Purpose
This guide shows how to configure a SmartZone / SmartCell Gateway network for IPERA Starling Guest Wi-Fi.
Please note that the images in this article may contain outdated configuration data. Therefore, please check the data contained in the article "Parameters for the Solution" at the bottom of the article, as they are certainly up to date.
Prerequisites
This guide applies to the Solution for version 5.0.0 or later of the Controller. Anyway, it seems that this integration properly works starting from the version 3.2.0.
The following products are supported:
- SCG
- vSCG
- SZ
- vSZ
- vSZ-D
In order to use this integration, it is necessary that:
- the controller and the access points must be connected to the Internet
- the access points must be configured to correctly point to the controller
- the controller must be reachable at the following URL: https://northboundIP:9443/portalintf, where northboundIP is the Northbound Interface public IP
Version Number
You can get the firmware version of your controller by going to System → General Settings and then checking the About tab.
Configuring RADIUS services
Go to Services & profiles → Authentication and open the Proxy (SZ Authenticator) tab. You can create a new service by clicking the Create button, or edit an existing service by clicking on its name.
On the configuration page, enter the following data:
- Portal Name: (any name you wish)
- Service Protocol: RADIUS
Primary Server
- IP Address: 35.156.39.198
- Port: 1812
- Shared Secret: (this value is privately communicated by IPERA)
- Confirm Secret: (this value is privately communicated by IPERA)
Secondary Server
- Backup RADIUS: → Enable Secondary Server: ON
- IP Address: 35.156.23.166
- Port: 1812
- Shared Secret: (this value is privately communicated by IPERA)
- Confirm Secret: (this value is privately communicated by IPERA)
Then go to Services & profiles → Accounting and open the Proxy tab. You can create a new service by clicking the Create button, or edit an existing service by clicking on its name.
On the configuration page, enter the following data:
- Portal Name: (any name you wish)
- Service Protocol: RADIUS Accounting
Primary Server
- IP Address: 35.156.39.198
- Port: 1813
- Shared Secret: (this value is privately communicated by IPERA)
- Confirm Secret: (this value is privately communicated by IPERA)
Secondary Server
- Backup RADIUS: → Enable Secondary Server: ON
- IP Address: 35.156.23.166
- Port: 1813
- Shared Secret: (this value is privately communicated by IPERA)
- Confirm Secret: (this value is privately communicated by IPERA)
Configuring WISPr/Hotspot settings
Go to Services & profiles → Hotspots & Portals and open the Hotspot (WISPr) tab. You can create a new service by clicking the Create button, or edit an existing service by selecting it and clicking on the Configure button.
On the configuration page, enter the following data:
General Options
- Portal Name: (any name you wish)
Redirection
- Smart Client Support: None
- Logon URL: External
- Redirecting unauthenticated user. → Primary: https://engage.iperawifi.com/onboarding
- Redirecting unauthenticated user: → Secondary: (leave it empty)
- Redirected MAC Format: AA:BB:CC:DD:EE:FF
- Start Page: → After the user is authenticated: → Redirect to the following URL: → https://engage.iperawifi.com/onboarding
- HTTPS Redirect: ON
It is mandatory to add the following domains to ACL
- engage.iperawifi.com
- static.iperawifi.com
If you wish to support social network logins, you need to add rules for domains below for each network you plan to support
|
|
login.microsoftonline.com | accounts.google.com | |
| aadcdn.msauth.net | www.google.com | ||
| login.live.com | fonts.gstatic.com | ||
| akamaihd.net | play.google.com | ||
| aadcdn.msftauth.net | ssl.gstatic.com | ||
| www.facebook.com | accounts.youtube.com | ||
| www.facebook.net | accounts.google.com | ||
| static.xx.fbcdn.net | TikTok (**) | *.tiktok.com | |
| api.twitter.com | firebaseinstallations.googleapis.com | ||
| abs-0.twimg.com | storage.googleapis.com | ||
| pbs.twimg.com | *.ibytedtos.com | ||
|
|
www.linkedin.com | *.tiktokv.com | |
| static.licdn.com | open-api.tiktok.com | ||
| media.licdn.com | www.tiktok.com | ||
| ponf.linkedin.com | *.ttwstatic.com | ||
| platform.linkedin.com | *.tiktokcdn.com | ||
| Apple | www.apple.com | ||
| appleid.apple.com | |||
| appleid.cdn-apple.com | |||
| is4-ssl.mzstatic.com | |||
(*) Please refer to the below URL if you wish to use Microsoft login method
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/review-admin-consent-requests
(**) Google, Facebook, Twitter, and Apple should be also added for TikTok
Configuring WLAN settings
You need to enable the support for the Northbound Portal interface. To do this, go to System → General Settings and open the WISPr Northbound Interface tab.
On the configuration page, enter the following data:
- Enable Northbound Portal Interface Support: ON
- Username / Password: (fill with proper values)
Disabling the encryption of MAC address
By using the default configuration, the device sends to IPERA not the real MAC address of the client, but an encrypted value.
For example:
it sends: ENC7792d246d8f5f3ec0bbb430193dfe817e47904f0bb49f2d6
instead of: 11:22:33:44:55:66
If you are going to use particular IPERA features that use the MAC address of the client (e.g. Smart Authentication), then you will need an extra configuration step to get the platform to correctly work.
In particular, to disable the encryption, you have to use the following CLI command:
ruckus(config)# [no] encrypt-mac-ip
PARAMETERS FOR THE SOLUTION
AWS
IPERA Radius IP Address (Primary): 35.156.39.198
IPERA Radius IP Address (Secondary): 35.156.23.166
Shared Secret: (it will be communicated by IPERA)
Authentication Port Number: 1812
Accounting Port Number: 1813
Redirect URL after login: https://engage.iperawifi.com/onboarding
External Webauth URL: https://engage.iperawifi.com/onboarding/?res=success
Azure
IPERA Radius IP Address (Primary): 20.174.25.122
IPERA Radius IP Address (Secondary): 20.174.42.3
Shared Secret: (it will be communicated by IPERA)
Authentication Port Number: 1812
Accounting Port Number: 1813
Redirect URL after login: https://me.iperawifi.com/onboarding
External Webauth URL: https://me.iperawifi.com/onboarding/?res=success
Any changes on the above parameters and values will be communicated with IPERA customers in advance.
Comments
0 comments
Please sign in to leave a comment.