Deployment Guide
Table Of Contents
- Table of Contents
- Preface
- About Extreme Campus Controller Deployment
- Configuring DHCP, NPS, and DNS Services
- Centralized Site with a Captive Portal
- Centralized Site with AAA Network
- Deploying a Mesh Network
- Configuring an External NAC Server for MBA and AAA Authentication
- Manage RADIUS Servers for User Authentication
- External Captive Portal on a Third-Party Server
- Access Control Rule Admin Portal Access
- Deploying Centralized Web Authentication
- Deploying ExtremeCloud IQ - SE as an External Captive Portal
- Deployment Strategy
- Configuring an External Captive Portal Network
- Editing the Configuration Profile for Network and Roles
- Extreme Campus Controller Default Pass-Through Rule
- Adding Extreme Campus Controller as a Switch to ExtremeCloud IQ - Site Engine
- Editing the Unregistered Policy on ExtremeCloud IQ - Site Engine
- Editing the ExtremeCloud IQ - Site Engine Profile for Policy and Location-Based Services
- Deploying an ExtremeGuest Captive Portal
- Deploying Client Bridge
- Deploying an Availability Pair
- Deploying Universal APs
- Extreme Campus Controller Pair with ExtremeLocation and AirDefense
- ECP Local Authentication
- PHP External Captive Portal, Controller’s Firewall Friendly API
- Index
Table 23: External Captive Portal Settings (continued)
Field Description
Auth Type Define the authorization type. Valid values are:
• Open —Anyone is authorized to use the network. This
authorization type has no encryption. The Default Auth role
is the only supported policy role.
• WEP — Static Wired Equivalent Privacy (WEP) oers keys
for a selected network, that match the WEP mechanism
used on the rest of the network. Each AP can participate in
up to 50 networks. Specify one WEP key per network. This
option is oered to support legacy APs.
• WPA2 with PSK — Network access is allowed to any client
that knows the pre-shared key (PSK). All data between the
client and the AP is AES encrypted using the shared secret.
Privacy is based on the IEEE standard, and privacy settings
are editable. If MAC-based authentication (MBA) is enabled,
you can assign dierent roles to dierent devices with a
PSK because MBA distinguishes between dierent devices.
If MBA is not enabled, then devices with a PSK use the
Default Auth role only.
• WPA2 Enterprise w/ RADIUS — Supports 802.1X
authentication with a RADIUS server, using AES encryption.
This method can be used with client certificate-based
authentication (EAP-TLS). All 802.1X protocols are
supported.
Note: Captive Portal is not supported when using WPA2
Enterprise w/ RADIUS. An exception is Centralized Web
Authentication (CWA). CWA captive portal supports WPA2
Enterprise w/ RADIUS.
Privacy Settings
Protected Management Frames — Management Frames are
the signaling packets used in the 802.11 wireless standard to
allow a device to negotiate with an AP. PMF adds an
integrity check to control packets being sent between the
client and the access point. Valid values are:
◦ Enabled. Supports PMF format but does not require it.
◦ Disabled. Does not address PMF format. Clients connect
regardless of format.
◦ Required. Requires all devices use PMF format. This
could result in older devices not connecting.
• WPA3 - Personal with SAE — 128-bit encryption.
◦ AP3xx running ExtremeWireless WiNG 7.3x and later.
◦ AP4xx running ExtremeWireless WiNG 7.3x and later.
◦ AP5xx running ExtremeWireless WiNG 7.2x and later.
WPA3 uses a pre-shared key (PSK) and Simultaneous
Authentication of Equals (SAE). WPA3 oers an augmented
Configuring
External Captive Portal Network ECP Local Authentication
194 Extreme Campus Controller Deployment Guide for version 5.46.03