Access Rights and Profiles¶
Access profile combines various permissions/rights (RADIUS attributes) into groups, and when attached to user accounts, it controls the access rights after authentication.
It defines the Authorization component of AAA (Authentication, Authorization, Accounting).
Navigate to HOTSPOT USERS → Access Profile. The system includes several default profiles that you can immediately attach to users.
Click New Profile to create a new profile, or Edit on an existing profile to modify its settings.
Profile Info¶
Enter a unique Profile Name and optional Description for easy reference and organization.
| Field | Purpose | Notes |
|---|---|---|
| Profile Name | Unique identifier for this access profile | Used in dropdowns, user assignment, and reporting; no spaces or special characters recommended |
| Description | Human-readable explanation of the profile's purpose | Example: "Premium Hotel Guests - 10 Mbps, 50 GB/month" |
Access Info¶
This tab defines the access attributes (speed, time limits, data quotas, device limits and more) that control what users can do after authentication.
Each attribute has its own row with a tick box:
- Tick a row to add that attribute to the profile, then enter its value. The value box appears once the row is ticked.
- Untick a row to remove the attribute from the profile.
- Click Save Changes to apply.
- Click the ? beside a section title for a short explanation of that section.
Values are entered in the units shown in each label (Kbps, seconds, minutes, MB).
Two approaches to organize policies:
- Single attribute per profile — Create many profiles (each with one control), then attach multiple profiles to each user. Flexible but complex.
- Multiple attributes per profile — Create a few profiles (each combining multiple controls), then attach one profile to all users in a tier. Simple and maintainable.
Recommendation: Use approach #2 (multiple attributes per profile) for most deployments. If you need truly granular per-user control beyond a profile, use per-account access rights.
Access Speed (Speed Control)¶
Sets the maximum upload and download speed per user connection.
| Setting | Purpose | Notes |
|---|---|---|
| Maximum upload (Kbps) | Maximum upstream bandwidth per user | Kbps (kilobits per second) |
| Maximum download (Kbps) | Maximum downstream bandwidth per user | Kbps; limits the fastest possible download speed |
Examples: Differentiate between Premium (50000 Kbps down / 10000 Kbps up) and Standard (10000 Kbps down / 2000 Kbps up) tiers.
Access Time (Time Control)¶
There are several attributes you can use (or combine) for user/device time and session duration control.
| Setting | Purpose | Notes |
|---|---|---|
| Idle timeout (seconds) | Disconnect if the user is inactive for this duration | Frees resources held by inactive devices; the user can reconnect immediately |
| Session timeout (seconds) | Maximum duration of a single continuous session | Once reached, the user is disconnected and must log in again |
| Total usage time, user / device (min) | Total online time allowed over the life of the account | user counts all of the account's devices together; device counts each device separately |
| Time per day, user / device (min) | Online time allowed per calendar day | Resets at 00:00 |
| Time per week, user / device (min) | Online time allowed per week | Resets weekly |
| Time per month, user / device (min) | Online time allowed per month | Resets monthly; common for subscription plans |
| Session waiting time (min) | How long a device must wait before it can start a new session |
Access Device (Device Control)¶
Controls how many devices can use an account, fixed IP assignment, and dynamic VLAN assignment for traffic steering.
| Setting | Purpose | Notes |
|---|---|---|
| No. of concurrent devices | Maximum number of devices logged in with this account at the same time | Up to 100; common limits are 1, 2 or 5 |
| No. of total unique devices | Maximum number of different devices that can use the account | Up to 14 |
| Framed IP address / netmask | Fixed IP address and netmask given to the user's device | IPv4, e.g. 192.168.0.100 |
| Dynamic VLAN ID | Assign user devices to a different VLAN based on profile | 1 to 4094; see VLAN Steering for use cases |
| Dynamic VLAN timeout | Timeout for the dynamic VLAN assignment | Use with Dynamic VLAN ID |
Example: A hotel guest with a Premium account might allow 3 devices (phone, tablet, laptop), while a Standard guest gets 1 device only. Premium devices could be assigned to a high-speed VLAN, while Standard devices use a limited-speed VLAN.
Access Data (Data Quota Control)¶
Controls how much data (upload + download combined) a user can consume before access is restricted.
| Setting | Purpose | Notes |
|---|---|---|
| Total data quota (MB) | Total data allowed over the life of the account | Does not reset |
| Data per day (MB) | Data allowed per calendar day | Once exceeded, the user is blocked until the next day (00:00) |
| Data per week (MB) | Data allowed per week | Resets weekly; use for fair-share pricing models |
| Data per month (MB) | Data allowed per month | Resets monthly; common for subscription plans |
Example: A Premium plan offers 10 GB/month (10240 MB), while a Standard plan offers 2 GB/month (2048 MB).
Hotspot Network (Network Control)¶
Restricts where users of this profile can log in from. List the IP address of each hotspot LAN interface they may use, one per line; users of the profile can then log in only through those interfaces. Useful when the same gateway runs multiple hotspot instances on different SSIDs or VLANs.
| Setting | Purpose | Notes |
|---|---|---|
| Hotspot LAN Interface IP | IP addresses of the hotspot LAN interfaces users of this profile may log in through | IPv4, one per line |
Example: A staff profile on a hotel network might list only the Staff VLAN interface IP, while guest profiles leave this unticked and can use any hotspot instance.
Login, Expiry and Redirect¶
Controls whether accounts can log in at all, when they expire, and where users land after login.
| Setting | Purpose | Notes |
|---|---|---|
| Auth type | Accept lets accounts authenticate normally; Reject blocks them | Use Reject to suspend accounts without deleting them; users see a login error |
| Expiry date and time | Fixed date and time when accounts become invalid | Useful for seasonal or promotional accounts |
| Expire after first use (min) | Accounts become invalid this many minutes after their first login | Useful for one-time vouchers or trial accounts, e.g. 1440 for 24 hours |
| Redirect URL after login | Page users are sent to after a successful login | Full URL, e.g. https://www.example.com; see URL Redirect |
Example: A hotel guest account might expire on their checkout date, while a trial account might expire 24 hours after first use.
URL Redirect¶
After successful authentication, users are redirected to a landing URL. This can be set at three levels, with priority from highest to lowest:
If multiple levels are configured, the highest precedence level wins (account-level overrides profile-level, which overrides instance-level).
Use Cases:
- Account-level: VIP guests redirected to personalized welcome page
- Profile-level: All Standard-tier users see the same post-login dashboard
- Instance-level: Default landing page for all users on a hotspot instance