Kiwire docs

Appearance

Aruba ​

How to connect an ArubaOS mobility controller or an Aruba Instant (virtual controller) cluster to Kiwire.

Device type in KiwireAruba OS (controller-based) · Aruba (Instant / virtual controller)
Redirect URLhttps://<kiwire-host>/login/aruba_os · https://<kiwire-host>/login/aruba
RADIUSauth 1812 / acct 1813 (UDP)
Identity must equalthe AP MAC the controller puts in the redirect (apmac), and the controller's RADIUS NAS-Identifier
Disconnect / live changes (CoA)Aruba OS: yes, RFC 3576 on the controller, port 3799. Instant: Kiwire sends standard RADIUS Disconnect and CoA to the record's IP Address; enable dynamic authorization (RFC 3576) on the cluster
Data capstime limits only (Session-Timeout)

Read Controller identity and Virtual NAS once before your first installation.

Which entry to pick ​

Your equipmentVendor in KiwireRedirect URL ends in
A mobility controller (or a conductor-managed controller) running ArubaOSAruba OS/login/aruba_os
Aruba Instant APs run by a virtual controllerAruba/login/aruba

Other Aruba login addresses you may see listed are not supported for new sites.

Both types work the same way on the Kiwire side: the redirect carries switchip (where the guest's browser sends the login back) and apmac (which AP the guest is on), and the controller then checks the login with Kiwire over RADIUS.

Before you start ​

From Kiwire:

  • the RADIUS server address shown in the Setup Guide checklist ("Before you add your controller" › "RADIUS Authentication & Accounting"), or the address your Kiwire provider gave you;
  • a shared secret of at most 64 characters (you create it when you add the controller in Kiwire);
  • your Kiwire host name, <kiwire-host>.

On the Aruba side: admin access to the ArubaOS WebUI or CLI, or to the Instant WebUI; the guest SSID you want to use; and the list of AP MAC addresses on that SSID.

ArubaOS controller (Aruba OS) ​

How a guest logs in through Aruba OS and Kiwire The guest joins the Wi-Fi and opens a page. The Aruba OS device redirects the browser to Kiwire at /login/aruba_os. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to switchip/cgi-bin/login. The device then asks Kiwire over RADIUS, identifying itself with NAS-ID; apmac for the portal. Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Later, Kiwire can disconnect the guest or change their limits with CoA on port 3799.Guest devicephone, laptopAruba OSmobility controllerKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/aruba_os3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to switchip/cgi-bin/login5 RADIUS REQUEST — IDENTITY =NAS-ID; apmac for the portal6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS8 LATER: DISCONNECT / CHANGE LIMITS (CoA, PORT 3799)
Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).

On the controller ​

Menu names and commands vary between firmware versions; the values are what matter.

  1. RADIUS server. Add a RADIUS authentication server (Configuration › Authentication › Auth Servers, or aaa authentication-server radius <name>): host <radius-server-ip>, key <shared-secret>, auth port 1812, accounting port 1813, and set NAS identifier to a fixed name for this controller, for example site1-aruba. Write it down; it becomes an Identity in Kiwire.
  2. Server group. Put that server in a server group (aaa server-group <group>, auth-server <name>).
  3. Captive portal profile. Create a captive portal authentication profile (aaa authentication captive-portal <profile>):
    • server group = the group from step 2;
    • Login page = https://<kiwire-host>/login/aruba_os;
    • turn on Add switch IP address in the redirection URL and Add AP MAC address in the redirection URL — Kiwire needs switchip to hand the login back and apmac to find your account;
    • white-list = a net destination that contains <kiwire-host> (next step).
  4. Walled garden. Create a net destination allowing <kiwire-host>, fonts.googleapis.com, fonts.gstatic.com and anything your portal design loads, and allow it in the pre-login (captive portal) role. See Walled garden and redirect.
  5. Accounting. In the AAA profile for the guest virtual AP, set RADIUS accounting to the same server group.
  6. CoA (optional). Add an RFC 3576 server (aaa rfc-3576-server <ip>, key <shared-secret>) and attach it to the AAA profile. The source is the Kiwire application server, not the RADIUS address — ask Synchroweb for it.
  7. Apply the captive portal profile to the guest user role and the role to the guest virtual AP.

In Kiwire (Aruba OS) ​

  1. System › Device Controller › add:
    • Vendor: Aruba OS.
    • Identity: the NAS identifier from step 1 (for example site1-aruba).
    • Shared Secret Key: <shared-secret> (same as the controller).
    • Under Advanced Configuration › Network Configuration: IP Address = the controller's address, COA Port = 3799. Then add one more record per AP, with Identity = that AP's MAC exactly as the controller sends it in apmac (Controller Test shows the format). Use the same Shared Secret Key on every record. Each record counts toward your licence's device limit. Background: Identity and virtual NAS.
  2. Check the redirect parameters with Redirect and login config: Kiwire reads mac, ip, url, switchip, apmac, vlan and essid.
  3. Add a zone rule and journey: Controllers and zones, Portal designer.

After the portal, the guest's browser sends user, password, dst (the page the guest first asked for) and cmd=authenticate to https://<switchip>/cgi-bin/login. If the browser shows a certificate warning at this point, install a trusted captive portal certificate on the controller.

Aruba Instant (Aruba) ​

How a guest logs in through Aruba Instant and Kiwire The guest joins the Wi-Fi and opens a page. The Aruba Instant device redirects the browser to Kiwire at /login/aruba. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to switchip/swarm.cgi. The device then asks Kiwire over RADIUS, identifying itself with NAS identifier; apmac for portal. Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Guest devicephone, laptopAruba Instantvirtual controllerKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/aruba3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to switchip/swarm.cgi5 RADIUS REQUEST — IDENTITY =NAS identifier; apmac for portal6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS
Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).

How the hand-back works: Instant puts switchip in the redirect. By default it is securelogin.arubanetworks.com, a name the Instant AP answers itself. After the portal, Kiwire sends the guest's browser to https://<switchip>/swarm.cgi with user, password, dst and cmd=authenticate. The AP then checks the credentials with Kiwire over RADIUS.

On the virtual controller ​

Menu names and commands vary between firmware versions; the values are what matter. The field names below are from Aruba Instant 8.x; match the menu paths to your version.

  1. RADIUS server. Add an authentication server (Security › Authentication Servers › New, or from the SSID's security settings): type RADIUS, IP address <radius-server-ip>, Auth port 1812, Accounting port 1813, Shared key <shared-secret>. If your version shows a NAS identifier field, set it to a fixed name for this cluster, for example site1-iap, and write it down: it becomes an Identity in Kiwire.
  2. External captive portal profile. Create one with:
    • Type: RADIUS Authentication;
    • IP or hostname: <kiwire-host>;
    • URL: /login/aruba;
    • Port: 443, with Use https enabled;
    • Captive Portal failure: Deny internet (so guests are not let out when Kiwire is unreachable).
  3. Guest SSID. On the SSID's security settings: Splash page type External, the captive portal profile from step 2, Auth server 1 the RADIUS server from step 1, and RADIUS accounting on (for example every 15 minutes).
  4. Walled garden. Allow <kiwire-host>, fonts.googleapis.com, fonts.gstatic.com and anything your portal design loads before login. See Walled garden and redirect.

Kiwire sends the original page as dst. Depending on the firmware version, Instant uses it or its own Redirect URL setting. If guests land on the wrong page after logging in, set the redirect page in the captive portal profile.

In Kiwire (Aruba) ​

  1. System › Device Controller › add:
    • Vendor: Aruba.
    • Identity: the NAS identifier from step 1 (for example site1-iap).
    • Shared Secret Key: <shared-secret>. Then add one more record per AP, with Identity = that AP's MAC exactly as Instant sends it in apmac (Controller Test shows the format). Use the same Shared Secret Key on every record. Each record counts toward your licence's device limit.
  2. If your version has no NAS identifier field, ask Synchroweb support to check what NAS-Identifier arrives with the first login attempt, and add a record with that value.
  3. Check the redirect parameters with Redirect and login config: Kiwire reads mac, ip, url, switchip, apmac, vlan and essid.
  4. Add a zone rule and journey: Controllers and zones, Portal designer.

Disconnects and live profile changes on Instant are sent as standard RADIUS Disconnect and CoA. Kiwire only sends them when the record has an IP Address and COA Port, and the cluster must have dynamic authorization (RFC 3576) enabled and be reachable at that address. Instant APs usually sit behind the site's NAT; if Kiwire cannot reach them, profile changes apply from the guest's next login.

Test it ​

  1. Portals › Troubleshoot › Controller Test › Start Capture, then connect a phone to the SSID. Check that mac, apmac and switchip arrive and that the controller shows as registered.
  2. Log in as a real guest. After the portal, the guest's browser sends the login to the address in switchip (/cgi-bin/login on ArubaOS, /swarm.cgi on Instant). If the browser shows a certificate warning at this point, install a trusted captive portal certificate on the controller or virtual controller.
  3. Reporting › Login › Active Session should list the guest within a minute.

Limits to know ​

  • Aruba has no data-cap attribute in Kiwire: profile quotas are not enforced by the controller, only time limits.
  • The Identity has to match exactly; aa:bb:cc:dd:ee:ff, aa-bb-cc-dd-ee-ff and aabbccddeeff are different.
  • Add records before the device goes live. Kiwire accepts a new record straight away. If the device already sent RADIUS requests before its record existed, they can keep failing for up to an hour. See Controller identity and Virtual NAS.
  • All records behind one public IP must share the same shared secret.

Vendor reference ​

Last updated:

Kiwire platform documentation

Synchroweb