Deployment Guide

Once the user is authenticated, it is assigned to a new role that does not redirect its HTTP trac to the
ECP. The client's assigned role is enforced and access is granted or restricted based on the rules defined
in the Policy role. Because this is a function of the role that the client gets assigned to, it is up to the
Extreme Campus Controller administrator to define the authenticated role appropriately. The
administrator can configure Extreme Campus Controller to steer the client back to the initially intended
URL, or redirect the client to a specific URL.
1.7 - Assuming the client is authenticated, it has internet access to the extent allowed by the
authenticated role to which it is assigned.
Configure the Firewall
Configure the firewall to enable clients that are behind the firewall to forward trac to port 80
destination on the insecure side of the firewall. Most sites configure this behavior by default. A firewall
friendly ECP can require the firewall to allow Extreme Campus Controller to forward RADIUS requests
(UDP) to an external server (typically at port 1812).
Configure an External Captive Portal
The External Captive Portal (ECP) is, essentially, a web server that runs an application allowing clients to
change their authentication state, by providing credentials, credit card details, demographic information
about themselves or acknowledging terms and conditions. The application can be written in any
language the ECP provider chooses. The Extreme Campus Controller web applications are implemented
in PHP, but they will interact with any programming language or library on the ECP or client that can
generate valid HTTP.
If the ECP expects the controller to sign redirection responses, it is critical that the real time clocks on
Extreme Campus Controller and the ECP are synchronized. Signed redirection responses include
timestamps to protect against replay attacks. Trust the redirection responses only for a limited period of
time.
The easiest way to do this is to configure both Extreme Campus Controller and the ECP to use Network
Time Protocol (NTP) to manage the clock. The time zone needs to be set correctly, both on the ECP and
on the appliance. On Extreme Campus Controller, go to Administration > System > Network Time to
configure NTP.
The timestamps in signed redirection responses are in UTC (Coordinated Universal Time). There is no
need for Extreme Campus Controller to know the ECP’s time zone and no need for the ECP to know the
appliance’s time zone.
The signing algorithm is a slight variation on Amazon Web Service’s (AWS) algorithm for signing
requests using query string parameters. At this time AWS makes an SDK available that includes
implementations of the signing algorithms in several dierent languages (notably Java and PHP). It may
be helpful to obtain and use this SDK rather than re-implement the signing algorithm from scratch.
Understand Processing Performed by the ECP
The ECP must receive HTTP/HTTPS redirection from Extreme Campus Controller, provide means for a
client to become authorized, and finally redirect the user back to a web server on Extreme Campus
Controller.
Configure
the Firewall External Captive Portal on a Third-Party Server
94 Extreme Campus Controller Deployment Guide for version 5.46.03