Backend network-planning

Altai Super WiFi

1

Not for Distribution – Altai ConfidentialNot for Distribution – Altai Confidential

Altai Super WiFi

Altai Certification Training

Backend Network Planning

Professional ServicesAltai Technologies Limited

Altai Super WiFi

2

Not for Distribution – Altai ConfidentialNot for Distribution – Altai Confidential

Altai Super WiFi

Module Outline

• Service Controller Solution– Layer 2 Network Deployment Scenario– Layer 3 Network Deployment Scenario

• A3 ACS Solution

Altai Super WiFi

Not for Distribution – Altai Confidential

Altai Super WiFi

www.altaitechnologies.com

3

Service Controller Solution

• RADIUS or Active Directory in the existing network as authentication server

• Multiple SSID for different groups of client to access; e.g. staff and guest

• Each group of client is only allowed to access specific network subnets

• Different authentication method can be applied to different SSID

Altai Super WiFi


Altai Super WiFi


4

Layer 2 Network Deployment Scenario

• Deployment scenario: Enterprise only one or several buildings network based on layer 2 connection.

• Solution 1: SC internet port behavior as network backhaul, and LAN port connect to AP.

• Solution 2: one of SC ports behavior as network backhaul.

Altai Super WiFi


Altai Super WiFi


5

Layer 2 Network Design

• Intranet for staff• Ingress VLAN 1• Egress VLAN 10• Client IP subnet

192.168.1.x• AD or RADIUS

Authentication• Allowed access

intranet and internet

• Internet for guest• Ingress VLAN 2• Egress VLAN 10• Client IP subnet

192.168.2.x• SC Local account• HTML-Authentication

Altai Super WiFi


Altai Super WiFi


6

Layer 2 Network Solution I

InternetRadius Server

Active Directory

Service Controller

Internet Port: VLAN 10 & 20

LAN Port: VLAN 1 & 2

Router

SSID_Intranet

192.168.1.x

VLAN 1

VLAN Switch

VLAN 1, 2, 100

SSID_Internet

192.168.2.x

VLAN 2

Management SSID

192.168.100.x

VLAN 100

Trunk Port

Altai AP

VLAN 1

VLAN 2

VLAN 100

Trunk Port Trunk Port

FirewallDHCP server

Intranet

VLAN 20

VLAN 10

Management Server

VLAN 100

Altai Super WiFi


Altai Super WiFi


7

Layer 2 Network Solution II


Active Directory

Router

SSID_Intranet

192.168.1.x

VLAN 1

VLAN Switch

Network: VLAN 10,20

SC Port: VLAN 1, 2, 10, 20, 100

AP Port: VLAN 1,2, 100

SSID_Internet

192.168.2.x

VLAN 2

Management SSID

192.168.100.x

VLAN 100

Trunk Port

Altai AP

VLAN 1

VLAN 2

VLAN 100


FirewallDHCP server

Intranet

VLAN 20

VLAN 10

Egress: VLAN 10 & 20

Ingress: VLAN 1 & 2Service Controller

Management Server

VLAN 100

Altai Super WiFi


Altai Super WiFi


8

Layer 2 Active Directory authentication Procedure

UserUser associate with

wireless network

EAPOL start

EAP Response/identity

EAP response

DHCP request

AP

EAP Request/identity

Redirect the request to Service Controller

EAP request

EAP success

Service Controller

EAP Response/IdentityOver AD

EAP Response over AD

AD Server

EAP request over AD

EAP success over ADand user configuration

DHCP server

Response DHCP request Send IP address back

Altai Super WiFi


Altai Super WiFi


9

Layer 2 HTML authentication Procedure


wireless network

Send DHCP request

User attempts to browse an Web site

User Login

Transport page sends request for session and welcome page

AP

Redirect the request to DHCP server


Service Controller

Request is intercepted

Login page is returned

User login info is sent for authentication

Transport page is sent

Session and Welcome pages are sent

Local account

Login approved.User configuration setting are returned

DHCP server


Altai Super WiFi


Altai Super WiFi


10

Layer 3 Network Deployment Scenario

• Deployment scenario: University & enterprise multiple buildings network based on layer 3 connection.

• Solution 1: Two buildings connect to each other based on layer 3 connection (Traffic forwarding based on IP address). Since SC establish communication with AP only by VLAN, each SC should be deployment for every building in such case.

• Solution 2: Two building connect to each other based on tunnel which support VLAN function. In this case, only one Service Controller is needed for the entire network.

Altai Super WiFi


Altai Super WiFi


11

Layer 3 Network Design Solution_I

Building 1• Intranet for staff• Ingress VLAN 1• Egress VLAN 10• Client IP subnet


Authentication• Allowed access intranet

and internet• Internet for guest• Ingress VLAN 2• Egress VLAN 10• Client IP subnet


Building 2• Intranet for staff• Ingress VLAN 3• Egress VLAN 10• Client IP subnet



and internet• Internet for guest• Ingress VLAN 4• Egress VLAN 10• Client IP subnet


Altai Super WiFi


Altai Super WiFi


12

Layer 3 Network Solution_I


Active Directory

Router

SSID_Intranet

192.168.1.x

VLAN 1

VLAN Switch

Network: VLAN 10,20

SC Port: VLAN 1, 2, 10, 20

AP Port: VLAN 1,2

SSID_Internet

192.168.2.x

VLAN 2

Trunk PortTrunk Port

FirewallDHCP server

Intranet

VLAN 20 & 40

VLAN 10 & 30

Service Controller


Ingress: VLAN 1 & 2

SSID_Intranet

192.168.3.x

VLAN 3

VLAN Switch

Network: VLAN 30,40

SC Port: VLAN 3, 4, 30, 40

AP Port: VLAN 3,4

SSID_Internet

192.168.4.x

VLAN 4


Service Controller


Ingress: VLAN 3 & 4

Altai AP

VLAN 1

VLAN 2Altai AP

VLAN 3

VLAN 4

Altai Super WiFi


Altai Super WiFi


13

Layer 3 Solution I Authentication Procedure


wireless network

EAPOL start


EAP response

DHCP request

AP



EAP request

EAP success

Service ControllerIn Builing 1



AD Server

EAP request over AD


DHCP server


Building 1 for example

Altai Super WiFi


Altai Super WiFi


14

Case study: ASTRI Deployment

InternetActive Directory

Router

SSID_Intranet

192.168.0.x

VLAN 1

AD authentication

VLAN Switch

Network: VLAN 10,20

SC Port: VLAN 1, 2, 10, 20

AP Port: VLAN 1,2

SSID_Internet

192.168.0.x

VLAN 2

HTML authentication

Trunk Port

Altai AP

VLAN 1

VLAN 2


FirewallIntranet

VLAN 20

VLAN 10


Ingress: VLAN 1 & 2Service Controller

DHCP server:192.168.0.x

Altai Super WiFi


Altai Super WiFi


15

Wireless Network

SSIDTarget Clients VLAN Authentication Encryption

Intranet Staff 1 Active Directory WPA/WPA2

Internet Guest 2 Captive Portal WPA-PSK

Altai Super WiFi


Altai Super WiFi


16

VLAN Network

SSID VLAN_IngressClient IP Address VLAN_Egress

Colubris Interface IP address

Intranet 1 192.168.0.x 10 10.6.11.2

Internet 2 192.168.0.x 20 10.6.12.2

Altai Super WiFi


Altai Super WiFi


17

Network configuration_ingress vlan

Altai Super WiFi


Altai Super WiFi


18

Network configuration_egress vlan

Altai Super WiFi


Altai Super WiFi


19

Network ports

Altai Super WiFi


Altai Super WiFi


20

DHCP server_1

Altai Super WiFi


Altai Super WiFi


21

DHCP server _2

Altai Super WiFi


Altai Super WiFi


22

DNS

Altai Super WiFi


Altai Super WiFi


23

Check IP routers

Altai Super WiFi


Altai Super WiFi


24

Join Active Directory

Altai Super WiFi


Altai Super WiFi


25

AD group configuration

Altai Super WiFi


Altai Super WiFi


26

Add RADIUS secret

Altai Super WiFi


Altai Super WiFi


27

Account Profiles_1

Altai Super WiFi


Altai Super WiFi


28

Account Profile_2

Altai Super WiFi


Altai Super WiFi


29

User account_1

Altai Super WiFi


Altai Super WiFi


30

User account _2

Altai Super WiFi


Altai Super WiFi


31

Access List

Altai Super WiFi


Altai Super WiFi


32

VSC AD authenticaton_1

Altai Super WiFi


Altai Super WiFi


33

VSC AD Authentication_2

Altai Super WiFi


Altai Super WiFi


34

VSC AD Authentication_3

Altai Super WiFi


Altai Super WiFi


35

VSC HTML Authentication_1

Altai Super WiFi


Altai Super WiFi


36

VSC HTML Authentication_2

Altai Super WiFi


Altai Super WiFi


37

Layer 3 Network Design Solution_II

• Intranet for staff• Ingress VLAN 1• Egress VLAN 10• Client IP subnet



and internet

• Internet for guest• Ingress VLAN 2• Egress VLAN 10• Client IP subnet


Altai Super WiFi


Altai Super WiFi


38

Layer 3 Network Solution_II


Active Directory

Router

SSID_Intranet

192.168.1.x

VLAN 1

VLAN Switch

Network: VLAN 10,20

SC Port: VLAN 1, 2, 10, 20

AP Port: VLAN 1,2,

SSID_Internet

192.168.2.x

VLAN 2


FirewallDHCP server

Intranet

VLAN 20 & 40

VLAN 10 & 30

Service Controller


Ingress: VLAN 1 & 2

SSID_Intranet

192.168.1.x

VLAN 1

SSID_Internet

192.168.2.x

VLAN 2


Altai AP

VLAN 1

VLAN 2

Multiple Layer3 tunnel

Altai AP

VLAN 1

VLAN 2

Altai Super WiFi


Altai Super WiFi


39

Mu

ltiple Layer3 T

unnel

Layer 3 Solution II Authentication Procedure


wireless network

EAPOL start


EAP response

DHCP request

AP



EAP request

EAP success

Service Controller



AD Server

EAP request over AD


DHCP server


Building 1 for example

Altai Super WiFi


Altai Super WiFi


40

Case Study: Operator Network Deployment Solution

IP Backbone

Metro Ethernet Network

BASDSLAM

ADSL

AAAStandard DSL Modem/Router Internet

AP (Switch Mode)

Controller

¿Tunnel between AP and Controller?IP Service with PPPoE (Internet or MPLS VPN)

WiFi

Eth

GE

Wireless Backhaul

Eth

Tunneling Router

Tunneling Router

Múltiple Access Point

TUNNEL

Altai Super WiFi


Altai Super WiFi


41

Altai A3 ACS Solution

• Deployment scenario: Hotzone whole network solution could be in one box.

• RADIUS or MAC in the existing network is authentication server, do not need to integrate with Active Director server

• Can use 3G as backhaul• Roaming across A3s is not supported• Local database is supported• Multiple SSID for different groups of client to access, like staff and

guest• Each group of client is only allowed to access specific network subnets• Different authentication method can be applied to different SSID

Altai Super WiFi


Altai Super WiFi


42

ACS Network Design Solution

• Intranet for staff• Intranet ACS Profile• Client IP subnet

192.168.0.x• RADIUS authentication• HTML-authentication• Allowed access intranet

and internet

• Internet for guest• Internet ACS Profile• Client IP subnet

192.168.0.x• MAC authentication• Allowed access internet

only

Altai Super WiFi


Altai Super WiFi


43

Altai A3 Access Control System


A3_Gateway Mode

ACS Profile

Router

SSID_Intranet

Intranet ACS Profile SSID_Internet

Internet ACS Profile

FirewallDHCP server

Web Server

Switch

Altai Super WiFi


Altai Super WiFi


44

ACS User Login Procedure

Altai Super WiFi


Altai Super WiFi


45

Case Study: Hotspot Operator ACS Profile Configuration

Radius Server

A3_Gateway Mode

10.6.127.200

DHCP server:192.168.0.1

SSID_HTMLAuth SSID_MACAuthrnet

3G network

Web Server

Hotspot Operator Noc

3G backhaul

Altai Super WiFi


Altai Super WiFi


46

Hotspot Operator Network Illustration

• 3G dongle as network backhaul• A3 build-in DHCP server enabled• Remote RADIUS server is for internal clients

authentication and accounting• Remote Web server is for RADIUS server authentication.• Access controlled list establish to define network access

difference for multiple kinds of clients• Local account is for MAC authentication to clients who

could only access internet

Altai Super WiFi


Altai Super WiFi


47

ACS Profile

Altai Super WiFi


Altai Super WiFi


48

Local Account

Altai Super WiFi


Altai Super WiFi


49

RADIUS Server

Altai Super WiFi


Altai Super WiFi


50

Access Rules 1

Altai Super WiFi


Altai Super WiFi


51

Access Rules 2

Altai Super WiFi


Altai Super WiFi


52

Access Rules Profile

Altai Super WiFi


Altai Super WiFi


53

HTMLAuth Profile

Altai Super WiFi


Altai Super WiFi


54

MACAuth Profile

Altai Super WiFi


Altai Super WiFi


55

Export ACS profile

Altai Super WiFi


Altai Super WiFi


56

Thank You