What each controller supports

Which Kiwire features work with each controller brand. ● built in, ◐ works with a condition (see the notes for that brand below the table), – not supported. Read Connecting a controller first for what every controller needs.

Read out of the platform

This page is generated from the code that runs your instance, so it cannot drift from what the platform actually does.

The features

• Guest login page. The controller sends guests to the Kiwire sign-in page and lets them online.
• RADIUS sign-in and accounting. Kiwire authorises each session and receives usage records.
• Speed limits. Upload and download limits from the user's profile.
• Change speed live. A new speed reaches a guest who is already online.
• Session time and idle timeout. Sessions end on time and after inactivity.
• Data quota. Sessions stop when the data allowance is used up.
• Disconnect a user. An admin, KAIA or a limit can end a session from Kiwire.
• Dynamic VLAN. Users are placed on a VLAN by their profile.
• Approved devices. Known devices such as TVs get online without a login page.
• WPA2 / WPA3 Enterprise. Staff WiFi with personal logins or certificates (802.1X).
• Automatic setup. Kiwire generates or pushes the controller configuration.

By brand

Controller	Login page	RADIUS	Speed limits	Live speed change	Time and idle	Data quota	Disconnect	Dynamic VLAN	Approved devices	Enterprise WiFi	Auto setup
MikroTik	●	●	●	●	●	●	●	◐	●	●	●
Ubiquiti UniFi	●	◐	●	●	◐	●	●	–	–	●	●
Cisco Catalyst / WLC	●	●	◐	●	●	◐	●	◐	◐	●	–
Cisco Meraki	●	●	◐	–	●	–	–	◐	◐	●	–
Aruba	●	●	◐	●	●	◐	●	◐	◐	●	–
Ruckus	●	●	◐	●	●	◐	●	◐	◐	●	–
Fortinet FortiAP	●	●	◐	●	●	◐	●	◐	◐	●	◐
Huawei	●	●	◐	●	●	◐	●	◐	◐	●	–
Huawei iMaster NCE	●	●	◐	–	●	–	–	◐	◐	●	–
Huawei Cloud UGW	●	●	◐	◐	●	◐	◐	◐	◐	●	–
TP-Link Omada	◐	●	◐	◐	●	◐	◐	◐	◐	●	–
Ruijie / Reyee	●	●	◐	●	●	◐	●	◐	◐	●	–
H3C	●	●	◐	●	●	◐	●	◐	◐	●	–
Allied Telesis	●	●	◐	◐	●	◐	◐	◐	◐	●	–
Cambium	●	●	◐	◐	●	●	◐	◐	◐	●	–
Nomadix (XML)	●	●	●	●	●	◐	–	◐	◐	–	–
CoovaChilli / ChilliSpot	●	●	◐	●	●	●	●	◐	◐	–	–
pfSense	●	●	◐	–	●	◐	–	◐	◐	–	–
WiFiDog gateways	●	–	◐	◐	◐	◐	◐	–	–	–	–
Other RADIUS controllers	●	●	◐	◐	●	◐	◐	◐	◐	●	–

Notes by brand

MikroTik

RouterOS hotspot.

• RADIUS sign-in and accounting ● Allow PAP on the hotspot profile.
• Speed limits ● WISPr plus MikroTik's own rate limit.
• Data quota ● Enforced by the router.
• Disconnect a user ● Set the router's incoming RADIUS port to 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ● RADIUS MAC authentication or router bypass rules.
• Automatic setup ● One-paste setup script.

→ Setup guide

Ubiquiti UniFi

UniFi console (Network application).

• RADIUS sign-in and accounting ◐ Guest access runs through the UniFi API instead of RADIUS.
• Speed limits ● Set when the guest is authorised.
• Change speed live ● Through the UniFi API.
• Session time and idle timeout ◐ Session time only. No idle timeout.
• Data quota ● Enforced by UniFi.
• Disconnect a user ● Through the UniFi API.
• Automatic setup ● Kiwire pushes the RADIUS profile and SSID.

→ Setup guide

Cisco Catalyst / WLC

AireOS and Catalyst 9800 controllers.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● RFC 5176 change of authorisation on port 3799.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 5176 disconnect on port 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Cisco Meraki

Meraki MR (cloud).

• Speed limits ◐ Set per-client limits in the Meraki dashboard if WISPr is ignored.
• Data quota – Meraki does not accept disconnect requests, so caps apply at the next sign-in.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Aruba

Instant APs and ArubaOS controllers.

• Speed limits ◐ WISPr, or an Aruba user role set on the profile.
• Change speed live ● RFC 3576 change of authorisation.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 3576 disconnect.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Ruckus

Unleashed / standalone APs, SmartZone and vSZ.

• Guest login page ● On SmartZone, turn off client MAC and IP encryption.
• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● RFC 5176 change of authorisation on port 3799.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 5176 disconnect on port 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Fortinet FortiAP

FortiAP managed by FortiGate.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● FortiGate RADIUS change of authorisation.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● FortiGate RADIUS disconnect.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.
• Automatic setup ◐ Generates the FortiGate's RADIUS, accounting and disconnect settings. The SSID portal is set by hand.

→ Setup guide

Huawei

AC / WLC and cloud-managed APs.

• Speed limits ◐ Add Huawei's rate attributes on the profile.
• Change speed live ● RFC 5176 change of authorisation on port 3799.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 5176 disconnect on port 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Huawei iMaster NCE

NCE-Campus cloud (relay mode).

• RADIUS sign-in and accounting ● Through the NCE RADIUS relay.
• Speed limits ◐ Add Huawei's rate attributes on the profile.
• Data quota – Caps apply at the next sign-in.
• Disconnect a user – Not available in relay mode.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Huawei Cloud UGW

AR5700 / AR6700, V600R024C00 or later.

• Speed limits ◐ Add Huawei's rate attributes on the profile.
• Change speed live ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

TP-Link Omada

Omada EAP access points.

• Guest login page ◐ Wireless guests on EAP access points. Not portals on Omada gateways.
• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Ruijie / Reyee

Ruijie Cloud and Reyee (ePortal v2).

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● RFC 5176 change of authorisation on port 3799.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 5176 disconnect on port 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

H3C

H3C wireless controllers.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● RFC 5176 change of authorisation on port 3799.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ● RFC 5176 disconnect on port 3799.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Allied Telesis

Vista Manager / AWC.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ◐ WISPr speeds only. Needs RFC 5176 on the controller.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Cambium

cnMaestro / cnPilot.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Data quota ● Cambium traffic quota attributes.
• Disconnect a user ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Nomadix (XML)

Nomadix gateways using the XML interface.

• Speed limits ● Through the Nomadix XML interface.
• Change speed live ● Through the Nomadix XML interface.
• Data quota ◐ Caps apply at the next sign-in.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

CoovaChilli / ChilliSpot

Chilli-based hotspot gateways.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ● Set the CoA port to 3799.
• Data quota ● Enforced by the gateway.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

pfSense

pfSense captive portal.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Data quota ◐ Up to 4 GB per session, enforced by pfSense.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

WiFiDog gateways

OpenWrt and other WiFiDog firmware.

• RADIUS sign-in and accounting – Uses WiFiDog check-ins instead of RADIUS.
• Speed limits ◐ Applied at sign-in.
• Change speed live ◐ Applied at the gateway's next check-in.
• Session time and idle timeout ◐ Applied at sign-in.
• Data quota ◐ From the usage the gateway reports.
• Disconnect a user ◐ At the gateway's next check-in, up to about 10 minutes.

→ Setup guide

Other RADIUS controllers

EnGenius, Peplink, Zyxel, Xirrus, Zebra, Nomadix (RADIUS) and any standards-based controller.

• Speed limits ◐ Standard WISPr speed attributes. If the controller ignores them, add its own attribute on the profile.
• Change speed live ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Data quota ◐ Kiwire counts usage and disconnects the user at the cap, so the controller must accept disconnect requests.
• Disconnect a user ◐ Needs RFC 5176 change of authorisation and disconnect on the controller.
• Dynamic VLAN ◐ Set the VLAN attributes in the profile's custom attributes. Applied at sign-in.
• Approved devices ◐ Through RADIUS MAC authentication or Kiwire's automatic portal sign-in. Switched on per site.

→ Setup guide

Not available yet

These types appear on the controller form, but guest sign-in does not work with them yet.

• FortiGate captive portal (FortiOS). Use FortiAP access points managed by the FortiGate instead.
• Juniper Mist. Not available yet.
• SonicWall. Not available yet.
• CMCC. Not available yet.
• Sundray. Not available yet.
• Ubiquiti (legacy controller types). Use the UniFi console type instead.