Motorola WS5100 Series Reference Manual page 20

1-10 WS5100 Series Switch System Reference Guide
2. A user ID/ Password and hotspot ESSID is issued by the site receptionist or IT staff.
3. The user connects their laptop to this ESSID
4. The laptop receives its IP configuration via DHCP. DHCP service can be provided by an external DHCP
server or provided by the internal DHCP server located on the switch.
5. The user opens a Web browser and connects to their home page.
6. The switch re-directs them to the hotspot Web page for authentication.
7. The user enters their User ID/ Password.
8. A Radius server authenticates the user.
9. Upon successful authentication, the user is directed to a Welcome Page that lists (among other things)
an Acceptable Use Policy.
10.The user agrees to the usage terms and is granted access to the Internet. (or other network services).
To redirect traffic from a default home page to a login page, the switch uses destination network address
translation (destination NAT is similar to the source NAT/ PAT but the destination IP address and port get
modified instead of the source as in traditional NAT). More specifically, when the switch receives an HTTP
Web page request from the user (when the client first launches its browser after connecting to the WLAN),
a switch protocol stack intercepts the request and sends back an HTTP response after modifying the network
and port address in the packet. Thus, acting like a proxy between the user and the Web site they are trying
to access.
To setup a hotspot, create a WLAN ESSID and select Hotspot authentication from the Authentication menu.
This is simply another way to authenticate a WLAN user, as it would be impractical to authenticate visitors
using 802.1x. For information on configuring a hotspot, see
1.2.2.6 IDM (Identity Driven Management)
Radius authentication is performed for all protocols using a Radius-based authentication scheme (such as
EAP). Identity driven management is provided using a Radius client. The following IDMs are supported:
• User based SSID authentication — Denies authentication to MUs if associated to a ESSID configured
differently by their Radius server.
• User based VLAN assignment — Allows the switch to extract VLAN information from the Radius server.
• User based QoS — Enables QoS for the MU based on settings within the Radius Server.
Configuring Hotspots on page 4-32.