Set up a controller, step by step

The same eight steps apply to every controller. Your vendor's guide fills in the exact screens and values; this page is the order to do them in.

1. Open your vendor's guide

Pick the page for the equipment the guests connect to: MikroTik · Cisco Meraki · Cisco WLC · Huawei · TP-Link Omada · Aruba · Ubiquiti UniFi · Ruckus · Fortinet · Ruijie and WiFiDog · H3C · Allied Telesis · Other controllers.

Each guide tells you which Vendor to choose in Kiwire, the redirect address to use, what to register as the Identity, and how disconnects and data caps work on that equipment.

2. Collect what you need from Kiwire

What	Where to find it
RADIUS server address	The top of System › Device Controller, or the Setup Guide checklist. Written <radius-server-ip> in the guides.
Where disconnects come from	The top of System › Device Controller, Disconnect / CoA requests come from. Allow it on the controller if you use disconnects or live changes.
Your portal host	Portals › Troubleshoot › Controller Test, the Test URL field. Written <kiwire-host> in the guides.
A shared secret	Make one with Generate on the Device Controller form (up to 64 characters). Meraki uses a fixed secret that Synchroweb support gives you.
Licence room	Every controller record counts toward your licence's device limit. The Device Controller page shows how many are left.

3. Collect what you need from the controller

• The Identity values. The ID the controller puts in the guest redirect, and the NAS-Identifier it sends in RADIUS. Your vendor guide says which setting holds each one. When they are the same, one record is enough; when they differ, you add both. See Controller identity and Virtual NAS.
• Its IP address, as Kiwire can reach it, if you want Kiwire to disconnect guests or change their limits mid-session.
• Admin access to the controller, with rights to change its captive-portal, RADIUS and walled-garden settings.

4. Add the Device Controller record in Kiwire

Do this before the controller starts sending guests, so its first requests are recognised.

1. System › Device Controller, and add a new controller. The Add Device Controller form opens.
2. Vendor: the one your guide names.
3. Identity: exactly what the controller sends (step 3). Upper and lower case match; dashes, colons and missing separators do not.
4. Shared Secret Key: the secret from step 2.
5. Under Advanced Configuration: the controller's IP Address, and the COA Port (3799 unless your guide says otherwise). Some vendors need more here, such as the UniFi API key and Site ID; the guide lists them.
6. Save. For many devices, use the CSV import on the same page.

5. Configure the controller

In the controller's own admin console, following your vendor guide:

1. Captive portal / external portal / splash page: point it at https://<kiwire-host>/login/<slug>, with the slug from your guide.
2. RADIUS authentication: <radius-server-ip>, port 1812, the shared secret.
3. RADIUS accounting: the same address, port 1813, the same secret.
4. Dynamic authorization (CoA): allow Kiwire to send disconnects and live changes on port 3799 from the address shown on the Device Controller page, where your equipment supports it.
5. Walled garden: allow <kiwire-host> and the hosts your portal loads, so guests can reach the login page before they sign in. See Walled garden and redirect.
6. Save and apply the configuration.

6. Map the controller to a zone and a journey

Portals › Captive Portal › Zones Mapping: add a zone rule that matches this controller (by NAS ID, SSID or VLAN), and give the zone a journey, so guests see the right login page. See Controllers and zones.

7. Test a real login

1. Portals › Troubleshoot › Controller Test › Start Capture.
2. Connect a phone to the guest Wi-Fi. The login page should open.
3. In the capture, check that the guest's MAC, the controller's Identity and (for most vendors) its login address arrived, and that the controller shows as registered.
4. Sign in as a guest and check you can browse.
5. Reporting › Login › Active Session: the session appears once the controller sends accounting.
6. If you entered an IP Address, disconnect the test session from Active Session and check the phone is sent back to the login page.

Portals › Troubleshoot › Portal Simulation lets you try the journey itself without the hardware, which is useful before you go on site.

8. Before you leave

Run the checklist in Before you leave site: the record, the CoA path, the walled garden and accounting.

If a step doesn't work, your vendor guide's Test it and Limits to know sections list the usual causes. Contact Synchroweb with the Controller Test capture if you're still stuck.