[NEBULA] Fast roaming

Already solved the problem.

We do not use fast roaming, we need Web authentication. We send passwords to wifi via SMS, which are registered in mysql.

We use 15 access points, made the network open, users authenticate with zywall usg 310, the network works as we need. If we use the hotspot built into the access point, the device cannot authenticate at the access point to which the device has not previously connected. I understand that this works differently. But it would be nice if we could place hotspot on 1 access point and indicate to everyone else its url.

In the configuration used, we had to connect our Zywall to the radius server, which theoretically creates another dangerous point in information security.

I want us to be able to prohibit the assignment of administrative access rights through the radius in Zuwall usg 310, in fact, everything depends on the "Zyxel-User-Type" attribute and the entry in the mysql database or text file.

Use external (radius) server for admin access = no - The best decision.

This will allow we not to place high security requirements on the radius service and mysql service.

@RUnglaube

Access points work in the same l2 network, roaming works fine, but if you disconnect wifi and go to the access point on which the first entrance to the network was not performed, then the login and password to the network will be requested - captive portal.

We use web authentication, a button is built into the web page that redirects to the page for sending a password via SMS. This is necessary in order not to change the password manually and not give out passwords to employees, they do everything on their own. As login, use the phone number of the employee.

Technically, the model looks like this:

AP - network is open

Zywall USG 310 - Web authentication is enabled using freetime for guests, radius + sms for employees.

Radius - freeradius + mysql, with each request, new passwords are generated and entered into the table.

With this configuration, the access points do not authenticate the client, authentication is performed by Zywall, this allows you to create a network with a single entry point in which authentication is required only 1 time.

When using web authentication built-in AP:

there are 2 points, the client connected to the first, entered the login and password, connected to the network, switching between the points works fine, but if the client turns off wifi and goes to the second point and turns on wifi, then the point does not authenticate the device, it will open the authentication page.

I have not tried using the nebula service to authenticate users, as this will not allow sending SMS with a password.

Hi Nebula_Bayardo

Frimware

V5.50(ABHD.2)