Configure an External Guest Authentication Hotspot

After you configure your external web server for external guest authentication, you can configure an External Guest Authentication hotspot on your Firebox. Before you begin, make sure you understand the external authentication process and correctly configure your external web server for guest authentication.

You can also create a Walled Garden to specify IP addresses, IP ranges, networks, and domain names that guests can connect to without authentication credentials. For example, you can allow guests to connect to your company website without authentication.

For more information, go to About Hotspot External Guest Authentication.

  1. Select Authentication > Hotspot.
    The Hotspots page appears with the Hotspots tab selected.
  2. Select the External Guest Authentication tab.
    The External Guest Authentication Hotspot settings appear.
  3. Select the Enable External Guest Hotspot check box.

Screen shot of the Wireless page, Hotspot tab, with Hotspot Type External Guest Authentication selected

  1. In the Shared Secret and Confirm text boxes, type the shared secret.
    This must be the same shared secret the external web server uses to create the checksum value it sends with the access decision.
  2. In the Authentication URL text box, type the URL of the authentication page on the external web server.
    The Authentication URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/auth.html or http://www.example.com/auth.html.
  3. In the Authentication Failure URL text box, type the URL of the authentication failure page on the external web server.
    The Authentication Failure URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/failure.html or http://www.example.com/failure.html.

Screen shot of completed External Guest Authentication settings

  1. Click Add.
  2. From the Choose Type drop-down list, select Host IPv4, Network IPv4, Host Range IPv4, or FQDN. For example, select FQDN.
  3. In the text box, type an IPv4 address, IPv4 network, IPv4 range, or FQDN. For example, type example.com.
  4. Click OK.
  5. To add more items to the Walled Garden, click Add.

Screen shot of External Auth page with populated Auth Exceptions list

  1. To apply the External Guest Authentication settings to an interface, select the Hotspots tab.
  2. From the Interfaces list, select an interface.
  3. Click Select Hotspot.
  4. Select External Guest Authentication.

Screen shot of Interfaces list

  1. Click Save.
  1. Select Setup > Authentication > Hotspot.
  2. Select the External Guest Authentication tab.
    The External Guest Authentication settings appear.
  3. Select Enable External Guest Authentication.
  4. In the Shared Secret and Confirm text boxes, type the shared secret.
    This must be the same shared secret the external web server uses to create the checksum value it sends with the access decision.
  5. In the Authentication URL text box, type the URL of the authentication page on the external web server.
    The Authentication URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/auth.html or http://www.example.com/auth.html.
  6. In the Authentication Failure URL text box, type the URL of the authentication failure page on the external web server.
    The Authentication Failure URL must begin with https:// or http:// and must specify the IP address or domain name of the web server. A port number is not required, but you can choose to specify a custom port number.
    For example, http://10.0.2.80:[port number]/failure.html or http://www.example.com/failure.html.

Screen shot of external hotspot authentication settings

  1. From the Walled Garden area, click Add.
  2. From the Choose Type drop-down list, select Host IPv4, Network IPv4, Host Range IPv4, or FQDN. For example, select FQDN.
  3. In the text box, type an IPv4 address, IPv4 network, IPv4 range, or FQDN. For example, type example.com.
  4. Click OK.
  5. To add more items to the Walled Garden, click Add.

Screen shot of External Guest Authentication screen

  1. To apply the External Guest Authentication settings to an interface, select the Hotspots tab.
  2. In the Interfaces list, click the Hotspot column for an interface.
    A drop-down list appears in the Hotspot column for that interface.

Screen shot of Interfaces list

  1. From the drop-down list, select the External Guest Authentication hotspot.
  2. Click OK.

When you enable external guest authentication, these policies are automatically created:

  • Allow External Web Server — Allows TCP connections from users on the guest network to the external web server IP address and the port you use for hotspot external guest authentication.
  • Allow Hotspot Session Mgmt — Allows connections from the external web server IP address to the Firebox.
  • Allow Hotspot-Users — Allows connections from the hotspot to addresses external to the Firebox.

Related Topics

Configure a Web Server for Hotspot External Guest Authentication