4IPNET WHG201 User manual

Copyright Notification
4IPNET, INC.
This document contains proprietary information which is the property of 4IPNET, INC. and is strictly confidential. No part may be reproduced except as
authorized by written permission of the contributing companies.
User Manual
WHG-Series WLAN Gateway-Controller
HSG-Series Wireless Hotspot Gateway
Verion 3.43.00

1
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
Table of Content
14IPNET WLAN QUICK DEPLOYMENT..............................................................................................................................5
1.1 CHECK YOUR NETWORK ENVIRONMENT ................................................................................................................................5
1.2 HOW TO ENABLE YOUR SERVICE ZONE ..................................................................................................................................5
1.3 HOW TO ADD AN USER ACCOUNTS ......................................................................................................................................6
1.4 HOW TO ADD AN ACCESS POINT..........................................................................................................................................6
2HOW TO CONFIGURE SYSTEM SETUP ............................................................................................................................7
2.1 SYSTEM GENERAL SETTING.................................................................................................................................................7
2.2WMI MANAGEMENT ACCESS.............................................................................................................................................8
2.3 WAN CONFIGURATION .....................................................................................................................................................9
2.4 LAN CONFIGURATION .....................................................................................................................................................11
2.5 ADVANCED FEATURES IN SYSTEM .......................................................................................................................................11
3HOW TO CONFIGURE SERVICE ZONE ...........................................................................................................................13
3.1 VLAN/IP, ISOLATION,NAT/ROUTER MODE........................................................................................................................13
3.2 DHCP SERVER OPTION ...................................................................................................................................................14
3.3 AUTHENTICATION SETTINGS..............................................................................................................................................14
3.4 PAGE CUSTOMIZATION.....................................................................................................................................................15
4HOW TO ENABLE USER AUTHENTICATION DATABASES................................................................................................17
4.1 INTERNAL AUTHENTICATION .............................................................................................................................................17
Local User Database .............................................................................................................................................174.1.1
On-Demand User Database ..................................................................................................................................184.1.2
On-Demand Accounts Creation and List ...............................................................................................................284.1.3
Guest User Database ............................................................................................................................................304.1.4
One Time Password ..............................................................................................................................................324.1.5
4.2 HOW TO INTEGRATE 4IPNET WTG SERIES PRINTER (WTG-SERIES) ...........................................................................................33
4.3 EXTERNAL AUTHENTICATION.............................................................................................................................................43
POP3 .....................................................................................................................................................................434.3.1
LDAP .....................................................................................................................................................................434.3.2
RADIUS..................................................................................................................................................................434.3.3
NT Domain............................................................................................................................................................454.3.4
SIP .........................................................................................................................................................................45
4.3.5
Social Media .........................................................................................................................................................464.3.6
4.4 HOW TO APPLY SOCIAL MEDIA LOGIN.................................................................................................................................48
4.5 RADIUS AUTHENTICATION APPLICATION ............................................................................................................................51
802.1X Authentication/ WPA2-Enterprise Authentication....................................................................................514.5.1
Local/ On-Demand Account Roaming Out............................................................................................................534.5.2
WLAN Controller as an Internal RADIUS Server ....................................................................................................574.5.3
DM and CoA..........................................................................................................................................................594.5.4
MAC ACL in the WLAN Controller..........................................................................................................................614.5.5
MAC Address Authentication................................................................................................................................614.5.6
PPP Authentication ...............................................................................................................................................624.5.7
WISPr for ISP Roaming..........................................................................................................................................624.5.8
5HOW TO CONFIGURE USER POLICIES........................................................................................................................... 64
1.1 USER POLICY...........................................................................................................................................................64

2
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
1.2 GLOBAL POLICY ......................................................................................................................................................66
6HOW TO GENERATE YOUR SCENARIOS........................................................................................................................67
6.1 USER GROUPS,USER POLICIES,SERVICE ZONES AND SCHEDULE ..............................................................................................67
6.2 BLACKLISTS AND PRIVILEGE LISTS .......................................................................................................................................70
Blacklists ...............................................................................................................................................................706.2.1
IP Privilege List......................................................................................................................................................706.2.2
IPv6 Privilege List ..................................................................................................................................................706.2.3
MAC Privilege List .................................................................................................................................................716.2.4
MAC Access Control List........................................................................................................................................716.2.5
6.3 ADDITIONAL CONTROL ....................................................................................................................................................71
7HOW TO CONFIGURE ACCESS POINT IN LAPM.............................................................................................................73
7.1 AP LIST AND OVERVIEW ..................................................................................................................................................74
7.2 AP ADDING AND CONFIGURATION.....................................................................................................................................74
7.3 TEMPLATE.....................................................................................................................................................................75
7.4 AP FIRMWARE MANAGEMENT .........................................................................................................................................77
7.5 WDS MANAGEMENT......................................................................................................................................................77
7.6 ROGUE AP DETECTION....................................................................................................................................................78
7.7 AP LOAD BALANCING......................................................................................................................................................78
8HOW TO CONFIGURE ACCESS POINT IN WAPM...........................................................................................................80
8.1 AP LIST ........................................................................................................................................................................81
8.2 GRAPHICAL MONITORING ................................................................................................................................................81
Google Map Integration .......................................................................................................................................818.2.1
AP Grouping..........................................................................................................................................................888.2.2
8.3 AP ADDING AND CONFIGURATION......................................................................................................................................90
AP discovery..........................................................................................................................................................908.3.1
How to prepare CAPWAP application ...................................................................................................................918.3.2
CAPWAP with Complete Tunnel ............................................................................................................................938.3.3
CAPWAP with Split Tunnel ....................................................................................................................................958.3.4
8.4 TEMPLATE.....................................................................................................................................................................96
8.5 WDS MANAGEMENT......................................................................................................................................................99
8.6 AP FIRMWARE MANAGEMENT ..........................................................................................................................................99
Backup Configuration ...........................................................................................................................................998.6.1
Firmware...............................................................................................................................................................998.6.2
8.7 ROGUE AP DETECTION..................................................................................................................................................100
8.8 AP LOAD BALANCING....................................................................................................................................................100
9HOW TO CONFIGURE SWITCH MANAGEMENT .......................................................................................................... 102
9.1 SWITCH LIST................................................................................................................................................................102
9.2 POESCHEDULE TEMPLATE .............................................................................................................................................102
9.3 BACKUP CONFIGURATION...............................................................................................................................................103
10 HOW TO REALIZE WI-FI MONITOR............................................................................................................................. 104
10.1 ADD A FLOOR PLAN ......................................................................................................................................................104
10.2 SIMULATION AP...........................................................................................................................................................107
10.3 AP MONITORING ON FLOOR PLAN ..................................................................................................................................109
11 HOW TO ENABLE VPN FEATURE ................................................................................................................................110
11.1 REMOTE VPN PPTP.....................................................................................................................................................110
11.2 REMOTE VPN IKEV2....................................................................................................................................................110

3
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
11.3 SITE-TO-SITE VPN ........................................................................................................................................................111
12 HIGH AVAILABILITY ................................................................................................................................................... 112
13 PORT LOCATION MAPPING ....................................................................................................................................... 114
14 PMS INTEGRATION....................................................................................................................................................117
15 UTILITIES FOR WLAN CONTROLLER ...........................................................................................................................119
15.1 NETWORK UTILITIES......................................................................................................................................................119
IPv4 ................................................................................................................................................................11915.1.1
IPv6 ................................................................................................................................................................11915.1.2
Sniff................................................................................................................................................................12015.1.3
IP Discovery....................................................................................................................................................12015.1.4
15.2 CERTIFICATES...............................................................................................................................................................120
System Certificate ..........................................................................................................................................12115.2.1
Internal Root CA .............................................................................................................................................12115.2.2
Internally Issued Certificate ...........................................................................................................................12115.2.3
Trusted Certificate Authorities .......................................................................................................................12115.2.4
15.3 ADMINISTRATOR ACCOUNTS...........................................................................................................................................122
15.4 BACKUP/RESTORE CONFIGURATION.................................................................................................................................123
15.5 RESTART .....................................................................................................................................................................124
15.6 SYSTEM UPGRADES.......................................................................................................................................................125
16 ADVANCED SETTINGS FOR NETWORK ENVIRONMENT ..............................................................................................126
16.1 IPV4/ IPV6DUAL STACK NETWORK.................................................................................................................................126
16.2 NAT ..........................................................................................................................................................................127
16.3 MONITOR IP LIST .........................................................................................................................................................129
16.4 WALLED GARDEN AND ADVERTISEMENT ...........................................................................................................................129
16.5 VPN..........................................................................................................................................................................130
16.6 PROXY SERVER.............................................................................................................................................................130
16.7 LOCAL DNS RECORDS ...................................................................................................................................................132
16.8 DYNAMIC ROUTING ......................................................................................................................................................132
16.9 DDNS .......................................................................................................................................................................134
16.10 CLIENT MOBILITY .........................................................................................................................................................134
17 STATUS FOR LOGS AND REPORTS .............................................................................................................................. 136
17.1 DASHBOARD................................................................................................................................................................136
17.2 SYSTEM RELATED STATUS ...............................................................................................................................................137
System Summary............................................................................................................................................13717.2.1
Network Interface ...................................................................................................................................13817.2.2
Process Monitor .............................................................................................................................................13917.2.3
Routing...........................................................................................................................................................13917.2.4
DHCP Server ...................................................................................................................................................14017.2.5
17.3 CLIENT RELATED STATUS ................................................................................................................................................141
Online User ....................................................................................................................................................14117.3.1
Associated Non Login Users ...........................................................................................................................14217.3.2
Cross Gateway Roaming Users ......................................................................................................................14217.3.3
On-Demand Roaming Out User .....................................................................................................................14317.3.4
Session List .....................................................................................................................................................14317.3.5
17.4 LOGS AND REPORTS ......................................................................................................................................................144
System Related Logs and Reports ..................................................................................................................14417.4.1
User Events ....................................................................................................................................................14417.4.2

4
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
17.5 REPORTS AND NOTIFICATION ..........................................................................................................................................145
SMTP Settings ................................................................................................................................................146
17.5.1
SYSLOG Settings .............................................................................................................................................14617.5.2
FTP Settings....................................................................................................................................................14717.5.3
Notification Settings ......................................................................................................................................14717.5.4
APPENDIX A. HARDWARE OVERVIEW ................................................................................................................................149

5
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
14ipnet WLAN Quick Deployment
1.1 Check your Network Environment
Before installing the 4ipnet WLAN controller, careful network planning is required in order to meet the
networking needs with the most efficient utilization of network resources. IT staff of any organization
should assess the available network resources at hand, and design a suitable network topology with
resiliency, capacity, and survivability in mind.
Typically, organization networks today are a combination of manageable wired and wireless LANs,
sometimes even remote LANs. Designed to fulfill most deployment needs, the two main categories of
network topologies supported are:
Layer 2 Topology
Layer 3 Topology
Layer 2 Topology aims to build a managed Local Area Network (LAN) which consists of both wired and
wireless capabilities to provide network services to a limited physical area such as office building, hotel,
school premises, and etc.
-Always connect hierarchically. If there are multiple switches in a building, use an aggregation switch.
-Locate the aggregation switch close to the network core (e.g. mainframe housing)
-Locate edge switches close to users (e.g. one per floor)
Layer 3 Topology aims to build a managed Local Area Network (LAN) which consists of both wired and
wireless capabilities to provide network services to local and remote physical areas such as enterprise
buildings, hotel chains, college campuses, and etc.
-Always connect hierarchically whether in local LAN or remote LAN. If there are multiple switches in a
building, use an aggregation switch.
-Locate the aggregation switch close to the network core (e.g. mainframe housing)
-Locate edge switches close to users (e.g. one per floor)
-Remote site’s device (4ipnet AP or 4ipnet WHG Controller) uplink should either have a public IP
address or an IP address in the same subnet as the main WHG Controller’s WAN IP address.
1.2 How to enable your Service Zone
Service Zone is a logic partition of WLAN controller’s LAN. The concept of Service Zone is that it is a virtual
gateway with customizable login portal page with its own gateway properties (such as VLAN tag, LAN IP
address, DHCP server settings, authentication options, etc.). With up to nine independent Service Zone
profiles, the WLAN controller is capable of servicing multiple hotspot franchises with a single device.
Administrators are able to check the Service Zone status from “Main ›System ›Service Zone”and click the

6
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
hyperlink of Service Zone Name for further configuration about its own VLAN tag, LAN IP address, DHCP
server settings, authentication options, etc. For more details, please refer to “chapter 3 How to configure
Service Zone.”
1.3 How to add an User Accounts
Local User is a type of user whose account credential is stored in the WLAN controller’s built-in database
named “Local”. The WLAN controller’s “Local” database capacity varies with different model. A local user
account does not have an expiration date once they are created. If administrator wishes to delete local
accounts, this must be done manually from the Web Management Interface.
Administrators are able to check the existed Local User Accounts from “Main ›Users ›Internal
Authentication ›Local Authentication ›Local User List” and simply create one by clicking “Add”button
with desired Username and Password. For more details, please refer to “session 4.1.1 Local User
Database”
On-Demand User is a type of user whose account credential is stored in the WLAN controller’s built-in
database named “On-Demand”. The WLAN controller’s “On-Demand” database capacity varies with
different model. On-Demand User is designed for short term usage purpose; it has time or volume
constraints and an expiration period. An On-Demand account record will be recycled for creating new
On-Demand account if it has expired for over 15 days or has been deleted by the Administrator/Manager
manually.
Administrators need to generate an On-Demand billing plan first form “Main ›Users ›Internal
Authentication ›On-Demand Authentication ›Billing Configuration” by clicking the hyperlink of the billing
plan number. Furthermore, administrators are able to check the existed On-Demand User Accounts from
“Main ›Users ›On-Demand Accounts ›Account Creation”and simply create one or multiple accounts by
clicking “Create Single”or “Create Batch”button with desired Username and Password, respectively. For
more details, please refer to “session 4.1.2 On-Demand User Database”and “session 4.1.3 On-Demand
Account Creation”
1.4 How to add an Access Point
There are couples of methodology to add the access point into management by WLAN controller. It
depends on what network topology it is. Simply, LAPM is for Layer 2 network topology (”session 7.2 AP
adding and configuration”), WAPM without tunnel is for L3 network topology without client
authentication (”session 8.3.1 AP discovery”), WAPM with complete tunnel is for L3 network topology
with fully controlling clients traffic (”session 8.3.3 CAPWAP with complete tunnel”), while WAPM with split
tunnel is for L3 network topology with authentication and traffic flow optimization(”session 8.3.4 CAPWAP
with split tunnel”).

7
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
2How to configure System Setup
2.1 System General Setting
This section relates to fundamental system configuration.
The General displays the following tabs:
General Settings
System Time
General Settings
System Name: This is a mnemonic name admin can give to the controller. Once configured, it will show on
the web browser’s frame.
Contact Information: This is the email, cell phone, or other means of contact, displayed on the clients’ web
browser in the event of internet disconnection.
HTTPS Certificate: HTTPS network certificate as site safety verification, which is able to be uploaded and
selected from “Utilities > Certificates > System Certificate, chapter 15.2”.
User HTTPS Login: Presents the option to allow end users authenticated with HTTPS for encrypted content
transfer. The Disable option indicates the user will be redirected to HTTP login page, while the Enable
option to HTTPS login page. The Secure option supports only “High” encryption cipher suites i.e. SSLv3
and TLSv1.
HTTPS Automatic Redirects provides an option for allowing or denying HTTPS requests when a user first
connects to a network. When enabled, HTTPS traffic will be redirected but may prompt a certificate
security warning. When HTTPS is disabled, all HTTPS traffic is denied and will be timed-out. This option
will effectively prevent all security warnings being shown on the user’s devices. When HTTPS requests are
timed-out, some browsers may automatically request a HTTP webpage to redirect to a Captive Portal.
-Enable HTTPS Automatic Redirect: users browsing with HTTPS may be shown a certificate security alert
when browsing before they access the Captive Portal.
-Block HTTPS Automatic Redirect: users browsing with HTTPS will be timed-out, meaning their webpage
will appear blank since they never reach their destination
-Bypass non-HTTP Traffic Prior to Sign-In: all HTTPS websites are allowed for browsing even though the
user have not accepted the disclaimer page or completed the sign-in process on the Captive Portal.
Internal Domain Name: A fully qualified domain name (FQDN) of the system. Ideal for accessing the
Controller instead of remembering the IP address of the LAN interfaces. When the administrator enters a
desired domain name in the Internal Domain Name field, the entered Internal Domain Name will be
shown in the URL of the Login Success page instead of a LAN IP address. In addition, when HTTPS is
enabled, enter the domain name of the uploaded certificate will increase login speed and the URL in the
User Login page will be changed. On the Social Media Login, this Internal Domain Name help redirect the
login succeeded clients back the Login Success page.
Portal URL Exceptions (User Agent): The desired landing page may be directed after users’ initial login
except specific opened browsers listed here.
User Log Access IP Address: Once configured, user logs can only be accessed via the administrator

8
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
matching the entered IP.
UAM Filter: The Universal Access Method (UAM) Filter drops non-browser http requests from user agents
before authentication to prevent system overloading from excessive traffic.
Management IP Address List: This allows the network administrator to enter a selection of reserved IP
addresses/ range that are authorized to see the Web Management Interface, which is configured in
“System > General > Management IP Address List, chapter2.2”. The remote console interface is disabled
by default.
SNMP: Presents an option to enable or disabled system info retrieval via SNMP protocal. Administrators
can choose to assign specific port to transmit SNMP trap messages. Detailed thresholds such as CPU
Usage, Memory Usage, DHCP Scope, and Heart Beat Period may be configured.
Suspend Warning Message: A field for administrator to enter the message to users when a Service Zone’s
service is temporarily suspended
System Time
Current Time: The system time right away following below configuration.
Time Zone: a dropdown list to select the local time zone the system is.
Time Update (NTP): The system completes automatic time synchronization by specifying external NTP
servers in the order of NTP Server 1 to 5. The checkbox of Use this controller as an NTP server is checked
by default so as to synchronize the time of managed-APs.
Time Update (Manually Set Up): The system time is manually configured.
2.2 WMI Management Access
The administrator can grant access to the WMI by specifying a list specific IP addresses or ranges of IP
addresses, both from WAN or from LAN, in web-based or in console-based.
The Management IP List displays the following tabs:
Management Service
Management Service Zone List
Management IP Address List
Management Service
SSH Service: The encrypted remote console interface in port 22. For security purposes, SSH Service is
recommended to disable to prevent malicious users from accessing the system. However, if the remotely
troubleshooting is required by 4ipnet Support team, please help enable in advance.
Telnet Service: The non-encrypted remote console interface in port 23. For security purposes, Telnet
Service is disabled by default to prevent malicious users from accessing the system.

9
User Manual ENGLISH
WHG-Series Wireless WLAN Controller
Copyright © 2017, 4ipnet, Inc. All rights reserved. All other trademarks mentioned are the property of their respective owners.
Management Service Zone List
Given the enabled Service Zone(s), which is configured in “System > Service Zone, chapter2.4”,
administrators could Active to let the devices matching the range of IP address could access the WMI of
the system.
Management IP Address List
For remote access purpose, the IP Address/ Segment could be customized for the administrators to access
the WMI of the system. Please confirm the entries are Active in the table by checking the checkboxes. For
example, entering "192.168.3.1" and "192.168.1.0/24" means that only the device at 192.168.3.1 and
devices in the range of 192.168.1.0 to 192.168.1.255 are able to reach the web management interface.
If administrators would like to type a specific IP address, there is not necessary to type the segment. (type
192.168.5.44, instead of 192.168.5.44/32)
2.3 WAN Configuration
The 4ipnet WHG-series Gateway-Controllers have at least 2 physical WAN ports for supporting most ISP. To
complete accessing the WAN IP address is important in the very beginning configuration.
The WAN screen displays the following tabs:
WAN Configuration
WAN2 Configuration
WAN2 Functions
WAN Configuration
Physical Mode: a drop-down list allows administrators to choose the speed and duplex of the WAN
connection. When Auto-Negotiation is ON, the system chooses the highest performance transmission
mode (speed/duplex/flow control) that both the system and the device connected to the interface
support.
Static: Manually specifying the IP address of the WAN port.
Dynamic: It is only applicable for a network environment where the DHCP server is available in the
upstream network. Renew button to get an IP address automatically.
PPPoE: It is for PPPoE dialup connection provided by your ISP, and the ISP will issue you an account with a
password so as to complete the configuration.
PPTP: Some IPSs (in European countries) may provide PPTP protocol for dialup connection. The issued
PPTP account and password for PPTP server are required.
Transmission Option (WHG711, WHG802 only): 4ipnet carrier grade models designed with SFP fiber ports,
which could be configured as
-Ether Port: Deploy the copper Ethernet WAN port for service.
-Fiber Port: Deploy the SFP fiber port for service.