Kiwire docs

Appearance

Allied Telesis ​

How to connect Allied Telesis wireless (TQ access points, standalone or managed by AWC / Vista Manager) to Kiwire.

Device type in KiwireAllied Telesis
Redirect URLhttps://<kiwire-host>/login/allied-telesis
RADIUSauth 1812 / acct 1813 (UDP)
Identity must equalthe AP MAC in the redirect (ap_mac), and the NAS-Identifier the AP sends in RADIUS
Disconnect / live changes (CoA)yes, port 3799, if the AP supports RFC 5176
Data capstime limits only (Session-Timeout)

Check the parameter names

Allied Telesis firmware versions differ in the redirect parameter names they send. Check them against the names Kiwire expects (below) with Controller Test during setup.

How a login works ​

How a guest logs in through Allied Telesis and Kiwire The guest joins the Wi-Fi and opens a page. The Allied Telesis device redirects the browser to Kiwire at /login/allied-telesis. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to switch_url. The device then asks Kiwire over RADIUS, identifying itself with AP MAC (ap_mac) / NAS-ID. Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Later, Kiwire can disconnect the guest or change their limits with CoA on port 3799.Guest devicephone, laptopAllied TelesisTQ AP / AWCKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/allied-telesis3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to switch_url5 RADIUS REQUEST — IDENTITY =AP MAC (ap_mac) / NAS-ID6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS8 LATER: DISCONNECT / CHANGE LIMITS (CoA, PORT 3799)
Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).
  1. The AP sends the guest to Kiwire with client_mac, ap_mac, switch_url (the AP's own login address) and wlan.
  2. After the portal, the guest's browser posts the user name and password to switch_url (any query on that address is dropped). The user name goes in both username and userid, because TQ firmware versions differ in which one they read. An empty dst field is sent too: Kiwire has no original page to pass back.
  3. The AP checks the credentials against Kiwire over RADIUS and lets the guest out.

Before you start ​

From Kiwire:

  • the RADIUS server address shown in the Setup Guide checklist ("Before you add your controller" › "RADIUS Authentication & Accounting");
  • a shared secret of at most 64 characters;
  • <kiwire-host>.

On the AP (or AWC): admin access, the guest VAP/SSID, and the MAC address of every AP that serves it.

On the controller ​

Menu names and commands vary between firmware versions; the values are what matter. Steps follow the TQ series user's guide (standalone AP web UI); in AWC / Vista Manager the same fields sit in the AP profile's VAP settings.

  1. Settings › VAP / Security › choose the radio and VAP › Captive Portal tab.
  2. Captive Portal = External Page Redirect.
  3. External Page URL = https://<kiwire-host>/login/allied-telesis.
  4. Primary RADIUS Server IP = <radius-server-ip>, Primary RADIUS Server Key = <shared-secret>, RADIUS Port = 1812, RADIUS Accounting = Enabled.
  5. Walled Garden: add <kiwire-host>, fonts.googleapis.com, fonts.gstatic.com and anything your portal design loads (FQDN, no http://). See Walled garden and redirect.
  6. If your firmware lets you set the RADIUS NAS-Identifier, set it to the AP's MAC in the same format the AP uses in ap_mac; then one Kiwire record per AP covers both.
  7. Save & Apply.

In Kiwire ​

  1. System › Device Controller › add one record per AP:
    • Vendor: Allied Telesis.
    • Identity: the AP MAC exactly as the AP sends it in ap_mac (Controller Test shows the format).
    • Shared Secret Key: <shared-secret> — the same on every record.
    • Advanced Configuration › Network Configuration: IP Address = the AP's address, COA Port = 3799. If the AP's RADIUS NAS-Identifier is a different value, add one more record with that value as Identity; see Identity and virtual NAS. Each record counts toward your licence's device limit.
  2. Check the redirect parameters with Redirect and login config: Kiwire reads client_mac, ap_mac, switch_url, wlan and error.
  3. Add a zone rule and journey: Controllers and zones, Portal designer.

Test it ​

  1. Portals › Troubleshoot › Controller Test › Start Capture, connect a phone, and check that client_mac, ap_mac and switch_url arrive and the AP shows as registered. If you see other parameter names, stop and contact Synchroweb.
  2. Log in as a real guest; the phone should go online after the page hands back to the AP.
  3. Reporting › Login › Active Session lists the guest.

Limits to know ​

  • Kiwire does not send the guest's original page back to the AP, so after login the AP decides where the guest lands.
  • No Allied Telesis data-cap attribute: profile quotas are enforced by time only.
  • The Identity must match the separators exactly: aa:bb:cc:dd:ee:ff and aa-bb-cc-dd-ee-ff are different (upper or lower case does not matter).

Vendor reference ​

Last updated:

Kiwire platform documentation

Synchroweb