GuestAir Administrators Guide

Transcription

1 GuestAir Administrators Guide 1. Introduction 2. Companies 3. Users 4. Zones 5. SonicWALL Configuration 6. s 7. User Auth Logins 8. User Registration 9. Facebook Logins 10. Editing Templates 11. File Browser 12. Token Auth Logins 13. Auth Logins 14. Mobile Auth Logins 15. Mac Auth Logins 16. Sessions 17. Traffic 18. Devices and Licensing 19. Logs 20. Troubleshooting Setting up GuestAir Go to and login with your username and password To Set up and use GuestAir you will need to create in the order below: The Company or Companies Users Zones SonicWALL WLAN Guest Zone 1 P a g e

2 Introduction Welcome to the GuestAir administrator s guide, GuestAir is a Cloud based external authentication server for use with SonicWALL s UTM Guest Services otherwise known as LHM, primarily for the Wireless Zones but can be tested and used on a Wired Zone if required. GuestAir is the ideal solution for Resellers/Customers to provide free public wireless access for Hotels, Shopping Centres, Health and Fitness Clubs, Golf Clubs, Conference Centres, Cafes, and Bars etc. The options for User Login are: Tokens Authentication ( authentication using a Token provided and contact details ) Authentication ( a confirmation is sent to the users address to confirm for access) SMS Mobile Authentication (authentication using Mobile Telephone Number) User Authentication (authentication for Permanent users added users in the GuestAir Users section) and users created using the registration portal. Facebook Authentication (login with a Facebook account, by using a zone tied to a Facebook company page) MAC Authentication ( this is used to enable certain devices to connect bypassing any authentication by the stored MAC addresses ) Bypass Authentication (used with no authentication but redirects to a company policy page) and user is logged via MAC address format in the SonicWALL Splash Screen option for different Login Methods The End User will be redirected to a screen like below, where they can enter their details and be granted access to the Internet via your Guest WiFi. 2 P a g e

3 Companies Setting up Companies As a Reseller you can set up a Company or Companies, if you are reselling to a company this works in a hierarchal order from your company down as in the example shown below, only the Parent Company can make changes in their level and below, so using the example shown below The Reseller Admin can make changes to all their Companies. An Admin User in Large Customer can make changes in all companies down to Branch 1 or Branch 2. An Admin User in Sub Company 1 can make changes to Sub Company 1. Branch 1 and Branch 2 An Admin User created in Sub Company 2 can only make changes in his own level Sub Company 2 An Admin User created in SOHO Customer can only make changes in their own Company 3 P a g e

4 To set up a Company, select Companies and New then enter your Company Info details, if you are creating a Sub Company change the Parent Company from the drop down to the desire parent company. If you are wishing to use the SMS Authentication then you will need to enter your SMS Gateway details 4 P a g e

5 On the Tab enter your details to be used with the Authentication if needed for the SSL otherwise one will be sent from GuestAir on your behalf by using Default (extra settings needed are set up in the Auth Zone / Auth Settings) Once you have created a company you will need to create User Accounts for this Company for example an Admin User and a Token Generator this can be done in the next chapter. 5 P a g e

6 Users There are different types of User Roles depending whether you are a Reseller or Customer (End-User) Admin Token Generator Marketing Admin Reports User Wireless Member User Admin The Admin account for Reseller has Full Admin rights to their level and all the companies it creates. The Admin account for the Customer has full Admin rights to their level and companies below. The Admin User can create other all other User account types including other Admin Users if needed. Token Generator The Token Generator User only has the privilege to generate tokens for their company level. If a Token Generator User is created for a large company with several small sites (customers) then if the User is created at the Parent company level they can create tokens for all of the small sites below the parent company, if you only want them to be able to generate tokens for one site then create the User at that Site (company) only. Marketing Admin The Marketing Admin has only access to edit certain areas to change logos, adverts, URL redirection and to collect session stats for Mailshots. Reports User The Reports Users has only access to the Traffic and Sessions pages to gather information for reports. Wireless Member User The Wireless Member User is only for permanent users who are created for the Zone User Authentication method, you can manually add them or they can be created automatically by the user registering for your company via the Zones Portal using User Authentication. Wireless Member Users have no permissions and they cannot login to the GuestAir Admin Portal. 6 P a g e

7 Creating User Accounts To Create Users Log in to the GuestAir Portal as an Admin at When you have received your License(s) you will be automatically created an Admin account and the details will be ed to you with your random generated password which you can change after the initial login Go to Users, select new then enter the required address and password 7 P a g e

8 Zones Zones are the Portals that the Wireless Client will be redirected to when they try to browse the Internet. Each Zone has a unique ID number this is used when setting up the SonicWALL external guest authentication keep a note of the ID number. Setting up Zones To set up a Zone(s) select Zones then New, give the Zone a name Ideally the name of the company and or location if a branch office zone. Select which Company you wish the Zone to apply to from the Company drop down bar. Select the correct method of authentication from the Auth Settings Tab N.B. The Customize Pages is in the next chapter Editing Templates 8 P a g e

9 On the Connectivity Tab enter the Authentication Method, this will need to be entered on the SonicWALL Guest Zones settings also, the shared secret. If your SonicWALL is behind NAT then you will have to enter the Public IP in the Management IP Override. Enter your desired Post Authentication URL. Now choose the Auth Settings Tab and select the Auth Settings to be used on the Zone, there are extra settings depending on the authentication chosen; these are described in more detail in the relevant authentication sections in this guide. 9 P a g e

10 Setting up the SonicWALL N.B. The screen shots used are based on SonicWALL firmware 5.9 First we need to create two Network Address Objects these are to be used to allow access to the Guest Air Servers and DNS servers, go to Network/ Address Objects scroll to the bottom of the page and select add, enter the details as below, if hosting the CSS files locally you will also need to allow that IP also. Scroll to the top of the Network Address Object page and create a Group we ve called our Guest Air Pass Networks, select the two address objects and put in the group. 10 P a g e

11 Now select the Zone to be used with Guest Access Configure the Zone by selecting the Pencil Icon 11 P a g e

12 Select the Guest Service Tab and tick Enable Guest Services, Enable External Guest Authentication and Select on the Pass Networks the Address Object Group we created earlier and enter the Max Guests required depending on appliance 255 Max on the NSA 240 used here. 12 P a g e

13 Click Configure next to the Enable External Guest Authentication and enter the details as below The GuestAir system uses the concept of Zones. The number shown below 1 in yellow refers to the zone number used in this test. You will need to substitute with your zone number. 13 P a g e

14 Editing Templates To Edit the Zone templates select the Page required to edit as in the picture below To create or Edit the Template choose Customize Pages tab then select Zone Landing Page: 14 P a g e

15 You will now see a page like below, on the top there is a Menu Bar as below Select Edit to change the appearance using the WYSIWYG Menu, change the layout add Logos edit the code etc... See examples below HTML Formatting Bold Italic Deleted Bullet List Numbered List Outdent Indent Insert Image Insert Video Table Link Font Colour Back Colour Alignment Insert Blue Line Save to Disk Load From Disk Load New Template Apply Changes To Load a new Template select the Load new Template Icon 15 P a g e

16 You will then see the File Browser list with all the available pre-loaded templates for you to use, for more options on the File Browser see the next chapter. Double click template file to select and Load the new Template Now click the Apply Changes Icon N.B. Don t forget to click save on the Zone page behind you should see Modified click save at the bottom to confirm. 16 P a g e

17 To Edit the elements of the template you can edit on the template page by changing text or importing images etc.. or you can switch to the HTML (This is the recommended method for advanced users) and edit the code manually (just be careful not to remove any of the code needed by GuestAir) it is recommended that you export your template before making any changes so you will always have a working copy to re-import back in if any errors are made and accidently saved. TIP (as long as you don t click save on the Customize Pages Tab you can always close and the changes won t have been applied). To edit the pictures you can select an image on your portal and select edit N.B. this method will add the image above the existing image, so you will have to delete the existing image after by clicking on it select Edit then delete. Then Select the Insert Image Icon from the Menu 17 P a g e

18 You can Drag and Drop an image in or browse to the location Also you can insert the URL to the images location If needed you can select a link for the image to redirect for adverts or promotions etc by clicking the image and selecting Edit on the image (Leave the image position as None). 18 P a g e

19 To edit the HTML select the HTML Icon To Override the CSS or the Background for your template add the following code replacing test server.com with your own URL with the link to your files in the File Browser like below N.B. Be careful with JavaScript files as the GuestAir Portal uses Java and any incorrect Java references added may cause instability with your Zone and may not allow you to edit or save changes, if this happens, contact your support team, as always recommended always export your template before making any changes then you always have a working backup. Custom CSS override <link type="text/css" href="/files/company_64/private/company 1/css/default.css " rel="stylesheet" media="screen"> Background Inline CSS override <body style="background: url ('/files/company_64/private/company 1/img/Background.jpg') no-repeat fixed;"> 19 P a g e

20 File Browser To upload your Files to use on the Zone Template, create a new folder by selecting the New Folder Icon as below Once created you can rename, delete etc... By right clicking on the folder 20 P a g e

21 You can then add Files by simply Dragging and dropping in the open folder the only exception is you cannot drag whole folders in. To find the URL Link to your files for your template background images, adverts or CSS files etc... right click the file and select Get Info 21 P a g e

22 Click the Link and this will open the link in the browser You can copy the URL to add to the HTML as the images below 22 P a g e

23 Editing Forms and Links Links to add to Templates for other pages on Zone Main Page (Warning - when editing the Code never remove any code that is between two % % as these are needed for the templates to show correct messages to users) Splash Screen Links ( When Using a Splash Screen Template you will need to add links back to the Landing Pages like below)(see the Splash Screen Template in the Files Browser/Templates.Translucent/Business/Splash_Screen.html) <a href="/auth_2" class="splash-button">user Account</a> For Terms & Conditions page: /page/display/terms_and_conditions For Use Policy: /page/display/use_policy For Privacy Policy: /page/display/privacy_policy Forgot Password Link for User Auth Login Template <a href="/page/display/user_request_reset_password">forgot Password Click Here to reset</a> Example Form <form id="auth" name="form" method="post" class="trans-form cf"> <h1 style="margin: -20px 0 20px 0"> Login</h1> <label style="text-align: left" for="extra_full_name">full Name:</label> <input value="%post_details_full_name%" name="details[full_name]" autocomplete="off" required="" tabindex="4" type="text"> <label style="text-align: left" for="extra_phone">phone:</label> <input value="%post_details_phone%" name="details[phone]" autocomplete="off" required="" tabindex="6" dataformat="phone" data-format-message="please enter a valid phone number" type="text"> <label style="text-align: left" for="extra_address">address:</label> <input value="%post_details_address%" name="details[address]" autocomplete="off" required="" tabindex="5" type="text"> <label style="text-align: left" for=" "> </label> <input value="%post_ %" name=" " autocomplete="off" required="" tabindex="1" autofocus="" data-format=" " data-format-message="please enter a valid address" type="text"> <input value="login" name="login" class="submit" type="submit"> 23 P a g e

24 <input name="terms_and_conditions" value="0" type="hidden"> <label for="terms_and_conditions" id="terms_text"> <input name="terms_and_conditions" id="terms_and_conditions" value="1" type="checkbox"> I have read and accept the terms and conditions</label> <input name="extra_ _opt" value="opt Out" type="hidden"><label> <input name="extra_ _opt" value="opt In" checked="checked" type="checkbox"> I opt-in receiving newsletters from %ZONE_TITLE%</label> <div style="float: left; clear: both;"> %MSG% </div> </form> Editing Forms Advanced Important Notes regarding the Forms data-format="<format>" where format can be phone, name, number, , uk-postcode has been added data-format-message="<message>" to replace the default message that shows up when the input field format is invalid Optionally you can use instead of data-format, data-format-regexp="<regexp>" to use a regular expression to validate the form field. For example to allow only 1 lower case letter followed by 3 numbers and then 1 upper case letter you would use data-format-regexp="^[a-z][0-9]{3}[a-z]$" So you have the choice of simple validation or very comprehensive input validation using regular expressions. Regular expressions can be tested out at before you deploy them and then you just paste the code into format-regexp="" If required or required="" is added the field is enforced. If you remove required attribute the field can be left empty, but must follow the validation rules if it's filled. Here are some code examples: <input name="extra-full_name" required="" id="extra-full_name" type="text" data-format-regexp="^[ A-Zaz\u00C0-\u017F]+$" data-format-message="name does not seem proper"> Would show "Name does not seem proper" if you + or numbers in the name for example. Would allow user to skip filling in the field <input data-format=" " name=" " id=" " type="text" required=""> 24 P a g e

25 Would show popup if there are some problems with formatting, for example spaces or invalid characters. <input name="extra-mobile" required="" id="extra-mobile" type="text" data-format="phone"> Would show a popup if phone field has something other than numbers, spaces and optional + as first character. It would be possible to use a regexp here instead to allow only for example 7-10 length numbers so users don't try to give short fake numbers. <input data-format="uk-postcode" name="extra-postcode" id="extra-postcode" type="text"> This would allow the user to optionally fill postcode, and matches only UK postcodes. Don't know how accurate this one is, but it's easy to not use it anyway. <input data-format="number" name="extra-room_no" id="extra-room_no" type="text" require> This would require the user to put in a single number of any length without spaces <input data-format-regexp="^[0-9]{3,5}$" name="extra-room_no" id="extra-room_no" type="text" require> This would require the user to put in 3-5 length numbers using regular expression. 25 P a g e

26 s This section is used to show which Guest Users have authenticated using the Authentication Zones; this is ideal for the Admins to Troubleshoot whether the has been sent to the User 26 P a g e

27 User Authentication When selected as User Authentication on the Auth Settings tab on the Zone, See section below. N.B. When a User Self Registers using the Registration form they can log in from any Zones within the same Company or a Company created as a sub Company using the User Authentication method. (This may be useful to companies with membership users who can access UK or global based chains like Hotels, Golf Clubs, Health and Fitness Centres etc in different locations). This is an example of the User Authentication Login Screen below with the link to the registration page 27 P a g e

28 User Registration This is the Registration settings page on the Zones to be used on your Portal; you have the options to edit the registration pages to suit. How the Registration works: 1. A user enters their details on the registration page 2. They are then sent an to complete the registration 3. Once they have clicked on the activation link in the (within the set Grace period) the account is activated and they can login to the portal from then on, if you need to disable the account you can do this under the users section by changing the User Enable to OFF. 4. If the User has forgot their Password they can Reset it using the link added to the Initial User Login Page This also works by sending the user an to confirm before allowing the reset. 28 P a g e

29 Facebook Logins To set up GuestAir to use Facebook logins you will first need to set up a Developer account to do this go to the bottom of your Facebook page and select Developers then and go through the wizard as below to register as a Developer First you will have to accept Facebooks developers Terms and Conditions After you have accepted the terms and conditions you will have to verify your account via SMS 29 P a g e

30 You should be sent a SMS message instantly or with 5 minutes with verification code which you would need input to proceed You will then get the screen below once you have be verified 30 P a g e

31 After you have registered as a developer you will then have ability to create an App as seen below When creating the App you will first need to give it a Display Name and a Contact 31 P a g e

32 After you have given the App a Display Name and Contact you will need to add an App Domain and a Website Facebook Login, these will both need to be N.B You will need to make a note of the App ID and the App Secret as these will be used in the GuestAir system to tie your Facebook Authentication page to your Facebook App/Facebook Login page 32 P a g e

33 Once you have created your Facebook App you will then need tie your App to your GuestAir Zone. To do this you need to change your Authentication type in your Zone to be Facebook Authentication and then fill in your App ID and Secret which you should have made a note of from the previous page Below is an example of a Facebook Authentication Page after configuring the Facebook App and Zone 33 P a g e

34 When you have accepted the Terms and Conditions and click the Facebook Logo you will then be redirected to the page below to login with your Facebook account. 34 P a g e

35 Token Logins Token Logins are the most common type of Authentication where the Client is given a Token at a Hotel Reception for example when they book in to the hotel or when they enter an event at a conference centre. Setting up Token Authentication Login to the GuestAir Portal as either an Admin or Token Generator Go to Token Logins and select Generate, enter the amount of Tokens to be generated the date the Tokens will be Valid for and the duration shown below is for 1hrs access within a month from creation. Next choose the Permissions Tab and select the Company level as to which the Tokens will apply. N.B. In the image below the user being used has been created with a Token Generator User Account with Permissions at the Parent Company level, this User can create Tokens for any of the Companies listed, if you wish for the Token Generator only to be allowed to create tokens for a sub company, then whilst creating the Token Generator User in the permissions Tab set the User at the sub Company level. (See Creating User Accounts) 35 P a g e

36 Tokens must be created separately for each Company as the Zones using Token Authentication can only be set to one Company, (so you cannot create Tokens at the Parent Company level and use the Tokens at the Sub Companies Zones). Once the Tokens have been generated you can then export them in several formats see image below 36 P a g e

37 To Test join the Guest Wireless network and go to an external web page on your browser you should be redirected to a similar page as below Once you have entered your details correctly you will be redirected to the URL set on the Token Authentication Zone You can now see your details in the SonicWALL under Users/Guest Status 37 P a g e

38 Auth Logins The Authentication Logins are more common nowadays with Café s, Bars and Conferences where the Host of the Guest wireless, wants users to connect without having to give out lots of printed Tokens which are likely to be discarded on the floor and wants to capture the address of users for future marketing s. This works by the User logging on to the GuestAir portal with such details as their Name, Mobile Number and Address GuestAir will then send the user an to which they must click on the confirmation within the required grace period, (the grace period is to allow a free period of time so the user can collect their ) if the user does not click the confirmation within the grace period then their session will be logged out. The Grace Period can be changed to suit and the confirmation and the activated pages are fully editable for HTML and Non HTML. The s can be sent Via GuestAir or if you want to use SSL you can add your server settings in the Companies section. To set up your Zone to Use Authentication Go to Zones and select New and enter the Name of your Zone. Select under the Zone Settings/Primary Zone page (Click to view or edit text) and choose an Template to use. Select Authentication from the Drop down list in Zones/Auth Settings and edit as needed 38 P a g e

39 Here is an example of the Auth Login Screen 39 P a g e

40 Mobile Logins Setting up Mobile Logins Mobile Logins can be setup to automatically send you an SMS Token with a configured Twilio Account, or you can manually add the Mobile Logins and assign the User with the SMS Token to enter. To manually add mobile logins select add from the Mobile Logins page, enter the Mobile number in (+44) format and a mobile Pass code will be generated for you to give the customer To Login using the Mobile Login Page you have to enter your Mobile Phone number beginning with +44 and remove the leading 0, then click the SMS CODE this will then send the Pass Code to your Mobile Phone enter the received Pass code and select the Login button you will now have internet access. 40 P a g e

41 MAC Logins Setting up MAC Logins Select MAC Logins from the Admin Menu, click New and add the MAC Address (All Lowercase) to be excluded from Authentication and a Friendly Name for the Device. N.B. When setting up this user if you give them Company Permissions at the Top level of the companies they can log in from any company s site created below. Once connected to the Internet you will bypass authentication but will be first redirected to the URL setup on the Zone. See User Login status below 41 P a g e

42 Sessions Viewing the Sessions The sessions menu is split in to two categories Active Sessions (All current active sessions) All Sessions (All Sessions current and past) To see all the active sessions select the Sessions/Active Sessions To see the information about the user there are sub sections Display Shows the details of when the Users Logged in, Mac Address, IP Address, Authentication method, Received & Sent Bytes, redirected URL, Initially requested URL etc Data Capture Shows the User Details to be used for Identification or marketing purposes Name, Address, Telephone number and Postcode. Disconnect to Disconnect the current session Other options to print out details as various formats including PDF, CSV etc 42 P a g e

43 If you select a current user and click Display you will see the Login details. If you select Data Capture you would see the details as below 43 P a g e

44 44 P a g e

45 Traffic Traffic Details In the Traffic section you can see the amount of traffic that has been used by either the Zone or by the Individual Users see the examples below 45 P a g e

46 Devices and Licensing This is the Section where you add the Devices and apply the Licenses to be used with GuestAir this can be the SonicWALL UTM Appliances and or the GuestAir Thermal Printer. Add a friendly name for the Firewall, the MAC Address of the SonicWALL (Serial Number) and select the correct Company. 46 P a g e

47 To Set Up and Add the GuestAir Printer When you try it for the first time plug in the Ethernet port before you power it on. It gets IP using DHCP and tries to register on the UK21.guestair.net server after it is online. It prints out the IP address it has received when it is switched on. Hover over Devices Select Printer and Add a printer by selecting the new button. Enter in title with a Friendly name. Mac address must be correct for the printer Provision key should be left empty. Reboot the printer after you have added it on the system. When it comes back up it should say it has registered successfully and you should see that the provision key has been filled when you edit the printer on the admin system 47 P a g e

48 You can now edit the Duration for each button and Text (but don t delete the existing text) 48 P a g e

49 Logs The Logs Section is for the SonicWALL administrator for Troubleshooting sync issues with GuestAir. If there are no entries after the Sync time setting set on the SonicWALL Zones has passed there is an issue with the SonicWALL being able to connect to the GuestAir Authentication Server (See the Troubleshooting section and verify that all the settings are correct). 49 P a g e

50 Troubleshooting If your SonicWALL is not Synchronising with GuestAir Ensure that if the SonicWALL is behind another Firewall that TCP 4043 and TCP 80 are Port Forwarded through. If content filtering is enabled make sure that uk21.guestair.net is added to the allow list. If SSO is being used on the SonicWALL make sure that the Guest Zone is exempt. Also add uk21.guestair.net to the (Users/Settings/Other Global User Settings/ Allow these HTTP URLs to bypass user authentication in access rules) section on the SonicWALL. The Users aren t redirected to the Login Portal Make sure the Users Browsers home page is not set to a HTTPS Website as this will not redirect and will show a certificate error, to get around this with Google set the homepage to if the homepage that the user uses on their PC is cached they will need to go to another website for the redirect to happen otherwise they can use CTRL +F5 to reload a fresh copy of their home page and this will then work, Make sure that all networks needed are in the Address object group for the Pass Network on the SonicWALL Zone Settings like DNS servers, internal IIS server that maybe hosting your CSS files and most importantly the uk21.guestair.net FQDN. Notes for Apple ios devices ios devices do not support Adobe Flash so using video on the redirect or post authentication pages will not be shown. Future use of HTML5 will resolve this issue. Use of video on the redirect page Using any kind of external links or embedded video would require the domain eg. YouTube.com to be added to the GuestAir Bypass Group object. (Note above with Video) GuestAir Bypass Group objects In some cases you may need to add various Address objects on the SonicWALL to be added to the GuestAir Passed Networks. For instance if you are using Facebook Authentication you will need to make sure you add *.facebook.com, also when using links on adverts to external sources the FQDN S will need adding for those also. Wireless and SonicWALL SonicPoint Devices Although the preferred wireless solution is SonicWALL SonicPoints, a custom zone can be setup on the SonicWALL firewall and LHM protocol for GuestAir with third-party wireless access points and will still function as expected. For SonicPoint L3 Management for use with GuestAir see the links below how to set up: 50 P a g e

51 This document assumes that the user has experience of setting up wireless networks as there are many factors that can affect the reliability of wireless unless care is taken to select the correct channels, frequencies and signal strength. A wireless survey is recommended for large deployments. Wired networks In some cases the Internet facing router or firewall may be providing DNS proxy services. In this scenario an object for the router/firewall will need to be created and added to the GuestAir Bypass Object group in order for DNS services to be reached. E.g. X1 default Gateway. Authentication (Spam issues) It is recommended that the domain guestair.net is added as a white listed domain to a company s anti-spam solution in order to avoid s being found in their junk folders or worse deleted. NOTE! If you use your own SMTP gateway this should be less of a problem as this is your own company s SMTP domain 51 P a g e