Appearance
Supported controllers
Every controller vendor the device form offers, grouped by how it talks to Kiwire. Read Connecting a controller first for what every vendor needs, then the vendor's own section here.
Read out of the platform
This page is generated from the code that runs your instance, so it cannot drift from what the platform actually does.
Cloud-managed
The vendor's cloud dashboard owns the access points; Kiwire is configured there once, for every site.
Cambium cnMaestro
Vendor key cambium
A Cambium AP (cnPilot / cnMaestro) External Hotspot sends the guest to Kiwire's portal (/login/cambium); after sign-in the browser posts ga_user and ga_pass to the AP's hotspot_login.cgi on port 880 with the ga_Qv token and original page, and the AP checks them against Kiwire over RADIUS.
On the controller. External Hotspot splash URL https://<kiwire-host>/login/cambium, Kiwire as the RADIUS server with the shared secret, the Kiwire host in the walled garden. Identity = the NAS ID (ga_nas_id), the same as the RADIUS NAS-Identifier. Kiwire sends Cambium's traffic-quota attribute for data caps plus Session-Timeout.
EnGenius
Vendor key engenius
The EnGenius AP sends the guest to Kiwire's portal (/login/engenius) with everything packed into actionurl; Kiwire unpacks it and after sign-in the browser posts the username, password and original page back to that actionurl, and the AP checks them against Kiwire over RADIUS.
On the controller. External splash page https://<kiwire-host>/login/engenius, Kiwire as the RADIUS server with the shared secret, the Kiwire host in the walled garden. Identity = nas_id (inside actionurl) and the RADIUS NAS-Identifier. No data cap (Session-Timeout).
Huawei Cloud UGW
Vendor key huawei-cloud-ugw
The Huawei cloud gateway (AR5700 / AR6700 on V600R024C00 or later) redirects the guest to Kiwire's portal (/login/huawei-cloud-ugw); after sign-in Kiwire posts the username, password and original page to the login address it sent (loginurl), and the credentials are checked against Kiwire over RADIUS.
On the controller. An HTTP/HTTPS portal pointing at https://<kiwire-host>/login/huawei-cloud-ugw and Kiwire as the RADIUS server with the shared secret. Register the AP MAC it sends (ap-mac) and the RADIUS NAS-Identifier as Identities; check the NAS-Identifier the AR sends with Synchroweb support before rollout. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Huawei iMaster NCE
Vendor key huawei-nce
APs managed from Huawei iMaster NCE redirect the guest to Kiwire's portal (/login/huawei-nce); after sign-in Kiwire posts the username, password and original page to the login address NCE provided (loginurl, port 19008), plus Kiwire's own error page for a failed login, and NCE relays the credentials to Kiwire over RADIUS. Kiwire does not call the NCE API.
On the controller. NCE relay mode (RADIUS relay) with the URL template parameter names Kiwire expects and https://<kiwire-host>/login/huawei-nce as the third-party authentication URL. Set the relay template's NAS-Identifier to Device MAC in the same format as ap-mac, then register one record per AP with Identity = that MAC; all records share one secret. Disconnects are not available when NCE relays RADIUS. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Cisco Meraki
Vendor key meraki
The Meraki AP sends the guest to Kiwire's portal as its custom splash URL (/login/meraki); after sign-in Kiwire posts the username, password and success_url to Meraki's one-time login_url (token included), and Meraki checks them against Kiwire over RADIUS.
On the controller. Splash page "Sign-on with my RADIUS server" with a custom splash URL of https://<kiwire-host>/login/meraki, Kiwire as the RADIUS server with the Meraki secret from Synchroweb support, and one Device Controller per access point with Identity = the AP's MAC. See the Meraki guide.
Juniper Mist
Vendor key mist
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. See Other controllers for the current status.
Ruijie Reyee
Vendor key ruijie-reyee
Ruijie / Reyee devices work in one of two ways: ePortalV2, a portal redirect to /login/ruijie-reyee where Kiwire posts the username, password and a landing page (next_url) back to the device's login_url and the device checks them over RADIUS; or WiFiDog mode, where the device uses the auth-server path /wifidog/ruijie and checks a one-time token with Kiwire over HTTPS instead of RADIUS.
On the controller. Either an external portal pointing at https://<kiwire-host>/login/ruijie-reyee with Kiwire as the RADIUS server, or WiFiDog with the auth server <kiwire-host>, path /wifidog/ruijie, over HTTPS on 443 (plain HTTP is answered with a redirect most gateways do not follow). Identity = the device ID it sends (nasid, or gw_id in WiFiDog mode). No data cap is enforced on the device. WiFiDog mode passes speed and time limits at login; Kiwire applies a data cap from the traffic the gateway reports, and a disconnect or profile change takes effect at the gateway's next check-in.
Ubiquiti UniFi (console / cloud)
Vendor key ubnt-console
The UniFi guest portal sends the guest to Kiwire as an external portal server; after sign-in Kiwire calls the UniFi Network API to authorise the guest's MAC with the profile's time, speed and data limits, and sends the browser on — no RADIUS on this path. UniFi sends no accounting, so Kiwire records the session start itself and reads usage and the session end from the UniFi API every few minutes.
On the controller. On the Device Controller record: the console or controller address (port 8443 unless you add another) and either a UniFi API key or a local admin username and password, plus the Site ID. One record per access point, Identity = the AP's MAC. Kiwire's app server must reach that HTTPS port. Limits are set at login (8 hours with no speed or data limit if Kiwire cannot read them). Disconnecting or changing a guest from Kiwire uses the same address, login and Site ID; try it on one test guest first. The record's Seamless Roaming Interval sets whether a guest who leaves and comes back must sign in again.
On-premises controllers
A controller or gateway on site fronts the access points and talks RADIUS to Kiwire.
Allied Telesis
Vendor key allied-telesis
The access point redirects the guest to Kiwire's portal (/login/allied-telesis); after sign-in Kiwire posts the user name (as both username and userid, since firmware differs), the password and an empty dst back to the AP's login address (switch_url), and the AP checks them against Kiwire over RADIUS.
On the controller. External Page Redirect to https://<kiwire-host>/login/allied-telesis, Kiwire as the RADIUS server with the shared secret, the Kiwire portal host in the walled garden. One record per AP, Identity = the AP MAC it sends (ap_mac), plus the RADIUS NAS-Identifier if different. Set the post-login landing page on the AP. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Aruba (controller / Instant)
Vendor key aruba
Aruba Instant APs redirect the guest to Kiwire's portal (/login/aruba); after sign-in Kiwire sends the browser to the virtual controller's login address (https://<switchip>/swarm.cgi, normally securelogin.arubanetworks.com) with the username and password, and the AP checks them against Kiwire over RADIUS.
On the controller. An external captive portal profile of type RADIUS Authentication pointing at <kiwire-host>, URL /login/aruba, port 443 with HTTPS, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the walled garden. Register the NAS identifier set on the RADIUS server and each AP MAC Instant sends (apmac) as Identities. For disconnects, enable dynamic authorization (RFC 3576) on the cluster; Kiwire sends standard RADIUS Disconnect and CoA to the record's IP Address. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Aruba OS
Vendor key aruba_os
The ArubaOS controller redirects the guest to Kiwire's portal (/login/aruba_os); after sign-in Kiwire sends the browser to the controller's own captive-portal login address (taken from the switchip it sent) with the username and password, and the controller checks them against Kiwire over RADIUS.
On the controller. An external captive portal pointing at https://<kiwire-host>/login/aruba_os, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the walled garden. Register the AP MAC the controller sends (apmac) and the controller's RADIUS NAS-Identifier as Identities. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Cisco WLC
Vendor key cisco_wlc
The Cisco WLC redirects the guest to Kiwire's portal (/login/cisco_wlc) through external web authentication; after sign-in Kiwire posts the username, password and original page back to the controller's web-auth address (switch_url), and the WLC checks them against Kiwire over RADIUS.
On the controller. A Layer 3 web policy with external web authentication at https://<kiwire-host>/login/cisco_wlc, Kiwire as the RADIUS server with the shared secret, and a pre-authentication ACL allowing the Kiwire portal host. The WLC identifies itself in the redirect by the WLAN (SSID) name, so register the SSID name as an Identity as well as the WLC's RADIUS NAS-Identifier. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Fortinet FortiAP
Vendor key fortiap
A FortiGate-managed FortiAP SSID with an external captive portal sends the guest to Kiwire's portal (/login/fortiap); after sign-in the browser posts the magic token, username and password to the FortiGate's fgtauth address (post), and the FortiGate checks them against Kiwire over RADIUS.
On the controller. SSID captive portal, Authentication Portal External <kiwire-host>/login/fortiap (no scheme), a user group whose remote server is Kiwire's RADIUS (shared secret, accounting on), and the Kiwire portal host in the exempt list. One record per AP, Identity = apmac (apname when apmac is empty or all zeros), plus one record for the FortiGate's RADIUS NAS-Identifier (FortiOS 7.2.4+: nas-id-type custom). No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Fortinet FortiGate
Vendor key fortigate
Not available yet — Kiwire completes the FortiOS login itself from its server; contact Synchroweb before deploying one.
On the controller. Only with Synchroweb: a Controller Test capture of the FortiGate redirect, and the FortiGate's login address reachable from Kiwire's server (internet or VPN). For Fortinet wireless use FortiAP — see the Fortinet guide.
H3C
Vendor key h3c
The H3C access controller redirects the guest to Kiwire's portal (/login/h3c); after sign-in Kiwire sends the browser to the controller's own portal login page (at the acip address it sent) with the username, password and guest IP, and the controller checks them against Kiwire over RADIUS. The guest's original page is not carried through.
On the controller. Portal / web authentication pointing at https://<kiwire-host>/login/h3c, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the free (pre-auth) rules. Register the value the controller sends as nasid and its RADIUS NAS-Identifier as Identities. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Huawei
Vendor key huawei
An older-style Huawei AC set-up: the AC redirects the guest to Kiwire's portal (/login/huawei) with user-ipaddress, AP-IP and AP-MAC; after sign-in Kiwire posts the username, password and original page to the AC's login address (login-url), and the AC checks them against Kiwire over RADIUS. For a new AC use Huawei WLC.
On the controller. A URL template pointing at https://<kiwire-host>/login/huawei that includes the AC's login address as login-url (without it the login has nowhere to go), the AP MAC as AP-MAC, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the free rules. Register the AP-MAC value and the RADIUS NAS-Identifier as Identities. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Huawei WLC
Vendor key huawei-wlc
The Huawei WLC redirects the guest to Kiwire's portal (/login/huawei-wlc); after sign-in Kiwire posts the username, password and original page to the controller's login address (login-url), and the controller checks them against Kiwire over RADIUS. Kiwire can disconnect guests or change their limits with CoA on port 3799.
On the controller. A URL template pointing at https://<kiwire-host>/login/huawei-wlc that adds the AC's system name as nas-id, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the free rules. Register the AC's system name as the Identity (the same value arrives as nas-id and, normally, as NAS-Identifier). For speed limits add Huawei's own rate attributes to the profile by hand. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Motorola / Zebra WiNG
Vendor key motorola
The WiNG controller sends the guest to Kiwire's portal (/login/motorola) with an encoded Qv value that Kiwire decodes; after sign-in the browser posts f_user, f_pass, f_hs_server and f_Qv to the hotspot server's hslogin.cgi on port 880, and WiNG checks them against Kiwire over RADIUS.
On the controller. Captive portal with externally hosted pages at https://<kiwire-host>/login/motorola, Kiwire as the RADIUS server with the shared secret, the Kiwire host allowed before login. Identity = the AP MAC decoded from Qv, plus the RADIUS NAS-Identifier if different. No data cap.
Nomadix gateway
Vendor key nomadix
The gateway redirects the guest to Kiwire's portal (/login/nomadix); after sign-in Kiwire sends the browser to Nomadix's standard login address (login.nomadix.com port 1111), which the gateway intercepts, with the username, password and original page, and the gateway checks them against Kiwire over RADIUS.
On the controller. A portal-page redirect to https://<kiwire-host>/login/nomadix carrying the guest MAC, IP, original URL and node ID (NI); Kiwire as the RADIUS server with the shared secret; the Kiwire portal host in the pass-through list. Identity = the node ID, and the RADIUS NAS-Identifier if different. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Nomadix gateway (XML API)
Vendor key nomadix_xml
Available through Synchroweb. The gateway sends the guest to Kiwire's portal (/login/nomadix_xml); after sign-in Kiwire's server logs the guest in on the gateway with an XML RADIUS_LOGIN command, and sends the browser on. The gateway checks the credentials against Kiwire over RADIUS; speed changes are pushed through the same XML interface.
On the controller. Portal-page redirect to https://<kiwire-host>/login/nomadix_xml with MA, SIP, OS and NI; Kiwire as RADIUS server; the XML interface enabled and reachable from Kiwire's server. On the record: IP Address = the gateway (XML port 1111, or add :port / set the COA Port). Identity = the node ID (NI) and the RADIUS NAS-Identifier.
Ruckus SmartZone (Hotspot WISPr)
Vendor key ruckus_ap
A SmartZone Hotspot (WISPr) WLAN with an external logon URL sends the guest to Kiwire's portal (/login/ruckus_ap); after sign-in the browser posts the credentials, guest MAC/IP, original page and proxy to SmartZone's hotspot login address on port 9997, and SmartZone checks them against Kiwire over RADIUS.
On the controller. WISPr portal with Logon URL External https://<kiwire-host>/login/ruckus_ap, Kiwire as authentication and accounting service with the shared secret, the Kiwire host in the walled garden. One record per AP, Identity = the AP MAC it sends (mac), plus the NAS-Identifier if different. SmartZone encrypts client MAC/IP by default and Kiwire does not decrypt them — check with Controller Test. No data cap (Session-Timeout only).
Ruckus SmartCell Gateway
Vendor key ruckus_scg
Available through Synchroweb. The SmartZone guest WLAN sends the guest to Kiwire's portal (/login/ruckus_scg); after sign-in Kiwire's server logs the guest in on SmartZone through its Northbound Portal Interface (JSON on port 9080), and sends the browser on. SmartZone checks the credentials against Kiwire over RADIUS.
On the controller. Northbound Portal Interface enabled with a password; the WLAN's external portal set to https://<kiwire-host>/login/ruckus_scg and Kiwire as RADIUS server; Kiwire's server able to reach SmartZone on port 9080. On the record (each AP, or once as Ruckus_Controller): IP Address = the NBI address, Password = the NBI password. Identity = the AP MAC SmartZone sends as mac. Turn off MAC/IP encryption so Kiwire records real MACs.
Ruckus Virtual SmartZone
Vendor key ruckus_vsz
Available through Synchroweb. The SmartZone guest WLAN sends the guest to Kiwire's portal (/login/ruckus_vsz); after sign-in Kiwire's server logs the guest in on SmartZone through its Northbound Portal Interface (JSON on port 9080), and sends the browser on. SmartZone checks the credentials against Kiwire over RADIUS.
On the controller. Northbound Portal Interface enabled with a password; the WLAN's external portal set to https://<kiwire-host>/login/ruckus_vsz and Kiwire as RADIUS server; Kiwire's server able to reach SmartZone on port 9080. On the record (each AP, or once as Ruckus_Controller): IP Address = the NBI address, Password = the NBI password. Identity = the AP MAC SmartZone sends as mac. Turn off MAC/IP encryption so Kiwire records real MACs.
SonicWall
Vendor key sonicwall
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. See Other controllers for the current status.
Sundray
Vendor key sundray
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. See Other controllers for the current status.
TP-Link Omada
Vendor key tplink
The Omada controller or gateway redirects the guest to Kiwire's portal (/login/tplink); after sign-in Kiwire sends the browser to Omada's External RADIUS Portal login address with the username, password, client and AP MAC, SSID, VLAN and the original page, and Omada checks the credentials against Kiwire over RADIUS.
On the controller. A portal with authentication type External RADIUS Server and an external portal URL of https://<kiwire-host>/login/tplink, Kiwire as the RADIUS server with the shared secret, and the Kiwire portal host in the pre-authentication access list. The http/https scheme and port Kiwire posts back to come from Omada's own redirect, so nothing about them is entered in Kiwire. Register the AP MAC Omada sends (apMac) and its RADIUS NAS-Identifier as Identities. No vendor data-cap attribute, so limits are time-based (Session-Timeout). If the redirect's target already starts with http:// or https://, the login does not complete yet; contact Synchroweb.
Ubiquiti (legacy)
Vendor key ubnt
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. For UniFi, use UBNT Console — see the Ubiquiti guide.
Ubiquiti UniFi controller
Vendor key ubnt_controller
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. There is no redirect for this type. For UniFi, use UBNT Console — see the Ubiquiti guide.
Xirrus
Vendor key xirrus
The Xirrus AP sends the guest to Kiwire's portal (/login/xirrus) ChilliSpot-style; after sign-in the browser opens the AP's uamip:uamport/logon with the username and a CHAP response, the AP checks it against Kiwire over RADIUS and returns the browser with res=success, and Kiwire sends the guest to their original page.
On the controller. External portal https://<kiwire-host>/login/xirrus, Kiwire as the RADIUS server with the shared secret, the Kiwire host allowed before login. Identity = nasid (apmac when no nasid). The AP's UAM secret must equal the Identity — Kiwire signs the response with it. No data cap.
Routers and standalone access points
The hotspot runs on the router or AP itself.
MikroTik (RouterOS hotspot)
Vendor key mikrotik
The RouterOS hotspot redirects the guest to Kiwire's portal (/login/mikrotik); after sign-in Kiwire sends the browser back to the hotspot's own login page with the username and password, and RouterOS checks them against Kiwire over RADIUS, applying the returned limits (Mikrotik-Rate-Limit for speed, Mikrotik-Total-Limit + Mikrotik-Total-Limit-Gigawords for a data cap, so caps over 4 GiB work). Kiwire sends Disconnect and CoA requests to the router (RADIUS incoming) for admin disconnects, expiry, used-up time or data, device-limit kicks and profile changes. Separately, Kiwire's Bypass Devices page can log into the router over the RouterOS API to let a device skip the hotspot.
On the controller. Hotspot login page redirecting to https://<kiwire-host>/login/mikrotik with the router's identity as nasid; RADIUS (auth 1812, accounting 1813) pointed at Kiwire with the shared secret; the router's identity registered as the Identity; the hotspot server profile's login-by including http-pap (Kiwire hands the password back in plain form, so CHAP-only rejects every login); the Kiwire portal host in the walled garden (IP walled garden for HTTPS). For disconnects and live changes, RADIUS incoming enabled on the COA Port (3799) with a RADIUS entry for the address Kiwire sends them from, and the router's IP Address on the record. For device bypass (RouterOS 6.43 or later), the RouterOS API service (port 8728) enabled with a username and password entered on the Device Controller record.
Peplink
Vendor key peplink
The router's captive portal redirects the guest to Kiwire's portal (/login/peplink); after sign-in Kiwire sends the browser to the router's form_action address with the username, password and command=login (GET), and the router checks them against Kiwire over RADIUS.
On the controller. Captive portal with RADIUS authentication pointed at Kiwire and an external splash page at https://<kiwire-host>/login/peplink; the Kiwire portal host in the allowed domains. Identity = the device name the router sends (device_name). Set the post-login landing page on the router. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Zyxel AP
Vendor key zyxelap
The AP's external captive portal redirects the guest to Kiwire's portal (/login/zyxelap); after sign-in Kiwire sends the browser to the AP's login address (apurl) with the username, password and success_url (GET), and the AP checks them against Kiwire over RADIUS.
On the controller. External captive portal URL https://<kiwire-host>/login/zyxelap, RADIUS authentication pointed at Kiwire with the shared secret, and the Kiwire portal host in the walled garden. One record per AP, Identity = the AP MAC as it sends it (apmac). Kiwire has no original page to pass back, so success_url is Google's home page unless a landing page is set on the AP or in Nebula. No vendor data-cap attribute, so limits are time-based (Session-Timeout).
Gateway software
A captive-portal daemon on a Linux box or firewall.
ChilliSpot / CoovaChilli
Vendor key chillispot
CoovaChilli / ChilliSpot sends the guest to Kiwire's portal (/login/chillispot) as its uamserver; after sign-in the browser opens uamip:uamport/logon with the username and the password encoded with the challenge and the UAM secret, the gateway checks them against Kiwire over RADIUS and returns the browser with res=success, and Kiwire sends the guest to their original page.
On the controller. uamserver https://<kiwire-host>/login/chillispot; uamsecret and radiussecret both = the record's Shared Secret Key; radiusnasid = the Identity; the Kiwire host in uamallowed; coaport 3799 with coanoipcheck for disconnects. Data caps via ChilliSpot-Max-Total-Octets plus Session-Timeout.
pfSense captive portal
Vendor key pfsense
A pfSense captive portal zone forwards the guest from a custom portal page to Kiwire's portal (/login/pfsense); after sign-in the browser posts auth_user, auth_pass, redirurl, zone and accept=continue to pfSense's $PORTAL_ACTION$, and pfSense checks them against Kiwire over RADIUS.
On the controller. RADIUS authentication and accounting pointed at Kiwire with the shared secret, NAS Identifier left at pfSense's default; a custom portal page forwarding to https://<kiwire-host>/login/pfsense with loginurl, zone, CLIENT_MAC and CLIENT_IP; the Kiwire host in Allowed Hostnames. Identity = CaptivePortal-<zone name>. No disconnects; data caps do not apply (Kiwire sends ChilliSpot's attribute, pfSense uses its own) — time limits only.
WiFiDog
Vendor key wifidog
Kiwire speaks the WiFiDog protocol, not RADIUS: the gateway sends the guest to Kiwire's portal, Kiwire hands the browser back to the gateway with a one-time token, and the gateway checks that token with Kiwire over HTTP and reports usage the same way. Any WiFiDog gateway uses the auth-server path /wifidog/ruijie.
On the controller. The gateway's auth server set to <kiwire-host> with path /wifidog/ruijie, reachable over HTTPS on 443 for the login, auth, ping and portal calls (plain HTTP is answered with a redirect to HTTPS). Identity = the gateway ID (gw_id). Set Monitoring Method to Wifidog to have the gateway's check-ins mark it as running. Speed and time limits are passed to the gateway at login; a data cap applies only if the gateway reports traffic in its check-ins, and a disconnect or profile change drops the guest at the next check-in.
Other
CMCC
Vendor key cmcc
Not available yet — a guest login does not complete on this controller type today; contact Synchroweb.
On the controller. See Other controllers for the current status.
Other / generic RADIUS
Vendor key other
A generic entry for a gateway that lets you name its redirect parameters: it redirects the guest to Kiwire's portal (/login/other) with nasid, mac, ip, url and login_url; after sign-in the browser posts the username and password to login_url, and the gateway checks them against Kiwire over RADIUS.
On the controller. Redirect to https://<kiwire-host>/login/other with exactly the parameter names nasid, mac, ip, url and login_url; Kiwire as the RADIUS server with the shared secret; the Kiwire host in the walled garden. Identity = the nasid value and the RADIUS NAS-Identifier. Set the post-login landing page on the gateway. No data cap (Session-Timeout).
Virtual NAS
Vendor key virtual-nas
Not a controller type of its own: a Virtual NAS is an extra Device Controller record whose Identity is the NAS-Identifier a cloud controller sends in RADIUS when that differs from the identity it puts in the portal redirect. It has no redirect of its own.
On the controller. Register it with Identity = the exact NAS-Identifier the cloud sends and the same shared secret as the controller's other records. It counts toward the licence device limit like any other record.
The vendor list is read from the controller form's own options, so it cannot fall behind it.