cnMaestro
CONFIGURATION GUIDE
The purpose of the following manual is to describe the necessary configuration of Cambium Networks equipment using the cnPilot access point for integration with Octopus Platform.
1- Pre-requisites
If there is a firewall in the network that might block the traffic, you will need to allow access to some domains to enable user's authentication:
Radius Servers:
Primary: <IP_Radius_1> 1812 and 1813 UDP ports
Secondary: <IP_Radius_2> 1812 and 1813 UDP ports
Splash Portal server:
Domain <captive_portal_domain> 80 and 443 TCP ports
For the operation of the Guest and Enterprise modules configuration, it will be necessary to previously contract the Octopus platform licenses with the respective modules.
2- Guest module configuration
2.1 Radius Servers
First, you must configure the Radius Server to which users' authentication requests will be sent. This will require the creation of two Radius servers. Within the AAA Servers tab in the WLAN configuration, the Authentication and Accounting servers must be added, for which the following parameters must be configured.
Authentication Server
Host: <IP_Radius_1>
Secret: <Secret>
Port: 1812
Host: <IP_Radius_2>
Secret: <Secret>
Port: 1812
Accounting Server
Host: <IP_Radius_1>
Secret: <Secret>
Port: 1813
Host: <IP_Radius_2>
Secret: <Secret>
Port: 1813
Accounting Mode: Start-Interim-Stop
Interim Update Interval: 600
2.2 Captive Portal
To configure all parameters related to the external Captive Portal access to Guest Access tab and set the following configuration:
Basic Settings
Enable: Check this box to enable the captive portal.
Portal Mode: External Hotpost
Access Policy: RADIUS
Redirect Mode: HTTP/HTTPS (choose an option depending on the type of captive portal validation)
External Page URL:
http option: http://<captive_portal_domain>/login/hotspot/cambium
https option: https://<captive_portal_domain>/login/hotspot/cambium
External Portal Type: Standard
Success Action:Seleccionar the option Redirect User to Original URL to be able to manage the redirection from the WIFI platform.
Advanced Settings
Inactivity Timeout: 900
2.3 Walled Garden
Finally to finish the WLAN configuration it is necessary to add the domains that the users will be able to visit without being authenticated in the captive portal. To do this, access Guest Access > Whitelist and add the necessary domains.
If you wish to add extra domains (Social Networks, Paypal, etc...) they can be consulted from the following link.
After making all the changes detailed above click on Save button to save all the configuration made and create the configured WLAN.
2.4 WLAN configuration
The first step is to create a new SSID or modify an existing one. To do that, access WLANs and click on the New WLAN button and set the following configuration:
Basic Information
Name: Identifying name of the WiFi network
Basic Settings
SSID: configure the SSID that APs will radiate.
Enable: check this box to enable the SSID.
VLAN: configure the corresponding vlan.
Advanced Settings
Inactivity Timeout: 900
2.5 AP Groups
When the captive portal configuration is done it is necessary to associate the WLAN to the AP Group that the access points belong to. So access to AP Groups and open the AP Group configuration. In the Configuration > Basic tab add the new WLAN created. In order to do it click on Add WLAN button and select the WLAN in the popup window.
After having added the WLAN to the AP Group, click on the Save button to apply all the changes made.
2.6 Authorized MAC Addresses
For user validation to work correctly, it is necessary to determine the NAS that will be able to make authentication requests to the Radius Server. In this case, all the MAC addresses of the Access Points that will radiate the configured SSID must be added. To obtain these MAC addresses easily access Ap Groups and select the AP Group to which the Access Points of the installation belong. Once inside, go to the APs tab where the MAC address of each of the APs can be consulted.
For information on how to add the MAC address of each AP as an authorized NAS on the platform, please refer to the following link Locations
3- Enterprise module configuration
In order to integrate the configurations of this module with the platform, it is necessary to contract the Octopus Platform Enterprise Module.
3.1 Captive portal + MAC Authentication configuration
To enable MAC Authentication, it is necessary to edit the WLAN created. To be able to perform this change, access to WLANs and select the WLAN you need to edit. Once the configuration page is displayed, access to Guest Access and enable the following setting in the Advanced Settings section:
MAC Authentication Fallback: Use guest-access only as fallback for clients failing MAC authentication.
3.2 MAC Authentication
To create an SSID dedicated only to MAC Authentication validation, go to WLANs and click on the New WLAN button and perform the following configuration:
Basic Information
Name: Identifying name of the WiFi network
Basic Settings
SSID: configure the network name or SSID e.g. Mac_Auth_Guest
Enable: check this box to enable the SSID.
VLAN: configure the corresponding vlan.
Advanced Settings
Inactivity Timeout: 900
Guest Access:
Disable: Disable the captive portal.
Success Action: Select the Redirect User to Original URL option to manage the redirection from the platform.
Advanced Settings
Inactivity Timeout: 900
Access control:
Policy: RADIUS
Delimiter: :
Password: disable
3.2 Configuration of Access Profiles
Through the Octopus platform it is possible to configure a series of reply attributes of the Access-Accept packages, grouped in the so-called Access Profile. These Access Profiles allow to activate a series of functionalities in the Cambium. Although the most common and proprietary Cambium radius dictionaries are available, below is a list of some of the most interesting ones:
Attribute | Description | Format |
|---|---|---|
Idle-Timeout | Maximum inactivity time. If the user does not transfer any data on the network during this time, the session will be terminated and the user will have to re-authenticate. | Seconds |
Acct-Interim-Interval | Defines the time interval at which the NAS sends the accounting packet update with all the user's session information. | Seconds |
WISPr-Bandwidth-Max-Down | Define Download speed limits. | Bytes |
WISPr-Bandwidth-Max-Up | Define upload speed limits. | Bytes |
CAMB-Traffic-Quota-Limit-Up | Defines the upstream traffic limit quota. | Bytes |
CAMB-Traffic-Quota-Limit-Down | Defines the downstream traffic limit quota. | Bytes |
Mikrotik-Group | Assignment of a Role Name/ Profile, previously created |
|
Reply-Message | Useful for troubleshooting functions, as it allows to identify associated elements of the Octopus Wifi platform, such as an access profile, access method, location, ... |
|
Example of an Access Profile configuration with the attributes explained above:
For more information on how to create an Access Profile in Octopus Platform go to Access profiles