#wi-fi radius

[globalreachtechnology]

About the GlobalReach RADIUS API

GlobalReach offers a powerful application program interface (API) that can be used to integrate GlobalReach RADIUS authentication services with user and guest management systems.

The API framework allows your platform to interact with the network access control infrastructure provided by GlobalReach.

The GlobalReach API is a secure JavaScript object notation (JSON) web services API allowing you to create, delete and modify users, groups, guest users and virtual RADIUS servers. Additionally, you can get a list of all active sessions.

With the GlobalReach API, user management systems can dynamically update the RADIUS server to instantly create or delete users in the GlobalReach database. And you can also set or modify access rights.

When a user attempts to access the network, GlobalReach uses the updated credentials as the basis for permitting activities on the network.

A custom captive portal self-registration can be presented. When a user logs in, the application can make an API call to GlobalReach to add the user.

When a user attempts to access a Wi-Fi network, the access point can send a RADIUS request to the GlobalReach RADIUS. GlobalReach authenticates the user based on the updated credentials.

For technical assistance with your GlobalReach API project, or to talk about your Wi-Fi programs, get in contact at www.globalreachtech.com/contact

[globalreachtechnology]

How To Manage Wi-Fi Access in Captive Portal Hotspots & Shared Working Spaces

We are talking to more and more wireless service providers with customers in retail, hospitality, and shared working spaces. They recognize that providing Wi-Fi access is more than a simple customer amenity.

It’s a way to use the Wi-Fi network to build services that increase customer and brand loyalty, improve engagement, gain customer insight and upsell new services:

A retail store can offer in-store promotions and influence shoppers based on known preferences

Restaurants and coffee shops can deliver ″good-today-only″ coupons to on-site customers

Hotel chains can offer perks such as free Wi-Fi to loyalty program members

Shared working hubs can control access, meter and charge tenants for its Wi-Fi service

Building compelling Wi-Fi services that work both for the end user and for the site, have a number of requirements. The service provider or business owner must architect a solution that delivers:

Simple user interface – Customers must be able to easily access the portal and get internet access via a browser based login.

Ability to gather information – Network owners must be able to derive value from the service offering by capturing customer names or other desired information, or measure and record usage.

Content delivery mechanism - To deliver targeted ads, discount offers, and other information to influence customer behavior.

Seamless integration with a back-end data store - Whether a simple SQL database or a self registration or third-party guest management system.

Ability to deliver service level according to customer – Portal owners must be able to configure network connections to enforce service access policies, including session time limits or bandwidth throttling.

A robust, easy-to-implement captive portal based hotspot system comprises the following elements:

Access points with screen redirect / captive portal support. GlobalReach works with Meraki and Ruckus, for example.

Captive portal web server - Either built-in or external, which provides the portal interface, user sign-on, and content delivery mechanisms.

Back-end data store - Where the portal will authenticate users,. This might be a VIP or customer loyalty program database, a self-registration system or a guest management system like those used by large hotel chains.

Cloud-hosted RADIUS server - GlobalReach RADIUS can handles customer authentication, service level configuration, and usage tracking.

GlobalReach RADIUS

The RADIUS server is a key component of the Wi-Fi captive portal infrastructure. It provides a multi-layer authentication service to let portal merchants and owners control who gets onto the network and what they are able to do. It also provides comprehensive user and usage insight and data.

GlobalReach RADIUS offers the following benefits to businesses and venues offering captive portal-based Wi-Fi network access:

Cost-effective – As a hosted cloud-based service, GlobalReach RADIUS requires no physical footprint. It can reduce capital and operating expenses by eliminating server hardware and software costs, and administrative complexity. GlobalReach RADIUS’s usage-based pricing allows network owners to pay only for the services they need. (GlobalReach RADIUS can be run in a private cloud on a virtual machine. Refer to example 2 below.)

Capable of configuring customer service levels – GlobalReach RADIUS can authorize specific user network privileges such as session time limits or bandwidth restrictions, allowing network owners to offer the services that make sense for their business.

Compatible with a wide variety of back-end data stores – GlobalReach RADIUS can validate credentials against a wide array of user stores, including a native MySQL database, or external stores such as LDAP or SQL databases, Active Directory, or cloud-based user stores such as Google Apps. A powerful API is also available to automate the interaction with third party self-registration programs, VIP & Customer Loyalty Program databases, and user / guest management systems.

Support for Wi-Fi APs and captive portal functionality from leading vendors. GlobalReach RADIUS works with any RADIUS-compatible Wi-Fi AP, controller, or gateway supporting Universal Access Method (UAM) base screen redirect, including Cisco, Meraki, Ruckus, Aruba, Motorola and other leading Wi-Fi vendors.

Usable in public or private cloud – You can use GlobalReach RADIUS in the public cloud, where you can take advantage of a shared multi-tenant infrastructure. You get the cost savings and management simplicity of RADIUS-as-a-service, while critical user data stays under your control. Or, you can choose to deploy GlobalReach RADIUS on a virtual machine running in a private cloud, data center, or individual or regional locations.

Example 1: Cloud-based Wi-Fi Implementation

When a hotspot implementation is based entirely in the public cloud, a user — located, for example, in a retail store, hotel, or shared working space — gains Wi-Fi access via a browser-based login to a captive portal from a Wi-Fi network managed by a cloud controller platform.

When using a browser-based login to authenticate a user to a captive portal, the cloud controller platform sends the authentication request to GlobalReach RADIUS. This then authenticates the user against an existing user data store, or new credentials issued by a guest management or payments platform, stored in an LDAP or SQL database.

Once the user is authenticated, GlobalReach RADIUS returns authorization attributes to the Wi-Fi AP or controller to configure user specific network privileges such as session time limits, time of day or bandwidth restrictions, VLAN assignment, and other configurable gateway parameters.

GlobalReach RADIUS then records all authentication and accounting activity to log files, which can be aggregated with other network and user store information to create a comprehensive view of user and session data for customer analytic and billing purposes.

Example 2. Private Cloud: Captive Portal Browser Based Login via GlobalReach RADIUS Virtual Appliance

When the GlobalReach RADIUS and the Wi-Fi controller are located in a private cloud (for example at a private enterprise or carrier data center), the user might be a hotel, conference center, or shared working hub. They gain Wi-Fi access via a browser-based login to a captive portal on a Wi-Fi network managed by a Wi-Fi network controller on the local network.

When using a browser-based login to authenticate a user to a captive portal, the AP or the Wi-Fi network controller sends the authentication request to the GlobalReach RADIUS virtual appliance, which then authenticates the user against a supplementary user store, or new credentials issued by a guest management or payments platform, stored in an LDAP or SQL database.

Once authenticated, GlobalReach RADIUS authorizes specific user network privileges such as session time limits, time of day restrictions, VLAN assignment, and other configurable gateway parameters.

[globalreachtechnology]

GlobalReach RADIUS in Enterprise Wi-Fi Deployments

Our website analytics and inbound enquiries tell us that the role of RADIUS, and the options available, in enterprise Wi-Fi is a popular subject. Time, we thought, to document what a RADIUS server delivers to enterprise Wi-Fi.

Driven by mobile and BYOD, the scale, complexity and importance of enterprise Wi-Fi networks is increasing dramatically. A well-architected, multifaceted access security infrastructure is an essential element of every enterprise Wi-Fi deployment. This infrastructure typically must support the following functions:

Authentication, to ensure that only authorized users gain access to the network

User and device authorization, to configure the appropriate level of access and security for network clients

Security, to prevent attacks on user credentials and data

In addition, these new Wi-Fi requirements should ideally integrate into the network’s existing access management systems and architecture, to ensure administrative simplicity.

Authentication Requirements Enterprise scale Wi-Fi deployments demand an authentication infrastructure capable of handling requests from a large number of users, accessing the network from geographically-distributed locations, with different credentials, access rights, and security requirements, and via access gateways from a variety of vendors.

User & Device Authorization Requirements

In addition to a robust authentication infrastructure, enterprise Wi-Fi networks typically must support different access levels, according to who (or what) is connecting. Employees, guests, and even IP-enabled devices must be able to gain access to the network, but each necessarily has different security requirements and access rights.

Security Requirements

Best practices for Wi-Fi access to enterprise LAN applications mandate the use of WPA2 Enterprise and 802.1X-based security; in addition, WPA2 and 802.1X are considered essential for securing Wi-Fi access in healthcare (HIPAA), financial services (SOX), and other regulated environments. Captive portal with sign-on splash is often used to enable guest and customer access to networks.

GlobalReach RADIUS

With its ability to centrally manage user authentication, authorization, and accounting, a RADIUS server is an integral component of an enterprise Wi-Fi network. GlobalReach RADIUS is uniquely capable of handling the security and manageability requirements on these networks, for the following reasons:

It supports industry-standard Wi-Fi security, as well as lower-security guest access – GlobalReach RADIUS provides full support for the 802.1X security protocols that ensure authentication and session security, as well as captive portal solutions that permit customers or guests to access a restricted area of the network with less strong security requirements. 

It’s simple to administer – GlobalReach RADIUS is a multi-vendor RADIUS solution that supports your existing network access gateways. In addition, it authenticates Wi-Fi users against the user data stores already in place on your network, including active directory, LDAP, SQL or Google user stores – with no manual re-entry of data required.

It’s built on the market-proven FreeRADIUS code base – GlobalReach RADIUS is a time-tested RADIUS solution, based on code that is already deployed on thousands of servers around the world. 

It’s available as a public cloud service, or for installation on a virtual machine. Use or deploy GlobalReach RADIUS in the way that makes sense on your network: 

Use the hosted GlobalReach RADIUS service in the public cloud, where you can take advantage of a shared multi-tenant infrastructure. You enjoy the cost savings and management simplicity of RADIUS-as-a-service, while critical user data stays under your control.

Deploy GlobalReach RADIUS as a virtual appliance running on a distributed basis in a private cloud, enterprise data center, or individual or regional locations. For enterprises who wish to keep RADIUS completely on-site and control service availability, this provides a cost-effective, Wi-Fi-appropriate alternative to legacy RADIUS servers.

It’s not just for Wi-Fi – GlobalReach RADIUS is capable of authentication access requests not only from Wi-Fi access points and gateways, but also VPNs, firewalls, and other access gateways. Use it to manage and secure all access to your network. 

Contact us for more here.