WLAN Authentication Type

The authentication type of the WLAN determines how users will gain access to the wireless network. For standard wireless networks, this typically involves entering a password.

However, SmartZone offers advanced options, such as portal-based WLANs. In these setups, users are redirected to a web portal, either hosted internally or by a third-party server, where the users can log in or register to access the wireless services.

Note: Some authentication types may support or require specific authentication methods. The following sections explain these types and methods in detail, providing guidance on how to configure and implement them effectively.

Standard usage (For most regular wireless networks) WLANs

The name indicates the usage of this WLAN type. Select this WLAN authentication type, if portal-based authentication or onboarding services are not required.

For Standard usage WLANs, you can use any of the following authentication methods:

  • Open
  • 802.1X EAP
  • MAC Address
  • 802.1X EAP & MAC
    Note: Each selected method will offer a different range of encryption options. For detailed explanations and configuration instructions, refer to the WLAN Encryption Options.

Portal-Based WLANs

There are many types of portal-based WLANs; they can be distinguished based on where the user credentials are stored and where the portal page is hosted.

Portal-based WLANs

WLAN Authentication Type User Credential Storage Location Portal on Which WLAN is Hosted
Guest Access Guest passes on the controller AP
Hotspot (WISPr) RADIUS server; LDAP/Active Directory External portal server or internal portal on the controller
Web Authentication RADIUS/LDAP/Active Directory AP

Guest and Web Authentication WLAN portals are hosted on the AP with limited customization.

HotSpot (WISPr) WLANs are typically hosted on external portal servers, offering flexibility for customization. They support advanced customization, such as a tailored login page that can include locale information, advertisements, and other specified content. HotSpot (WISPr) WLANs can also be configured to bypass the authentication portal so that if the MAC address of an end user device (used as a credential) is stored on a RADIUS server, there is no need to redirect the end user to the portal server for authentication.

Portal-Based WLANs Characteristics

Portal-based WLANs have the following general characteristics:

  • Uses a captive portal to control network access, requiring users to authenticate before gaining full connectivity.
  • Redirects users to a web-based login page upon connecting to the network.
  • Supports encryption options such as WPA2/WPA3 for secure data transmission and can integrate with RADIUS or LDAP for centralized authentication.

Web Authentication WLANs have the following characteristics:

  • Does not provide an option to modify the portal (WYSIWYG).
  • Handles user authentication by the RADIUS server, LDAP, and Active Directory.
  • Allows redirecting of user web pages.
Guest Access WLANs have the following characteristics:
  • Provides an option to modify the portal elements such as the logo, Terms and Conditions, title, and other elements.
  • Handles user authentication by using guest passphrases (unless the Guest Authentication option is set to Always Accept).
  • Allows redirecting of user web pages.
  • Does not possess a local database, LDAP, Active Directory, or RADIUS server.
Hotspot (WISPr) WLANs have the following characteristics:
  • Internal Portal
    • Provides an option to modify the portal elements such as the logo, Terms and Conditions, title, and other elements.

    • Handles user authentication by the local database, LDAP, Active Directory, RADIUS server (unless the Guest Authentication option is set to Always Accept).

    • Allows user redirection to a specific URL.
    • Supports the Walled Garden approach to allow user access to specific areas within the network.
  • External Portal
    • Allows customization of the portal pages through external services.
    • Supports Northbound Portal Interface for authentication.

    • Handles user authentication by the local database, LDAP, Active Directory, RADIUS server (unless the Guest Authentication option is set to Always Accept).

    • Allows user redirection to a specific URL.
    • Supports the Walled Garden approach to allow user access to specific areas within the network.
Bypassing Apple CNA

Some Apple iOS and OS X clients include Captive Network Assistant (CNA), which allows clients to connect to an open captive portal WLAN without displaying the login page.

When a client connects to a wireless network, the CNA launches a pre-browser login utility and it sends a request to a success page on the Apple® website. If the success page is returned, the device assumes it has network connectivity and no action is taken. However, this login utility is not a fully functional browser, and does not support HTML, HTML5, PHP, or other embedded video. In some situations, the ability to skip the login page for open WLANs is a benefit. However, for other guest or public access designs, the lack of ability to control the entire web authentication process is not desirable.

The controller provides an option to work around Apple CNA if it is not desirable for your specific deployment. With the Bypass CNA option enabled, captive portal (web-based authentication) login must be performed by opening a browser to any unauthenticated page (HTTP) to get redirected to the login page.

Hotspot (WISPr) WLANs

The Hotspot (WISPr) authentication type is designed for public Wi-Fi networks, such as those found in cafes, airports, and hotels. This method uses the Wireless Internet Service Provider roaming (WISPr) protocol to provide a seamless login experience. When users connect to the network, they are redirected to either an internal or external captive portal where they can authenticate using various methods, such as MAC address, entering a username and password, using social media logins, or accepting terms and conditions. This approach not only enhances user convenience but also allows network administrators to manage access and gather usage data effectively.

For HotSpot (WISPr) WLANs, you can use any of the following authentication methods:

  • Open
  • 802.1X EAP
  • MAC Address
Note: Each selected method will offer a different range of encryption options. For detailed explanations and configuration instructions, refer to WLAN Encryption Options.

Defining the Hotspot Portal for WISPr WLANs

The following options must be configured for the Hotspot Portal section:

  • Hotspot (WISPr) Portal - Select an existing portal from the drop-down list or click the + icon to create a new portal. For more information, refer to the Working with Hotspot (WISPr) Services.
  • Bypass CNA - Toggle the switch to ON to enable the feature for the WLAN. For more information, refer Bypassing Apple CNA.
  • Portal Detection and Suppression - Select an existing profile from the dropdown list or click the + icon to create a new profile. For more information, refer Creating a Portal Detection and Suppression Profile.
  • Authentication and Accounting Services - Select an existing service from the drop-down list or click the + icon to create a new service. For more information, refer AAA.

Guest Access WLANs

Guest Access WLANs are designed to provide temporary and convenient internet access for visitors in environments such as offices, hotels, and public venues. These networks typically require minimal authentication, such as accepting terms and conditions or entering a simple guest pass code. The primary goal is to offer a hassle-free connection experience while maintaining network security and control. Guest Access WLANs can be customized to display welcome messages, promotional content, or usage policies, ensuring that guests are informed and engaged.

For Guest Access WLANs, you can use any of the following authentication methods:

  • Open

Defining the Guest Access Portal for Guest Access WLANs

The following options must be configured for the Guest Access Portal.

Guest Authentication - Select a method among the following options for the guest user to authenticate:

  • Guest - Using this method, when redirected to the Guest Portal, the guest user needs to enter a Guest Pass that you provided. For more information about manually and automatically generating guest passes, refer to Guests.
  • Always Accept - When this option is selected, the guest user will not be redirected to the Guest Portal for authentication; instead, the user is automatically granted access and probably redirected to a welcome page if configured.
  • Guest Access / Social Media Login - When using this option, the guest user will have the opportunity to use either the Guest Pass that you provided, or their social media credentials to log in. When you select this option, a new setting for Social Media Profile appears. Select the Social Media Profile from the drop-down list or use + to create a new one.
    Note: For detailed instructions about creating a Social Media Profile, refer to Creating Social Media Login Profile.
  • Social Media Login - When using this option, the guest user will have the opportunity to use their social media credentials to log in. When you select this option, a new setting for Social Media Profile appears. Select the Social Media Profile from the drop-down list or use the + to create a new one.

Guest Portal Service - Select an existing portal from the dropdown list or click the + icon to create a new portal. For more information, refer Creating a Guest Access Portal.

Bypass CNA - Toggle the switch to ON to enable the feature for the WLAN. For more information on this feature, refer Bypassing Apple CNA.

Portal Detection and Suppression - Select an existing profile from the drop-down list or click the + icon to create a new profile. For more information, refer Creating a Portal Detection and Suppression Profile.

Guest Accounting - Select an existing service from the drop-down list or click the + icon to create a new portal. For more information, refer AAA.

Web Authentication WLANs

Web authentication WLANs, also known as captive portal WLANs, require users to authenticate through a web-based login page before accessing the network. When users connect to the WLAN, they are automatically redirected to a captive portal where they must enter credentials, such as a username and password, or accept terms and conditions. This method is commonly used in public and semi-public environments like cafes, airports, and hotels to control access and ensure that only authorized users can connect. Web authentication provides a flexible and user-friendly way to manage network access, allowing for integration with various authentication systems, including social media logins, vouchers, and payment gateways. This approach not only enhances security but also offers opportunities for user engagement and data collection.

For Web Authentication WLANs, you can use any of the following authentication methods:

  • Open

Defining the Authentication and Accounting Services for Web Authentication WLANs

The following options must be configured for the Authentication & Accounting Service for Web Authentication WLANs:

  • Web Authentication Portal - Select an existing portal from the drop-down list or click the + icon to create a new portal. For more information, refer Creating a Web Authentication Portal.
  • Bypass CNA - Toggle the switch to ON to enable the feature for the WLAN. For more information on this feature, refer Bypassing Apple CNA.
  • Portal Detection and Suppression - Select an existing profile from the drop-down list or click the + icon to create a new profile. For more information, refer Creating a Portal Detection and Suppression Profile.
  • Authentication and Accounting Service - Select an existing service from the drop-down list or click the + icon to create a new portal. For more information, refer AAA.

Hotspot 2.0 Access WLANs

Hotspot 2.0 Access WLANs provide seamless and secure Wi-Fi connectivity by allowing devices to automatically connect to compatible networks without manual intervention. This is achieved through Hotspot 2.0 and Passpoint protocols that support secure onboarding using credentials like SIM cards or certificates. Hotspot 2.0 Access networks integrate with various identity providers, ensuring a consistent and reliable user experience across different locations, making it ideal for environments such as airports, hotels, and large public venues.

For Hotspot 2.0 Access WLANs, you can use any of the following authentication methods:

  • 802.1X EAP
Note: The Hotspot 2.0 access WLANs support the following encryption options -
  • WPA2
  • WPA3
  • WPA2/WPA3-Mixed

Defining the Hotspot 2.0 Profile

The following sections must be defined for the Hotspot 2.0 Profile:

  • Hotspot 2.0 Profile - Select an existing profile from the drop-down list or click the + icon to create a new profile. For more information, refer Working with Hotspot 2.0 Services.
  • Authentication Service - Toggle the switch ON to enable Authentication Service. Supports RFC 5580 location delivery on the WLAN, which carries location information in RADIUS exchanges.
  • Accounting Service - Indicates the frequency to send interim updates. Configures the account update interval for accounting servers defined in the Hotspot 2.0 Identity Provider profile. Enter the duration in minutes. Range: 0 through 1440.

Hotspot 2.0 Onboarding WLANs

Hotspot 2.0 Onboarding WLANs are used for devices that do not have pre-existing credentials to connect to a Hotspot 2.0 network. These WLANs facilitate the initial connection and credential provisioning process. The onboarding WLAN can be either open or secure and uses server-side only authentication, keeping the client side anonymous. Users are directed to an Online Signup (OSU) portal where they can sign up for services and receive the necessary credentials. After successful authentication, users are provisioned with a Per-Provider Subscription Management object (PPS-MO) and then reconnected to the secure Hotspot 2.0 Access WLAN.

For Hotspot 2.0 Onboarding WLANs, you can use any of the following authentication options:

  • Open
  • 802.1X EAP
Note: For Hotspot 2.0 Onboarding WLANs, when the authentication method is set to Open, only None is supported for encryption option. When the authentication method is set to 802.1X EAP, only WPA2 encryption option is supported.

Parent topic: WLAN Authentication Options