VLAN Steering

In this scenario, we showcase how we can use captive portal features to dynamically steer users to their respective VLAN based on the user profile. Traditionally, if we want to assign authorized users to different networks, we need to run multiple SSID to map to multiple VLANs and multiple portals for a different profile of users. Then users need to choose their respective SSID to connect and sign-in to their respective network. This can confuse users and also hard to maintain Wi-Fi configurations.

RansNet Dynamic VLAN assignment (VLAN steering) over captive portal authentication significantly simplifies wireless configuration and improves network security. You just need to provision a single SSID on wireless setting, and manage all users/VLAN/captive portal settings on HSG. HSG will work with AP to dynamically steer users to their respective VLAN upon successful authentication.

Common Sectors

Hotels | Enterprises | Institutions | Airports | Stadium | Dormitories.

VLAN Steering Scenario Workflow

1. For any new device associated with SSID, they will be assigned to a quarantine/default VLAN (VLAN10)
2. The Vlan10 assigns an IP and prompts with a captive portal login page.
3. For Staff, after login with Staff accounts, they will be assigned to VLAN20-Staff VLAN
4. For Guest, they will register with SMS OTP and auto-assigned to VLAN30-Guest VLAN

Deployment of VLAN Steering Using UI

Prerequisites

1. Upgrade the Hotspot Gateway box firmware version 20210213-2300. See link Upgrade Firmware
2. Connect the WAN Interface of HSG to ISP device (ONT or Modem)
   • Info– The WAN port (eth0) of HSG is pre-configured to get dhcp IP from ISP ONT/modem (or upstream router).
3. Connect ETH1 port of HSG to the LAN Switch.
   • Info– The ETH1 port (eth1) of HSG is pre-configured to release IP to LAN.
4. Connect the AP to the LAN Switch
   • Use default VLAN1 as management VLAN for AP/WLC
     • Access Point will be receiving DHCP IP from HSG from network 192.168.8.0/22
     • Info– Reserved IP for WLC or other devices, range from 192.168.8.2 to 192.168.8.99.
   • Add all VLANs on the switch (VLAN100, 102, 103), configure all switch-ports to be in trunk mode, and permit all VLANs for each port (default)
   • Configure APs to broadcast the VLAN100’s SSID and enable MAC-based Authentication.
   • Configure AP/WLC to point the HSG as a RADIUS server with the below settings (Radius) for MAC-based authentication.
     • NAME – RansNet-HSG-AUTH
     • AUTH TYPE – RADIUS
     • IP ADDRESS – 192.168.8.1
     • PORT – 1812
     • SHARED SECRET – testing123
5. Connect ETH2 port to a PC for Management
   • Info– The ETH2 port (eth2) of HSG is pre-configured to release IP.

Procedure

Step 1 – Access to Hotspot Management UI

1. Login to Hotspot Gateway UI
   • on-premises Hotspot Gateway – Use the Management PC and browse to http://10.10.10.1 and login with the Credentials.

Step 2 – Create Entity, User Account, and Permission for the User Account

1. Create Entity – See link Create Customer Entity
   • User can use the Company name as entity name

2. Create and Configure Permission for the User Account
   • Navigate to ‘ADMIN > Permissions‘. Click on the button and configure the required permission.
   • Recommendation – Create the new User Account and in the Profile field select ‘Super admin’ for this Scenario.

3. Create User Account – See link Create User Account

Step 3 – Create VLANs (100, 102 & 103) on eth1 interface

1. Navigate to the ‘NETWORK SETTINGS > Interfaces > VLAN‘ tab and click on the button, See link New VLAN interface
   • Configure three new VLANs as per the below Tables,

.

.

.

Step 4 – Create, Configure Captive Portal and Login Method

1. User can create a Captive Portal. See link Create/Edit Captive portal.
   • Portal name – ‘Dy_Vlan100’ | portal template – ‘Central’

2. Configure Login Method (SMS OTP and Username+Password methods). Enable Login Methods as mentioned below. See link Login Method Types.

Portal Name: Dy_Vlan100 Portal Template: Central Entity: [Customer’s Entity name] Login Method: SMS OTP (Guest Login) and Username & Password (Staff Login)

Step 5 – Configure Hotspot Instance (VLAN100) Interface.

1. Navigate to ‘Hotspot Settings > Hotspot Instances‘. Click on ‘vlan100′ below the interface column heading and configure the vlan100 and all three sections of instance, as per the Table 2 settings below.
   • Configure the VLAN interfaces as per below
     • vlan100 – http://captive.ransnet.com/pid/Dy_Vlan100/login.php
   • In the ‘Hotspot Instance Option Config Section‘, Refer to Table 2 below for configuration.

.

Step 6 – Configure Access Control

User can create two different Access Profile for Default Quarantine (Vlan100), Staff (Vlan102) VLANs with different Profile Access Info as per the below table, and Guest (Vlan103) profile will be Auto-generated by the system.
Info – User can configure ‘Access Profile‘ name and the ‘Access info‘ setting for Quarantine Vlan, Staff Vlan manually and for the Guest Vlan the profile is created automatically and the Access Info setting can be manually edited.
See Link Manual Profile
See Link Auto Profile

1. Configure Access Profile for Default Quarantine VLan and Staff VLan by navigating to ‘HOTSPOT USERS > Access Profile‘
   • Navigate to ‘HOTSPOT USERS > Access Profile‘ and locate for
   • Note – To configure the Email Registration profile, the user has to first test the Captive portal Email Registration Authentication. After the first test is successful, the Email OTP auto-creates the profile in ‘Access Profile’ in the format of (RansNet_[Device Name]_[Interface Name]_[MAC Address, last 4 digits]_<<emailonepageotp??>>. Eg : RansNet_mbox_br-vlan10_96-19_emailonepageotp). User can click on the Profile name and configure the account info settings as per the user requirement.

.

-----------------------------------Default Configuration--------------------------
hostname HSG800-WT
!
interface eth0
 description "Default connection to WAN"
 enable
 ip address dhcp
!
interface eth1
 description "Default connection to LAN"
 enable
 ip address 192.168.8.1/22
 dhcp-server
  description "DHCP-ETH1 DHCP"
  lease-time 86400
  router 192.168.8.1
  dns 8.8.8.8 8.8.4.4
  range 192.168.8.100 192.168.11.254
!
interface eth2
 description "Default OOB-Mgmt"
 enable
 ip address 10.10.10.1/24
 dhcp-server
  lease-time 86400 86400
  router 10.10.10.1
  dns 8.8.8.8 8.8.4.4
  range 10.10.10.10 10.10.10.20
  enable
!
interface eth3
 description "Reserved network"
!
interface vlan 1 100
 description "Quarantine VLAN"
 enable
 ip address 172.16.10.1/24
 dhcp-server
 dns 8.8.8.8 8.8.4.4
 router 172.16.10.1
 leasetime 86400 86400
 range 172.16.10.20 172.16.10.254
 enable
!
interface vlan 1 102
 description "Staff VLAN"
 enable
 ip address 172.16.20.1/24
dhcp-server
 dns 8.8.8.8 8.8.4.4
 router 172.16.20.1
 leasetime 86400 86400
 range 172.16.20.20 172.16.20.254
 enable
!
interface vlan 1 103
 description "Guest VLAN"
 enable
 ip address 172.16.30.1/24
dhcp-server
 dns 8.8.8.8 8.8.4.4
 router 172.16.30.1
 leasetime 86400 86400
 range 172.16.30.20 172.16.30.254
 enable
!
interface loopback
 enable
 ip address 2.1.2.1/32
!
ip name-server 8.8.8.8 8.8.4.4
!
ip ntp-server 203.211.159.1 62.201.225.9
!
ip host macc.ransnet.com 2.1.2.1 rewrite
ip host splash.ransnet.com 2.1.2.1 rewrite
!
firewall-input 10 permit all tcp dport 80 src 10.0.0.0/8 admin remark "WEB mgmt
from OOB"
firewall-input 11 permit all tcp dport 22 src 10.0.0.0/8 remark "SSH mgmt from O
OB"
firewall-input 12 permit all tcp dport 443 src 10.0.0.0/8 remark "Web (Https) mgmt from O
OB"
firewall-input 13 permit all udp dport 1812
firewall-input 14 permit all upd dport 1813
!
firewall-access 10 permit outbound eth0
!
firewall-snat 10 overload outbound eth0
!
security radius-server
 client 2.1.2.1 key testing123 name HSG800WT
 client 0.0.0.0/0 key testing123 name RansNet_AAA
 start
-----------------------------------Default Configuration--------------------------
!
security hotspot vlan10
 hotspot-server 172.16.10.1 ports 5205 4029
 client-network 172.16.10.0 255.255.255.0
 client-static 172.16.10.0 255.255.255.0
 client-local-dns on
 redirect-url http://www.ransnet.com
 radius-server splash.ransnet.com testing123
 hotspot-access-udp 1812, 1813
 hotspot-portal https://captive.ransnet.com/RNSrilanka/Portal_Roam1/login.php
 hotspot-nac NACDEFAULT
 start

.

Integration with 3rd Party Access Point Reference Link

• Extreme Networks
• HP Aruba Networks

.

Deployment References Links (Videos/Demos)

• Create Captive portal and Configure Login Methods – https://youtu.be/yrjAkt8XkT8
• Configure Seamless User Re-login – https://www.youtube.com/watch?v=CABBfKHO4gY