Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in captive portal architecture. Initially my understanding was that places such as airports and internet cafes would have all the RADIUS and AAA infrastructure on the local side of the firewall. After looking at WISP (wireless internet service provider) models, my initial ideas seemed wrong. Even if a company offers several different public wifi hotspots, would they still potentially keep the AAA server, captive portal web server and RADIUS internals on the local side of the firewall?

If they kept the RADIUS and AAA servers centralised, would they connect to this via a VPN from the firewall and have a non-VPN out onto the internet for after the users have been authenticated?

I am just trying to understand a general architecture for public wifi.

share|improve this question

Here's an example

enter image description here

It makes sense to centralise the AAA service if you are providing infrastructure for multiple hotspots (e.g. independent site-operators each of whome receive income from a business providing the hot-spot equipment and back-end service) - apart from anything else, you want customers to register once and then be able to use any of your hotspots without separate re-registration. A centralised (or regional) AAA service is likely to be easier to manage than a fully decentralised system.

Obviously, it is important that the hotspot gateway is able to communicate with the AAA-server securely over a public network. RADIUS is a commonly used AAA protocol but while a RADIUS client encrypts passwords to be transmitted to RADIUS server, there are concerns about the strength of RADIUS. A VPN between RADIUS client and server is one way to provide some additional security.

User traffic would be unaffected by a VPN used for RADIUS.

share|improve this answer
Hi, thanks for that! Just one small question, your last statement: "User traffic would be unaffected by a VPN used for RADIUS", are you saying that once a user starts to use the internet this would also go through the VPN, to the provider's server and THEN onto the internet? I guess this would allow easier monitoring and billing, rather than access the internet from the firewall but have to constantly send RADIUS packets from the user to the provider (so that the provider can bill accordingly)? – Shalom Dec 30 '11 at 14:15
@Shalom: No, I'm saying the opposite of that. Only traffic addressed to the AAA server would be routed into the VPN tunnel. – RedGrittyBrick Dec 30 '11 at 14:20
so in order to keep track of the internet usage it would be normal (and acceptable) for the AP to transmit RADIUS protocol messages back through the VPN to the AAA server? – Shalom Dec 30 '11 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .