Deployment Guide

Extreme Campus Controller adds parameters to the redirection, for example: the user’s MAC address,
the BSSID, or AP location, and AP Ethernet MAC. All available parameters are encoded into the URL
request. The client’s browser typically follows the redirection automatically. The redirection contains the
query parameters added by Extreme Campus Controller.
1.2 - Because the ECP is located on a third-party server, the user’s request must be forwarded through
the enterprise firewall. Most companies allow requests for port 80 to pass through the firewall. Typically,
the firewall also serves as a Network Address Translation (NAT). The NAT records the state of the
connection, replaces the IP address in the request, and forwards it to the ECP.
When the ECP receives the redirected request, it typically replies with a web page. The client’s browser
sends subsequent requests to the ECP to retrieve additional content needed to render the page. If NAT
is present, and the firewall allows it, the client establishes direct connection with the ECP web server,
which serves the user experience and any necessary transactions related to the captive portal
experience (including login, credentials collection, and validation).
Extreme Campus Controller is not involved in this interaction, except to forward trac between the ECP
and the client. The interaction can be as simple or complex as necessary (represented by the box
labeled seq ECP Authentication).
1.3 - The ECP changes the client’s authentication state and role. Once the server completes the captive
portal workflow, the server responds to the client, instructing the client to redirect to Extreme Campus
Controller. The status of the ECP authentication (and possibly credentials needed to have Extreme
Campus Controller perform final authentication of the registering client) are encoded within the
response message. You can display a set of terms and conditions on the ECP web page that the user
must accept before a more liberal access control role is assigned.
1.4 - The client’s browser usually follows the redirection URI automatically. Assuming the URI passes
basic validation, the flow proceeds in one of two ways: If the URI contains a signature (secure hash) and
the hash is verified by Extreme Campus Controller, the appliance accepts the user as authenticated. If
the URI contains the name of an access control role defined on Extreme Campus Controller, it applies
that role to all trac that the client sends subsequently.
1.5 and 1.6 - If the URI is unsigned and contains a user name and password, then Extreme Campus
Controller attempts to authenticate the user against a RADIUS server. The WLAN Service that redirects
to the ECP must have at least one RADIUS server configured for authentication or an error is reported.
(Optional) If the ECP returns the credentials of the registered client (with the expectation that the
appliance will perform final user authentication based on those parameters), the administrator can
configure Extreme Campus Controller with the address and the shared secret of at least one RADIUS
authentication server. Instructions on how to configure a RADIUS server for a network using captive
portal authentication is documented in theExtreme Campus Controller User Guide located in the
Extreme Networks documentation portal.
The response from the RADIUS server may also contain attributes, such as maximum session duration,
the VLAN to which the client’s trac is assigned, and the name of an access control role to apply to the
trac the client sends subsequently. If the attributes in the response are valid, Extreme Campus
Controller applies them to the user session.
If no specific role is returned by the RADIUS server, then Extreme Campus Controller applies the
Authorized role that is defined in the network configuration.
External Captive Portal on a Third-Party Server
FF-ECP on Extreme Campus Controller
Extreme Campus Controller Deployment Guide for version 5.46.03 93