Deployment Guide
Table Of Contents
- Table of Contents
- Preface
- About Extreme Campus Controller Deployment
- Configuring DHCP, NPS, and DNS Services
- Centralized Site with a Captive Portal
- Centralized Site with AAA Network
- Deploying a Mesh Network
- Configuring an External NAC Server for MBA and AAA Authentication
- Manage RADIUS Servers for User Authentication
- External Captive Portal on a Third-Party Server
- Access Control Rule Admin Portal Access
- Deploying Centralized Web Authentication
- Deploying ExtremeCloud IQ - SE as an External Captive Portal
- Deployment Strategy
- Configuring an External Captive Portal Network
- Editing the Configuration Profile for Network and Roles
- Extreme Campus Controller Default Pass-Through Rule
- Adding Extreme Campus Controller as a Switch to ExtremeCloud IQ - Site Engine
- Editing the Unregistered Policy on ExtremeCloud IQ - Site Engine
- Editing the ExtremeCloud IQ - Site Engine Profile for Policy and Location-Based Services
- Deploying an ExtremeGuest Captive Portal
- Deploying Client Bridge
- Deploying an Availability Pair
- Deploying Universal APs
- Extreme Campus Controller Pair with ExtremeLocation and AirDefense
- ECP Local Authentication
- PHP External Captive Portal, Controller’s Firewall Friendly API
- Index
• {: <port>} is a literal colon ( : ), followed by the TCP/IP port number to which the client is redirected.
The port is optional. Include it only if the port is not port 80 or port 443.
• /ext_approval.php is the literal string. It is the name of the script that is invoked on the appliance
when the redirect is received there.
• <token> is the token taken from the redirect to the ECP.
• <wlanid> is the numeric identifier for the client’s WLAN Service as taken from the appliance’s
redirect to the ECP.
• <userid> is the user name the appliance sends to the RADIUS server to authenticate this user.
• <dest> is the original destination the client was trying to reach, as reported in the appliance’s
redirect to the ECP.
• <rolename> is the name of a role defined on Extreme Campus Controller that will be applied to the
remainder of the client’s session.
• <max-seconds-duration> is a positive integer representing the maximum duration of the client’s
session.
• X-Amz-Algorithm=AWS4-HMAC-SHA256 is a literal string embedded in the signed URL.
• <Scoped-Credential> is a credential in the format: <identity>/<YYYYMMDD>/world/ecp/
aws4_request.
• <YYYYMMDDThhmmssZ> is the date and time at which the redirection response was sent by the
ECP, in ISO 8601 compatible format.
• <duration> is a positive integer indicating the maximum duration after the X-Amz-Date that the
request should be honored.
• X-Amz-SignedHeaders=host is a literal string constant.
• <Signature> is the actual signature computed over the redirection response.
The order of the parameters in the query string is not important.
The following is an example of a signed redirection response that assigns the user to a role called
“Guest_Access” and limits the session duration to 10 hours:
https://10.10.21.6/ext_approval.php?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-
Credential=BigAuthInc%2F20140729%2Fworld%2Fecp%2Faws4_request&X-Amz-
Date=20140729T153754Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&dest=http%3A%2F
%2F1.2.3.4%2Fnews.com&opt27=36000&role=Guest_Access&token=T7vb1LdUZmsuY0q9V60Iww
External Captive Portal on a Third-Party Server
Case 2: When the ECP is the Final Authority
Extreme Campus Controller Deployment Guide for version 5.46.03 109