AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

D-Link DSA-3600
Integration Guide
Revision
Date
0.9
15th December 2009
Copyright © 2007 amigopod Pty Ltd
amigopod Head Office
amigopod Pty Ltd
Suite 101
349 Pacific Hwy
North Sydney, NSW 2060
Australia
ABN 74 124 753 420
Web
www.amigopod.com
Phone
[phone]
Fax
[phone]

CONFIDENTIAL 2
Table of Contents
Introduction ................................................................................................................................... 3!
Test Environment...................................................................................................................... 4!
Integration ................................................................................................................................. 5!
Amigopod Configuration ............................................................................................................... 6!
Step 1 – Create RADIUS NAS for D-Link DSA-3600 Gateway ................................................ 7!
Step 2 – Restart RADIUS Services........................................................................................... 8!
Step 3 – Create a Web-Login Page .......................................................................................... 9!
Step 4 - Review to Web Login Captive Portal page................................................................ 12!
D-Link DSA-3600 Configuration ................................................................................................. 13!
Step 2 – Install Managed D-Link Access Points (Optional) .................................................... 17!
Step 3– Create RADIUS Definition for amigopod ................................................................... 18!
Step 4 – Enable Authentication on Default Service Zone ....................................................... 20!
Step 5 – Define Login Page External Destination................................................................... 22!
Step 6 – Apply Access Policy to all Guest Users (Optional) ................................................... 24!
Testing the Configuration............................................................................................................ 25!
Step 1 – Create a test user account ....................................................................................... 25!
Step 2 – Confirm DHCP IP Address received......................................................................... 26!
Step 3 – Launch Web Browser and login................................................................................ 27!
Step 4 – Confirm the login successful from DSA-3600........................................................... 28!
Step 7 – Check User Experience............................................................................................ 32!
Appendix A – Per User Policy Definition via RADIUS ................................................................ 33!
Create D-Link Specific User Role ........................................................................................... 34!
Create Test D-Link user.......................................................................................................... 35!
Enable Class-Mapping on the DSA-3600 ............................................................................... 36!
Test Result.............................................................................................................................. 40!
Before Firewall Policy Applied ............................................................................................ 40!
After Firewall Policy Applied ............................................................................................... 41!
Before QoS Policy Applied.................................................................................................. 42!
After QoS Policy Applied..................................................................................................... 42!
Detailed RADIUS Debug..................................................................................................... 43!
Appendix B – Advanced Customisation...................................................................................... 45!
Testing the configuration......................................................................................................... 50!
Optional Walled Garden Access ............................................................................................. 51!
Appendix C – Advanced RADIUS VSA Configuration ................................................................ 52!

CONFIDENTIAL 3
Introduction
This document outlines the configuration process on both the D-Link Multi-Service Business
Gateways and the amigopod appliance to create a fully integrated Visitor Management solution.
The solution leverages the captive portal functionality built into the D-Link DSA-3600. D-Link
uses the terminology of User Login Pages to refer to their internal captive portal functionality
and it can be generally defined as follows:
Captive portal allows a wireless client to authenticate using a web-based portal. Captive portals
are typically used in public access wireless hotspots or for hotel in-room Internet access. After a
client associates to the wireless network, their device is assigned an IP address. The client must
start a web browser and pass an authentication check before access to the network is granted.
Captive portal authentication is the simplest form of authentication to use and requires no
software installation or configuration on the client. The username/password exchange is
encrypted using standard SSL encryption.
However, Captive Portal authentication does not provide any form of encryption beyond the
authentication process; to ensure privacy of client data, some form of link-layer encryption (such
as WEP or WPA-PSK) should be used when sensitive data will be sent over the wireless
network.
Amigopod extends the standard D-Link User Login Pages functionality by providing many
advanced features such as a fully branded user interface, SMS integration for delivery of
receipts, bulk upload of visitors for conference management, self provisioning of users for public
space environments to name a few.
The following table outlines the D-Link Gateways that have been tested with the amigopod
solution by either a partner or the vendor directly
Vendor
Products
amigopod verified
Partner Verified
DSA-3600
Yes – 3.50.00

CONFIDENTIAL 4
Test Environment
The test environment referenced throughout this integration guide is based on a D-Link DSA-
3600 Multi-Service Business Gateway. Although this low end hardware platform has been used,
the testing and therefore this procedure is valid for all DSA hardware variants from D-Link as it
is the DSA software that is providing the integration points with amigopod.
The following table shows the software versions used during the integration testing. This
document will be updated in the future if changes in either amigopod or D-Link subsequent
releases affect the stability of this integration. It is advised that the customer always check for
the latest integration guide available from either amigopod or Trapeze.
Date Tested:
December 2009
AmigoPod Version:
Kernel!2.0.20, Radius Services!2.0.20
Plugins Required:
Standard build only
DSA Version:
3.50.00
Integration:
HTTP Captive Portal
Amigopod was deployed locally on the WAN1 interface of the D-Link DSA3600 Gateway as a
VMWare image running on a test laptop. Although the VMWare image has been used the
integration is equally valid for the amigopod appliance and self installing DVD deployment
variants.
DSA WAN1 IP Address
10.0.20.166
DSA Default Service Zone IP Address
192.168.1.1
Internet Gateway Address
10.0.20.1
amigopod IP Address
10.0.20.54
amigopod RADIUS port
Auth 1812 Acc 1813 (default settings)

CONFIDENTIAL 5
The following diagram provides a high level overview of the test lab topology:
Integration
Although the D-Link DSA-3600 supports both internal and external Captive portal functionality,
this integration guide will focus on the later as the internal HTML Authentication dictates the use
of the internal Login Page resident on the controller itself. The Login page is very basic and
doesn’t allow for significant customization as is possible with the amigopod Web Logins feature.
Note: D-Link now allows for customised Captive portal pages to be uploaded onto the gateway
but this process requires a significant amount of web design and javascript experience to
produce a professional result. One of amigopod’s strongest selling points is the Skin Plugin
technology where the presentation of the User Interface is separated from the mechanics of the
underlying application. This allows amigopod to supply end users with a ready branded Skin for
all amigopod interaction (both Visitor and Administrators) for a small nominal fee at time of
purchase.
The integration will also leverage the DSA-3600’s ability to define and reference external
RADIUS servers for the authentication and accounting of visitor accounts. In the standalone D-
Link ONDEMAND Guest provisioning solution the local database in each gateway is used to
store user credentials, limiting the solution to the scope of the local deployment. With the
introduction of amigopod, all visitor accounts are created, authenticated and accounted for on
the amigopod internal RADIUS Server.

CONFIDENTIAL 6
Amigopod Configuration
The following configuration procedure assumes that the amigopod software or appliance has
been powered up and a basic IP configuration has been applied through the setup wizard to
allow the administrator to access the Web User Interface. The following table again reviews the
IP Addressing used in the test environment but this would be replaced with the site specific
details of each customer deployment:
DSA WAN1 IP Address
10.0.20.166
DSA Default Service Zone IP Address
192.168.1.1
Internet Gateway Address
10.0.20.1
amigopod IP Address
10.0.20.54
amigopod RADIUS port
Auth 1812 Acc 1813 (default settings)
Please refer to the amigopod Quick Start Guide for more information on the basic configuration
of the amigopod software.

CONFIDENTIAL 7
Step 1 – Create RADIUS NAS for D-Link DSA-3600 Gateway
In order for the D-Link DSA-3600 to authenticate users it needs to be able to communicate with
the amigopod RADIUS instance. This step configures the amigopod NAS definition for the D-
Link DSA-3600 Gateway. The RADIUS key used here needs to be configured exactly the same
as what will be configured on the DSA-3600 for the RADIUS transactions to be successful.
For simplicity we will use a shared secret of wireless. Please note this as it will be required in
the first step of the D-Link DSA-3600 configuration.
From the RADIUS Services ! Network Access Servers screen click on the Createbutton to add
a new NAS device. Enter the IP Address of the D-Link DSA-3600 Gateway, set the NAS Type
as Other NAS and enter the key of wireless in the Shared Secret field.
Click the Create NAS button to commit the change to the RADIUS database.

CONFIDENTIAL 8
Step 2 – Restart RADIUS Services
A restart of the RADIUS Service is required for the new NAS configuration to take effect.
Click the Restart RADIUS Server button shown below and wait a few moments for the process
to complete.

CONFIDENTIAL 9
Step 3 – Create a Web-Login Page
From the RADIUS Services ! Web Logins page select the Create New Web Login page option
at the bottom of the page. From the RADIUS Web Login page enter a name and description of
the Web Login page you are creating.
Optionally you can set a preferred page name that will make up the Web Login URL. In this
example we have chosen to use dlink_login as the name and the resulting URL in this lab
environment will be:
http://10.0.20.54/dlink_login.php
The Submit URL is made up of the Service Zone IP Address of the D-Link DSA-3600 and a
URL suffix defined by D-Link to be:
/loginpages/userlogin.shtml
In the Lab network design, the Default Service Zone is being used for the basis of all
subsequent configurations and therefore the default IP address used by D-Link on this interface
is 192.168.1.1. Depending on your network design, the remaining Service Zones such as SZ1-
SZ4 may also be used and your submit URL should be updated to reflect these changes.

CONFIDENTIAL 10
Ensure the Submit Method is set to POST.
By default the D-Link DSA-3600 uses port 80 for unsecured HTML authentication and 443 for
secure HTML authentication. Via the System ! General settings on the D-Link DSA-3600 all we
login traffic can be configured to use HTTPS (port 443) and therefore provide secure encryption
for the username and password traffic being sent over the wireless network.
Note: To avoid receiving browser warnings regarding self signed certificates, trusted root issued
certificates should be deployed on both the D-Link DSA-3600 and the amigopod in production
environments.
This setting has been mentioned at this point of the configuration process as it affects the
Submit URL that needs to be set in the Web Login configuration shown above. The example
above shows the default setting of port 80 (ie. http) being used.

CONFIDENTIAL 11
The decision to use either secure (https) or non-secure (http) authentication will be determined
by what sort of Guest Access you intend to provide. If you are providing credit card based
billable Guest Access then the expectation would be that all transactions would be secure and
protected by a https session. On the other hand if you are running a Free Hotspot this may not
be as much of a concern.
Make sure you select the Skin that you would like presented as the branding for the Captive
Portal page and set the Title of the Web Login so it is displayed correctly in the user’s browser.
Modify the sample HTML in the Header HTML, Footer HTML and Login Message section to
customize for your local environment. Click the Save Changes button to commit the changes.

CONFIDENTIAL 12
Step 4 - Review to Web Login Captive Portal page
Returning to the Web Logins page, select the D-Link Web Login entry and Click the Test button
and in a new window the configured captive portal page will be displayed as shown below:
Click the Back button in the web browser to return to the amigopod configuration screen.
Note: Make note of the URL presented in the web browser after the Test button has been
clicked. This URL will be required in the configuration of the Custom Pages settings on the D-
Link DSA-3600 gateway. An example of the URL is shown below:
http://10.0.20.54/dlink_login.php

CONFIDENTIAL 13
D-Link DSA-3600 Configuration
The following configuration procedure assumes that the D-Link DSA-3600 has been powered up
and a basic IP configuration has been applied through the steps detailed in the Quick Install
Guide. The following table again reviews the IP Addressing used in the test environment but this
would be replaced with the site specific details of each customer deployment:
DSA WAN1 IP Address
10.0.20.166
DSA Default Service Zone IP Address
192.168.1.1
Internet Gateway Address
10.0.20.1
amigopod IP Address
10.0.20.54
amigopod RADIUS port
Auth 1812 Acc 1813 (default settings)
Depending on your network design the D-Link DSA-3600 may need to be configured to perform
Network Address Translation (NAT) on the Internet port. As can be seen from the previous Lab
Topology diagram, to simplify our lab routing environment NAT has been enabled.
If NAT is required in your network design, the DSA NAT settings can be found under
System ! Service Zones ! Default ! Configure as shown below:

CONFIDENTIAL 14
If your design requires the use of other Service Zones than the Default Service Zone then the
NAT settings for these zones will also have to be updated.
If you intend to run your network in a routed environment you will either need to update your
routing tables on the default gateway router that is servicing the network the WAN1 port of the
DSA is connected to and / or add a static route to the amigopod configuration.
To add a static route to your amigopod install, browse to the Administrator ! Network Interfaces
menu option and select your active Ethernet adaptor. In our case eth1 is connected to the local
lab network as shown below:

CONFIDENTIAL 15
Click on the Routes option and add in the details for your IP address range allocated to the LAN
port on the DSA as shown below:

CONFIDENTIAL 16
Step 1 – Enable DHCP on LAN port
In our Lab environment DHCP needs to be enabled on the Default Service Zone to provide IP
addresses to both downstream D-Link Access Points and any wired clients connected to this
interface of the DSA-3600. This is configured again under System ! Service
Zones ! Default ! Configure as shown in the following screen shot:

CONFIDENTIAL 17
Step 2 – Install Managed D-Link Access Points (Optional)
Although the D-Link DSA-3600 range of gateways is designed primarily for the centralized
control of D-Link Access Points, the gateway can be equally used for providing Access Control
in pure wired environments.
The many different methods of configuring the D-Link Access Points is covered extensively in
the D-Link DSA-3600 User Guide in Chapters 4.3 and is therefore considered outside of the
scope of this Integration guide. Please refer to the D-Link User Guide for further information on
these topics and the best method for configuring your wireless environment.
For the lab environment used through the rest of this document, the DSA-3600 will be used and
configured as a wired Access Controller and the test client will be attached directly to the LAN
ports of the DSA.

CONFIDENTIAL 18
Step 3– Create RADIUS Definition for amigopod
From the Users ! Authentication screen click the Server 3 RADIUS Auth option. In the following
screen be sure to enter and confirm the following details:
•Enter a descriptive name for the Name
•An identifier that will be appended to the end of any authenticated usernames in the
Postfix field
Next to the Authentication Database option click on the Configure button as shown in the above
screenshot.
•Under Primary RAIUS Server enter the IP address of the amigopod
•Confirm the default setting of 1812 & 1813 for the Authentication & Accounting Port
•Select PAP for the Authentication Protocol
•Enter the Shared Secret recorded in Step 1 of the amigopod config as the Secret Key ie.
wireless
•Enable the Accounting Service if you wish to receive session statistics and be able to
leverage the amigopod Guest Manager ! Active Sessions display.
Be sure to save the changes by clicking on the Apply button on the bottom left hand side of the
page.

CONFIDENTIAL 19
Note: The Secret above needs to be the same as the one defined in Step 1 of the amigopod
configuration. For example, wireless.
The User ! Authentication table should now look something like the following screenshot:

CONFIDENTIAL 20
Step 4 – Enable Authentication on Default Service Zone
In order for the DSA to be able to intercept and redirect any new Guest users to the amigopod
hosted Web Login page, the gateway must have Authentication Required enabled for the
Security Zone in question. By default the following table displays the factory configured Security
Zones and their disabled authentication state:
Click on the Configure button for the Default Security Zone shown above and scroll down to the
Authentication Settings section.
Firstly make sure the Authentication Required For the Zone option is Enabled.
Next, under the Authentication Options section immediately below ensure the radio button in the
Default column for RADIUS Auth Database is checked and enabled.