About This Guide
- Intended Audience
- How to Use This Guide
- Safety Information
- Sicherheitshinweise
- Consignes De S??curit??
- Text Conventions
- Providing Feedback to Us
- Getting Help
- Related Publications
Overview of the ExtremeWireless Solution
- Introduction
  - The ExtremeWireless Appliance
- Conventional Wireless LANs
- Elements of the ExtremeWireless Solution
  - Extreme Networks Extreme Management Center Integration
- ExtremeWireless and Your Network
- ExtremeWireless Appliance Product Family
Configuring the ExtremeWireless Appliance
- System Configuration Overview
- Logging on to the ExtremeWireless Appliance
- Wireless Assistant Home Screen
- Working with the Basic Installation Wizard
- Configuring the ExtremeWireless Appliance for the First Time
- Using a Third-party Location-based Solution
  - Configuring Location-Based Services
- Additional Ongoing Operations of the System
Configuring the ExtremeWireless APs
- Wireless AP Overview
- Discovery and Registration
- AP3916ic Integrated Camera Deployment
  - Camera Direct Stream Subscription
  - AP3916ic-Camera Web User Interface
    - Accessing the Camera Web User Interface
    - Camera UI Basic Functions
- Wireless AP Default Configuration
  - Configuring the Default Wireless AP Settings
- Configuring Wireless AP Properties
- Assigning Wireless AP Radios to a VNS
  - Assigning WLAN Services to Wired Client Ports
- Configuring Wireless AP Radio Properties
- Configuring IoT Properties
- Setting Up the Wireless AP Using Static Configuration
  - Configuring VLAN Tags for Wireless APs
- Setting Up 802.1x Authentication for a Wireless AP
- Configuring Co-Located APs in Load Balance Groups
- Configuring an AP Cluster
- Configuring an AP as a Guardian
- Configuring a Captive Portal on an AP
  - Configuring Firewall Friendly External Captive Portal on an AP
  - Controlling Network Access on the AP
- Performing AP Software Maintenance
- Understanding the ExtremeWireless LED Status
Configuring Topologies
- Topology Overview
- Configuring the Admin Port
- Configuring a Basic Data Port Topology
  - Configuring a Basic Topology
- Creating a Topology Group
- Edit or Delete a Topology Group
- Enabling Management Traffic
- Layer 3 Configuration
- Exception Filtering
- Multicast Filtering
Configuring Roles
- Roles Overview
- Configuring Default VLAN and Class of Service for a Role
- Policy Rules
Configuring WLAN Services
- WLAN Services Overview
- Third-party AP WLAN Service Type
- Configuring a Basic WLAN Service
  - Advanced WLAN Service Configuration
- Configuring Privacy
- Configuring Accounting and Authentication
- Configuring QoS Modes
  - Defining the DSCP and Service Classifications
- Configuring Hotspots
  - To Configure a New Hotspot
Configuring a VNS
- Configuring a VNS
  - Controller Defaults
- VNS Global Settings
- Methods for Configuring a VNS
- Manually Creating a VNS
  - Creating a VNS Manually
- Creating a VNS Using the Wizard
- Enabling and Disabling a VNS
- Renaming a VNS
- Deleting a VNS
Configuring Classes of Service
- Classes of Service Overview
- Configuring Classes of Service
- CoS Rule Classification
- Priority and ToS/DSCP Marking
  - Configuring ToS/DSCP Marking
- Rate Limiting
Configuring Sites
- VNS Sites Overview
- Configuring Sites
- Recommended Deployment Guidelines
  - Defining Roles, CoS, and RADIUS Servers for Local RADIUS Authentication
- Radius Configuration
- Selecting AP Assignments
- Selecting WLAN Assignments
Working with a Mesh Network
- About Mesh
- Simple Mesh Configuration
- Wireless Repeater Configuration
- Wireless Bridge Configuration
- Examples of Deployment
- Mesh WLAN Services
  - Mesh Setup with a Single Mesh WLAN Service
  - Mesh Setup with Multiple Mesh WLAN Services
- Key Features of Mesh
- Deploying the Mesh System
- Changing the Pre-shared Key in a Mesh WLAN Service
Working with a Wireless Distribution System
- About WDS
- Simple WDS Configuration
- Wireless Repeater Configuration
- Wireless Bridge Configuration
- Examples of Deployment
- WDS WLAN Services
  - WDS Setup with a Single WDS WLAN Service
  - WDS Setup with Multiple WDS WLAN Services
- Key Features of WDS
- Deploying the WDS System
- Changing the Pre-shared Key in a WDS WLAN Service
Availability and Session Availability
- Availability
- Session Availability
  - Events and Actions in Session Availability
  - Enabling Session Availability
- Viewing SLP Activity
Configuring Mobility
- Mobility Overview
- Mobility Domain Topologies
- Configuring a Mobility Domain
  - Designating a Mobility Manager
  - Designating a Mobility Agent
Working with Third-party APs
- Defining Authentication by Captive Portal for the Third-party AP WLAN Service
- Defining the Third-party APs List
- Defining Policy Rules for the Third-party APs
Working with ExtremeWireless Radar
- Radar Overview
- Radar Components
- Radar License Requirements
  - AP Limitations
- Radar Scan Profiles
  - In-Service Scan Profiles
  - Guardian Scan Profiles
- Enabling the Analysis Engine
- Viewing Existing Scan Profiles
- Adding a New Scan Profile
- Configuring an In-Service Scan Profile
- Configuring a Guardian Scan Profile
- Maintaining the Radar List of APs
- Working with Radar Reports
Working with Location Engine
- Location Engine Overview
- Location Engine on the Controller
- Deploying APs for Location Aware Services
- Configuring the Location Engine
Working with Reports and Statistics
- Application Visibility and Device ID
- Viewing AP Reports and Statistics
- Viewing All Clients
  - Displaying Client Details
    - Client Search Facility
    - Viewing Client MAC and OUI
- Viewing Role Filter Statistics
- Viewing Topology Reports
- Viewing Mobility Reports
- Viewing Controller Status Information
- Viewing Routing Protocol Reports
- Viewing RADIUS Reports
- Call Detail Records (CDRs)
Performing System Administration
- Performing Wireless AP Client Management
  - Adding Clients to a Blacklist
- Defining Wireless Assistant Administrators and Login Groups
  - Modifying Admin Password
  - Removing Administrator
Logs, Traces, Audits and DHCP Messages
- ExtremeWireless Appliance Messages
- Working with Logs
- Viewing Wireless AP Traces
- Viewing Audit Messages
- Viewing the DHCP Messages
- Viewing the NTP Messages
- Viewing Software Upgrade Messages
- Viewing Configuration Restore/Import Messages
Working with GuestPortal Administration
- About GuestPortals
- Adding New Guest Accounts
- Enabling or Disabling Guest Accounts
- Editing Guest Accounts
- Removing Guest Accounts
- Importing and Exporting a Guest File
- Viewing and Printing a GuestPortal Account Ticket
- Working with the Guest Portal Ticket Page
- Configuring Guest Password Patterns
  - To Configure a Guest Password Pattern
- Configuring Web Session Timeouts
Regulatory Information
- ExtremeWireless APs 37XX , 38XX, and 39XX
Default GuestPortal Ticket Page
- Example Ticket Page
  - Placeholders Used in the Default GuestPortal Ticket Page
  - Default GuestPortal Ticket Page Source Code

NAC Integration with the Wireless WLAN

The Extreme Networks Wireless WLAN (Wireless Local Area Network) supports integration with a NAC (Network Admission Control) Gateway. The NAC Gateway can provide your network with authentication, registration, assessment, remediation, and access control for mobile users.

NAC Gateway integration with Wireless WLAN supports SSID VNSs when used in conjunction with MAC-based external captive portal authentication.

WLAN and NAC Integration with External Captive Portal Authentication depicts the topology and workflow relationship between Wireless WLAN that is configured for external captive portal and a NAC Gateway. With this configuration, the NAC Gateway acts like a RADIUS proxy server. An alternative is to configure the NAC Gateway to perform MAC-based authentication itself, using its own database of MAC addresses and permissions. For more information, see Creating a NAC VNS Using the VNS Wizard.

WLAN and NAC Integration with External Captive Portal Authentication

1	The client laptop connects to the AP. The AP determines that authentication is required, and sends an association request to the appliance.
2	The appliance forwards to the NAC Gateway an access-request message for the client laptop, which is identified by its MAC address. The NAC Gateway forwards the access-request to the RADIUS server. The NAC Gateway acts like a RADIUS proxy server.
3	The RADIUS server evaluates the access-request and sends an AccessAccept message back to the NAC. Note RADIUS servers with captive portal and EAP authentication can be tested for connectivity using the radtest command. For more information, see the ExtremeWireless CLI Guide. The NAC receives the access-accept packet. Using its local database, the NAC determines the correct role to apply to this client laptop and updates the access-accept packet with the role assignment. The updated AccessAccept message is forwarded to the appliance and AP.
4	The appliance and the AP apply role against the client laptop accordingly. The appliance assigns a set of filters to the client laptop‘s session and the AP allows the client laptop access to the network.
5	The client laptop interacts with a DHCP (Dynamic Host Configuration Protocol) server to obtain an IP address.
6	Eventually the client laptop uses its web browser to access a website. The appliance determines that the target website is blocked and that the client laptop still requires authentication. The appliance sends an HTTP redirect to the client laptop‘s browser. The redirect sends the browser to the web server on the NAC Gateway. The NAC displays an appropriate web page in the client laptop‘s browser. The contents of the page depend on the current role assignment (enterprise, remediation, assessing, quarantine, or unregistered) for the MAC address.
7	When the NAC determines that the client laptop is ready for a different role assignment, it sends a ‘disconnect message‘ (RFC 3576) to the appliance. When the appliance receives the ‘disconnect message‘ sent by the NAC, the appliance terminates the session for the client laptop. The appliance forwards the command to terminate the client laptop‘s session to the AP, which disconnects the client laptop.

Published May 2017prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback