Kiwire docs

Appearance

Huawei ​

How to connect Huawei iMaster NCE-Campus cloud APs, on-premises Huawei wireless access controllers (AC), and cloud-managed Huawei AR gateways to Kiwire.

Device type in KiwireHuawei NCE, Huawei WLC, Huawei Cloud UGW (plain "Huawei" for older AC set-ups, see below)
Redirect URLhttps://<kiwire-host>/login/huawei-nce · https://<kiwire-host>/login/huawei-wlc · https://<kiwire-host>/login/huawei-cloud-ugw
RADIUSauth 1812 / acct 1813 (UDP)
Identity must equalNCE: each AP's MAC, exactly as NCE sends it in ap-mac and as NAS-Identifier (set NAS-Identifier to Device MAC). AC: the AC's system name, sent as nas-id and as NAS-Identifier
Disconnect / live changes (CoA)NCE relay mode: no. AC: yes, port 3799 (enable it on the AC). Cloud UGW: Kiwire sends standard RADIUS Disconnect / CoA to the record's IP Address; the AR must accept dynamic authorization
Data capsTime limits only (Session-Timeout). Speed through Huawei attributes you add to the profile

Read Controller identity and Virtual NAS first. With NCE set up as below — NAS-Identifier = Device MAC — no Virtual NAS is needed: one record per AP covers everything.

Which entry to pick ​

Your equipmentVendor in KiwireRedirect URL ends in
iMaster NCE-Campus (Huawei cloud or on-premises NCE) managing cloud APsHuawei NCE/login/huawei-nce
On-premises wireless access controller (AC), e.g. AC6508, AC6805, AirEngine 9700Huawei WLC/login/huawei-wlc
Cloud-managed AR gateway as the authentication point. AR5700 / AR6700 on V600R024C00 or later onlyHuawei Cloud UGW/login/huawei-cloud-ugw
An AC set up with the older parameter names (user-ipaddress, AP-IP, AP-MAC)Huawei/login/huawei

"Huawei" (plain entry)

For a new AC, use Huawei WLC. The plain Huawei entry exists for ACs already set up with the older parameter names. It follows the Huawei WLC steps below with these differences in the URL template: guest IP as user-ipaddress, AP IP as AP-IP, the controller ID as AP-MAC (register that value as the Identity), and the AC's login address as login-url — without login-url the guest's login has nowhere to go. Check that all four arrive with Controller Test during setup.

Before you start ​

From Kiwire:

  • The RADIUS server address shown in the Setup Guide checklist (Before you add your controller › RADIUS Authentication & Accounting).
  • A <shared-secret> of 64 characters or fewer. Use the same one on every Huawei record in Kiwire, because all requests from one NCE, or from one site's internet connection, must share a secret. If your NCE is Huawei's public cloud, other Kiwire customers may relay through the same NCE addresses. Ask Synchroweb support which secret to use before you start.
  • Your <kiwire-host> (the host name of your portal).

From Huawei:

  • Admin access to iMaster NCE-Campus (tenant or MSP view), or CLI access to the AC.
  • The list of AP MAC addresses (NCE), or the AC's system name (AC).
  • For an AC: an address of the AC that guests can reach, and that Kiwire can reach for disconnects.

iMaster NCE-Campus (Huawei NCE) ​

The two NCE modes ​

NCE offers two ways to use an external portal. They differ in who talks RADIUS to Kiwire, and that decides how you set up Kiwire.

Relay mode (recommended)Third-party authentication mode
NCE setting (SSID › Page pushing mode)Relay authentication by cloud platform, Interconnection mode RADIUS relayThird-party authentication
Where Kiwire posts the guest's loginTo NCE, through the loginurl it sends (port 19008)To the AP's own login address
Who sends RADIUS to KiwireNCE itself, for all APsEach AP, from the site's public IP
Kiwire recordsOne per AP, Identity = the AP MAC. The same record matches the redirect (ap-mac) and RADIUS (NAS-Identifier = Device MAC). All share one secretOne per AP. All APs behind one site share one secret
Disconnect / live changesNot supported by Huawei in relay modeNot practical: the APs sit behind the site's NAT

Use relay mode. Kiwire's Huawei NCE type is built for it: it posts the login to NCE's loginurl. Third-party authentication mode is covered briefly at the end of this section.

How a guest logs in through Huawei NCE and Kiwire The guest joins the Wi-Fi and opens a page. The Huawei NCE device redirects the browser to Kiwire at /login/huawei-nce. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to loginurl (port 19008). The device then asks Kiwire over RADIUS, identifying itself with AP MAC (Device MAC). Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Guest devicephone, laptopHuawei NCEiMaster NCE-CampusKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/huawei-nce3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to loginurl (port 19008)5 RADIUS REQUEST — IDENTITY =AP MAC (Device MAC)6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS
In relay mode NCE, not the AP, sends the RADIUS request in step 5, and there is no step 8: Huawei does not accept disconnects in this mode. When the page loads but the login never completes, check step 4 (the loginurl parameter) and step 5 (the AP MAC format and the shared secret).

What NCE sends as NAS-Identifier, and what that means in Kiwire ​

In the RADIUS Relay Server template, NAS-Identifier has two choices:

  • Device MAC — use this. NCE sends the MAC of the AP the guest is on. Set the MAC format so it is identical to the ap-mac value in the redirect (same case and separators). Each AP's record then matches both lookups, and no Virtual NAS is needed.
  • Controller ID — don't use this with Kiwire. NCE would send the fixed text Huawei Agile Controller-Campus for every AP of every customer, and a Kiwire Identity is unique across the platform, so it can't be tied to your organisation.

On the controller (NCE, relay mode) ​

Menu names and commands vary between firmware versions; the values are what matter. The paths below are from iMaster NCE-Campus V300R024C00. Older releases put Template Management under Design › Basic Network Design or Plan › Design › Network Design.

  1. On-premises or MSP NCE only. Make sure the RADIUS relay and port 8445 services are enabled on the management plane (Huawei's settings ENABLE_RADIUS_PORT and ENABLE_8445). On Huawei's public cloud this is already done.

  2. ACL template (walled garden). Go to Network Configuration › Global Settings › Template Management › Network › ACL. Create an ACL that permits, before login:

    • <kiwire-host>
    • fonts.googleapis.com and fonts.gstatic.com
    • your DNS server
    • anything else your portal pages load (see Walled garden).

  3. URL template. Go to Template Management › Authentication › URL Template and create a template with type Cloud platform-relayed authentication. Set the parameters and their Parameter Name exactly as Kiwire expects:

    NCE parameterParameter Name to enter
    user-macuser-mac
    user-ipuser-ip
    redirect-urlredirect-url
    loginurlloginurl
    ssidssid
    the AP's MAC (device-mac)ap-mac
    • Leave URL parameter encryption off, because Kiwire cannot read encrypted parameters.
    • Choose one MAC format and keep it. Your Identities in Kiwire must be written in the same format.
    • Which parameter carries the AP's MAC can vary by NCE version. Confirm it in Controller Test (step "Test it").

  4. RADIUS Relay Server template. Go to Template Management › Authentication › RADIUS Relay Server:

    • Authentication server: <radius-server-ip>, port 1812, key <shared-secret>.
    • Accounting server: <radius-server-ip>, port 1813, key <shared-secret>.
    • Authentication protocol: PAP (or CHAP).
    • NAS-Identifier: Device MAC (see above), in the same MAC format as ap-mac.
    • Use the same MAC address format as the URL template.

  5. SSID. Go to the site's AP › Wi-Fi › SSID and create or edit the guest SSID:

    • Security: Open network, Open+Portal authentication.
    • Page pushing mode: Relay authentication by cloud platform. Interconnection mode: RADIUS relay. Page push protocol: HTTP.
    • Portal parameter names: username field username, password field password, success URL field dst. Huawei's own example uses successUrl, but Kiwire sends the success address as dst. Leave the logout field empty.
    • RADIUS relay server: the template from step 4.
    • Real-time accounting: on (for example every 15 minutes).
    • Default permit rule: the ACL from step 2.

  6. Portal Page Push Policy. Go to Policy › NAC › Admission Resources › Page Management › Portal Page Push Policy and add a policy:

    • Access mode: Wireless.
    • Match your guest SSID.
    • Authentication mode: Cloud platform-based relay authentication. Interconnection mode: RADIUS relay.
    • URL template: the template from step 3.
    • Third-party authentication URL: https://<kiwire-host>/login/huawei-nce

In Kiwire (NCE) ​

  1. Admin › System › Device Controller: add one record per AP:

    • Vendor: Huawei NCE
    • Identity: the AP's MAC, exactly as it appears in ap-mac (same case, same separators)
    • Shared Secret Key: <shared-secret>
    • IP Address: leave empty (NCE does not accept disconnects from Kiwire)

    For many APs, use the CSV import on the same page.

  2. Check the redirect parameters against The redirect and the login config. Huawei NCE expects user-mac, user-ip, redirect-url, loginurl, ap-mac, ssid.

  3. Portals › Captive Portal › Zones Mapping: add a zone and rules (for example on SSID or NAS ID = an AP MAC). Then pick its journey. See Controllers and zones and Portal designer.

Third-party authentication mode ​

In this mode each AP is its own RADIUS client and sends requests from the site's public IP.

  • NCE has no setting for the NAS-Identifier an AP sends, and the value can vary by firmware. Before rollout, ask Synchroweb support to check what NAS-Identifier arrives.
  • CoA/disconnect is not practical, because the APs sit behind the site's NAT.
  • The AP expects the portal to post the login to the AP itself.

Kiwire's Huawei NCE type can only work in this mode if the URL template names the AP login address loginurl. Relay mode is the recommended set-up. Contact Synchroweb before deploying NCE in this mode.

On-premises AC (Huawei WLC) ​

How a guest logs in through Huawei WLC and Kiwire The guest joins the Wi-Fi and opens a page. The Huawei WLC device redirects the browser to Kiwire at /login/huawei-wlc. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to login-url. The device then asks Kiwire over RADIUS, identifying itself with AC system name (nas-id). Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Later, Kiwire can disconnect the guest or change their limits with CoA on port 3799.Guest devicephone, laptopHuawei WLCon-premises ACKiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/huawei-wlc3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to login-url5 RADIUS REQUEST — IDENTITY =AC system name (nas-id)6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS8 LATER: DISCONNECT / CHANGE LIMITS (CoA, PORT 3799)
Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).

How the AC is identified ​

The AC has no built-in "NAS ID" redirect parameter. Kiwire's Huawei WLC type reads the controller ID from a redirect parameter named nas-id, so you add one to the AC's URL template that carries the AC's system name (sysname). Set the Identity in Kiwire to that system name.

The AC normally uses its system name as the RADIUS NAS-Identifier too, but this can vary by firmware. If the redirect works and logins still fail, ask Synchroweb support to check what NAS-Identifier arrives. If it differs, add a second record with that value (see Controller identity and Virtual NAS).

On the controller (AC CLI) ​

Menu names and commands vary between firmware versions; the values are what matter. The commands below are for V200R019 / V200R022 firmware in NAC unified mode. Much older firmware uses different syntax.

# 1. RADIUS server
radius-server template kiwire
 radius-server authentication <radius-server-ip> 1812
 radius-server accounting <radius-server-ip> 1813
 radius-server shared-key cipher <shared-secret>
 quit

# 2. Disconnect / live changes from Kiwire (off by default)
radius-server authorization server-source all-interface
radius-server authorization <kiwire-coa-source-ip> shared-key cipher <shared-secret>

# 3. AAA
aaa
 authentication-scheme kiwire
  authentication-mode radius
 accounting-scheme kiwire
  accounting-mode radius
  accounting realtime 15
 domain kiwire
  authentication-scheme kiwire
  accounting-scheme kiwire
  radius-server kiwire
 quit

# 4. HTTPS listener that receives the guest's login (default port 8443)
ssl policy kiwire type server
http secure-server ssl-policy kiwire
portal web-authen-server https ssl-policy kiwire port 8443

# 5. URL template: parameter names must match Kiwire's
url-template name kiwire
 url https://<kiwire-host>/login/huawei-wlc
 url-parameter user-mac user-mac user-ipaddress user-ip redirect-url redirect-url ap-ip ap-ip ssid ssid sysname nas-id login-url login-url https://<ac-ip>:8443
 quit

# 6. Portal server
web-auth-server kiwire
 protocol http password-encrypt none
 url-template kiwire
 http-method post
 quit

# 7. Walled garden
free-rule-template name default_free_rule
 free-rule 1 destination ip <kiwire-host-ip> mask 32
 free-rule 2 destination ip <dns-ip> mask 32 udp destination-port 53

# 8. Profiles, bound to the guest VAP
portal-access-profile name kiwire
 web-auth-server kiwire direct
authentication-profile name kiwire
 portal-access-profile kiwire
 free-rule-template default_free_rule
 access-domain kiwire force
wlan
 vap-profile name guest
  authentication-profile kiwire

Notes:

  • Step 2 (disconnect). <kiwire-coa-source-ip> is the address Kiwire's disconnect requests come from. It is not the RADIUS server address, and no admin page shows it, so ask Synchroweb support. Huawei's docs don't state the listening port for these requests. Kiwire sends to 3799 (the standard). Confirm that the AC listens there.
  • Step 5 (URL template). Each url-parameter pair is what the AC fills in followed by the name Kiwire reads. Keep the names exactly as shown: user-mac, user-ip, redirect-url, ap-ip, ssid, nas-id, login-url.
    • login-url must be an address of the AC that the guest's device can reach, because the guest's browser posts the login to it.
    • Guests will see a certificate warning unless the AC's certificate is trusted.
  • Step 6 (portal server). protocol http covers both HTTP and HTTPS; the default protocol is portal, which does not work with Kiwire.
    • Kiwire posts username, password and dst (the page the guest first asked for). Keep the AC's username and password keys at their defaults (username, password).
    • Some firmware also expects a cmd=login field. Test a real login before you leave site, and contact Synchroweb support if the AC rejects it.
  • Step 7 (walled garden). free-rule matches IP addresses, so <kiwire-host-ip> must be the address(es) <kiwire-host> resolves to. Add rules for any other hosts your portal loads (see Walled garden).
  • Step 8. Use layer3 instead of direct if guests are routed to the AC rather than on a directly connected VLAN.

In Kiwire (AC) ​

  1. Admin › System › Device Controller: add a record:
    • Vendor: Huawei WLC
    • Identity: the AC's system name, exactly as set with sysname
    • Shared Secret Key: <shared-secret>
    • IP Address: an address of the AC that Kiwire can reach (for disconnects)
    • COA Port: 3799
  2. Check the redirect parameters against The redirect and the login config. Huawei WLC expects user-mac, user-ip, redirect-url, ap-ip, login-url, nas-id, ssid.
  3. Portals › Captive Portal › Zones Mapping: add a zone and rules, then pick its journey. See Controllers and zones and Portal designer.

Cloud-managed AR gateway (Huawei Cloud UGW) ​

Use this entry when a cloud-managed AR router, not the APs, is the authentication point under NCE.

How a guest logs in through Huawei Cloud UGW and Kiwire The guest joins the Wi-Fi and opens a page. The Huawei Cloud UGW device redirects the browser to Kiwire at /login/huawei-cloud-ugw. Kiwire shows the portal and the guest signs in. Kiwire hands the login back to the device: POST to loginurl. The device then asks Kiwire over RADIUS, identifying itself with ap-mac value. Kiwire accepts and returns the profile's limits, the device lets the guest out and starts sending accounting. Guest devicephone, laptopHuawei Cloud UGWAR5700 / AR6700Kiwireportal + RADIUSInternetafter acceptance1 JOINS THE SSID, OPENS A PAGE2 REDIRECT TO/login/huawei-cloud-ugw3 PORTAL PAGE — THE GUEST SIGNS IN4 HAND-BACK:POST to loginurl5 RADIUS REQUEST — IDENTITY =ap-mac value6 ACCEPT + PROFILE LIMITS7 GUEST IS LET OUT; ACCOUNTING STARTS
This is how Kiwire handles the Huawei Cloud UGW type. What the AR sends as its RADIUS identity in step 5 can vary by firmware; before rollout, ask Synchroweb support to check what NAS-Identifier arrives.
  • Only the AR5700 and AR6700 running V600R024C00 or later support the HTTP/HTTPS portal that Kiwire needs. Other cloud ARs (AR600, AR6000–AR6300, AR100–AR3600) only speak Huawei's own portal protocol and cannot be used with Kiwire as the authentication point. Use NCE relay mode with the APs instead.
  • Configure it in NCE like the AP modes above:
    • a Portal Server template with protocol HTTP or HTTPS
    • a RADIUS Server template pointing at <radius-server-ip> 1812/1813 with <shared-secret>; on ARs, use the IP address type, not Domain
    • an ACL for the walled garden
    • a URL template whose Parameter Names are Kiwire's: user-mac, user-ip, redirect-url, loginurl, ap-mac, ssid
  • Redirect URL: https://<kiwire-host>/login/huawei-cloud-ugw. Kiwire posts username, password and dst to the loginurl address.
  • Huawei publishes no worked example for this setup, and the exact NCE screens and what the AR sends as NAS-Identifier vary by version. Contact Synchroweb before deploying one.

Test it ​

  1. Portals › Troubleshoot › Controller Test → Start Capture, then connect a phone to the guest SSID. Check that:

    • mac, ip, nasid (the controller ID) and login_url are filled in
    • the controller ID shows as registered to your organisation

    If nothing appears and the controller is not added yet, add the Test URL from that page to the controller's redirect for the test.

  2. Log in as a real guest and make sure you reach the internet. Kiwire accepts a new record straight away. If the device already tried to log guests in before you added its record, its RADIUS requests can keep failing for up to an hour. If logins still fail after that, re-check the Identity and secret.

  3. Reporting › Login › Active Session: the session should appear, and accounting should update at the interval you set.

Limits to know ​

  • Data caps are not sent to Huawei equipment. Kiwire sends Session-Timeout, Idle-Timeout and Acct-Interim-Interval. A profile's data quota is not passed to any Huawei type, so the controller won't cut a guest off at a volume limit. Rely on time limits.
  • Speed limits. Kiwire sends the standard WISPr bandwidth attributes from the profile. Huawei applies its own speed attributes; add them to the profile:
    • Go to Account › Profiles → custom RADIUS attributes → Add Row.
    • Type Huawei-Input-Average-Rate (upload) and Huawei-Output-Average-Rate (download), with values in bits per second.
    • Add them in the profile's Custom Attribute box, for example {"reply:Huawei-Input-Average-Rate": 2097152, "reply:Huawei-Output-Average-Rate": 10485760} for 2 Mbit/s up and 10 Mbit/s down.
    • NCE relay mode passes only these two Huawei speed attributes.
  • NCE relay mode has no disconnect. Disconnecting a guest or changing their profile in Kiwire will not reach the AP. The session ends at its Session-Timeout or Idle-Timeout.
  • Shared secret is shared. Every Huawei record that sends through one NCE, or one site's internet connection, must use the same Shared Secret Key.
  • One record per AP under NCE. Each record counts toward your licence.
  • Huawei ignores a Session-Timeout of 0 unless the device is configured otherwise, so give every profile a real validity.

Vendor reference ​

Last updated:

Kiwire platform documentation

Synchroweb