Portnox™ CLEAR and Wi-Fi in WatchGuard Cloud Integration Guide

Deployment Overview

This guide demonstrates how to integrate Wi-Fi in WatchGuard Cloud with Portnox™ CLEAR to ensure secure and trusted user access with RADIUS.

Test Topology

Portnox™ CLEAR Configuration

1. Log in to the Portnox™ CLEAR Management Portal.
2. Select Devices > Accounts.
3. Click to create a new Portnox™ CLEAR account.
4. In the Email text box, type an email address that is associated with your organization.
5. (Optional) In the Description text box, type the description for the account.
6. Keep all other settings as the default value.

7. Click Save account.
8. The email address you specify will receive a notification with a password that you can use with RADIUS authentication.

9. Select Settings > + CLEAR RADIUS SERVICE > Create new CLEAR RADIUS instance.
10. From the Location drop-down list, select your location. Click Create.

11. Record the Cloud RADIUS IP, Authentication port, and the Shared Secret.

12. Select Groups > Create New Group.
13. In the Group Name text box, type the group name.
14. In the 802.1X WIRELESS NETWORK ACCESS section, click Add Wi-Fi Network.

15. In the Network name text box, type the SSID of the network.
16. For Allowed authentication types, select the Credentials check box.
17. From the Device requirement drop-down list, select Agentless or AgentP-based & Agentless.
18. Click Save.

19. Click Save.
20. Select the Members tab.
21. Expand the CLEAR REPOSITORY.
22. Select your account and move your account to this group.

23. Click Save.

Wi-Fi in WatchGuard Cloud Configuration

For detailed information on WatchGuard Cloud AP deployment, see Get Started with Wi-Fi in WatchGuard Cloud.

Access points can have two different types of settings:

• Device-level settings — Settings that you apply individually to each access point.

• Access point site settings — Access point sites enable you to create SSID settings and apply them to multiple access points that subscribe to the site.

Configure Authentication Domain for Portnox CLEAR RADIUS Server In WatchGuard Cloud

1. Log in to your WatchGuard Cloud account. If you have a Service Provider account, you must select a subscriber account.
2. Select Configure > Authentication Domains.
3. Click Add Authentication Domain.
4. In the Domain Name text box, type a domain name.
5. Click Next.
6. In the Add servers section, select RADIUS.
7. From the Type drop-down list, select Host IPv4.
8. In the IP Address text box, type the Cloud RADIUS IP Address from Portnox CLEAR.
9. In the Port text box, type the authentication port number for the RADIUS server from Portnox CLEAR.
10. In the Shared secret text box, type the shared secret from the Portnox CLEAR server.
11. In the Confirm shared secret text box, type the shared secret from the Portnox CLEAR RADIUS server.

12. Click Save to save the Authentication Domain settings.
13. Click Done.

Configure the Authentication Domain and SSID Settings for an Access Point (Device Level Configuration)

To configure Authentication Domain and SSID settings for a single access point at the device level configuration:

1. From WatchGuard Cloud, select Configure > Devices.
2. Select your Access Point.
3. Select Device Configuration.
4. In the Authentication tile, click Domains.
5. Click Add Authentication Domain.
6. From the Select an existing Authentication Domain drop-down list, select the domain you created in the previous section.
7. From the RADIUS Server drop-down list, select the RADIUS server.

8. Click Save.
9. Click Back to return to the configuration settings.
10. Click SSIDs.
11. Click Add SSID.
12. In the SSID Name text box, type the SSID name.
13. Select the Broadcast SSID check box.
14. From the SSID Type drop-down list, select Private.
15. From the Radio drop-down list, select 2.4 GHz and 5 GHz.
16. From the Security drop-down list, select WPA2 Enterprise.
17. From the Authentication Domain drop-down list, select the domain you created in the previous section.
18. In the Network section, select Bridged.

19. Click Save.
20. Click Schedule Deployment.
21. Select Deploy changes now.
22. In the Description text box, type a description for the deployment.

23. Click Deploy.

Configure the Authentication Domain and SSID Settings for an Access Point Site

To configure Authentication Domain and SSID settings and apply the configuration to multiple access points with an Access Point Site:

1. In WatchGuard Cloud, select Configure > Access Point Sites.
2. Click Add Site.
3. In the Name text box, type a name for the site.
4. Click Add.

5. In the Authentication tile, click Domains.
6. Click Add Authentication Domain.
7. From the Select an existing Authentication Domain drop-down list, select the domain you created in the previous section.
8. From the RADIUS Server drop-down list, select the RADIUS server.

9. Click Save.
10. Click Back to return to the site configuration settings.
11. Click SSIDs.
12. Click Add SSID.
13. In the SSID Name text box, type the SSID name.
14. Select the Broadcast SSID check box.
15. From the SSID Type drop-down list, select Private.
16. From the Radio drop-down list, select 2.4 GHz and 5 GHz.
17. From the Security drop-down list, select WPA2 Enterprise.
18. From the Authentication Domain drop-down list, select the domain you created in the previous section.
19. In the Network section, select Bridged.

20. Click Save.
21. Click Schedule Deployment.
22. Select Deploy changes now.
23. In the Description text box, type a description for the deployment.
24. Click Deploy.
25. Click Close.
26. Click Back to return to the site configuration settings.
27. Select the Subscribed Devices tab.

28. Click Select Devices.
29. Select the access points to subscribe to the site.
30. Click Save.

Test Portnox™ CLEAR Integration

1. Use a wireless client to connect to the SSID you created. For example: AP330_Portnox_Clear
2. Type your user name and password that you received in the Portnox configuration.

You should see a 802.1X authentication success notification in the Portnox alerts page.