Wi-Fi HotSpot Solution (HSG, MAP)

HSG – Captive Portal HotSpot Gateway

HSG is a HotSpot Gateway to provide guest Internet access with granular user access control and security enforcement. It allows enterprises or venue owners (hotels, malls, clubs, F&B, etc) to offer flexible and differentiated Internet access for guests, VIP members or visitors. Refer to datasheet for hardware details.

Sitting at the Internet edge, mbox HSG manages user Internet access through a few key modules:

• Router, Stateful firewall, DHCP server, Multi-WAN
• HotSpot Access Controller (hotspot instance)
• Captive Portal (CP)
• User Authentication Authorization and Accounting (AAA, also called RADIUS).
• mbox Access Point Cloud Controller (MACC)
• Advertising gateway

HotSpot Access Controller combines DHCP server, firewall, and bandwidth control engines, granting user Internet access, and enforces their respective rights based on AAA/RADIUS client policies. It intercepts user’s initial browsing requests and redirects to a captive portal (also called landing page in many places) for entering authentication credentials and accepting terms and enforces the authorization (client rights) returned by AAA/RADIUS server for each authenticated users.

A single mbox HSG can support multiple instances of HotSpot Access Controller. Typically each instance maps to a different VLAN or network for different access controls (Ex: different login/landing pages, different bandwidth control policies, etc), so that we can enforce different user experiences for users coming from different networks.

HSG hotspot Access controller supports following features:

• Multi-instance, multi-VLAN support, Multi-WAN.
• Built-In DHCP server for client DHCP address assignment for each VLAN. Each instance of HotSpot Access controller (for each VLAN) can issue different subnets of DHCP addresses and redirects to the different captive portal login page.
• MAC address bypass (eg. default pass-through for some devices), domain bypass, and URL bypass (eg. default pass-through for some destination domains or URLs).
• Per-user, per session bandwidth control based on username or user VLANs
• Dynamic bandwidth allocation per user, dynamically re-allocating per user bandwidth by adapting to backhaul link utilization.

HSG captive portal is a built-in web server that prompts users with a customizable web login page. It also interacts with Access Controller and AAA/RADIUS server to enable user credential inputs and integrates with RansNet cloud advertising server to stream landing page ads etc.

HSG AAA server (or RADIUS server) validates user credentials and passes user access policies (bandwidth per user, session time, volume/usage, etc) to the Access Controller for enforcement.

A. Workflow of HSG HotSpot User Access – Deployed on-premise:

1. User device (Mobile/Computer) connects to the Local Area Network (LAN) through Wireless-open SSID (can be any wireless   Infra with MAP or 3rd-party Access Point) or to normal switch port, and then the client device gets IP address from DHCP server.
2. User browses Internet using a standard browser, The browsing request hits the mbox LAN/VLAN interface and intercepted by HotSpot Access Controller.

3. mbox HotSpot Access controller redirects the User’s device browser to a Captive Portal login page.
4. The user entries the Login credentials In the Captive Portal login page, which is forwarded to HotSpot Access Controller, which then sends to the RADIUS server for validation.
5. RADIUS server validates user credentials and returns Access/Reject result to HotSpot Access Controller, together with a set of authorized profiles access rights for the authenticated user.
6. HSG HotSpot Access Controller grants users Internet access and enforces respective rights passed by RADIUS.
7. User traffic breaks out from the HSG WAN interface to the Internet and it performs NAT for user’s source IP.

B. Workflow of MAP/UA with external (HSG) HotSpot Gateway.

1. The user device (Mobile | Computer) connects to MAP/UA/HSA open wireless SSID. Because in cloud-based deployment, MAP is configured in NAT mode, mbox HotSpot Access Controller (MAP/UA) will issue DHCP address to the client device. (if MAP is configured in bridge mode in an on-premise design model, then the scenario will be the same as above #A).

2. User browses Internet using a standard browser, The browsing request hits the mbox MAP/UA/HSA device and intercepted by HotSpot Access Controller.
3. HotSpot Access controller redirects user browsing request to the external HSG for captive portal and AAA.
4. The user enters the login credentials, which are forwarded to the external radius server for validation. RADIUS server validates user credentials and returns Access/Reject result to HSA/MAP/UA HotSpot Access Controller, together with a set of authorized profiles access rights for the authenticated user.
5. HSA/MAP/UA HotSpot Access Controller grants user Internet access and enforces the respective rights passed by radius.
6. User traffic breaks out from MAP/UA directly to the Internet. HSA/MAP/UA performs NAT for the user’s source IP.

MAP – Mbox Access Point

MAP-820 is the latest enterprise-grade AP that supports next-generation Wi-Fi 6 technology, with backward compatibility to existing legacy devices. The 802.11ax AP is designed for intensive Wi-Fi usages, such as malls, exhibition centres, enterprise offices, schools, hospitalities, and dormitories. It supports up to 1024 Wi-Fi clients and provides up to 65% higher total throughput than legacy Wi-Fi 5. The 2 x 2 MIMO MAP-820 supports selectable dual-band dual-radio (2.4G + 5G or 5G+5G) mode with up to 2.4Gbps wireless throughput. It is also IoT ready integrated with BLE.

MAP-130 is specially designed to be deployed in individual rooms (1 MAP-130 per room). The dual-band AC wall-mountable AP has the same size as a standard 86-type faceplate with integrated Ethernet and voice ports.

MACC (MAP Control Centre) is a Wireless LAN Controller software module embedded inside HSG & CMG gateways, for mass deploying and managing mbox Access Points (MAP).

All MAP can operate in 3 modes:

• Fat mode (autonomous). The MAP can operate as a standalone AP and be configured via both CLI and web GUI.
• Fit mode (light-weight). The MAP will completely depend on the AC controller to manage and operate the AP, like how other typical light-weight AP works.
• Fit-macc mode (Hybrid). This is the most unique and powerful operating mode for MAP. When MAP is integrated with MACC, MAP uses MACC for provisioning, monitoring, policy management, and wireless optimization, but will continue to function standalone when the connection to MACC is lost due to whatever reasons. For example, during HSG/MACC maintenance, we can upgrade or reboot MACC without any downtime to the wireless network.

Advanced features of MAP:

• Dual-radio, dual-band, supporting 2×2 spatial streams and the latest OFDMA, MU-MIMO, and BSS technology. Enterprise-grade hardware. High performance and reliability. All support PoE LAN switches.
• Wi-Fi Alliance certified.  Support all standard WFA security, EAP, WPA, WPA2/3, WPA2/3-dot1x
• Support advanced wireless security, such as client isolation, rogue AP detection, wireless intrusion detection, per device rate limiting, etc.
• Support up to 1024 devices (for MAP-820), multiple 16 SSID per AP. Each SSID can be configured either in bridge mode (map to a VLAN) or NAT mode (functions as a router). This flexibility makes MAP ideal for both large WLAN networks (bridge) or small F&B outlets (NAT).
• By working with MACC, MAP supports adaptive radio management, mobile access, QoS, seamless roaming, load balancing,  and many other Wi-Fi optimizations.
• MAP also comes with a built-in HotSpot Access Controller to redirect user traffic to external captive portals for guest Wi-Fi access and Wi-Fi monetization.

All MAPs are built with the latest wireless technologies and all features are fully available upon purchase of the hardware. No separate license is required for different wireless features. Other than warranty costs, there’s no yearly software or cloud subscription costs.

MACC comes as a default module of HSG and there’s no licensing limit for the no. of MAP to manage, except there are certain guidelines for different HSG based on hardware resource availability.

Refer to datasheet for further technical details.