Captive portal architecture- internal or external?

Question

I am interested in captive portal architecture. Initially my understanding was that places such as airports and internet cafes would have all the RADIUS and AAA infrastructure on the local side of the firewall. After looking at WISP (wireless internet service provider) models, my initial ideas seemed wrong. Even if a company offers several different public wifi hotspots, would they still potentially keep the AAA server, captive portal web server and RADIUS internals on the local side of the firewall?

If they kept the RADIUS and AAA servers centralised, would they connect to this via a VPN from the firewall and have a non-VPN out onto the internet for after the users have been authenticated?

I am just trying to understand a general architecture for public wifi.

Answer 1

Here's an example

It makes sense to centralise the AAA service if you are providing infrastructure for multiple hotspots (e.g. independent site-operators each of whome receive income from a business providing the hot-spot equipment and back-end service) - apart from anything else, you want customers to register once and then be able to use any of your hotspots without separate re-registration. A centralised (or regional) AAA service is likely to be easier to manage than a fully decentralised system.

Obviously, it is important that the hotspot gateway is able to communicate with the AAA-server securely over a public network. RADIUS is a commonly used AAA protocol but while a RADIUS client encrypts passwords to be transmitted to RADIUS server, there are concerns about the strength of RADIUS. A VPN between RADIUS client and server is one way to provide some additional security.

User traffic would be unaffected by a VPN used for RADIUS.