Controller identity and Virtual NAS

How Kiwire decides which controller, and which organisation, a guest login belongs to, and when you need an extra "Virtual NAS" record to make that work.

Every vendor guide links here. Read it once before your first installation. Almost every "the portal loads but the login never completes" problem comes back to one of the rules on this page.

Two lookups, one value: the Identity

Each Device Controller record in Kiwire (Admin › System › Device Controller) has an Identity. Kiwire uses it twice, in two separate lookups:

1. RADIUS. When the controller sends a login or accounting request, Kiwire reads the NAS-Identifier in that request and looks for a Device Controller whose Identity is exactly that value. It then checks the request against that record's Shared Secret Key.
   • If the controller sends no NAS-Identifier, Kiwire uses the access point's MAC address from Called-Station-Id instead, written in capitals with colons, like AA:BB:CC:DD:EE:FF.
   • The address the request comes from does not matter. Kiwire does not recognise controllers by IP address. The IP Address field on the record is only used when Kiwire sends a disconnect or a live change back to the controller.
2. Portal. When the controller sends a guest to the login page, the redirect carries a controller ID. That ID must also equal an Identity in Kiwire. Which redirect parameter carries it depends on the vendor. It might be the access point's MAC, a NAS ID, or the SSID. Each vendor guide says which one.

If the controller sends the same value in both places, one record is enough. If the two values are different, you need one record for each value. For example, the redirect might carry the AP's MAC while RADIUS carries the controller's name. Both records must be in the same organisation and have the same Shared Secret Key.

Check what the controller really sends

Portals › Troubleshoot › Controller Test shows the parameters from each redirect as they arrive. It also shows whether the controller ID is registered. Controller Test lists hits only from controllers that are already added to your organisation. Before a controller is added, use the Test URL it gives you: add it to the controller's redirect and run the capture.

Rules for the Identity

• At least 4 characters, and unique across the whole Kiwire platform, not just your organisation. If the form says the Identity is already taken, another organisation has it registered. Contact Synchroweb support rather than trying variations.
• Write it exactly as the controller sends it. This matters most for MAC addresses: aa:bb:cc:dd:ee:ff, AA-BB-CC-DD-EE-FF and aabbccddeeff are three different Identities. Use the same separators and the same upper or lower case as the controller. When Kiwire falls back to Called-Station-Id, write the MAC in capitals with colons.
• Wildcards and ranges are not supported. Ten access points that each send their own MAC need ten records.
• Every record counts toward your licence's controller limit, including the extra records described below. If the Add button is refused, you have reached the limit.

Shared secret

• The Shared Secret Key field accepts up to 64 characters (some devices accept fewer, so check yours). Use Generate for a random one. Enter exactly the same value on the controller's RADIUS server settings. If the controller insists on a longer secret, contact Synchroweb support.
• Everything behind one public IP address must use the same shared secret. For about an hour, Kiwire reuses the secret it looked up for the first request from an address for every request from that address. This includes every controller at a site behind one internet connection, and every device relayed through one cloud platform. If two records behind the same address have different secrets, logins through one of them will fail.
• Changing a secret works the same way. Allow up to an hour before the new value is used for every request.
• A few vendors use a fixed RADIUS secret. The vendor guide says when this applies.

Allow up to an hour for a new controller

A controller that is new to Kiwire can be rejected for up to about an hour after you add it, especially if it was already sending requests before the record existed. Allow up to an hour after adding a controller before the first login works. If it still fails after that, check Portals › Troubleshoot › Controller Test. Also check the Identity and secret against the rules above.

Where the RADIUS server address comes from

Point the controller's RADIUS authentication (UDP 1812) and accounting (UDP 1813) at the RADIUS server address shown in the Setup Guide checklist. You'll find it under Before you add your controller › RADIUS Authentication & Accounting. If the Setup Guide is no longer shown in your admin, ask your Kiwire provider for the address.

Virtual NAS

What it is

A Virtual NAS is an ordinary Device Controller record with no physical device behind it. Its Identity is the NAS-Identifier that a cloud platform or RADIUS relay sends to Kiwire on behalf of many devices.

Some platforms don't let each access point talk RADIUS to Kiwire. The platform sends every request itself, stamped with its own NAS-Identifier. Examples:

• A RADIUS relay that stamps its own name on every request (an OpenRoaming/RadSec relay, for example). Huawei iMaster NCE can relay too, but set its NAS-Identifier to Device MAC and it needs no Virtual NAS — see Huawei.
• An OpenRoaming or RadSec relay that forwards requests from many venues under one name.

Those requests won't match any access point's record. A Virtual NAS is the record they do match. The guest still arrives on the portal with the access point's own ID in the redirect, so the per-AP records stay as well.

When you need one, and when you don't

• You need one when RADIUS requests arrive with a NAS-Identifier that doesn't equal any access point's Identity. This is typically a fixed platform name or a relay name.
• You don't need one when each access point sends its own value as NAS-Identifier, for example its own MAC. That value already equals the AP's record, as long as it is written in the same format.

	One record per AP	Virtual NAS + one record per AP
Who sends RADIUS	Each AP or controller itself	A cloud platform or relay, for all APs
NAS-Identifier Kiwire receives	The AP's own value (often its MAC)	One shared value, such as the platform's name
Records you add	One per AP, Identity = what the AP sends in both places	One Virtual NAS (Identity = the platform's NAS-Identifier) plus one per AP (Identity = the AP ID in the redirect)
Shared Secret Key	Same on every record behind one public IP	Same on the Virtual NAS and every AP record
Disconnect / live changes	Possible if Kiwire can reach the device	Depends on the platform. Often not available
Licence	One per AP	One per AP, plus one

How to add one

1. Admin › System › Device Controller → add a record.
2. Vendor: choose the vendor of the real platform, for example Huawei NCE, not "Virtual NAS". Kiwire uses the Vendor to decide how disconnects, speed and data limits are sent, so it has to name the real platform.
3. Identity: the exact NAS-Identifier the platform sends.
4. Shared Secret Key: the same secret you use on the platform and on the per-AP records.
5. Leave IP Address empty unless the platform accepts disconnect requests from Kiwire and you know its address.

The "Virtual NAS" vendor choice does not create a Virtual NAS

The Vendor list includes an entry called Virtual NAS. Choosing it does nothing special. What makes a record a Virtual NAS is its Identity, not the Vendor. To keep it out of the dashboards' access-point counts and silence alerts, tick Virtual NAS (a relay identity, not a physical device) under Network Configuration; it still counts toward your licence. Virtual NAS is also not a testing option: every record is live and counts toward your licence. To try the portal without hardware, use Portals › Troubleshoot › Portal Simulation instead.

Zone rules with a Virtual NAS

A zone rule on NAS ID is matched against the controller ID in the redirect when the guest logs in through the portal. It is matched against the NAS-Identifier when a device authenticates by RADIUS alone. On a Virtual NAS setup, write portal zone rules against the per-AP Identities. See Controllers and zones.

Related

• The redirect and the login config: which redirect parameter carries the controller ID for each vendor.
• Before you leave site: the final checks.