Contents

Related Topics

Configure an External Guest Authentication Hotspot

After you configure your external web server for external guest authentication, you can configure an External Guest Authentication hotspot on your Firebox. Before you begin, make sure you understand the external authentication process and correctly configure your external web server for guest authentication.

In Fireware v11.12 or higher, you can create a Walled Garden to specify IP addresses, IP ranges, networks, and domain names that guests can connect to without authentication credentials. For example, you can allow guests to connect to your company website without authentication.

For more information, see About Hotspot External Guest Authentication.

If your Firebox runs Fireware v11.11 and lower, you can enable only one hotspot on one interface on your Firebox. Multiple hotspots are only supported in versions higher than v11.11. The configuration settings in lower versions of Fireware appear different, but the configuration settings are the same as for a single hotspot in higher versions of Fireware.

To enable the External Guest Authentication hotspot, from Fireware Web UI:Closed
  1. Select Authentication > Hotspot.
    The Hotspots page appears with the Hotspots tab selected.
  2. Select the External Guest Authentication tab.
    The External Guest Authentication Hotspot settings appear.
  3. Select the Enable External Guest Hotspot check box.

Screen shot of the Wireless page, Hotspot tab, with Hotspot Type External Guest Authentication selected

  1. In the Shared Secret and Confirm text boxes, type the shared secret.
    This must be the same shared secret the external web server uses to create the checksum value it sends with the access decision.
  2. In the Authentication URL text box, type the URL of the authentication page on the external web server.
    The Authentication URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/auth.html or http://www.example.com/auth.html.
  3. In the Authentication Failure URL text box, type the URL of the authentication failure page on the external web server.
    The Authentication Failure URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/failure.html or http://www.example.com/failure.html.

Screen shot of completed External Guest Authentication settings

  1. To create a Walled Garden (Fireware OS v11.12 or higher):Closed
  1. Click Add.
  2. From the Choose Type drop-down list, select Host IPv4, Network IPv4, Host Range IPv4, or FQDN. For example, select FQDN.
  3. In the text box, type an IPv4 address, IPv4 network, IPv4 range, or FQDN. For example, type example.com.
  4. Click OK.
  5. To add more items to the Walled Garden, click Add.

Screen shot of External Auth page with populated Auth Exceptions list

  1. To apply the External Guest Authentication settings to an interface, select the Hotspots tab.
  2. From the Interfaces list, select an interface.
  3. Click Select Hotspot.
  4. Select External Guest Authentication.

Screen shot of Interfaces list

  1. Click Save.
To enable the External Guest Authentication Hotspot, from Policy Manager:Closed
  1. Select Setup > Authentication > Hotspot.
  2. Select the External Guest Authentication tab.
    The External Guest Authentication settings appear.
  3. Select Enable External Guest Authentication.
  4. In the Shared Secret and Confirm text boxes, type the shared secret.
    This must be the same shared secret the external web server uses to create the checksum value it sends with the access decision.
  5. In the Authentication URL text box, type the URL of the authentication page on the external web server.
    The Authentication URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/auth.html or http://www.example.com/auth.html.
  6. In the Authentication Failure URL text box, type the URL of the authentication failure page on the external web server.
    The Authentication Failure URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/failure.html or http://www.example.com/failure.html.

Screen shot of external hotspot authentication settings

  1. To create a Walled Garden (Fireware OS v11.12 or higher): Closed
  1. From the Walled Garden area, click Add.
  2. From the Choose Type drop-down list, select Host IPv4, Network IPv4, Host Range IPv4, or FQDN. For example, select FQDN.
  3. In the text box, type an IPv4 address, IPv4 network, IPv4 range, or FQDN. For example, type example.com.
  4. Click OK.
  5. To add more items to the Walled Garden, click Add.

Screen shot of External Guest Authentication screen

  1. To apply the External Guest Authentication settings to an interface, select the Hotspots tab.
  2. In the Interfaces list, click the Hotspot column for an interface.
    A drop-down list appears in the Hotspot column for that interface.

Screen shot of Interfaces list

  1. From the drop-down list, select the External Guest Authentication hotspot.
  2. Click OK.

When you enable external guest authentication, these policies are automatically created:

  • Allow External Web Server — Allows TCP connections from users on the guest network to the external web server IP address and the port you use for hotspot external guest authentication.
  • Allow Hotspot Session Mgmt — Allows connections from the external web server IP address to the Firebox.
  • Allow Hotspot-Users — Allows connections from the hotspot to addresses external to the Firebox.

See Also

Configure a Web Server for Hotspot External Guest Authentication

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.