Omada SDN Controller User Guide

Name

Status

Protocols

WAN

Use the other WAN port if the current WAN is down .

Routing Legend

Select the type of the traffic source and destination.

Network : Select the LAN Interfaces for the traffic source or destination.

IP Group : Select the IP Group for the traffic source or destination. You can click + Create to create a new IP Group.

IP-Port Group: Select the IP-Port Group for the traffic source or destination. You can click + Create to create a new IP-Port Group.

Name

Status

Source IP

Any : The rule applies to traffic from any source IP address.

Limited IP Address : The rule only applies to traffic from specific IP addresses. With this option selected, specify the IP addresses and subnets according to your needs.

Interface

DMZ

Destination IP in the LAN, port to port. You need to specify the Destination IP .

Source Port and the Protocol is forwarded. The traffic is forwarded to the Destination Port of the Destination IP in the LAN. You need to specify the Source Port , Destination IP , Destination Port , and Protocol .

Source Port

Source Port to receive the traffic from the internet. Only the traffic which matches the Source Port and the Protocol is forwarded.

Destination IP

Destination IP in the LAN.

Destination Port

Destination Port of the host in the LAN.

Protocol

Source Port and the Protocol is forwarded.

All .

FTP ALG

�? The FTP server is in the LAN, while the FTP client is on the internet.

�? The FTP server is on the internet, while the FTP client is in the LAN.

�? The FTP server and FTP client are in different LANs.

H.323 ALG

�? One of the endpoints is in the LAN, while the other is on the internet.

�? The endpoints are in different LANs.

PPTP ALG

�? The PPTP server is in the LAN, while the PPTP client is on the internet.

�? The PPTP server is on the internet, while the PPTP client is in the LAN.

�? The PPTP server and PPTP client are in different LANs.

SIP ALG

�? One of the endpoints is in the LAN, while the other is on the internet.

�? The endpoints are in different LANs.

IPsec ALG

�? One of the endpoints is in the LAN, while the other is on the internet.

�? The endpoints are in different LANs.

Name

Status

Source Type

Network : Limit the maximum sessions of specific LAN networks. With this option selected, select the networks, which you can customize in Wired Networks > LAN Networks . For detailed configuration of networks, refer to 4. 3. 2 Configure LAN Networks .

IP Group : Limit the maximum sessions of specific IP Groups. With this option selected, select the IP Groups, which you can customize in Profiles > Groups . For detailed configuration of IP groups, refer to 4. 8 Create Profiles .

Maximum Sessions

3. Click Create . The new Session Limit rule is added to the list. You can click to edit the rule. You can click to delete the rule.

4. 6. 4 Bandwidth Control

Bandwidth Control optimizes network performance by limiting the bandwidth of specific sources.

1. Go to Setting > Transmission > Bandwidth Control . In Bandwidth Control , enable Bandwidth Control globally and configure the parameters. Then click Apply .

2. In Bandwidth Control Rule List , click + Create New Rule to load the following page and configure the parameters.

3. Click Create . The new Bandwidth Control rule is added to the list. You can click to edit the rule. You can click to delete the rule.

4. 7 Configure VPN

VPN (Virtual Private Network) provides a means for secure communication between remote computers across a public wide area network (WAN), such as the internet. Omada managed gateways supports various types of VPN. VPN configurations include 4. 7. 1 VPN and 4. 7. 2 VPN User .

4. 7. 1 VPN

VPN (Virtual Private Network) gives remote LANs or users secure access to LAN resources over a public network such as the internet. Virtual indicates the VPN connection is based on the logical end-to-end connection instead of the physical end-to-end connection. Private indicates users can establish the VPN connection according to their requirements and only specific users are allowed to use the VPN connection.

The core of VPN connection is to realize tunnel communication, which fulfills the task of data encapsulation, data transmission and data decompression via the tunneling protocol. The gateway supports common tunneling protocols that a VPN uses to keep the data secure:

�? IPsec

IPsec (IP Security) can provide security services such as data confidentiality, data integrity and data authentication at the IP layer. IPsec uses IKE (Internet Key Exchange) to handle negotiation of protocols and algorithms based on the user-specified policy, and to generate the encryption and authentication keys to be used by IPsec. IPsec can be used to protect one or more paths between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.

�? PPTP

PPTP (Point-to-Point Tunneling Protocol) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPN across TCP/IP-based data networks. PPTP uses the username and password to validate users.

�? L2TP

L2TP (Layer 2 Tunneling Protocol) provides a way for a dialup user to make a virtual Point-to-Point Protocol (PPP) connection to an L2TP network server (LNS), which can be a security gateway. L2TP sends PPP frames through a tunnel between an L2TP access concentrator (LAC) and the LNS. Because of the lack of confidentiality inherent in the L2TP protocol, it is often implemented along with IPsec. L2TP uses the username and password to validate users.

�? OpenVPN

OpenVPN uses OpenSSL for encryption of UDP and TCP for traffic transmission. OpenVPN uses a client-server connection to provide secure communications between a server and a remote client over the internet. One of the most important steps in setting up OpenVPN is obtaining a certificate which is used for authentication. Omada SDN controller supports generating the certificate which can be downloaded as a file on your computer. With the certificate imported, the remote clients are checked out by the certificate and granted access to the LAN resources.

There are many variations of virtual private networks, with the majority based on two main models:

�? Site-to-Site VPN

A Site-to-Site VPN creates a connection between two networks at different geographic locations. Typically, headquarters set up Site-to-Site VPN with the subsidiary to provide the branch office with access to the headquarters�?network.

Omada managed gateway supports two types of Site-to-Site VPNs:

�? Auto IPsec

The controller automatically creates an IPsec VPN tunnel between two sites on the same controller. The VPN connection is bidirectional. That is, creating an Auto IPsec VPN from site A to site B also provides connectivity from site B to site A, and nothing is needed to be configured on site B.

�? Manual IPsec

You create an IPsec VPN tunnel between two peer routers over internet manually, from a local router to a remote router that supports IPsec. Omada managed gateway on this site is the local peer router.

�? Client-to-Site VPN

A Client-to-Site VPN creates a connection to the LAN from a remote host. It is useful for teleworkers and business travelers to access their central LAN from a remote location without compromising privacy and security.

The first step to build a Client-to-Site VPN connection is to determine the role of the gateways and which VPN tunneling protocol to use:

�? VPN Server

The gateway on the central LAN works as a VPN server to provide a remote host with access to the local network. The gateway which functions as a VPN server can use L2TP, PPTP, IPsec, or OpenVPN as the tunneling protocol.

�? VPN Client

Either the remote user’s gateway or the remote user’s laptop or PC works as the VPN client.

When the remote user’s gateway works as the VPN client, the gateway helps create VPN tunnels between its connected hosts and the VPN server. The gateway which functions as a VPN client can use L2TP, PPTP, or OpenVPN as the tunneling protocol.

When the remote user’s laptop or PC works as the VPN client, the laptop or PC uses a VPN client software program to create VPN tunnels between itself and the VPN server. The VPN client software program can use L2TP, PPTP, IPsec, or OpenVPN as the tunneling protocol.

Note:

Here is the infographic to provide a quick overview of VPN solutions.

To complete the VPN configuration, follow these steps:

1 ) Create a new VPN policy and select the purpose of the VPN according to your needs. Select Site-to-Site if you want the network connected to another. Select Client-to-Site if you want some hosts connected to the network.

2 ) Select the VPN tunneling protocol and configure the VPN policy based on the protocol.

�? Configuring Site-to-Site VPN

Omada managed gateway supports two types of Site-to-Site VPNs: Auto IPsec and Manual IPsec .

�? Configuring Auto IPsec VPN

1. Go to Settings > VPN . Click to load the following page.

2. Enter a name to identify the VPN policy and select the purpose as Site-to-Site VPN. Refer to the following table to configure the required parameters and click Create .

Name		Purpose	Site-to-Site VPN .
VPN Type	Auto IPsec .
Status		Remote Site	�? Configuring Manual IPsec VPN 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Site-to-Site VPN. Refer to the following table to configure the basic parameters and click Create . Name Purpose Site-to-Site VPN . VPN Type Manual IPsec . Status Remote Gateway Remote Subnets Local Networks Pre-Shared Key A pre-shared key is a string of characters that is used as an authentication key. Both peer gateways create a hash value based on the same pre-shared key and other information. The hash values are then exchanged and verified to authenticate the other party. WAN 3. Click Advanced Settings to load the following page. Advanced settings include Phase-1 settings and Phase-2 settings. Phase-1 is used to set up a secure encrypted channel which the two peers can negotiate Phase-2, and then establish the IKE Security Associations (IKE SA). Phase-2 is used to negotiate about a set of parameters that define what traffic can go through the VPN, and how to encrypt and authenticate the traffic, then establish the IPsec Security Associations (IPsec SA). Refer to the following table to complete the configurations according to your actual needs and click Create . For Phase-1 Settings: Phase-1 Settings Internet Key Exchange Version Note that both peer gateways must be configured to use the same IKE version. Proposal Authentication algorithms verify the data integrity and authenticity of a message. The types of authentication includes MD5 and SHA1. Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. The DH group includes DH1, DH2, DH5, DH14, DH15, DH16, DH19, DH20, DH21, DH25, and DH26. Exchange Mode Main Mode: This mode provides identity protection and exchanges more information, which applies to scenarios with higher requirements for identity protection. Aggressive Mode: This mode establishes a faster connection but with lower security, which applies to scenarios with lower requirements for identity protection. Negotiation Mode Initiator Mode: This mode means that the local device initiates a connection to the peer. Responder Mode: This mode means that the local device waits for the connection request initiated by the peer. Local ID Type IP Address: Select IP Address to use the IP address for authentication. Name: Select Name, and then enter the name in the Local ID field to use the name as the ID for authentication. Local ID Remote ID Type IP Address: Select IP Address to use the IP address for authentication. Name: Select Name, and then enter the name in the Remote ID field to use the name as the ID for authentication. Remote ID SA Lifetime DPD DPD Interval For Phase-2 Settings: Phase-2 Settings Encapsulation Mode Proposal Note that both peer gateways must be configured to use the same Proposal. PFS SA Lifetime �? Configuring Client-to-Site VPN Omada managed gateway supports seven types of client-to-Site VPNs depending on the role of your Omada managed gateway and the protocol that you used: Configuring the gateway as a VPN server using L2TP Configuring the gateway as a VPN server using PPTP Configuring the gateway as a VPN server using IPsec Configuring the gateway as a VPN server using OpenVPN Configuring the gateway as a VPN client using L2TP Configuring the gateway as a VPN client using PPTP Configuring the gateway as a VPN client using OpenVPN �? Configuring the gateway as a VPN server using L2TP 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Server - L2TP . Status IPsec Encryption Encrypted: Select Encrypted to encrypt the L2TP tunnel by IPsec (L2TP over IPsec). With Encrypted selected, enter the Pre-shared Key for IKE authentication. VPN server and VPN client must use the same pre-shared secret key for authentication. Unencrypted: With Unencrypted selected, the L2TP tunnel will not be encrypted by IPsec. Auto: With Auto selected, the L2TP server will determine whether to encrypt the tunnel according to the client ‘s encryption settings. And enter the Pre-shared Key for IKE authentication. VPN server and VPN client must use the same pre-shared secret key for authentication. Local Networks Pre-shared Key WAN IP Pool 3. Add the VPN users account to validate remote hosts. To create VPN users, refer to 4. 7. 2 VPN User . �? Configuring the gateway as a VPN server using PPTP 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Server - PPTP . Status MPPE Encryption Encrypted: With Encrypted selected, the PPTP tunnel will be encrypted by MPPE. Unencrypted: With Unencrypted selected, the PPTP tunnel will be not encrypted by MPPE. Local Networks WAN IP Pool 3. Add the VPN users account to validate remote hosts. To create VPN users, refer to 4. 7. 2 VPN User . �? Configuring the gateway as a VPN server using IPsec 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the basic parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Server - IPsec . Status Remote Host Local Networks Pre-Shared Key A pre-shared key is a string of characters that is used as an authentication key. Both VPN peers create a hash value based on the same pre-shared key and other information. The hash values are then exchanged and verified to authenticate the other party. WAN IP Pool 3. Click Advanced Settings to load the following page. Advanced settings include Phase-1 settings and Phase-2 settings. Phase-1 is used to set up a secure encrypted channel which the two peers can negotiate Phase-2, and then establish the IKE Security Associations (IKE SA). Phase-2 is used to negotiate about a set of parameters that define what traffic can go through the VPN, and how to encrypt and authenticate the traffic, then establish the IPsec Security Associations (IPsec SA). Refer to the following table to complete the configurations according to your actual needs and click Create . For Phase-1 Settings: Phase-1 Settings Internet Key Exchange Version Note that both VPN peers must be configured to use the same IKE version. Proposal Authentication algorithms verify the data integrity and authenticity of a message. The types of authentication includes MD5 and SHA1. Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. The DH group includes DH1, DH2, DH5, DH14, DH15, DH16, DH19, DH20, DH21, DH25, and DH26. Exchange Mode Main Mode: This mode provides identity protection and exchanges more information, which applies to scenarios with higher requirements for identity protection. Aggressive Mode: This mode establishes a faster connection but with lower security, which applies to scenarios with lower requirements for identity protection. Negotiation Mode Initiator Mode: This mode means that the local device initiates a connection to the peer. Responder Mode: This mode means that the local device waits for the connection request initiated by the peer. Local ID Type IP Address: Select IP Address to use the IP address for authentication. Name: Select Name, and then enter the name in the Local ID field to use the name as the ID for authentication. Local ID Remote ID Type IP Address: Select IP Address to use the IP address for authentication. Name: Select Name, and then enter the name in the Remote ID field to use the name as the ID for authentication. Remote ID SA Lifetime DPD DPD Interval For Phase-2 Settings: Phase-2 Settings Encapsulation Mode Proposal Note that both peer gateways must be configured to use the same Proposal. PFS SA Lifetime �? Configuring the gateway as a VPN server using OpenVPN 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Server - OpenVPN . Status Protocol Service Port Local Networks WAN IP Pool 3. After clicking Create to save the VPN policy, go to VPN Policy List and click in the Action column to export the OpenVPN file that ends in .ovpn which is to be used by the remote client. The exported OpenVPN file contains the certificate and configuration information. �? Configuring the gateway as a VPN client using L2TP 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Client - L2TP . Status Working Mode NAT: With NAT (Network Address Translation) mode selected, the L2TP client uses the assigned IP address as its source addresses of original IP header when forwarding L2TP packets. Routing: With Routing selected, the L2TP client uses its own IP address as its source addresses of original IP header when forwarding L2TP packets. Username Password IPsec Encryption Encrypted: Select Encrypted to encrypt the L2TP tunnel by IPsec (L2TP over IPsec). With Encrypted selected, enter the Pre-shared Key for IKE authentication. VPN server and VPN client must use the same pre-shared secret key for authentication. Unencrypted: With Unencrypted selected, the L2TP tunnel will be not encrypted by IPsec. Remote Server Remote Subnets Local Networks Pre-shared Key WAN �? Configuring the gateway as a VPN client using PPTP 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Client - PPTP . Status Working Mode NAT: With NAT (Network Address Translation) mode selected, the PPTP client uses the assigned IP address as its source addresses of original IP header when forwarding PPTP packets. Routing: With Routing selected, the PPTP client uses its own IP address as its source addresses of original IP header when forwarding PPTP packets. Username Password MPPE Encryption Encrypted: Select Encrypted to encrypt the PPTP tunnel by MPPE. Unencrypted: With Unencrypted selected, the PPTP tunnel will be not encrypted by MPPE. Remote Server Remote Subnets Local Networks WAN �? Configuring the gateway as a VPN client using OpenVPN 1. Go to Settings > VPN . Click to load the following page. 2. Enter a name to identify the VPN policy and select the purpose as Client-to-Site VPN. Refer to the following table to configure the required parameters and click Create . Name Purpose Client-to-Site VPN . VPN Type VPN Client - OpenVPN . Status Remote Server Local Networks WAN Configuration to import the OpenVPN file that ends in .ovpn generated by the OpenVPN server. Only one file can be imported. 4. 7. 2 VPN User VPN User is used to configure and record your custom settings for VPN configurations, and it allows you to configure VPN users that can be used for multiple VPN servers, including L2TP servers and PPTP servers. It saves you from setting the VPN users with the same configurations repeatedly when you want to apply the user in different VPN servers. To configure the VPN users, follow these steps: 1. Go to Settings > VPN > VPN User . Click +Create New VPN User to add a new entry of VPN User. 2. Specify the parameters and select the VPN policy with the type of VPN Server-L2TP/PPTP that the VPN user is applied to and click Create . Username Password VPN Server Mode Client: This mode allows the client to request for an IP address and the server supplies the IP addresses from the VPN IP Pool. With this mode selected, set maximum number of concurrent VPN connections with the same account in Maximum Connections. Network Extension Mode: This mode allows only clients from the configured subnet to connect to the server and obtain VPN services. With this mode selected, specify the subnet in Remote Subnets. Maximum Connections Remote Subnets to specify the subnet. To edit or delete the VPN users, click the icon in the Action column. Delete the VPN user. 4. 8 Create Profiles Profiles section is used to configure and record your custom settings for site configurations. It includes Time Range and Groups profiles. In Time Range section, you can configure time templates for wireless schedule, PoE schedule, etc. In Groups section, you can configure groups based on IP, IP-Port and MAC addresses for ACL, Routing, NAT, etc. After creating the profiles, you can apply them to multiply configurations for different sites, saving you from repeatedly setting up the same information. 4. 8. 1 Time Range Time Range section allows you to customize time-related configurations. You can set different time range templates which can be shared and applied to wireless schedule, PoE schedule, etc. in site configuration. To configure the time range profiles, follow these steps: 1. Go to Settings > Profiles > Time Range . Click +Create New Time Range to add a new time range entry. By default, there is no entry in the list. 2. Enter a Name for the new entry, select the Day Mode, and specify the time range. Click Apply to save the entry. After saving the newly added entry, you can apply them to site configuration. To apply the customized time range profiles in configuration, refer to 4. 4. 3 WLAN Schedule , and 4. 10. 6 PoE Schedule . Name Day Mode Every Day , Weekday , Weekend , or Customized first before specifying the time range for each day. Every Day : You only need to set the time range once, and it will repeat every day. Weekday : You only need to set the time range once, and it will repeat every weekday from Monday to Friday. Weekend : You only need to set the time range once, and it will repeat every Saturday and Sunday. Customized : You are able to set different time range for the chosen day(s) based on your needs. When a day is not chosen, the WiFi is open all day by default. You can view the name, day mode and time range in the list. To edit or delete the time range entry, click the icon in the Action column. Delete the entry. 4. 8. 2 Groups Overview Groups section allows you to customize client groups based on IP, IP-Port, or MAC Address. You can set different rules for the groups profiles which can be shared and applied to ACL, Routing, NAT, etc. in site configuration. Configuration To configure the group profiles, follow these steps: 1. Go to Settings > Profiles > Groups . By default, there is an entry covering all IPs, and it is not editable and deletable. Click +Create New Group to add a new group entry. 2. Enter a name for the new group profile entry, and select the type for the new entry. �? Based on IP Group To configure a group profile based on IP Group, you are required to specify the IP subnets, while subnet mask is optional. You can click +Add Subnet to add new subnets, and click to delete them. �? Based on IP-Port Group To configure a group profile based on IP-Port Group, you are required to specify the port(s) for the entry, while it is optional to specify the IP subnet(s). If you only specify the port(s) without entering any IP subnet, it means the group contains the specified port(s) for all IPs. You can click +Add Subnet to add new IP subnets, click +Add Port to add ports, and click to delete them. �? Based on MAC Group To configure a group profile based on MAC Group, you are required to enter MAC Address(es) in the MAC Addresses List. There are three ways to add MAC address(es) to the MAC Addresses List. Add MAC addresses in batches. You can enter the MAC addresses and names in the input box or import them with files in the format of Excel, txt, and text. If you want to use the newly added MAC address(es) and names when they conflict with the existing ones, click the to allow it to override the curent MAC Access Control List. Note: 1. Each MAC address and name should be entered on a new line. The MAC address and name should be separated by a space. 2. Octets in a MAC address should be separated by a hyphen. For example, AA-BB-CC-DD-EE-FF. 3. Click Apply to save the entry. After saving the newly added entry, you can apply them to site configuration. To apply the customized profiles in configuration, refer to 4. 5. 1 ACL , 4. 6. 1 Routing , 4. 6. 2 NAT . You can view the name, type, and count in the list. To view, edit or delete the group entry, click the icon in the Action column. Delete the entry. 4. 8. 3 Rate Limit Overview Rate Limit allows you to customize rate-related configurations. You can set different rate limit templates. They can be bound with wireless network to limit the upload/download rate of clients connected the SSID, and applied to specific types of Portal, such as Local User and Voucher. After creating the profiles, you can apply them to multiple configurations, saving you from repeatedly setting up the same information. Configuration To configure the rate limit profiles, follow these steps: 1. Go to Settings > Profiles > Rate Limit . By default, there is an entry with no limits, and it can not be deleted. Click +Create New Rate Limit Profile to add a new group entry. 2. Enter a name and specify the download/upload rate limit for the new entry. After saving the newly added entry, you can apply them to other configurations. To apply the customized rate limit profiles in the related configurations, refer to 4. 9. 1 Portal , 4. 4. 1 Set Up Basic Wireless Networks , and 7. 1. 3 Using the Properties Window to Monitor and Manage the Clients . Name Download Limit Upload Limit 3. Click Apply to save the entry. After saving the newly added entry, you can apply them to site configuration. To apply the customized rate limit profiles in the related configurations, refer to 4. 9. 1 Portal , and 4. 4. 1 Set Up Basic Wireless Networks . You can view the name, download limit, and upload limit in the list. To view, edit or delete the rate limit profile, click the icon in the Action column. Delete the entry. 4. 9 Authentication Authentication is a portfolio of features designed to authorize network access to clients, which enhances the network security. Authentication sevices include 4. 9. 1 Portal , 4. 9. 2 802.1X and 4. 9. 3 MAC-Based Authentication , covering all the needs to authenticate both wired and wireless clients. 4. 9. 1 Portal Portal authentication provides convenient authentication services to the clients that only need temporary access to the network, such as the customers in a restaurant or in a supermarket. To access the network, these clients need to enter the authentication login page and use the correct login information to pass the authentication. In addition, you can customize the authentication login page and specify a URL which the authenticated clients will be redirected to. Portal authentication takes effect on SSIDs and LAN networks. EAPs authenticate wireless clients which connect to the SSID with Portal configured, and the gateway authenticates wired clients which connect to the network with Portal configured. To make Portal authentication available for wired and wireless clients, ensure that both the gateway and EAPs are connected and working properly. The controller provides six types of Portal authentication: �? No Authentication With this authentication type configured, clients can pass the authentication and access the network without providing any login information. Clients just need to accept the terms (if configured) and click the Login button. �? Simple Password With this authentication type configured, clients are required to enter the correct password to pass the authentication. All clients use the same password which is configured in the controller. �? Hotspot With this authentication type configured, clients can access the network after passing any type of the authentication: �? Voucher Clients can use the unique voucher codes generated by the controller within a predefined time usage. Voucher codes can be printed out from the controller, so you can print the codes and distribute them to your costumers to tie the network access to consumption. �? Local User Clients are required to enter the correct username and password of the login account to pass the authentication. �? SMS Clients can get verification codes using their mobile phones and enter the received codes to pass the authentication. �? RADIUS Clients are required to enter the correct username and password which are stored in the RADIUS server to pass the authentication. �? External RADIUS Server Clients are required to enter the correct username and password created on the RADIUS server to pass the authentication. �? External Portal Server The option of External Portal Server is designed for the developers. They can customize their own authentication type like Google account authentication according to the interface provided by Omada Controller. �? Facebook With Facebook Portal configured, when clients connect to your Wi-Fi, they will be redirected to your Facebook page. To access the internet, clients need to log in their account or enter the password code in the Facebook page. Portal authentication can work with Access Control Policy, which grant specific network access to the users with valid identities. You can determine that the clients which didn’t pass Portal authentication can only access the network resources allowed by Access Control Policy. �? Pre-Authentication Access Pre-Authentication Access allows unauthenticated clients to access the specific network resources. �? Authentication-Free Client Authentication-Free Clients allows the specific clients to access the specific network resources without authentication. To complete the Portal configuration, follow these steps: 1 ) Click to create new Portal entry. 2 ) Click to enable Portal, select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters including authentication type, authentication timeout and so on. 3 ) Customize the Portal page including the background picture, logo picture and so on. 4 ) (Optional) Configure access control policies including Pre-Authentication Access and Authentication-Free Clients if needed. The following part introduces how to configure each type of Portal authentication: No Authentication , Simple Password , Hotspot (Voucher, Local User, SMS, RADIUS), External RADIUS Server , External Portal Server and Facebook . �? Configuring Portal with No Authentication 1. Go to Settings > Authentication > Portal . On Portal tab, click to create new portal entry. Then click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters including authentication type, authentication timeout and so on. Portal Name Portal to enable Portal. SSID & Network Authentication Type Authentication Timeout Daily Limit HTTPS Redirection Landing Page The Original URL: Clients are directed to the URL they request for after they pass Portal authentication. The Promotional URL: Clients are directed to the specified URL after they pass Portal authentication. 3. In the Portal Customization section, customize the Portal page including the background picture, logo picture and so on. Type Edit Current Page: Edit the related parameters to customize the Portal page based on the provided page. Import Customized Page: Click to import your unique Portal page for branding it as per your business. Default Language Background Solid Color: Configure your desired background color by entering the hexadecimal HTML color code manually or through the color picker. Picture: Click and select a picture from your PC as the background. Logo Logo Picture and select a picture from your PC as the logo. Logo Position Button Color Button Text Color Button Position Welcome Information Terms of Service Copyright Click Advertisement Options and c ustomize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement 4. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. �? Configuring Portal with Simple Password 1. Go to Settings > Authentication > Portal . On Portal tab, click to create new portal entry. Then click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters including authentication type, authentication timeout and so on. SSID & Network Authentication Type Password Authentication Timeout HTTPS Redirection Landing Page The Original URL: Clients are directed to the URL they request for after they pass Portal authentication. The Promotional URL: Clients are directed to the specified URL here after they pass Portal authentication. 3. In the Portal Customization section, customize the Portal page including the background picture, logo picture and so on. Type Edit Current Page: Edit the related parameters to customize the portal page based on the provided page. Import Customized Page: Click to import your unique Portal page for branding it as per your business. Default Language Background Solid Color: Configure your desired background color by entering the hexadecimal HTML color code manually or through the color picker. Picture: Click and select a picture from your PC as the background. Logo Logo Picture and select a picture from your PC as the logo. Logo Position Input Box Color Input Text Color Button Text Color Button Position Welcome Information Terms of Service Copyright Click Advertisement Options and c ustomize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement 4. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. �? Configuring Portal with Hotspot 1. Go to Settings > Authentication > Portal . On Portal tab, click to create new portal entry. Then click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters. SSID & Network Authentication Type Type HTTPS Redirection Landing Page The Original URL: Clients are directed to the URL they request for after they pass Portal authentication. The Promotional URL: Clients are directed to the specified URL after they pass Portal authentication. 3. With different types of Hotspot selected, configure the related parameters. �? Configuring Voucher Portal Voucher to manage the voucher codes. 7. 2. 2 Vouchers for detailed information about how to create vouchers. �? Configuring Local Portal Local User to manage the information of the login accounts. 7. 2. 3 Local Users for detailed information about how to create Local Users. �? Configuring SMS Portal Select SMS and configure the required parameters in the SMS section. SMS Twilio SID Auth Token Operating Phone Number Maximum User Numbers Authentication Timeout Preset Country Code �? Configuring RADIUS Portal Select RADIUS and configure the required parameters in the RADIUS section. Authentication Timeout RADIUS Profile from the drop-down list or to create one. The RADIUS profile records the information of the RADIUS server which provides a method for storing the authentication information centrally. Authentication Mode NAS ID Disconnected Requests Receiver Port Status 4. In the Portal Customization section, customize the Portal page including the background picture, logo picture and so on. Type Edit Current Page: Edit the related parameters to customize the portal page based on the provided page. Import Customized Page: Click to import your unique Portal page for branding it as per your business. Default Language Background Solid Color: Configure your desired background color by entering the hexadecimal HTML color code manually or through the color picker. Picture: Click and select a picture from your PC as the background. Logo Logo Picture and select a picture from your PC as the logo. Logo Position Input Box Color Input Text Color Button Color Button Text Color Button Position Welcome Information Terms of Service Copyright Click Advertisement Options and c ustomize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement 5. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. �? Configuring Portal with External RADIUS Server 1. Go to Settings > Authentication > Portal . Click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters including authentication type, authentication timeout and so on. SSID & Network Authentication Type Authentication Timeout RADIUS Profile from the drop-down list or to create one. The RADIUS profile records information of the RADIUS server including the IP address, port and so on. NAS ID Disconnected Requests Receiver Port Status Authentication Mode Portal Customization HTTPS Redirection Landing Page The Original URL: Clients are directed to the URL they request for after they pass Portal authentication. The Promotional URL: Clients are directed to the specified URL here after they pass Portal authentication. 3. If you choose Local Web Portal which is provided by the built-in portal server of the controller, customize the Portal page in the Portal Customization section, including the background picture, logo picture and so on. Type Edit Current Page: Edit the related parameters to customize the portal page based on the provided page. Import Customized Page: Click to import your unique Portal page for branding it as per your business. Default Language Background Solid Color: Configure your desired background color by entering the hexadecimal HTML color code manually or through the color picker. Picture: Click and select a picture from your PC as the background. Logo Logo Picture and select a picture from your PC as the logo. Logo Position Button Color Button Text Color Button Position Welcome Information Terms of Service Copyright Click Advertisement Options and customize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement 4. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. �? Configuring Portal with External Portal Server 1. Go to Settings > Authentication > Portal . On Portal tab, click to create new portal entry. Then click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters including authentication type, custom portal server and so on. SSID & Network Authentication Type Custom Portal Server HTTPS Redirection Landing Page The Original URL: Clients are directed to the URL they request for after they pass Portal authentication. The Promotional URL: Clients are directed to the specified URL here after they pass Portal authentication. 3. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. �? Configuring Portal with Facebook 1. Go to Settings > Authentication > Portal . Click to enable Portal and load the following page. 2. Select the SSIDs and LAN networks for the portal to take effect on and configure basic parameters. SSID & Network Authentication Type Facebook Page Configuration: to specify the Facebook Page. Facebook Checkin Location HTTPS Redirection 3. In the Portal Customization section, customize the Portal page including the background picture, logo picture and so on. Type Edit Current Page: Edit the related parameters to customize the portal page based on the provided page. Import Customized Page: Click to import your unique Portal page for branding it as per your business. Default Language Background Solid Color: Configure your desired background color by entering the hexadecimal HTML color code manually or through the color picker. Picture: Click and select a picture from your PC as the background. Logo Logo Picture and select a picture from your PC as the logo. Logo Position Theme Color Button Text Color Button Position Welcome Information Terms of Service Copyright Click Advertisement Options and c ustomize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement Click Advertisement Options and c ustomize advertisement pictures on the authentication page. Advertisement Picture Resource and select pictures from your PC as the advertisement pictures. When several pictures are added, they will be played in a loop. Advertisement Duration Time Picture Carousel Interval Allow Users To Skip Advertisement 4. (Optional) Configure access control rules including Pre-Authentication Access and Authentication-Free Policy if needed. Go to Settings > Authentication > Portal . On Access Control tab, click the checkbox to enable Pre-Authentication Access and Authentication-Free Policy. Pre-Authentication Access Pre-Authentication Access List to configure the IP range or URL which unauthenticated clients are allowed to access. Authentication-Free Policy Authentication-Free Client List and enter the IP address or MAC address of Authentication-Free clients. 4. 9. 2 802.1X 802.1X provides port-based authentication service to restrict unauthorized clients from accessing to the network through publicly accessible switch ports. An 802.1X-enabled port allows only authentication messages and forbids normal traffic until the client passes the authentication. 802.1X authentication uses client-server model which contains three device roles: client/supplicant, authenticator and authentication server. This is described in the figure below: �? Client A client, usually a computer, is connected to the authenticator via a physical port. We recommend that you install TP-Link 802.1X authentication client software on the client hosts, enabling them to request 802.1X authentication to access the LAN. �? Authenticator An authenticator is usually a network device that supports 802.1X protocol. As the above figure shows, the switch is an authenticator. The authenticator acts as an intermediate proxy between the client and the authentication server. The authenticator requests user information from the client and sends it to the authentication server; also, the authenticator obtains responses from the authentication server and sends them to the client. The authenticator allows authenticated clients to access the LAN through the connected ports but denies the unauthenticated clients. �? Authentication Server The authentication server is usually the host running the RADIUS server program. It stores information of clients, confirms whether a client is legal and informs the authenticator whether a client is authenticated. Based on authenticated identity, 802.1X can also deliver customized services. For example, 802.1X and VLAN Assignment together make it possible to assign different authenticated users to different VLANs automatically. To complete the 802.1X configuration, follow these steps: 1 ) Click to enable 802.1X. 2 ) Select the RADIUS profile you have created and configure other parameters. 3 ) Select the ports on which 802.1X Authentication will take effect. Enable 802.1X Configure RADIUS Profile and Parameters Select the Ports Go to Settings > Authentication > 802.1X . Click to enable 802.1X. Enable 802.1X Configure RADIUS Profile and Parameters Select the Ports Select the RADIUS profile you have created. If no RADIUS profiles have been created, click from the drop-down list or to create one. The RADIUS profile records the information of the RADIUS server which acts as the authentication server during 802.1X authentication. Authentication Protocol PAP: The EAP packets are converted to other protocol (such as RADIUS) packets, and transmitted to the RADIUS server. EAP: The EAP packets are encapsulated in other protocol (such as RADIUS) packets, and transmitted to the authentication server. To use this authentication mechanism, the RADIUS server should support EAP attributes. Authentication Type Port Based: After a client connected to the port gets authenticated successfully, other clients can access the network via the port without authentication. MAC Based: Clients connected to the port need to be authenticated individually. The RADIUS server distinguishes clients by their MAC addresses. VLAN Assignment MAB Enable 802.1X Configure RADIUS Profile and Parameters Select the Ports Select the ports to enable 802.1X authentication or MAB for them. To enable 802.1X authentication, click the unselected ports. 802.1X-enabled ports will be marked with . To enable MAB, click the ports marked with . You can enable MAB only on 802.1X-enabled ports. MAB-enabled ports will be marked with . Note: �? You are not recommended to enable 802.1X authentication on the switch ports which connects to network devices without 802.1X capability like the router and APs. �? The switch authenticates wired clients which connect to the port with 802.1X enabled. And the gateway authenticates wired clients which connect to the network with Portal configured. Wired clients should pass Portal and 802.1X authentication to access the internet when both are configured. 4. 9. 3 MAC-Based Authentication Overview MAC-Based Authentication allows or disallows clients access to wireless networks based on the MAC addresses of the clients. In this authentication method, the controller takes wireless clients�?MAC addresses as their usernames and passwords for authentication. The RADIUS server authenticates the MAC addresses against its database which stores the allowed MAC addresses. Clients can access the wireless networks configured with MAC-based authentication after passing authentication successfully. Note: Both MAC-Based Authentication and Portal authentication can authenticate wireless clients. If both are configured on a wireless network, a wireless client needs to pass MAC-Based Authentication first and then Portal authentication for internet access. You can enable MAC-Based Authentication Fallback to allow clients bypass MAC-Based Authentication, which means the client needs to pass either of the two authentication. The client tries MAC-Based Authentication first, and is allowed to try portal authentication if it failed the MAC-Based Authentication. 1. Go to Settings > Authentication > MAC-Based Authentication . Click to enable MAC-Based Authentication. 2. In the Basic Info, select the SSIDs, RADIUS Profile and other required parameters. Refer to the following table to configure the required parameters and click Save . SSID RADIUS Profile from the drop-down list or to create one. The RADIUS profile records the information of the RADIUS server which acts as the authentication server during MAC-Based Authentication. MAC-Based Authentication Fallback MAC Address Format Empty Password 4. 9. 4 RADIUS Profile Overview RADIUS (Remote Authentication Dial In User Service) is a client/server protocol that provides for the AAA (Authentication, Authorization, and Accounting) needs in modern IT environments. In authentication services including 802.1X, Portal and MAC-Based Authentication, Omada devices operate as clients of RADIUS to pass user information to designated RADIUS servers. A RADIUS server maintains a database which stores the identity information of legal users. It authenticates users against the database when the users are requesting to access the network, and provides authorization and accounting services for them. A RADIUS profile records your custom settings of a RADIUS server. After creating a RADIUS profile, you can apply it to multiple authentication policies like Portal and 802.1X, saving you from repeatedly entering the same information. 1. Go to Settings > Authentication > RADIUS Profile . Click to load the following page. 2. Enter the information of the RADIUS servers. Refer to the following table to configure the required parameters and click Save . Name VLAN Assignment Note: 1. VLAN Assignment is not currently supported when a client is authenticated by Portal with External RADIUS Server or RADIUS Hotspot. 2. VLAN Assignment is applicable only when the device supports the feature. To make this feature work properly, it is recommended to upgrade your devices to the latest firmware version. Authentication Server IP Authentication Port Authentication Password RADIUS Accounting Interim Update Interim Update Interval Accounting Server IP Accounting Port Accounting Password 4. 10 Services Services provide convenient network services and facilitate network management. You can configure servers or terminals in DDNS, SNMP, UPnP, and SSH, schedule the devices in Reboot Schedule and PoE Schedule, and export the running logs in Export Data. 4. 10. 1 Dynamic DNS WAN IP Address of your gateway can change periodically because your ISP typically employs DHCP among other techniques. This is where Dynamic DNS comes in. Dynamic DNS assigns a fixed domain name to the WAN port of your gateway, which facilitates remote users to access your local network through WAN Port. Let’s illustrate how Dynamic DNS works with the following figures. Go to Settings > Services > Dynamic DNS . Click + Create New Dynamic DNS Entry , to load the following page. Configure the parameters and click Create . Service Provider Status Interface Username Go To Register . Password Domain Name Update Interval 4. 10. 2 SNMP SNMP (Simple Network Management Protocol) provides a convenient and flexible method for you to configure and monitor network devices. Once you set up SNMP for the devices, you can centrally manage them with an NMS (Network Management Station). The controller supports multiple SNMP versions including SNMPv1, SNMPv2c and SNMPv3. Note: If you use an NMS to manage devices which are managed by the controller, you can only read but not write SNMP objects. Go to Settings > Services > SNMP and configure the parameters. Then click Apply . SNMPv1 & SNMPv2c Community String SNMPv3 Username Password 4. 10. 3 UPnP UPnP (Universal Plug and Play) is essential for applications including multiplayer gaming, peer-to-peer connections, real-time communication (such as VoIP or telephone conference) and remote assistance, etc. With the help of UPnP, the traffic between the endpoints of these applications can freely pass the gateway, thus realizing seamless connections. Go to Settings > Services > UPnP . Enable UPnP globally and configure the parameters. Then click Apply . Interface Networks 4. 10. 4 SSH SSH (Secure Shell) provides a method for you to securely configure and monitor network devices via a command-line user interface on your SSH terminal. Note: If you use an SSH terminal to manage devices which are managed by the controller, you can only get the User privilege. Go to Settings > Services > SSH . Enable SSH Login globally and configure the parameters. Then click Apply . SSH Server Port Layer 3 Accessibility 4. 10. 5 Reboot Schedule Reboot Schedule can make your devices reboot periodically according to your needs. You can configure Reboot Schedule flexibly by creating multiple Reboot Schedule entries. 1. Go to Settings > Services > Reboot Schedule . Click + Create New Reboot Schedule to load the following page and configure the parameters. Name Status Occurrence Devices List 2. Click Create . The new Reboot Schedule entry is added to the table. You can click to edit the entry. You can click to delete the entry. 4. 10. 6 PoE Schedule PoE Schedule can make PoE devices which are connected to your PoE switches power on and work only in the specific time period as you desire. You can configure PoE Schedule flexibly by creating multiple PoE Schedule entries. 1. Go to Settings > Services > PoE Schedule . Click + Create New PoE Schedule to load the following page and configure the parameters. Name Status Time Range + Create New Time Range Entry from the drop down list of Time Range. For details, refer to Profiles . Devices List 2. Click Create . The new PoE Schedule entry is added to the table. You can click to edit the entry. You can click to delete the entry. 4. 10. 7 Export Data You can export data to monitor or debug your devices. Go to Settings > Services > Export Data . Select the type of data from the export list and click Export . Export List Device List : Export the list of managed devices. Client List : Export the list of all clients that are connected to the networks. Insight-Rogue AP List : Export the list of the rogue APs scanned before. For detailed information, refer to 8. 4. 9 Rogue APs . Log List : Export the list of the logs generated by the controller. Authorized Client List : Export the list of authorized clients. Voucher Codes : Export the list of the voucher codes. Running Log : Export the day-to-day running log of the controller. Mode All Columns : Export the data list that contains all columns. Current Display Columns : Export the data list that contains only the displayed columns currently. Format < Previous Next > Feedback * Please rate this article: poor excellent * Does this article help you solve your problem? Yes No Just browsing Suggestions: Enter your contact information so we can get back to you: Name: Email: * I have read and agree to the Privacy Policy Submit Thank you for your feedback. Sorry, something went wrong!