ZyXEL ATP

CONFIGURATION GUIDE

The purpose of the following manual is to describe the necessary configuration of Zyxel Firewall ATP equipment for integration with Octopus Platform

1- Pre-requisites

• If there is a firewall in the network that might block the traffic, you will need to allow access to some domains to enable user's authentication:

  • Radius Servers:

    • Primary: <IP_Radius_1> 1812 and 1813 UDP ports

    • Secondary: <IP_Radius_2> 1812 and 1813 UDP ports

  • Splash Portal server: 

    • Domain <captive_portal_domain> 80 and 443 TCP ports

• For the operation of the Guest and Enterprise modules configuration, it will be necessary to previously contract the Octopus platform licenses with the respective modules.

2- Guest module configuration

2.1 Radius Server

It is neccessary to include the radius servers of the Wifi Platform, to do that access to Configuration > Object > AAA server and access to the tab RADIUS. Once inside click on Add to add a new Radius server and configured the following parameters:

• Name: Radius_Guest

• Authentication Server Settings

  • Server Address: <IP_Radius_1>

  • Authentication Port: 1812

  • Backup Server Address: <IP_Radius_2>

  • Backup Authentication Port: 1812

  • Key: <Secret>

• Accounting Server Settings

  • Server Address: <IP_Radius_1>

  • Accounting Port: 1813

  • Backup Server Address: <IP_Radius_2>

  • Backup Accounting Port: 1813

  • Key: <Secret>

  • Enable Accounting Interim update: Enable

  • Interim Interval: 10

• General Server Settings

  • Timeout: 5

  • NAS Identifier: ZYXEL

Open

Once the Radius sever has been added go to Configuration > Object > Auth. Method to add a new authentication method associated to the Radius server that was previously added. Click on Add and configure:

• Name: AuthMethod_Guest

• Method List: the one created previously, Radius_Guest

Open

2.2 Walled Garden

To add the domains that the user will have free access before be validated on the captive portal go to Configuration > Object > Address/Geo IP and in the tab Address create an entry (Add) for each domain that we wanto to add with an identifying name.

Once the entries are added we will group them in the Address Group. For that click on Add.

Click on OK to save the changes.

2.3 Captive Portal

Next configure the external captive portal, go to Configuration > Web Authentication and access to the Authentication Type tab. Once inside click on Add and configure the following parameters:

Once added click on Apply to save the changes and go to the General window. Then configure the following parameters:

Finally within Web Authentication Policy Summary click on Add to add a new policy with the following configuration:

Later, also from Web Authentication Policy Summary, add an entry for the walled gardens:

• Enable Policy: Enable this option

• Incoming Interface: Select the interface to which we want to apply the captive portal.

• Source Address: any

• Destination Address: Walled_Garden,  or Address Group name that was created earlier.

• Schedule: none

• Authentication: unneccesary

Click on Apply to save the configuration correctly. Then enter on the submenú: Configuration > System > WWW

2.4 Authorized MAC Addresses

2.5 Additional settings

Idle Timeout

Apply configuration to WLAN

The first step is to associate the interface to the SSID where you want to apply the configuration. To do this, go to Configuration > Object > AP Profile and select the SSID tab. Once inside, click on Add to add a new SSID profile and configure the following parameters:

To display the configuration in the Access Points, Go to Configuration > Wireless >AP Management and access to the AP Group tab. Select the group where we want to add the guest SSID:

3- Enterprise module configuration

In order to integrate the configurations of this module with the platform, it is necessary to contract the Octopus Wifi Enterprise Module.

3.1 Configuration of “Access Profiles” funtionality in the Octopus Platform

Through the Octopus platform it is possible to configure a series of reply attributes of the Access-Accept packages, grouped in the so-called Access Profile. These Access Profiles allow to activate a series of functionalities in the Omada. Although the most common and proprietary Omada radius dictionaries are available, the following is a list of some of the most interesting ones:

Filter-ID Configuration

Go to Object > AAA Server > Radius and select User Login Settings > Group Membership Attibute Filter-ID. Then go to Object > User/Group > User and create a new entry with the settings: