Kiwire docs

Appearance

H3C ​

How to connect an H3C wireless access controller (Comware) to Kiwire with remote portal authentication and RADIUS.

Device type in KiwireH3C
Redirect URLhttps://<kiwire-host>/login/h3c
RADIUSauth 1812 / acct 1813 (UDP)
Identity must equalthe nasid value in the redirect and the AC's RADIUS NAS-Identifier (make them the same)
Disconnect / live changes (CoA)yes, port 3799 (dynamic authorization on the AC)
Data capstime limits only (Session-Timeout)

How the login works ​

How a guest logs in through H3C and Kiwire The guest joins the Wi-Fi and opens a page. The H3C device redirects the browser to Kiwire at /login/h3c. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST /portal/httplogin on acip. The device then asks Kiwire over RADIUS, identifying itself with AC NAS-ID (nasid). Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Later, Kiwire can disconnect the guest or change their limits with CoA on port 3799.Guest devicephone, laptopH3CComware ACKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/h3c3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST /portal/httplogin on acip5 RADIUS REQUEST — IDENTITY =AC NAS-ID (nasid)6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS8 LATER: DISCONNECT / CHANGE LIMITS (CoA, PORT 3799)
Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).

The AC redirects the guest to Kiwire with the guest's MAC and IP, the AC's address and a NAS ID. After the portal, the guest's browser hands the login back to the AC at http://<AC-IP>/portal/httplogin, and the AC authenticates the guest against Kiwire over RADIUS. So the guest must be able to reach the AC on that address over HTTP.

Before you start ​

From Kiwire:

  • the RADIUS server address shown in the Setup Guide checklist ("Before you add your controller" › "RADIUS Authentication & Accounting");
  • a shared secret of at most 64 characters;
  • <kiwire-host>.

On the AC: CLI access, the guest service template, and the AC address guests can reach (<AC-IP>).

On the controller ​

Menu names and commands vary between firmware versions; the values are what matter. The commands below follow H3C's remote portal configuration examples.

  1. RADIUS scheme
    radius scheme kiwire
 primary authentication <radius-server-ip> 1812
 primary accounting <radius-server-ip> 1813
 key authentication simple <shared-secret>
 key accounting simple <shared-secret>
 user-name-format without-domain
    Set the NAS-Identifier the AC sends to a fixed name, for example site1-h3c (on most firmware this is the nas-id setting on the service template or in an AAA NAS-ID profile — the exact command varies; check your AC's command reference).
  2. ISP domain
    domain kiwire
 authentication portal radius-scheme kiwire
 authorization portal radius-scheme kiwire
 accounting portal radius-scheme kiwire
  3. Portal web server — the redirect, with the parameters Kiwire reads:
    portal web-server kiwire
 url https://<kiwire-host>/login/h3c
 url-parameter usermac source-mac
 url-parameter wlanuserip source-address
 url-parameter nasid nas-id
 url-parameter acip value <AC-IP>
    If nas-id is not available as a parameter source on your firmware, use url-parameter nasid value site1-h3c with the same fixed name as step 1.
  4. Walled garden (portal free rules): allow DNS and <kiwire-host>, plus fonts.googleapis.com, fonts.gstatic.com and anything your portal design loads — for example portal free-rule 1 destination host-name <kiwire-host> and free rules for UDP/TCP 53. See Walled garden and redirect.
  5. Service template
    wlan service-template <guest-template>
 portal enable method direct
 portal domain kiwire
 portal apply web-server kiwire
  6. HTTP login on the AC. The AC must accept the portal login at http://<AC-IP>/portal/httplogin. How this is enabled differs between AC models and firmware versions — ask Synchroweb for an H3C reference configuration for your model.
  7. CoA (optional). Enable RADIUS dynamic authorization on the AC (radius dynamic-author server) with Kiwire as a client and key <shared-secret>. Changes come from the Kiwire application server, not the RADIUS address — ask Synchroweb for it.

In Kiwire ​

  1. System › Device Controller › add:
    • Vendor: H3C.
    • Identity: the NAS ID from step 1 (for example site1-h3c) — the same value arrives as nasid in the redirect and as NAS-Identifier in RADIUS, so one record covers both.
    • Shared Secret Key: <shared-secret>.
    • Advanced Configuration › Network Configuration: IP Address = the AC address, COA Port = 3799. If the two values differ on your AC, you need a record for each; see Identity and virtual NAS.
  2. Check the redirect parameters with Redirect and login config: Kiwire reads usermac, wlanuserip, acip and nasid.
  3. Add a zone rule and journey: Controllers and zones, Portal designer.

Test it ​

  1. Portals › Troubleshoot › Controller Test › Start Capture, connect a phone, and check that usermac, wlanuserip, acip and nasid arrive and the controller shows as registered.
  2. Log in as a real guest; the phone should go online after the page hands back to the AC.
  3. Reporting › Login › Active Session lists the guest.

Limits to know ​

  • After login the AC sends the guest to a standard search page (Google), not the page they first asked for.
  • H3C has no data-cap attribute in Kiwire: profile quotas are enforced by time only.
  • The h3c-cloud entry you may see listed is not covered by this guide; use /login/h3c.
  • If the AC sent RADIUS requests before its record existed in Kiwire, the first logins can still be refused for up to an hour; see Allow up to an hour for a new controller.

Vendor reference ​

Last updated:

Kiwire platform documentation

Synchroweb