AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

HP ProCurve MSM
Integration Guide
Revision
Date
0.9
22 August 2009
Copyright © 2007 amigopod Pty Ltd
amigopod Head Office
amigopod Pty Ltd
Suite 101
349 Pacific Hwy
North Sydney, NSW 2060
Australia
ABN 74 124 753 420
Web
www.amigopod.com
Phone
[phone]
Fax
[phone]

CONFIDENTIAL 2
Table of Contents
Introduction ................................................................................................................................... 3
Test Environment...................................................................................................................... 4
Integration ................................................................................................................................. 5
Amigopod Configuration ............................................................................................................... 6
Step 1 –Create RADIUS NAS for HP ProCurve Controller...................................................... 7
Step 2 –Restart RADIUS Services........................................................................................... 8
Step 3 –Create a Web-Login Page .......................................................................................... 9
Step 4 -Review to Web Login Captive Portal page................................................................ 11
HP ProCurve MSM Configuration............................................................................................... 12
Step 2 –Install HP ProCurve MultiService Access Point (Optional)....................................... 16
Step 3–Create RADIUS Definition for amigopod ................................................................... 17
Step 4 –DNS Proxy & Interception configuration................................................................... 18
Step 5 -Add Default Route for MSM ...................................................................................... 19
Step 6 –Configure the Default VSC ....................................................................................... 20
VSC Global Configuration................................................................................................... 21
VSC Access Control Configuration ..................................................................................... 21
VSC Virtual AP Configuration ............................................................................................. 22
VSC HTML Based User Logins Configuration .................................................................... 23
Step 7 –Public Access Configuration..................................................................................... 24
Step 8 –Public Access Attributes ........................................................................................... 25
Define Login URL destination ............................................................................................. 26
Access List Configuration ................................................................................................... 27
(Optional) User Experience Customisation......................................................................... 29
(Optional) Modify default user session limits ...................................................................... 29
Testing the Configuration............................................................................................................ 31
Step 1 –Create a test user account ....................................................................................... 31
Step 2 - Connect to the amigopod wireless network............................................................... 32
Step 2 –Confirm DHCP IP Address received......................................................................... 33
Step 3 –Confirm session detected by HP ProCurve Controller ............................................. 33
Step 4 –Launch Web Browser and login................................................................................ 35
Step 5 –Confirm the login successful from MSM ................................................................... 36
Step 6 –Confirm RADIUS debug messages on amigopod .................................................... 37
Step 7 –Check User Experience............................................................................................ 40
Appendix A –Public Access RADIUS configuration................................................................... 41
Create the MSM Configuration User Role .............................................................................. 42
Create MSM Configuration user ............................................................................................. 43
Test Result.............................................................................................................................. 45
Detailed RADIUS Debug..................................................................................................... 46

CONFIDENTIAL 3
Introduction
This document outlines the configuration process on both the HP Pro Curve MultiService
Controllers and the amigopod appliance to create a fully integrated Visitor Management
solution. The solution leverages the captive portal functionality built into the HP ProCurve MSM.
HP ProCurve uses the terminology of HTML Authentication to refer to their internal captive
portal functionality and it can be generally defined as follows:
Captive portal allows a wireless client to authenticate using a web-based portal. Captive portals
are typically used in public access wireless hotspots or for hotel in-room Internet access. After a
client associates to the wireless network, their device is assigned an IP address. The client must
start a web browser and pass an authentication check before access to the network is granted.
Captive portal authentication is the simplest form of authentication to use and requires no
software installation or configuration on the client. The username/password exchange is
encrypted using standard SSL encryption.
However, Captive Portal authentication does not provide any form of encryption beyond the
authentication process; to ensure privacy of client data, some form of link-layer encryption (such
as WEP or WPA-PSK) should be used when sensitive data will be sent over the wireless
network.
Amigopod extendsthe standard HP ProCurve HTML Authentication functionality by providing
many advanced features such as a fully branded user interface, SMS integration for delivery of
receipts, bulk upload of visitors for conference management, self provisioning of users for public
space environments to name a few.
The following table outlines the HP ProCurve MSM appliances that have been tested with the
amigopod solution by either a partner or the vendor directly.
Vendor
Products
amigopod verified
Partner Verified
MSM710, MSM750
Yes – 5.2.6.2

CONFIDENTIAL 4
Test Environment
The test environment referencedthroughout this integration guide is based on a HP ProCurve
MSM710. Although this low end hardware platform has been used, the testing and therefore this
procedure is valid for all hardware variants from HP ProCurve as it is the MSM software that is
providing the integration points with amigopod.
The following table shows the software versions used during the integration testing. This
document will be updated in the future if changes in either amigopod or HP ProCurve
subsequent releases affect the stability of this integration. It is advised that the customer always
check for the latest integration guide available from either amigopod or Trapeze.
Date Tested:
August 2009
AmigoPod Version:
Kernel2.0, Radius Services2.0.1
Plugins Required:
Standard build only
MSM Version:
5.2.6.2-01-7148
Integration:
HTTP Captive Portal
Amigopod was deployed locally on the LAN interface of the HP ProCurve controller as a
VMWare image running on a test laptop. Although the VMWare image has been used the
integration is equally valid for the amigopod appliance and self installing DVD deployment
variants.
MSM710 IP Address
10.0.20.25
Internet Gateway Address
10.0.20.1
amigopod IP Address
10.0.20.60
amigopod RADIUS port
Auth 1812 Acc 1813 (default settings)
The following diagram provides a high level overview of the test lab topology:

CONFIDENTIAL 5
Integration
Although the HP ProCurve MSM710 supports both internal and external Captive portal
functionality, this integration guide will focus on the later as the internal HTML Authentication
dictates the use of the internal Login Page resident on the controller itself. The Login page is
very basic and doesn’t allow for significant customization as is possible with the amigopod Web
Logins feature.
Note: HP ProCurve now allowsfor customised Captive portal pages to be cached on the
controller but this process requires a significant amount of web design and javascript experience
to produce a professional result. One of amigopod’s strongest selling points is the Skin Plugin
technology where the presentation of the User Interface is separated from the mechanics of the
underlying application. This allows amigopod to supply end users with a ready branded Skin for
all amigopod interaction (both Visitor and Administrators) for a small nominal fee at time of
purchase.
The integration will also leverage the MSM’s ability to define and reference external RADIUS
servers for the authentication and accounting of visitor accounts. In the standalone HP
ProCurve Guest provisioning solution the local database in each controller is used to store user
credentials, limiting the solution to the scope of the local deployment. With the introduction of
amigopod, all visitor accounts are created, authenticated and accounted for on the amigopod
internal RADIUS Server.

CONFIDENTIAL 6
Amigopod Configuration
The following configuration procedure assumes that the amigopod software or appliance has
been powered up and a basic IP configuration has been applied through the setup wizard to
allow the administrator to access the Web User Interface. The following table again reviews the
IP Addressing used in the test environment but this would be replaced with the site specific
details of each customer deployment:
MSM710 IP Address
10.0.20.25
Internet Gateway Address
10.0.20.1
amigopod IP Address
10.0.20.60
amigopod RADIUS port
Auth 1812 Acc 1813 (default settings)
Please refer to the amigopod Quick Start Guide for more information on the basic configuration
of the amigopod software.

CONFIDENTIAL 7
Step 1 –Create RADIUS NAS for HP ProCurve Controller
In order for the HP ProCurve controller to authenticate users it needs to be able to communicate
with the amigopod RADIUS instance. This step configures the amigopod NAS definition for the
HP ProCurve Controller. The RADIUS key used here needs to be configured exactly the same
as what will be configured on the MSM for the RADIUS transactions to be successful.
For simplicity we will use a shared secret of wireless. Please note this as it will be required in
the first step of the HP ProCurve configuration.
From the RADIUS Services  Network Access Servers screen click on the Create button to add
a new NAS device. Enter the IP Address of the HP ProCurve Controller, set the NAS Type as
Colubris/HP (RFC 3576 Support) and enter the key of wireless in the Shared Secret field.
Click the Create NAS button to commit the change to the RADIUS database.

CONFIDENTIAL 8
Step 2 –Restart RADIUS Services
A restart of the RADIUS Service is required for the new NAS configuration to take effect.
Click the Restart RADIUS Server button shown below and wait a few moments for the process
to complete.

CONFIDENTIAL 9
Step 3 –Create a Web-Login Page
From the RADIUS Services  Web Logins page select the Create New Web Login page option
at the bottom of the page. From the RADIUS Web Login page enter a name and description of
the Web Login page you are creating.
Optionally you can set a preferred page name that will make up the Web Login URL. In this
example we have chosen to use procurve_login as the name and the resulting URL in this lab
environment will be:
http://10.0.20.60/procurve_login.php
The Submit URL is made up of the IP Address of the HP ProCurve MSM, the port number used
for HTTP authentication and a URL suffix defined by HP ProCurve to be:
/goform/HtmlLoginRequest
Ensure the Submit Method is set to POST.

CONFIDENTIAL 10
By default the HP ProCurve MSM710 uses port 8080 for unsecured HTML authentication and
8090 for secure HTML authentication. Depending on your sites use of Proxy Servers these
ports may not be appropriate and may need to be modified. These settings can be reviewed in
the MSM configuration under Service Controller  Public Access  Access Control. The defaults
are shown below in the screenshot from the HP ProCurve MSM Web Management Tool.
This setting has been mentioned at this point of the configuration process as it affects the
Submit URL that needs to be set in the Web Login configuration shown above. The example
shows the default setting of port 8080 being used. Note the <IP-address:port-number> syntax
used in URLs above.
The decision to use either secure (https) or non-secure (http) authentication will be determined
by what sort of Guest Access you intend to provide. If you are providing credit card based
billable Guest Access then the expectation would be that all transactions would be secure and
protected by a https session. On the other hand if you are running a Free Hotspot this may not
be as much of a concern.
Make sure you select the Skin that you would like presented as the branding for the Captive
Portal page and set the Title of the Web Login so it is displayed correctly in the user’s browser.
Modify the sample HTML in the Header HTML, Footer HTML and Login Message section to
customize for your local environment. Click the Save Changes button to commit the changes.