Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a public wifi, like the type you find at an airport, when an unauthenticated user first connects to the network is it the gateway which detects they are unauthorised or the AAA server located remotely?

After they are authenticated, does the gateway know they are and do they still go through the AAA server (I presume they do because of billing)?

share|improve this question

The short answer is that the ROUTER/GATEWAY can detect if the user is authenticated or not, based on the list of allowed clients sent back from the AAA service (server or service).

Most small WiFi setup's usually use a built in functionality on their router, which has a direct callback to the AAA service, so that once the user signs up, the router is almost instantly updated, and the user is given access.

The process works pretty much the same on major networks; with the exception that the AAA service is usually a RADIUS or other type of major AAA server, which authorizes, and updates all associated MESH AP's with the user information, so that they have direct access to the net (and not using the captive DNS settings).

In both cases above, the gateway/router is usually the first to detect if the user is authenticated, using either MAC routing tables, or callbacks to the authenticated AAA services tied directly into the router.

On major networks, the Gateway (the first major server that the user interacts with, can accomplish this job; but normally, the first line of defense is the AP, which can detect if the user is allowed on the network, and re-route if not to the AAA service.

Hope that made a bit more sense.

share|improve this answer
Hi zack, does that mean for an unauthenticated user it would be the gateway which redirects the user to the captive portal, rather than the AAA/RADIUS server? – Ian Jan 7 '12 at 20:56
The AAA/RADIUS server's job is simply to provide a list of users who are allowed to access the network. They use MAC routing tables to do this. When the user CONNECTS to the network, the gateway checks the MAC routing table, and figures out if the user is allowed. IF NOT, it uses the captive DNS, which redirects to the captive portal; if allowed, it uses the proper DNS, and allows the connection through. – zackrspv Jan 7 '12 at 21:00
So I see the captive portal webpage, I enter my billing details and submit the form. Which part of the infrastructure would receive whether the payment was successful or not and add the user to the AAA Server authenticated user list, would the AAA server check whether the payment was successful? I presume the gateway wouldnt do such a thing? – Ian Jan 7 '12 at 21:30
The AAA service or server is the one responsible for this; they will detect if the payment went through (given that it's a simple web service that talks to a billing provider). If it has gone through, it adds the users MAC address to the RADIUS or router allowed MAC table, and then initiates a new web request. The AP detects this new web requests, RECHECKS the RADIUS server, or MAC table on the router, and notices the user is allowed; it then uses the proper DNS settings, and lets the web request go through to the public internet. It's a nicely orchestrated event :) – zackrspv Jan 7 '12 at 21:37
Thanks Zack, just one small final question. Is the user always identified by their MAC address? As in does the AAA server always identify users by their MAC address? I wasn't sure if they could use IP address, or maybe a cookie given to them, or some advanced concept like a secret key which the client would send, maybe in some protocol like EAP?? – Ian Jan 7 '12 at 21:43

I am not sure, I am just guessing here.

You can configure a firewall pretty easy to redirect all incoming traffic coming from an unknown MAC-Adress to a diplay a specific website. (And block all non-http-requests) With this site you can authenticate yourself, it probably is located elsewhere than the firewall, eg in the datacenter.

After the authentification your traffic will no longer be redirected to the authentification site but you will see what you want. When you no longer need the Access Point it will reset your authentification after a given period of time (like 10minutes).

check the this answer and the comment below to a similar question on ITSec.SE

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .