Cisco Enterprise Controller Configuration

The following instructions outline how to setup a Cisco Enterprise Level device for the Marketing4WIFi Platform.  Please make sure any firewall rules, web content filters, and other security measures have been configured to interface with the Smart WiFi Platform.

Step 1) Radius

Click Security on the top navigation panel, then click the AAA tab on the left.

• Security Tab – AAA – Radius Authentication

Add the following server information for RADIUS Authentication for Splash Page:
Host 1: Select one

Port: 1812
Secret: Available in the Edit Hotspot page in the Marketing4WiFi dashboard, called RADIUS Secret in the dashboard.
Host 2: Select one

US-A Radius 2 IP

52.207.192.243

You can confirm your platform environment under Operator Customizations.

US-B Radius 2 IP

3.18.137.68

You can confirm your platform environment under Operator Customizations.

Port: 1812
Secret: Available in the Edit Hotspot page in the Marketing4WiFi dashboard, called RADIUS Secret in the dashboard.

Create the Radius Authentication Server 1

Create the Radius Authentication Server 2

• Security Tab – AAA – Radius Accounting

Add the following server information for RADIUS Accounting for Splash Page:
Host 1: Select one

Port: 1813
Secret: Available in the Edit Hotspot page in the Marketing4WiFi dashboard, called RADIUS Secret in the dashboard.
Host 2: Select one

US-A Radius 2 IP

52.207.192.243

You can confirm your platform environment under Operator Customizations.

US-B Radius 2 IP

3.18.137.68

You can confirm your platform environment under Operator Customizations.

Port: 1813
Secret: Available in the Edit Hotspot page in the Marketing4WiFi dashboard, called RADIUS Secret in the dashboard.

Radius Accounting Server 1

Radius Accounting Server 2

• AP Policies

Accept Self Signed Certificate(SSC): Enabled
Accept Manufactured Installed Certificate(MIC): Enabled

Step 2) Web Auth and ACL

Click on the Security tab on the Top navigation Bar.

• Security Tab – Web Auth – Web Login Page

Web authentication type: External (Redirect to external server)
Redirect URL after login: Select one

External Webauth URL: Select one

• Access Control Lists

1. Create a new IPv4 ACL.
2. Click the name of the new ACL. Hover your cursor over the blue drop-down arrow, choose Add-Remove URL from the drop-down list to open the URL List page.
3. Please add all the Default walled garden entries.
   

   If you’re a white label client and you have your own splash domain, be sure to include it in the walled garden.

Step 3) WLAN

Click on WLANs on the top navigation bar then click the WLANs tab to the left. Create a new WLAN. (If you have an existing WLAN intended for use for Guest WiFi you can edit that WLAN)

• WLAN – General Tab

Profile Name: SmartWiFi (Or whatever you would like)
SSID: SmartWiFi (Or whatever you would like)
Status: Enabled
Broadcast SSID: Enabled
NAS-ID: Available in the Edit Hotspot page in the Marketing4WiFi dashboard, called SWS/Hotspot/NAS-ID.

• WLAN – Security – Layer 3 Tab

Make sure to apply the appropriate PreAuthentication ACL list created previously in this document.

Layer 3 Security: Web Policy
Authentication: Enable
Pre-Authentication ACL: Use the ACL created earlier.
Override Global Config: Enable
Web Auth Type: External(Re-direct to an external server)
Redirect URL: Select one

• WLAN – Security – AAA Servers Tab

Authentication Servers: Enable
Server 1: Select one

-Port:1812
Server 2: Select one

US-A Radius 2 IP

52.207.192.243

You can confirm your platform environment under Operator Customizations.

US-B Radius 2 IP

3.18.137.68

You can confirm your platform environment under Operator Customizations.

-Port: 1812
Accounting Servers: Enable
Server 1: Select one

US-A Radius 1 IP

52.23.46.139

You can confirm your platform environment under Operator Customizations.

US-B Radius 1 IP

3.132.31.3

You can confirm your platform environment under Operator Customizations.

-Port:1813
Server 2: Select one

US-A Radius 2 IP

52.207.192.243

You can confirm your platform environment under Operator Customizations.

US-B Radius 2 IP

3.18.137.68

You can confirm your platform environment under Operator Customizations.

-Port: 1813
Interim Update: Enabled
Interim Interval: 900
Authentication priority order for web-auth user-
Not used: LOCAL, LDAP
Order used for Authentication: RADIUS

• WLAN – Advanced Tab

Allow AAA Override: Enable
Enable Session Timeout: Enabled
Session Timeout: 43200

Step 4) HTTPS and Secure Webauth

1. Management Tab – HTTP-HTTPS
2. WebAuth SecureWeb: Disabled
3. HTTPS Redirection: Disabled