AMIGOPOD PowerConnect W Clearpass 100 Software User manual

Amigopod

Implementing Accounting-Based

Authorization

2|May 2011 Amigopod |Technical Note

Networks®, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management System®,

Mobile Edge Architecture®, People Move. Networks Must Follow®, RFProtect®, Green Island®. All rights

reserved. All other trademarks are the property of their respective owners.

Open Source Code

Certain Aruba products include Open Source software code developed by third parties, including software code

subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open

Source Licenses. The Open Source code used can be found at this site:

http://www.arubanetworks.com/open_source

Legal Notice

The use of Aruba Networks, Inc. switching platforms and software, by all individuals or corporations, to

terminate other vendors’ VPN client devices constitutes complete acceptance of liability by that individual or

corporation for this action and indemnifies, in full, Aruba Networks, Inc. from any and all legal actions that might

be taken against it with respect to infringement of copyright on behalf of those vendors.

Warranty

This hardware product is protected by the standard Aruba warranty of one year parts/labor. For more

information, refer to the ARUBACARE SERVICE AND SUPPORT TERMS AND CONDITIONS.

Altering this device (such as painting it) voids the warranty.

www.arubanetworks.com

1344 Crossman Avenue

Sunnyvale, California 94089

Phone: 408.227.4500

Fax 408.227.4550

Amigopod |Technical Note Implementing Accounting-Based Authorization| 3

Table of Contents

1Introduction ............................................................................................................................ 4

Audience ................................................................................................................................................. 4

Document Overview .............................................................................................................................. 4

Disclaimer............................................................................................................................................... 5

2About Accounting-Based Authorization................................................................................ 6

Authentication, Authorization and Accounting.................................................................................. 6

Accounting-Based Authorization ......................................................................................................... 7

Authorization during Access-Request ....................................................................................................... 7

Authorization during Accounting-Request ............................................................................................... 8

NAS Requirements ............................................................................................................................... 10

3Configuring Accounting-Based Authorization .................................................................... 11

Check Plugin Versions......................................................................................................................... 11

Create RADIUS User Role................................................................................................................... 11

Create RADIUS NAS Client................................................................................................................. 12

Create Terms of Use page................................................................................................................... 12

Set Terms of Use URL ......................................................................................................................... 13

Create Landing page ............................................................................................................................ 13

Create Login page ................................................................................................................................ 16

Additional Configuration Guidelines ................................................................................................. 18

4Verifying Accounting-Based Authorization......................................................................... 19

Check NAS captive portal settings..................................................................................................... 19

Check terms of use page ..................................................................................................................... 19

Check login page .................................................................................................................................. 19

Check landing page.............................................................................................................................. 20

Check traffic limit ................................................................................................................................ 20

5Modifying Accounting-Based Authorization ....................................................................... 21

Adjusting the traffic limit .................................................................................................................... 21

Count only uploaded or downloaded traffic..................................................................................... 21

Accounting terminology ........................................................................................................................... 21

Counting only downloaded traffic........................................................................................................... 21

4| Implementing Accounting-Based Authorization Amigopod |Technical Note

1Introduction

This technical note explains how to use accounting-based authorization to build a

complete portal for a network service that offers free usage to guests, where guests are

restricted to a certain daily quota of traffic.

The completed portal includes:

•A login page where guests can log in with their username and password.

•A terms of use page describing the conditions under which the guest service is

provided.

•A landing page showing the guest’s current traffic counters and remaining quota.

•A user role configured with the appropriate authorization rules based on accounting

traffic.

Audience

This document is intended for network administrators and system integrators deploying an

Amigopod-based visitor management solution.

Basic familiarity with the Amigopod Visitor Management Appliance is assumed. For in-

depth information about the features and functions of the Amigopod appliance, refer to the

Amigopod Deployment Guide.

Document Overview

The first section of the document explains the concept of accounting-based authorization,

and how this solution works with the Amigopod Visitor Management Appliance.

Amigopod |Technical Note Implementing Accounting-Based Authorization |5

The next section contains a detailed configuration guide for creating the portal. Step-by-

step instructions are provided for creating each page, and for performing all necessary

configuration tasks.

Disclaimer

The topics of network design, security architectures and visitor access are complex

subjects, and no single document can hope to cover all of the possible combinations of

network equipment, network design, deployment requirements, and device configurations,

nor can all the possible security implications for a particular recommendation be covered.

Therefore, while you read this document, it is best to consider it as a guide to developing

your own understanding of the network design topics covered, and as a basis for further

investigation.

6| Implementing Accounting-Based Authorization Amigopod |Technical Note

2About Accounting-Based Authorization

This section provides background information explaining the concepts of authorization

and accounting, and how these can interact to provide a restricted network service to

guests.

Authentication, Authorization and Accounting

The Amigopod Visitor Management Appliance is built on the industry standard AAA

framework, which consists of authentication, authorization and accounting components.

Diagram 1 shows how the different components of this framework are employed in a guest

access scenario.

Diagram 1: Sequence diagram for network access using AAA

Guest NAS Amigopod VMA

Associates [1]

Redirects

Browse to Landing page [2]

Submit form [3]

Automated NAS login

Internet browsing

Complete login form

Unregistered role

Guest role [7]

States: Unauthorized Authenticating Authorized

Access-Request [5]

Access-Accept [6]

Authentication

Authorization

Accounting-Request [8]

Accounting-Response

Accounting

Session timeout [9]

Accounting-Request [10]

Accounting-Response

Accounting

Amigopod |Technical Note Implementing Accounting-Based Authorization |7

In the standard AAA framework, network access is provided to a user according to the

following process:

•The user connects to the network by associating with a local access point [1].

•A landing page is displayed to the user [2] which allows them to log into the NAS [3],

[4] using the login name and password of their guest account.

•The NAS authenticates the user with the RADIUS protocol [5].

•The Amigopod Visitor Management Appliance determines whether the user is

authorized, and if so returns vendor-specific attributes [6] that are used to configure

the NAS based on the user’s role [7].

•If the user’s access is granted, the NAS permits the guest to access the network, based

on the settings provided by the Amigopod Visitor Management Appliance.

•The NAS reports details about the user’s session to the Amigopod Visitor Management

Appliance using RADIUS accounting messages [8].

•After the user’s session times out [9], the NAS will return the user to an unauthorized

state and finalize the details of the user’s session with an accounting update [10].

Accounting-Based Authorization

Authorization decisions can be made based on the accounting records available to the

RADIUS server.

By using this process, traffic limits can be applied for guests within a particular time

period.

The example portal developed in this technical note applies a 200 MB combined limit for

guest traffic (upload and download), measured in any 24 hour period starting from

midnight. Many other rules are possible using the flexible approach to authorization

conditions.

There are two scenarios in which authorization is required:

Authorization during Access-Request

As shown in Diagram 1, when a guest connects to the network and logs in a RADIUS

Access-Request is performed.

More detail on the initial authorization is shown in Diagram 2.

8| Implementing Accounting-Based Authorization Amigopod |Technical Note

Diagram 2: Sequence diagram for traffic limited authorization

If the guest has not previously logged in today, or if the guest’s total traffic consumption

for today is less than the configured limit, then the guest is authorized [1] and an Access-

Accept response is sent [2].

To limit the guest’s traffic, if the guest’s total traffic from previous sessions today exceeds

the configured limit (200 MB) then this is determined during the authorization process [3]

and an Access-Reject response will be sent [4].

Because the Amigopod Visitor Management Appliance uses role-based access control for

visitor accounts, the authorization rules above should be defined as part of the role that

the visitor accounts are using; in this example, the role is the “Traffic Limited Guest role”.

Authorization during Accounting-Request

Because of the authorization rules applied at login time, if the guest is able to successfully

allowed quota.

Once a guest is authorized, then, how are they prevented from consuming more than their

allowed traffic quota?

Guest NAS Amigopod VMA

Submit form

Automated NAS login

Complete login form

Traffic Limited Guest

States: Unauthorized Authenticating Authorized

Access-Request

Access-Accept [2]

Authentication

Authorization

[1]

Traffic less than limit

Submit form

Automated NAS login

Complete login form

Traffic Limited Guest

Access-Request

Access-Reject [4]

Authentication

Authorization

[3]

Traffic over limit

Returned to login form

Amigopod |Technical Note Implementing Accounting-Based Authorization |9

There are two ways to achieve this, depending on the type of NAS equipment in use:

•Vendor-specific attributes — Certain NAS vendors provide the capability to limit the

amount of traffic in a particular session. For example:

The ChilliSpot-Max-Total-Octets attribute may be used with a coova-chilli NAC

device.

The Colubris-AVPair attribute may be used with a HP/Colubris controller; set a

suitable value for this attribute such as max-total-octets=200000000.

This scenario is not described further in this document, although it is possible to

implement this approach with the programmable attributes in the Amigopod’s

RADIUS User Roles.

•Interim accounting with dynamic authorization — In the general case, if the NAS does

not provide the ability to disconnect the session automatically, the session must be

monitored by the RADIUS server using RADIUS Interim Accounting updates sent by

the NAS.

Once the traffic limit has been reached, the session must be terminated as it is no

longer authorized. To do this, the dynamic authorization extensions to RADIUS

defined in RFC 3576 are used. The remainder of this technical note describes how to

implement this scenario.

Refer to Diagram 3 to understand how dynamic authorization is used to disconnect a guest

session once the traffic limit has been reached.

Diagram 3: Sequence diagram for interim accounting authorization

During the course of the session, the NAS sends interim accounting updates, including the

current traffic counters for the session, to the RADIUS server using an Accounting-Request

Guest NAS Amigopod VMA

Internet browsing

States: Unauthorized Authenticating Authorized

Accounting-Request [1]

Accounting-Response Accounting [2]

Accounting-Request

Accounting-Response Accounting [3]

Disconnect-Request [4]

Disconnect-Ack

Traffic limit exceeded

Returned to login form [5]

10| Implementing Accounting-Based Authorization Amigopod |Technical Note

message [1].The session information is updated on the RADIUS server [2], and can be

seen using the Active Sessions view.

If the guest reaches the allowed traffic limit, then on the next accounting update [3] the

authorization will be rechecked. Because the session is no longer authorized to continue,

the Amigopod Visitor Management Appliance will initiate an RFC 3576 Disconnect-Request

[4] to the NAS, which will disconnect the visitor’s session and respond with an

acknowledgment.

Further attempts by the guest to access the network will trigger the NAS captive portal

functionality to redirect the guest to the login form [5].

As shown in Diagram 2, the guest is now over the traffic limit and will be denied access to

the network (Access-Reject) with each subsequent login attempt. This will continue until

the authorization rules permit the guest to login again.

NAS Requirements

Full support for an accounting-based authorization model requires NAS equipment that

supports at least one of the two approaches described below:

1. Support for limiting individual sessions by traffic counters.

2. Support for both RADIUS Interim Accounting (RFC 2869) and the Dynamic

Authorization Extensions to RADIUS (RFC 3576) – specifically, support for the

Disconnect-Request packet.

Without NAS support for either point 1 or point 2 above, accounting-based authorization

cannot be implemented properly in the guest portal.

Other manuals for PowerConnect W Clearpass 100 Software

This manual suits for next models

Table of contents

Other AMIGOPOD Software manuals

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Installation guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Instruction Manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick reference guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software User manual

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

AMIGOPOD

AMIGOPOD PowerConnect W Clearpass 100 Software Quick setup guide

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual