virtual WLC. The following parameters for Hotspot Manager were used in this guide, you will have to adapt them to your setup : RADIUS server RADIUS secret RADIUS NAS-ID Web URL Redirection E8687C55C585B7A1A83D0640F39E3AE3 D0-C2-82-E1-B1-20 Mac Address of your WLC II. Cisco WLC configuration Connect to the admin interface of your WLC to proceed the following setup A. General Configuration First, you have to configure network settings, specially the IP address for the management interface. Go to Controller -> Interfaces, then click on Management. ADIPSYS Configuration guide for Cisco WLC v1.5 3

4 Enter the network parameters of the controller on your LAN. You ll also see the MAC address of the WLC here. You will have to adapt the interface address parameters to your network environment. Then, you ll have to configure the NAS-ID parameter value that will be sent in Radius requests to uniquely identify your controller. The NAS-ID is usually defined by using the Mac ADIPSYS Configuration guide for Cisco WLC v1.5 4

5 Address of the controller formatted as XX-YY-ZZ-AA-BB-CC to ensure the symmetrical configuration of the device with Hotspot Manager. To configure it, go to Controller -> General. Modify the value of the Name field with the Mac Address of the controller. In this example, the NAS-ID value will be «D0-C2-82-E1-B1-20». B. Radius Server 1. Authentication Go to Security -> AAA -> Radius -> Authentication Select AP MAC Address as Auth Call Station ID Type. Select Hypen as MAC Delimiter. Click on Apply (top right) then on New to define the external Radius server in charge of authentication requests. ADIPSYS Configuration guide for Cisco WLC v1.5 5

6 Enter the following parameters : - Server IP Address : IP of radius server ( for demo.hotspotmanager.fr) - Shared Secret : E8687C55C585B7A1A83D0640F39E3AE3 - Port Number : 1812 (default port for Radius authentication) Click on Apply to validate changes. 2. Accounting Go to Security -> AAA -> Radius -> Accounting Set the same settings used for Authentication : - AP MAC Address as Acct Call Station ID Type. - Hypen as MAC Delimiter. Click on Apply then on New to define the external Radius server in charge of collecting accounting datas. Set the same settings used for Authentication except port number : - Server IP Address : IP of radius server ( for demo.hotspotmanager.fr) - Shared Secret : E8687C55C585B7A1A83D0640F39E3AE3 - Port Number : 1813 (default port for Radius accounting) Click on Apply to validate changes. C. Access Lists Go to Security -> Access Control Lists -> Access Control Lists Click on New to add an Access Control List, choose a name and click on Apply. ADIPSYS Configuration guide for Cisco WLC v1.5 6

7 Then click on that new ACL to edit it. Click on Add New Rule (top right) For that first ACL, enter the following parameters : - Sequence : 1 - Source : select IP Address and enter the IP of Hotspot Manager server (here ) and Netmask at to target only HM server - Protocol : select TCP - Direction : select Outbound - Action : select Permit Click on Apply to validate changes. Then create a new rule for Inbound direction. For this second ACL, enter the following parameters : - Sequence : 2 - Destination : select IP Address and enter the IP of Hotspot Manager server (here ) and Netmask at to target only HM server - Protocol : select TCP - Direction : select Inbound - Action : select Permit Click on Apply to validate changes. ADIPSYS Configuration guide for Cisco WLC v1.5 7

8 If external websites have to be added in the Walled Garden to be accessible by devices connected but not authenticated (PayPal or Facebook connection for example), you can add URLs by hovering the arrow next to your ACL name. D. Web redirection Go to Security -> Web Auth -> Web Login Page ADIPSYS Configuration guide for Cisco WLC v1.5 8

9 Set the following parameters : - Web Authentication Type : External (Redirect to external server) - External Webauth URL : the target url for Hotspot Manager (for example for our demo instance : Click on Apply to validate changes. E. SSID configuration Go to WLANs -> WLANs, select Create New and click on Go Set a Profile Name and the SSID name that will be broadcasted by the Hotspot. Click on Apply to validate changes. Under General tab, check the Status box to enable the SSID Under Security tab -> Layer 2, select None as Layer 2 Security parameter. Under Security tab -> Layer 3, select Web Policy and the ACL created previously as Preauthentication ACL (here ACL_DEMO) ADIPSYS Configuration guide for Cisco WLC v1.5 9

10 Under Security tab -> AAA Servers, check to following boxes to enable options : - Radius Server Overwrite interface - Authentication Servers and select radius server configured previously - Accounting Servers and select radius server configured previously Then, modify the Authentication priority order for web-auth user to have Radius on top of the list. ADIPSYS Configuration guide for Cisco WLC v1.5 10

11 Under Advanced tab : - Check the box Allow AAA Override - Uncheck the box Enable Session Timeout Click on Apply to validate changes. Don t forget to click on Save Configuration (top right) to retain your configuration after a reboot. Your WLC is now ready to be configured in Hotspot Manager interface. ADIPSYS Configuration guide for Cisco WLC v1.5 11

12 III. Cisco WLC configuration in Hotspot Manager To access Hotspot Manager platform you ll need an admin account. Contact to have your credentials. Then connect to and enter your credentials. A. Add the controller in HM Under Configurations -> Access Controllers - NAS-ID : enter here the same NAS-ID you ve configured previously. - Monitor : if enabled, HM will monitor the radius activity. - COA : default port for Change Of Authorization requests. B. Hotspot Configuration Once the WLC has been created, it has to be associated to a Wifi Zone and the AP will have to be associated to a Hotspot. (Please refer to HM configuration guide for more details) To identify which APs your WLC manages, go to Wireless -> Access Points (in the WLC interface) to see the list of all known aps by your WLC. ADIPSYS Configuration guide for Cisco WLC v1.5 12

13 Click on the one you want to configure in HM to get its Mac Address which will be the Base Radio Mac value (here 0C AB-DD-E0) Once you have all necessary Macs, you can create APs in HM under APs tab. ADIPSYS Configuration guide for Cisco WLC v1.5 13

14 Set : - the Name of the AP displayed in HM - the Access Controller to be linked with the AP. - the MAC address (base radio mac of the AP). Setup finished. Now when a device will connect to the SSID broadcasted by APs linked to your WLC, it will be redirected to the captive portal associated in HM interface. If you re getting an error message, check APs Mac Address configured in the Hotspot. If you re not getting the configuration to work, open a ticket on support.adipsys.com and attach a snapshot if it s possible. IV. Hotspot Manager Compliancy Matrix Features available, compatible or not with this controller and Hotspot Manager. Web authentication yes When a user tries to log into the hotspot, he must authenticate through a web captive portal with a couple of login / password Duration yes Amount of time a user can log into the hotspot before his credit is sold out Validity yes Amount of time before the credentials of a user expire Idle-Timeout no Amount of time of inactivity before a user is disconnected from the hotspot Maximum duration per Amount of time a user can be logged into the hotspot before having to yes session (Session-Timeout) re-authenticate Quota received data no Maximum volume of data a user can receive before his credit is sold out Quota sent data no Maximum volume of data a user can send before his credit is sold out RADIUS Change of Authorization (CoA) / Disconnect yes Allows HM to contact the Controller to modify the parameters of an ongoing session (CoA) / disconnect an end-user (Disconnect) Maximum download speed yes Maximum download speed allowed for the user (rate limiting) Maximum upload speed yes Maximum upload speed allowed for the user (rate limiting) Redirect SSL og Allows to redirect any HTTPs request initiated by an unauthentified device towards the captive portal Legal log External yes yes no og nct The feature is available today and validated The feature exists on the controller but uses a vendor specific profile The feature does not exist on the controller Ongoing or to be confirmed New compliancy tests planned ADIPSYS Configuration guide for Cisco WLC v1.5 14