OmniAccess Stellar Enterprise SE Remote Demo Script

Size: px

Start display at page:

Download "OmniAccess Stellar Enterprise SE Remote Demo Script"

Daniella McCormick
5 years ago
Views:

1 OmniAccess Stellar Enterprise SE Remote Demo Script Table of Contents Introduction... 2 Release Information... 2 Equipment Requirements... 2 Overview of the Demo... 2 Step 1 Connect to the edemo environment & access to the OV2500 GUI... 3 Step 2 Trust the Access Point... 4 Step 3 Configure an 802.1x SSID... 7 Step 4 Configure a Guest SSID with Captive Portal authentication Contact... 39

2 Introduction This is a step-by-step guide on how to perform a OmniAccess Stellar ENTERPRISE Remote Demo, what to show to the customer and what to say when doing it. It is strongly recommended the reader is already familiar with the demo set-up (please refer to OmniAccess Stellar ENTERPRISE SE Remote Demo Platform Information document for further details). Release Information This first release of the OmniAccess Stellar ENTERPRISE SE Remote Demo is based on following AP1101 firmware version: - APs firmware: AWOS OmniVista 2500: R01 MR-2 (Build 115) Equipment Requirements 1. Your PC 2. RDP configuration file and credentials ed when demo is booked and approved 3. A good, un-firewalled internet connection Overview of the Demo The demo flow can be summarized as follow: 1. Connect to the edemo environment (cf. platform information guide), and access to the OmniVista 2500 GUI. 2. From the OV2500 GUI, trust the demo Access Point (AP). 3. Configure an 802.1x SSID and connect to it. 4. Configure a Guest SSID with Captive Portal authentication and connect to it.

Step 1 Connect to the edemo environment & access to the OV2500 GUI Refer to separate document: OmniAccess STELLAR ENTERPRISE - SE Remote Demo - Platform Information to connect to the edemo

3 Step 1 Connect to the edemo environment & access to the OV2500 GUI Refer to separate document: OmniAccess STELLAR ENTERPRISE - SE Remote Demo - Platform Information to connect to the edemo environment. You should now be connected to the Stellar Enterprise demo dedicated rebound server and see the Graphical User Interface (GUI) of the OmniVista 2500 unified Network Management System (NMS). Authenticate to the OmniVista 2500 NMS with the first login (including or not the ebs domain) that has been sent to you in the demo booking confirmation mail: If you face latency issues, please note that you can directly access the OV2500 GUI in order to build the demo without using RDP (use same credentials): You will still need RDP to connect to the SSIDs you will configure Feel free to introduce the OV2500 GUI, its Global dashboard and WLAN specific dashboard, their associated respective widgets, the main OV applications like Topology

What to say to the audience: In the OmniAccess Stellar Enterprise mode, Alcatel-Lucent Enterprise OmniVista 2500 (OV2500) Network Management System (NMS) is deployed on top of the Access Points

OV2500 embeds a visionary distributed control architecture, providing user friendly workflows for Unified Access together with integrated Unified Policy Authentication Manager (UPAM) which helps

4 What to say to the audience: In the OmniAccess Stellar Enterprise mode, Alcatel-Lucent Enterprise OmniVista 2500 (OV2500) Network Management System (NMS) is deployed on top of the Access Points infrastructure to take care of management and configuration of all the APs for maximum scalability. OV2500 embeds a visionary distributed control architecture, providing user friendly workflows for Unified Access together with integrated Unified Policy Authentication Manager (UPAM) which helps define authentication strategy and policy enforcement for Employees, Guest Access and BYOD. In addition, the Stellar Enterprise mode offers advanced features and capabilities like a heatmap feature for WLAN site planning or Deep Packet Inspection capabilities providing real-time classification and control of flows at the application level. Step 2 Trust the Access Point Locate the AP Management widget that shows one AP in the Unmanaged state and click on more :

5 Go to the Unmanaged AP tab, select the demo AP (AP-DD:40) and trust it: A popup appears asking to confirm the status change of the AP. Click on OK : A new page is displayed to show the status of the previous operation which should be a Success. Click on OK :

Check that the AP is now displayed in the Managed AP tab: What to say to the audience: the APs contact the OmniVista server

By default, for security reasons, new APs are not automatically registered and require a "Trust" action in the registration tool.

But the OmniVista NMS offers the possibility to configure automatic registration for new APs : APs are managed through the AP-group

6 Check that the AP is now displayed in the Managed AP tab: What to say to the audience: the APs contact the OmniVista server according to the Option 138 inserted in the DHCP lease they have received. They can then register. By default, for security reasons, new APs are not automatically registered and require a "Trust" action in the registration tool. An untrusted AP will have the radios turned off. But the OmniVista NMS offers the possibility to configure automatic registration for new APs : APs are managed through the AP-group concept which defines a logical grouping of one or more APs with similar settings like radio settings (e.g. Country Code). In the framework of the demo, the trusted AP is managed in the STELDEMGRP AP-group which has been preconfigured for simplification purposes.

7 Step 3 Configure an 802.1x SSID Go to the UNIFIED ACCESS -> UNIFIED PROFILE -> Template menu: Go to the AAA Server Profile page and click on + to define the Radius authentication server the 802.1x SSID will rely on for authentication: What to say to the audience: The OmniAccess Stellar WLAN solution includes a built-in RADIUS server for 802.1x and MAC authentication. This embedded server is called Unified Policy Access Manager (UPAM) and is inherent to the global solution. While ALE s competitors proposals consist of an additional appliance or server/vm, UPAM comes in the form of an integrated software module with the OmniVista 2500 Network Management System.

Much more than a built-in Radius server, UPAM is a Policy Manager that consists of a Guest Access application for visitors network access and a BYOD access solution for employee device secure

Connecting to an external authentication source allows centralized user management with the possibility to assign user or device role profiles (VLAN, QoS and security ACL) based on AD/LDAP attributes.

8 Much more than a built-in Radius server, UPAM is a Policy Manager that consists of a Guest Access application for visitors network access and a BYOD access solution for employee device secure on-boarding. The UPAM module can be used as a local Radius database but can also interface with an external Radius server or with the company corporate Microsoft Active Directory or LDAP server. Connecting to an external authentication source allows centralized user management with the possibility to assign user or device role profiles (VLAN, QoS and security ACL) based on AD/LDAP attributes. In the Authentication Servers section and for all authentication methods (802.1X, Captive Portal and MAC), specify UPAMRadiusServer (created by default) which is the UPAM embedded radius server: o Profile Name: AAA-SP-eDemo (this is an example) o 802.1X Primary: UPAMRadiusServer (drop-down box) o Captive Portal Primary: UPAMRadiusServer o MAC Primary: UPAMRadiusServer

9 Scroll down and click on Accounting Servers to set the same information for the Accounting part related to the different authentication methods. Then, click on Create : Go to the Access Role Profile page and click on + to create a role profile that will be assigned to users connecting to the 802.1X SSID:

10 Create an Access Role Profile (ARP) called Employee-RP and click on Create : What to say to the audience: The Alcatel-Lucent Enterprise OmniAccess Stellar WLAN solution supports role based access control. OmniAccess Stellar APs utilize radius attributes to assign users or devices to roles. Once the role of the user is learned (accomplished by interfacing with existing backend authentication servers such as RADIUS, LDAP, and Active Directory) authenticated users or devices can be assigned to a specific VLAN. The OmniAccess Stellar APs have firewalling capabilities and the role based access control can even go beyond basic VLAN assignment. A pre-defined profile can be applied to set the VLAN but also security (network ACLs) and Quality of Service (QoS) policies for the authenticated user or device. The AP embedded firewall is identity-aware and can take permit/deny, and Quality of Service (QoS) decisions (such as setting DSCP/802.1p bits or placing the packet into a priority queue) based on the

11 identity of the user or device and application. By applying granular policies tailored to the role of the particular user, the OmniAccess Stellar WLAN solution restricts network privileges to those appropriate to the user s role, and also greatly decreases exposure in the event that a device or user were compromised by limiting the amount of damage that can be done.. Apply the newly created ARP to the AP Group STELDEMGRP (which was created before the demo for reasons of simplification) and associate VLAN 57 to the Employee-RP for that AP Group:

Go to the WLAN Service page and click on + to create a WLAN Service (which is the SSID) called Employee-8021X : o Service Name: Employee-8021X (this is an example) o ESSID: Employee-8021X (this is an

13 Go to the WLAN Service page and click on + to create a WLAN Service (which is the SSID) called Employee-8021X : o Service Name: Employee-8021X (this is an example) o ESSID: Employee-8021X (this is an example) In the Security section, set the Security Level to Enterprise (802.1X secured SSID), which makes appear additional security parameters: o Security Level: Enterprise (drop-down box) o Encryption Type: WPA2_AES (drop-down box)

14 o AAA Profile: AAA-SP-eDemo (previously created) o Default Access Role Profile: Employee-RP (previously created) Load the newly created SSID to the demo AP by applying the SSID to the AP via the AP-Group:

16 Go to the UPAM -> AUTHENTICATION -> Employee Account menu to create a user account in the UPAM Radius database that will be used to authenticate to the newly created Employee-8021X SSID:

17 o Username: theemployee (this is an example) o Password: theemployee (this is an example) o Access Role Profile: Employee-RP (previously created)

18 Go to the UPAM -> AUTHENTICATION -> Authentication Strategy menu to create an Authentication Strategy that will tell the system where the employee users database is located:

Access Policy that will set the condition that will

19 o Strategy Name: Employee-AS (this is an example) o Authentication Source: Local Database Create an Access Policy that will set the condition that will tell which authentication strategy to use for authentication:

o Policy Name: EmployeeSSID-Policy (this is an example) o Mapping Condition attribute: SSID (drop down box) o Mapping Condition value: Employee-8021X (previously

20 o Policy Name: EmployeeSSID-Policy (this is an example) o Mapping Condition attribute: SSID (drop down box) o Mapping Condition value: Employee-8021X (previously created) o Authentication Strategy: Employee-AS Check that the Employee-8021X is broadcasted by the AP and that you cannot access yet the Internet from the rebound server:

21 Connect to the Employee-8021X SSID and, when prompted, authenticate with the previously created theemployee employee account: o Username: theemployee o Password: theemployee

22 You can now validate that you have access to the Internet by visiting a public website:

23 Step 4 Configure a Guest SSID with Captive Portal authentication Go back to the UNIFIED ACCESS -> UNIFIED PROFILE -> Template menu: Go to the Access Role Profile page and click on + to create a role profile that will be assigned to users connecting to the Guest SSID:

24 Create an Access Role Profile (ARP) called Guest-RP and click on Create : o Profile Name: Guest-RP o Redirect status: Enable Apply the newly created ARP to the AP Group STELDEMGRP (which was created before the demo for reasons of simplification) and associate VLAN 56 to the Guest-RP for that AP Group:

26 Go to the WLAN Service page and click on + to create WLAN Service (which is the SSID) called Guest-CP : o Service Name: Guest-CP (this is an example) o ESSID: Guest-CP (this is an example)

27 In the Security section, set the Security Level to Open, which makes appear additional security parameters: o Security Level: Open (drop-down box) o Mac Auth: ENABLED o AAA Profile: AAA-SP-eDemo (previously created) o Default Access Role Profile: Guest-RP (previously created)

28 Load the newly created SSID to the demo AP by applying the SSID to the AP via the AP-Group:

30 Go to the UPAM -> AUTHENTICATION -> Authentication Strategy page to create an additional Authentication Strategy that will tell how guest will authenticate:

31 o Strategy Name: Guest-AS (this is an example) o Authentication Source: None o Web Authentication: Guest o Guest Access Strategy: Default Guest

Create an Access Policy that will set the condition that will tell which authentication strategy to use for authentication: o Policy Name: GuestSSID-Policy

32 Create an Access Policy that will set the condition that will tell which authentication strategy to use for authentication: o Policy Name: GuestSSID-Policy (this is an example) o Mapping Condition attribute: SSID (drop down box) o Mapping Condition value: Guest-CP (previously created) o Authentication Strategy: Guest-AS

33 Go to the UPAM -> GUEST ACCESS -> Guest Access Strategy to define how a guest can identify himself and be authorized to connect to the network: Edit the Default Guest strategy:

self-register by providing his name only, and click on

34 Scroll down to the Self-Registration Strategy. Disable the Approval option to allow the guest to self-register by providing his name only, and click on Apply : Check that the Guest-CP is broadcasted by the AP and that you can connect to it:

35 Try to connect to a public web site on the Internet: you should be redirected to the UPAM Captive Portal after having ignored the security certificate warning by clicking on Continue to this webpage. Click then on Create new one if don t have an account : Enter your name and click on Register :

36 Click on OK : Note your automatically generated password and click on Back to login :

now authenticated and connected to the Internet: You can now

37 Your login and password should already be entered: check the I accept the terms of use checkbox and click on login : You are now authenticated and connected to the Internet: You can now visit any public web site on the Internet (open a new window/tab):

What to say to the audience: The UPAM module provides an advanced and sophisticated Captive Portal with maximum customization capabilities and various access methods (employee sponsored guest

We could show that the registration process may require approval (by a visited employee who would be notified by mail, or by a guest operator like the receptionist of the company).

38 What to say to the audience: The UPAM module provides an advanced and sophisticated Captive Portal with maximum customization capabilities and various access methods (employee sponsored guest access, guest self-registration, social login registration ). We showed in our demo how a visitor can register by simply providing a username (the password being automatically generated). We could show that the registration process may require approval (by a visited employee who would be notified by mail, or by a guest operator like the receptionist of the company). We could also have authenticated with pre-set guest credentials, or with a social login like Facebook or Google. The social login option requires more configuration than what a remote demo reasonably allows:

39 Contact edemo support teams: EMEA (CET 9am-6pm): NAR /CALA (PST 9am-6pm): APAC, China (AWST 9am-6pm):

OmniAccess Stellar Enterprise SE Remote Demo Platform information

OmniAccess Stellar Enterprise SE Remote Demo Platform information Contents Introduction... 2 How to obtain access to the Demo?... 3 Demo Infrastructure... 7 Network Diagram... 7 Equipment IP addresses