Basic settings

Prerequisites

Before configuring INC Cloud authentication, complete the following tasks:

• Connect the device to INC Cloud. For more information, see the Intelbras INC Cloud Deployment Guide.
• Complete VLAN and DHCP settings.
• Configure Wireless services and ensure that the APs can go online.

Configure settings on the device

Restrictions and guidelines

Only software version 5405 or higher supports deploying authentication settings automatically. For other software versions, manually configure the following settings on the device.

For fast deployment of the following authentication methods, see Appendix A Authentication commands for the device.

• One-key authentication.
• Fixed account authentication.
• Facebook authentication.
• Dumb terminal authentication.

Configure general settings

1. Configure a portal authentication domain.

# Add an ISP domain named cloud and enter its view.

<Sysname> System-View 
                        [Sysname] domain cloud

# Specify the authentication, authorization and accounting methods as none.

[Sysname-isp-cloud] authentication portal none 
                        [Sysname-isp-cloud] authorization portal none 
                        [Sysname-isp-cloud] accounting portal none 
                        [Sysname-isp-cloud] quit

2. Configure cloud portal authentication.

# Add a portal Web server named cloud and specify its URL and type. (If the administrator configures the wireless service in INC Cloud, the configuration will be deployed to the device automatically.)

[portal web-server cloud
                        [Sysname-portal-websvr-cloud] url  http://inccloud-captive.intelbras.com.br/portal/protocol 
                        [Sysname- portal-websvr-cloud] server-type oauth

# Configure a match rule to redirect HTTP requests that carry the user agent string CaptiveNetworkSupport to the URL http://inccloud-captive.intelbras.com.br/generate_404.

[Sysname-portal-websvr-cloud] if-match user-agent CaptiveNetworkSupport redirect-url http://oasisauth.intelbras.com/generate_404

# Configure a match rule to redirect HTTP requests that carry the user agent string Dalvik/2.1.0(Linux;U;Android7.0;HUAWEI to the URL http://inccloud-captive.intelbras.com.br/generate_404.

[Sysname-portal-websvr-cloud] if-match user-agent Dalvik/2.1.0(Linux;U;Android7.0;HUAWEI redirect-url  http://inccloud-captive.intelbras.com.br/generate_404

# Configure a temporary pass rule to allow user packets that contain user agent information Mozilla to pass and then redirect the packets destined for the URL http://captive.apple.com to URL http://inccloud-captive.intelbras.com.br/portal/protocol.

[Sysname-portal-websvr-cloud] if-match original-url http://captive.apple.com user-agent Mo- zilla temp-pass redirect-url  http://inccloud-captive.intelbras.com.br/portal/protocol

# Configure a temporary pass rule to allow user packets that contain user agent information Mozilla to pass and then redirect the packets destined for the URL http://www.apple.com to URL http://inccloud-captive.intelbras.com.br/portal/protocol.

[Sysname-portal-websvr-cloud] if-match original-url http://www.apple.com user-agent Mozilla temp-pass redirect-url  http://inccloud-captive.intelbras.com.br/portal/protocol
                        [Sysname-portal-websvr-cloud] quit

# Configure a temporary pass rule to temporarily allow user packets that access URL http://10.168.168.168 to pass.

[portal web-server cloud
                        [Sysname-portal-websvr-cloud] if-match original-url http://10.168.168.168 temp-pass

# Enable the optimized captive-bypass feature for iOS users.

[Sysname-portal-websvr-cloud] captive-bypass ios optimize enable 
                        [Sysname-portal-websvr-cloud] quit

# Enable direct portal authentication on service template Cloud.

[Sysname] wlan service-template Cloud
                        [Sysname-wlan-st-cloud] portal enable method direct

# Configure the authentication domain as cloud and specify portal Web server cloud as the portal Web server for portal authentication.

[Sysname-wlan-st-cloud] portal domain cloud 
                        [Sysname- wlan-st-cloud] portal apply web-server cloud 
                        [Sysname- wlan-st-cloud] quit

# Enable portal temporary pass and set the temporary pass period to 20 seconds.

[Sysname] wlan service-template Cloud
                        [Sysname-wlan-st-cloud] portal temp-pass period 20 enable 
                        [Sysname-wlan-st-cloud] quit

# Add an HTTP-based local portal Web service and enter its view.

[Sysname] portal local-web-server http 
                        [Sysname-portal-local-websvr-http] quit

# Add an HTTPS-based local portal Web service and enter its view.

[Sysname] portal local-web-server https 
                        [Sysname] portal-local-websvr-https] quit

# Enable the HTTP and HTTPS services.

[Sysname] ip http enable 
                        [Sysname] ip https enable

# Enable validity check on wireless portal clients.

[Sysname] portal host-check enable

# Enable logging for portal user logins and logouts.

[Sysname] portal user log enable

# Configure destination-based portal-free rule 1 to allow portal users to access the DNS service without authentication. (This example uses rule 114.114.114.114 255.255.255.255.)

[Sysname] portal free-rule 1 destination ip 114.114.114.114 255.255.255.255

# Configure destination-based portal-free rules 2 and 4 to allow portal users to access the DNS service without authentication.

[Sysname] portal free-rule 2 destination ip any udp 53 
                        [Sysname] portal free-rule 3 destination ip any tcp 53 
                        [Sysname] portal free-rule 4 destination ip any tcp 5223

# Configure destination-based portal-free rule 5 to allow portal users to access the INC Cloud authentication server without authentication.

[Sysname] portal free-rule 5 destination oasisauth.intelbras.com

# Configure destination-based portal-free rules 10 to 22 to allow portal users to access the INC Cloud authentication server without authentication.

[Sysname] portal free-rule 10 destination short.weixin.qq.com 
                        [Sysname] portal free-rule 11 destination mp.weixin.qq.com 
                        [Sysname] portal free-rule 12 destination long.weixin.qq.com 
                        [Sysname] portal free-rule 13 destination dns.weixin.qq.com 
                        [Sysname] portal free-rule 14 destination minorshort.weixin.qq.com 
                        [Sysname] portal free-rule 15 destination extshort.weixin.qq.com 
                        [Sysname] portal free-rule 16 destination szshort.weixin.qq.com 
                        [Sysname] portal free-rule 17 destination szlong.weixin.qq.com 
                        [Sysname] portal free-rule 18 destination szextshort.weixin.qq.com 
                        [Sysname] portal free-rule 19 destination isdspeed.qq.com 
                        [Sysname] portal free-rule 20 destination wx.qlogo.cn
                        [Sysname] portal free-rule 21 destination wifi.weixin.qq.com 
                        [Sysname] portal free-rule 22 destination open.weixin.qq.com

# Enable portal safe-redirect.

[Sysname] portal safe-redirect enable

# Specify HTTP request methods permitted by portal safe-redirect.

[Sysname] portal safe-redirect method get post

# Specify browser types permitted by portal safe-redirect.

[Sysname] portal safe-redirect user-agent Android 
                        [Sysname] portal safe-redirect user-agent CFNetwork
                        [Sysname] portal safe-redirect user-agent CaptiveNetworkSupport 
                        [Sysname] portal safe-redirect user-agent MicroMessenger 
                        [Sysname] portal safe-redirect user-agent Mozilla
                        [Sysname] portal safe-redirect user-agent iPhone 
                        [Sysname] portal safe-redirect user-agent micromessenger

Direct Creation and Linking on SSID

The steps to link the authentication portal to your SSID are the same, regardless of the chosen authentication method (Fixed Account, Voucher, One-Key, etc.).

It is also possible to configure and link the authentication template directly in the SSID profile, without having to access the "Service" menu first. Follow the steps below:

1. Navigate to Network > Cloud APs > WLAN Settings > Wi-Fi Settings.
2. Click Add to create a new SSID or the Edit icon to modify an existing one.


Add SSID

3. In the SSID configuration window, locate the Advanced settings section and enable the Authentication field (select On).
4. In the Portal type field, select Cloud-integrated authentication.


Portal type

5. Click OK. A confirmation message will be displayed asking if you want to continue configuring the Authentication template.
6. Click Authentication template to go directly to the template drawing screen, where you can perform the same configuration steps described earlier.


Authentication template

Next step: After accessing the template creation and drawing screen, the configuration and visual customization of the page depend on the chosen authentication method (such as One-Key, Voucher, SMS, Facebook, etc.). Go to the Captive portal design section to see the detailed step-by-step on how to configure and draw the capture page according to your needs.

Tip: If you closed the confirmation window without clicking Authentication template, you can access the drawing screen at any time. To do this, go back to Wi-Fi Settings, locate the SSID and click the Draw icon in the Actions column.

Linking the Captive Portal to SSIDs via Service menu

The steps to create and link the authentication portal template via the Service menu are described below.

1. Creation of the Authentication Template via Service menu

Before linking the authentication portal to the SSID, it is necessary to create and design the template in the centralized INC Cloud panel:

1. On the top header, select the menu Service > Authentication.
   
2. Click Add to start creating the portal.
3. Choose one of the available design templates and click Select (templates are fully editable).
   
4. Enter an identification name for your template and click Apply.
   
5. Click OK to confirm and open the Captive Portal editor screen.
   

With the graphic editor open, configure the specific parameters described in the corresponding section under Captive portal design. Once you have saved and released the designed template, proceed with the linking steps below.

2. Linking the Template to SSIDs

Follow the step-by-step guide below to propagate the created portal template to multiple SSIDs and sites:

1. Return to the Service > Authentication screen.
2. On the created template, click the Issue Template button at the end of the registry row.
   
3. Select the Cloud AP option, choose the Site, and click Apply.
   
4. Select the registered SSID code and confirm the change.
   

   Note: To find out which SSID code to link, go to Network > Settings > Cloud APs > WLAN Settings > Wi-Fi Settings and check the number registered in the Num column.

5. Confirm the linking by accessing the SSID settings and checking if the Cloud-integrated authentication option is checked with the name of the created portal.
   

Configure One-Key authentication

One-Key authentication allows users to access the Wi-Fi network with just one click, without the need to fill out forms or enter credentials. It is the fastest and simplest solution for free access networks.

Drawing and Parameter Settings

1. In the Captive Portal editor, click the One-Key box in the Auth Configuration area.
2. Enable the one-key authentication and confirm it. Configure other session settings as needed.
3. Click OK or Release in the upper right corner of the page to save the template.

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Fixed Account authentication

Fixed Account authentication requires the user to enter a predefined username and password to gain network access. It is ideal for secure connections for employees or recurring users.

Fixed Account authentication allows network access via a username and password. The way these accounts are created depends on how the administrator configures the portal.

Restrictions and guidelines

• If you do not configure the validity period or configure it as 0, the account never expires.
• If you select Bind MAC Address and do not enter any MAC addresses, clients that use the fixed MAC address might be excluded.
• The account is not limited.
• If you select Sent by Email, the system sends the account name and password to the specified email address. The number of email addresses cannot exceed 10 and must be separated by commas.

1. Drawing and Parameter Settings

1. In the Captive Portal editor, in the Auth Method row, select the Account option and enable the configuration.
   
2. In Advanced Settings, configure the session and idle time settings as needed.
   
3. After configuring these settings, click OK to save the template.

2. Fixed Account Generation for Authentication

1. On the top navigation bar, select Settings > Cloud APs > Users.
2. Select a branch and a site at the top of the page.
3. Click the Portal Users tab and then click the Fixed Accounts tab.
4. Click Add.
5. Configure fixed account information as required and click OK.
   

Self-Registration

By default, fixed account access management is handled by the network administrator, who is responsible for creating credentials (username and password) in the system and delivering them to users. With this option enabled, users can register themselves on the network without administrator intervention. When self-registration is enabled, the Required Registration Info options appear. Select the information you want users to provide when registering on the network.

Custom field: When you select this option, you can create a free-form field to request additional information during registration, such as a tax ID or employee number.

The Custom field is available exclusively when editing the template linked to the SSID. To access it, navigate to: Network > Cloud APs > WLAN Settings > Wi-Fi Settings.

If the SSID already exists and authentication is enabled, click the Draw icon (color palette) in the corresponding Actions column to open the authentication template.

Otherwise, click Add to create a new SSID, go to Advanced settings > Authentication: Enabled > Portal type: Cloud-integrated authentication, and upon saving click to configure the Authentication template.

On the template editing screen, the Custom field will be available in the Required Registration Info options of the template linked to that SSID.

Important: If you create the template using the Service > Authentication method and link it to the SSID later (as described in Linking Template via Service menu), the Custom field will not be available in the registration info menu. The Custom field can only be enabled and configured if the template is created directly in the SSID profile, using the Direct Creation and Linking on SSID method.

Data entered in this field is not validated by the system. The portal only requires that the field not be left blank, but does not verify the authenticity or format of the information. For example, if the field is intended to capture a tax ID, the user will be able to complete registration even if they type letters or an invalid number sequence.

Next Step: Linking to the SSID

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Google authentication

Google authentication allows visitors to connect to the Wi-Fi network using their Google account credentials. To enable this integration, it is necessary to previously create an OAuth project in the Google Developer Console.

Creating a Google app

1. Log in to the Google Cloud Platform at https://console.cloud.google.com/apis.

2. Click CREATE PROJECT to create a project.

Project creation

3. Set the basic project settings and click Create.

Basic settings of the project

4. Configure the OAuth consent screen settings.

Entering the OAuth consent screen

• Select External as the user type on the audience screen.

Selecting a user type

• Edit app registration settings. Go to the branding tab.

Editing app registration settings

• Configure scopes. You only need to select userinfo.profile.

Updating scopes

• Configure test users. Click Add Users to add test users. Only test users can log in to a Google app in the Testing state.

Adding test users

• Create credentials. Click CREATE CREDENTIALS and then click OAuth client ID.

• Select Web application as the application type.

Selecting an application type

• Add authorized JavaScript origins and authorized redirect URLs. The authorized redirect URI is https://oasiscloudportal.intelbras.com/portal/googleCallback.html. The specified JavaScript origins must start with https.

Authorized JavaScript origins and authorized redirect URIs

5. Once the credential is created, click Credentials in the left navigation panel. In the list that opens, click Edit OAuth client in the Actions column of the OAuth 2.0 Client IDs row. On the page that opens, you can view the client ID and client secret.

Client information

Drawing and Parameter Settings

1. In the Captive Portal editor, click the Google box in the Auth Configuration area and enable Google authentication.
2. Enter the client ID and client secret, and configure other settings as needed.
3. Click OK and then click Release in the upper right corner of the page to save.

Google authentication can be used in combination with:

• Fixed Account authentication.
• Member authentication.
• Facebook authentication.
• Twitter authentication.

You can use up to three authentication methods simultaneously.

Google authentication

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Twitter authentication

Twitter authentication allows users to authenticate to the network using their Twitter credentials. This method requires previously creating an app on the Twitter Developer Platform.

Creating a Twitter app

• Log in to the Twitter Developer Platform at https://developer.twitter.com.

Home page

• Register for a developer account and accept terms. The API account is created by default. Then change the following settings.

Dashboard with created account

• Record the API key and API key secret. They will be used later.

Passwords

• Configure app settings. Click App settings in the Apps area.

• Click Set up in the User authentication settings area.

User authentication settings

• Enable OAuth 1.0a.

OAuth 1.0a enablement

• Specify a redirect URL and a website URL.
• Redirect URL: https://oasiscloudportal/portal/twitterCallback.html.
• Website URL: enter a URL in domain name format.

Redirect URL and website URL

Drawing and Parameter Settings

1. In the Captive Portal editor, click the Twitter box in the Auth Configuration area and enable Twitter authentication.
2. Enter the app ID and app secret of the Twitter app created previously. Configure other options as needed and save the template.
   

Twitter authentication can be used in combination with:

• Fixed Account authentication.
• Member authentication.
• Facebook authentication.
• Google authentication.

You can use up to three authentication methods simultaneously.

Twitter authentication

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Voucher authentication

Voucher authentication allows users to connect to the Internet using a temporary access code generated by the system. It is ideal for controlling session durations in hotels, cafes, and events.

1. Drawing and Parameter Settings

1. In the Captive Portal editor, in the Auth Method row, select the Voucher option and enable the configuration.
   
2. In Advanced Settings, configure the time limit options according to your plan:
   • Session Timeout: Duration of the session (in minutes). It cannot exceed the daily limit.
   • Daily Online Duration: Daily connection limit for a client (maximum of 1440 minutes / 24h).
   • Idle Timer: Idle time. The client is disconnected after this period of inactivity (in minutes).
   
3. After configuring these settings, click OK to save the template.
   

2. Voucher Generation for Authentication

1. On the top navigation bar, select Settings > Cloud APs > Users.
2. Select a branch and a site at the top of the page.
3. Access the Voucher tab, click User group, and click Add. Enter the group name and the voucher validity duration. When finished, click OK to save.
   
   
4. Access the Voucher tab to generate the codes. Click Add, set the quantity, select the group configured in the previous step, the voucher type, and the character length. Click OK to save. The codes will be visible in the Voucher column.
   
   

Next Step: Linking to the SSID

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Hotel authentication

Hotel authentication integrates the login portal with hotel check-in databases, requiring guests to enter details like room number and last name to unlock Internet access.

1. Hotel ID Creation

1. On the top navigation bar, click the Service menu.
2. Select Authentication > Accounts > Hotel ID to add a hotel.
3. To add a hotel, click Add in the Hotel ID tab.

2. Drawing and Parameter Settings

1. In the Captive Portal editor, click the Hotel box in the Auth Configuration area and enable Hotel authentication.
2. Select the Hotel ID created previously. Configure other control options as needed.
3. Click OK and click Release in the upper right corner of the page to save.

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Email authentication

Email authentication requires users to provide a valid email address to receive a one-time access passcode. This method is ideal for validating visitors' contact information.

Drawing and Parameter Settings

1. In the Captive Portal editor, click the Email box in the Auth Configuration area and enable Email authentication.
2. Confirm the Email authentication, setting the additional session parameters according to your preferences.
3. Click OK and click Release in the upper right corner of the page to save.

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Facebook authentication

With Facebook authentication enabled, users will be redirected to the Facebook login page for authentication. They will be able to access the network only after granting INC Cloud access to their Facebook information (nickname, profile, and email info).

Creating a Facebook app

1. Log in to Meta for Developers at https://developers.facebook.com.
2. Click Create app to create a Facebook app.


Creating an app

3. Specify the app name.


Specifying the app name

4. Start business verification and finish creation.


Business verification and finalization

5. On Meta for Developers, enable Client OAuth Login and Web OAuth Login and enter the login URL as a valid redirect URI.
   

Drawing and Parameter Settings

1. In the Captive Portal editor, click the Facebook box in the Auth Configuration area and enable Facebook authentication.
2. Enter the app ID and app secret. Configure other options as needed.
3. Click OK or Release in the upper right corner of the page to save.

Facebook authentication configuration

Portal authentication configuration page

Portal login preview page

Configure Facebook authentication

Important:
» Execute commands in this section after you finish the settings in Configure general settings or Appendix A Authentication commands for the device.

» Free-rule 38 might disable the app from displaying pictures. Please configure this rule as needed or contact technical support.

# Configure destination-based portal-free rules to allow portal users who send an HTTP/HTTPS request that carries Facebook-related host names to access network resources without authentication.

<Sysname> System-View
                        [Sysname] portal free-rule 31 destination facebook.com 
                        [Sysname] portal free-rule 32 destination m.facebook.com 
                        [Sysname] portal free-rule 33 destination www.facebook.com 
                        [Sysname] portal free-rule 34 destination graph.facebook.com
                        [Sysname] portal free-rule 35 destination connect.facebook.net
                        [Sysname] portal free-rule 36 destination static.xx.fbcdn.net 
                        [Sysname] portal free-rule 37 destination staticxx.fbcdn.com
                        [Sysname] portal free-rule 38 destination scontent-hkg-3-1.xx.fbcdn.net

Next Step: Linking to the SSID

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure combined authentication

Restrictions and guidelines

The following authentication methods can be used together:

• Fixed account authentication.
• Voucher authentication.
• Google authentication.
• Twitter authentication.
• Facebook authentication.
• Email authentication.

A user can access the network as long as they pass one authentication.

Procedure

1. Configure settings on the device as described if the software version of the device is lower than 5405.
2. Select Service > Authentication > Authentication Templates. Select multiple authentication methods on the design page.

Next Step: Linking to the SSID

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure Dumb terminal authentication

Restrictions and guidelines

• If an account group contains accounts that have been authenticated, changing the validity period of the account group changes the validity period of all accounts in the group.
• If you configure the validity period as 0, the account never expires.
• You can enter the first three bytes to add MAC addresses in bulk. The configuration of the validity period of a full MAC address and that of a three-byte MAC address are not mutually exclusive. Suppose you add MAC addresses that start with AA-BB-CC and specify a validity period of 5 days, and then add the MAC address AA-BB-CC-11-22-33 and specify a validity period of 10 days. The validity periods of Dumb terminals with a MAC address of AA-BB-CC-11-22-33 and a MAC address that starts with AA-BB-CC are 10 and 5 days, respectively.

Procedure

1. On the top navigation bar, click Service.
2. Select Authentication in the navigation panel and click the Accounts tab.
3. On the Dumb Terminal Accounts tab, click Edit Account Group.
4. Click Add.
5. Enter the required info and click OK.


Adding an account group

6. Select an account group and click Add.
7. Enter a MAC address in the required format.


Adding a MAC address

8. In the Captive Portal editor, click the Dumb terminal box in the Auth Configuration area and enable Dumb terminal authentication.
9. Select the account group created in the previous step.
10. Click OK or Release in the upper right corner of the page to save.
    

    Dumb terminal authentication configuration

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Configure bulk authentication

Perform this task to implement bulk authentication settings.

Restrictions and guidelines

• The configuration of a bulk authentication template takes precedence over that of a non-bulk authentication template. For the non-bulk authentication template to take effect, click the Edit icon for that template and then click Apply.
• Before implementing the bulk configuration, make sure the following requirements are met:
  • The devices on which bulk authentication is deployed are online. If one is offline, the implementation will fail for it.
  • The wireless service name is the same as the portal web server name.

Procedure

1. After creating and designing the authentication template, on the template list screen (Service > Authentication), click the Deploy Template icon in the Actions column of the corresponding record.
   
2. In the window that opens, click the ACs tab.
3. Select the desired branch or location.
4. Select the corresponding device or site and click Apply.

After configuring all parameters and completing the portal design for this authentication method, it will not be active on your network yet. For clients to start being directed to your captive portal, it is necessary to complete the final step of linking the generated template to the desired SSID. Please refer to the detailed step-by-step guides in the Direct Creation and Linking on SSID or Linking Template via Service menu sections.

Customize authentication page

You can configure the landing page, login page, login success page, and home page, and you can push or disable the landing page or login success page as needed.

Restrictions and guidelines

• The image size cannot exceed 1 M. As a best practice, set the image size between 100 KB and 200 KB. Only JPG, JPEG, BMP, PNG, GIF, and SVG formats are allowed.
• As a best practice to avoid affecting page loading speed, do not add too many controls.

Procedure

1. In the Captive Portal editor (template design screen), configure the settings shown in the Preview of configuration changes:
   • Logo: the aspect ratio must be 1:1. The image will be automatically cropped into a circle. You can enter a store name shorter than 12 characters.
   • Background: the aspect ratio must be 3:5.
   • Carousel: the aspect ratio must be 11:5. Two or three images with the same height are required.
   • Image: the aspect ratio must be 11:5. The image description cannot exceed 48 characters.
   • Video: the video size cannot exceed 5 M. Only MP4, WEBM, and OGG formats are allowed.
   • Text: you can edit the font, font size, bold, and font color.

Description of custom template

2. To configure the home page, click the Home tab and select Use custom link.
3. Enter a custom link and click Upload.
4. To preview the link, click Preview in the upper right corner of the page.
   

Configure client blacklist

Perform this task to prohibit specific clients from accessing the WLAN.

Restrictions and guidelines

This feature takes effect only on offline clients. If you add an online client to the blacklist, it will be rejected upon the next access attempt.

Procedure

1. On the top navigation bar, click Network.
2. Select Settings > Device Category > in the navigation pane click Users if the device is a Cloud AP and Authentication if the device is an AC.
3. Perform one of the following tasks to add users to the blacklist:
   • On the Guests tab, click the Add to Blacklist icon for the target user.
   • On the Blacklist tab, click Add.

Log off online users

Perform this task to log off specific online users or all online users.

Restrictions and guidelines

This feature has no effect on unauthenticated users.

This feature is available only in scenarios with an AC or a wired router as the authenticator.

Procedure

1. On the top navigation bar, click Network.
2. Select Network > Settings > ACs > Users > Portal Users > Online Users from the navigation pane.
3. Select a branch and a site from the top of the page.
4. On the Online Clients tab, click Authenticated Clients.
5. To log off specific clients, select the clients and click Log Off Selected Users. To log off all clients, click Log Off All Users.

Wireless QoS

The Wireless QoS (Bandwidth Limit) feature provides advanced traffic control and bandwidth management per SSID. When enabled on any SSID of a radio, the processing of QoS policies shifts to software forwarding to allow the application of the configured rules. As a consequence, the radio's maximum forwarding capability may be reduced compared to the standard hardware-accelerated operation. This behavior applies to the radio as a whole and can influence the performance of other SSIDs configured on the same radio. It is recommended to enable this feature only when bandwidth control is a deployment requirement.

Encryption service configuration

To synchronize SSID information, click Sync SSID Info.

Ensure you have created a wireless service and configured SSID information on the device.

Note: This feature is available only for ACs with versions earlier than 5418 and routers with versions earlier than 0809.

Sync SSID Info

To synchronize wireless service settings on devices to INC Cloud, click Sync to Cloud. This operation synchronizes settings such as the wireless service name, SSID, and guaranteed bandwidth rate to INC Cloud.

Note: This feature is available only for ACs with versions earlier than 5418 and routers with versions earlier than 0809.