Information for the Customer to Consider Before Cloudpath is Deployed

Before Cloudpath is implemented into the customer network, the following network configurations should be considered:

  • The initial firewall configuration should be set up to allow Internet access for the following:
    • Access from ES -> xpc.cloudpath.net (TCP 80/443-HTTP/HTTPS)
    • Access from ES -> dist2.cloudpath.net (used for ES updates TCP 80/443-HTTP/HTTPS)
    • Access from ES -> NTP (UDP 123)
      Note: You can use 0.centos.pool.ntp.org on the standard NTP port (123). This can be configured to point to a local server during system setup, if you prefer.
    • Internally, the guest/onboarding VLAN needs to be able to access to the wireless controller (this can be locked down to specific ports after the initial setup).
    • The WLAN controller requires Layer 3 access to the Cloudpath server.
  • If using Active Directory, you need the AD domain information (plus any subdomains) and the IP address of the AD server.
    Note: AD groups should be set up before the implementation call.
    Note: The Cloudpath VM should have Layer 3 access to Active Directory (Port 636 for LDAPs, Port 389 for LDAP).
  • Your wireless controller must be WPA2-Enterprise capable.
  • You should have knowledge about how to configure a captive portal on your wireless controller(s).
    • The open SSID typically has pre-authentication ACLs defined, which permit access to the VM.
    • The WLAN controller is configured to point to the Cloudpath VM as an external captive portal.
  • The WPA2-Enterprise SSID should be set up to delegate authentication to the onboard AAA server or your existing AAA.
    Note: If using an existing AAA server, it requires Layer 3 access to the Cloudpath VM to verify certificate status (optional).
  • A web server certificate is required for HTTPS. The system can be configured prior to the WWW server certificate being installed, but it should be installed before attempting to enroll end-users.
    • The WWW certificate may be a wildcard certificate (*.company.com) or a named certificate (test.company.com).
    • The WWW certificate must match the DNS name used by the end-users to enroll.
    • To request a WWW certificate, you may need to provide a Certificate Signing Request (CSR). If so, you can download a CSR from ES after the system is set up.
  • If using NPS, set up the NPS server role and a RADIUS server.
    Note: The new RADIUS server certificates and root CA can be uploaded after Cloudpath is configured.
  • If using a pre-existing RADIUS server, you need the IP address and access to the RADIUS server-signed certificates.
  • If using an existing CA, and you would like to use Cloudpath as an intermediate CA to issue client certificates, you need the public and private key of the existing CA to upload into Cloudpath.
  • If using Cloudpath as a proxy for an existing CA (Microsoft CA or Custom External CA) you need the CA URL and CA chain for the remote CA.
  • DNS should be configured for Cloudpath and other components appropriate for your network.
  • You should have a general idea about your deployment scheme for employees, partners, contractors and guests.