Device Management

Device Controllers

Device Controllers are the network access points, switches, and NAS (Network Access Server) devices registered in Kiwire. Each device holds RADIUS credentials and communicates with the RADIUS server to enforce user authentication, apply bandwidth policies, and report accounting data.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/device/overview.png

The Device Controllers grid showing device name, IP address, type, zone, and status.

Key Fields

Field	Description
`name`	Human-readable display name for the device (e.g., Lobby AP-01)
`ip_address`	The NAS-IP-Address sent in RADIUS packets — must match the AP's actual IP as seen by the RADIUS server
`mac_address`	Optional MAC address identifier for the device; used for additional matching in some RADIUS policies
`secret`	RADIUS shared secret — masked in the UI; must exactly match the secret configured on the physical access point
`type`	Device vendor/type: `Mikrotik`, `Cisco`, `Ubiquiti`, `Ruckus`, `Generic`, etc. Determines which RADIUS attribute profile is applied
`zone_id`	The zone this device belongs to — determines which captive portal journey users see when connecting through this AP
`status`	`active` — device can authenticate users; `inactive` — device is registered but disabled
`description`	Free-text admin notes (location details, rack position, maintenance history, etc.)

Available Actions

Add Device

Click Add Device to open the configuration panel. Required fields: name, ip_address, secret, type, and zone_id. The IP address and shared secret must match what is configured on the physical hardware before authentication will succeed.

Edit Device

Click a device row to open the edit panel. All fields can be updated. If you change the shared secret, you must also update the RADIUS client configuration on the physical access point to match — a mismatch will cause all authentication requests from that AP to be silently rejected.

Delete Device

Removes the device from Kiwire. Once deleted, the physical AP will no longer be able to authenticate users — it will receive no response or an explicit rejection from the RADIUS server. Any active sessions through that AP will time out at their next accounting interval.

Deleting a device immediately prevents new authentications through that access point. Ensure users on that AP are notified or that the AP is taken offline before removing it from Kiwire.

Test Connection

The Test Connection action sends a test RADIUS Access-Request packet to verify end-to-end connectivity between Kiwire and the device. A successful response confirms that:

The IP address is reachable from the RADIUS server
The shared secret is correct on both sides
UDP ports 1812 (authentication) and 1813 (accounting) are not blocked by a firewall

Use the Diagnostic Account credentials when running this test from Monitoring › RADIUS Test.

RADIUS Configuration Notes

The RADIUS shared secret is case-sensitive and must be identical on both the Kiwire device record and the access point's RADIUS client configuration. A single character difference will cause all authentication attempts to fail with no error message to the end user.

The ip_address field corresponds to the NAS-IP-Address attribute in RADIUS packets. Use the management IP of the AP, not its wireless SSID IP.
The type selection controls which vendor-specific RADIUS attributes (VSAs) are sent back to the device — for example, Mikrotik uses Mikrotik-Rate-Limit for bandwidth control, while Cisco uses cisco-avpair.
If the AP sits behind NAT, the ip_address must be the post-NAT address as seen by the RADIUS server.

Zones and Captive Portals

Each device is assigned to exactly one Zone. When a user connects through an AP and is redirected to the captive portal, Kiwire uses the device's zone to determine which portal journey (login flow, branding, and profile assignment) to present. Multiple access points can share the same zone — for example, all APs across a conference floor can be grouped into a single "Conference" zone, all showing the same portal experience.

Group devices by logical location or service tier rather than by floor or room — zones link directly to portal journeys, so grouping by intended user experience gives the most flexibility.

Required Permissions

view-devices · create-devices · update-devices · delete-devices