topic RE: Remote APs - Captive portal in ExtremeWireless (Identifi)

Remote APs - Captive portal

agd — Fri, 04 Sep 2015 20:13:00 GMT

I have remotes APs and I want to set an SSID with a captive portal for guest access, but the Internet traffic should be from the local Internet connection where are the APs, not where the controller is located.

It's possible ?

RE: Remote APs - Captive portal

Ronald_Dvorak — Fri, 04 Sep 2015 20:24:00 GMT

Yes, that is possible.
Set the topology for the non-authenticated role to either routed or bridge@EWC (traffic thru the controller) and as soon as the client has put in username/password he'll get the authenticated role.

For this role use a bridge@AP topology.

Here a "normal" example...
https://community.extremenetworks.com/extreme/topics/how-to-identifi-wireless-appliances-guest-porta...

So just change the topology in the "2) create roles" section.
!!! you should use a very low DHCP lease time on the first toplogy, so if the client is switching roles/topology that he'll renew his IP !!!

-Ron

RE: Remote APs - Captive portal

Laura — Fri, 04 Sep 2015 21:19:00 GMT

I think I am trying to create the same thing, if this is what it does:...this captive portal lets guests users logon to a guest SSID and only be able to access the internet, not our other network resources?

RE: Remote APs - Captive portal

Ronald_Dvorak — Fri, 04 Sep 2015 21:36:00 GMT

Hi Laura,

Yes, if you configure it per the above example you should be fine.

If you don't use a dedicated firewall for guest access (= the FW is also used for your internal network) make sure to create rules on the firewall to deny traffic from the guest VLAN to the intranet interfaces/resources.

-Ron

RE: Remote APs - Captive portal

Laura — Fri, 04 Sep 2015 22:51:00 GMT

I am just confused on what IP addresses to use, since I am not very familiar with our network. I will need to find out my default gawteway and dns servers, correct? the rest I just create on my own?

RE: Remote APs - Captive portal

Ronald_Dvorak — Fri, 04 Sep 2015 23:22:00 GMT

The easiest and most secure way (guest can't access intranet) is to connect the controller directly via a unused port to a unused port on the firewall.
The FW is the default gateway and you could use the Google DNS 8.8.8.8 & 8.8.4.4.