Beonic (Skyfii) Integration with Wi-Fi in WatchGuard Cloud

WatchGuard Cloud integrates with Beonic (formerly known as Skyfii) to provide captive portal services to end users. With WatchGuard Cloud, you can configure an SSID to direct users to the Beonic captive portal. This enables you to leverage your marketing campaigns configured in Beonic for your Wi-Fi in WatchGuard Cloud users.

Before you begin, make sure your access point is activated with a WatchGuard Standard Wi-Fi or USP Wi-Fi Management license and registered with WatchGuard Cloud. For more information, go to Activate an Access Point.

Contents

• Beonic (Skyfii) Integration with Wi-Fi in WatchGuard Cloud
• Contents
• Platform and Software
• Test Topology
• WatchGuard Cloud Configuration
• Add a RADIUS Authentication Domain to WatchGuard Cloud
• Configure SSID Settings for an Access Point Site
• Configure an Authentication Domain for an Access Point Site
• Configure a Captive Portal for a Guest SSID
• Get the WatchGuard Access Point Device Settings
• Beonic Configuration
• Create a Venue
• Create an Access Point
• Create a Guest Wi-Fi Portal
• Test the Beonic Integration

Test Topology

For more information about network port configuration for communications between your access points, WatchGuard Cloud, and Beonic, go to the Beonic (Skyfii) documentation and the WatchGuard Cloud documentation.

WatchGuard Cloud Configuration

For detailed information on Wi-Fi in WatchGuard Cloud deployment, go to Get Started with Wi-Fi in WatchGuard Cloud.

Access points can have two different types of settings:

• Device-level settings — Settings that you apply individually to each access point.
• Access Point Site settings — Access Point Sites enable you to create SSID settings and apply them to multiple access points that subscribe to the site.

The Captive Portal feature is only available when setting up Access Point Site settings.

Add a RADIUS Authentication Domain to WatchGuard Cloud

Before you add a RADIUS authentication domain to WatchGuard Cloud, verify the RADIUS server settings in your Beonic support documentation as these settings and addresses might change.

• IP addresses for primary RADIUS servers
  • Asia
  • Australia and New Zealand
  • Europe and Africa
  • North America
  • South America
• Authentication Port: 1812
• Accounting Port: 1813
• RADIUS Server Shared Secret: radsec

To configure a RADIUS authentication domain in WatchGuard Cloud:

1. Log in to your WatchGuard Cloud account.
   If you are a service provider, make sure you have allocated the activated access point to a subscriber account in WatchGuard Cloud.
2. Select Configure > Shared Configurations > Authentication Domains.
3. Click Add Authentication Domain.
4. In the Domain Name text box, type a domain name. In this example, we use beonic.primary.
5. Click Next.
6. In the Add servers section, select RADIUS.
7. From the RADIUS Server Type drop-down list, select RADIUS Authentication Server.
8. From the Type drop-down list, select Host IPv4.
9. In the IP Address text box, type the primary IP address of the Beonic RADIUS server.
10. In the Port text box, type the authentication port number of the Beonic RADIUS server.
11. In the Shared secret text box, type the shared secret of the Beonic RADIUS server.

12. Click Save,
13. Click Done.
14. From the authentication domain list, select your domain name. In this example, beonic.primary.
15. From the Update Authentication Domain page, select Servers.
16. Click Add Server.
17. Repeat steps 6 -12 to create a RADIUS Accounting Server with port 1813.
    The authentication and accounting services are located on the same RADIUS server and run on different ports.
18. (Optional) Repeat these steps to create a secondary RADIUS server.

Configure SSID Settings for an Access Point Site

To configure SSID settings for an Access Point Site in WatchGuard Cloud:

1. Log in to your WatchGuard Cloud account.
   If you are a service provider, make sure you have allocated the activated access point to a subscriber account in WatchGuard Cloud.
2. Select Configure > Shared Configurations > Access Points Sites.
3. Select an existing site, or add a new site.
4. In the Subscribed Devices tab, make sure your access points are subscribed to the site.

5. From the Configuration Details tab, in the Wi-Fi Networks section, click SSIDs.
6. Click Add SSID.
7. In the SSID Name text box, type an SSID name. In this example, we use Guest-Beonic.
8. Select the Broadcast SSID check box.
9. From the SSID Type drop-down list, select Guest.
10. From the Radio drop-down list, select 2.4 GHz and 5 GHz.
11. From the Security drop-down list, select Open.
12. In the Network section, select Bridged.

13. Click Save.
14. To apply the configuration to your access points, click Schedule Deployment in the banner at the bottom of the page.
15. Type a Description for the deployment.

16. Click Deploy, then click Close.

Configure an Authentication Domain for an Access Point Site

To configure Authentication Domain settings for an Access Point Site:

1. Log in to your WatchGuard Cloud account.
   If you are a service provider, make sure you have allocated the activated access point to a subscriber account in WatchGuard Cloud.
2. Select Configure > Shared Configurations > Access Point Sites.
3. Select the Access Point Site where you configured your SSID in the SSID settings section.
4. Select the Configuration Details tab.
5. In the Authentication section, click Domains.
6. Click Add Authentication Domain.
7. From the Select an existing Authentication Domain drop-down list, select the domain you created in the Add a RADIUS Authentication Domain to WatchGuard Cloud section.
8. From the RADIUS Authentication Server drop-down list, select the primary or secondary RADIUS authentication server.
9. From the RADIUS Accounting Server drop-down list, select the primary or secondary RADIUS accounting server.

10. Click Save
11. To apply the configuration to your access points, click Schedule Deployment in the banner at the bottom of the page.
12. Type a Description for the deployment.

13. Click Deploy, then click Close.

Configure a Captive Portal for a Guest SSID

To add a captive portal to an SSID, you must enable the captive portal feature in an Access Point Site:

1. Log in to your WatchGuard Cloud account.
   If you are a service provider, make sure you have allocated the activated access point to a subscriber account in WatchGuard Cloud.
2. Select Configure > Share Configurations > Access Point Sites.
3. Select the Access Point Site where you configured your SSID in the SSID settings section.
4. Select the Configuration Details tab.
5. In the Portal widget, click Captive Portal.

6. Click Add Captive Portal.
   The Add Captive Portal page appears.
7. From the SSID drop-down list, select the SSID you created in the Configure SSID Settings for an Access Point Site section.
8. From the Captive Portal Type drop-down list, select Third-party hosted.

9. Click Next.
10. In the Splash Page URL text box, type the Beonic splash page URL.

    Use the format: <captive-portal-domain>/welcome/watchguard/cloud.

    For example: https://guestwifi-us.beonic.io/welcome/watchguard/cloud

    Verify the regional captive portal domain name and shared secret in the Beonic support documentation:

• Asia
• Australia and New Zealand
• Europe and Africa
• North America
• South America

11. In the Shared Secret text box, type the shared secret for the Beonic captive portal splash page. Currently, this is secret. Verify this shared secret with the current Beonic support documentation.
12. From the Authentication Domain drop-down list, select your authentication domain you created in the Add a RADIUS Authentication Domain to WatchGuard Cloud section.

13. In the Walled Garden section, click Add Destination. Make sure you add the Beonic (Skyfii) portal URL and any other support sites that the splash page uses. For more information, view the Beonic (Skyfii) support documentation for the required servers in your region.

    You must add each IP address listed in your regional server documentation:

    • Asia
    • Australia and New Zealand
    • Europe and Africa
    • North America
    • South America

You must also add these addresses:

• skyfii.com
• All values in the appropriate access control lists (ACL) for your region
• To enable social media authentication in the portal, add the addresses listed in Social Login ACLs & Global Domain / IP Whitelist.

14. Leave the other options at their default settings.

15. Click Finish.
16. Return to the Configuration Details page of the Access Point Site.
17. To apply the configuration to your access points, click Schedule Deployment in the banner at the bottom of the page.
18. Type a Description for your deployment.
    

19. Click Deploy, then click Close.

Get the WatchGuard Access Point Device Settings

Make sure that you record the name and MAC address of each WatchGuard access point you want to use to integrate with Beonic.

To get the settings for each WatchGuard access point:

1. Log in to your WatchGuard Cloud account.
   If you are a service provider, make sure you have allocated the activated access point to a subscriber account in WatchGuard Cloud.
2. Select Configure > Devices.
3. Select an access point.
4. Click Device Settings.
5. Copy the device MAC address.

Beonic Configuration

Before you begin, verify these instructions with the Beonic (Skyfii) support documentation as the settings might change.

Create a Venue

1. Log in to your Beonic Cloud region.
2. Click in the top right of the Beonic user interface.
3. Select Venues.
4. Click Add New.
5. Type a Name for the venue. In this example, type WatchGuard Test Venue.
6. From the Region drop-down list, select your region.
7. From the Timezone drop-down list, select your timezone.
8. From the Category drop-down list, select an appropriate category.
9. From the Registration Group drop-down list, select your registration group.
10. Select the Enabled check box.
11. From the Campaign Marketing List drop-down list, select a marketing list or select Create new Marketing List.

12. In the Addresses section, from the Country drop-down list, select a country.
13. (Optional) Type an Address, Suburb, Postcode, State, Latitude, and Longitude.

14. Click Create.
15. From the navigation pane, select Venues.
16. Select the venue you created. In this example, we select WatchGuard Test Venue.
17. Select the Engage Settings tab.

18. (Optional) Configure the Minimum minutes between contact, Marketing Email From Address, and Market Email From Name values.
19. Click Save Changes.

Create an Access Point

To create an Access Point in Beonic:

1. Click in the upper-right of the Beonic user interface.
2. Select Access Points.
3. Click Add New.
   The Create Access Point page appears.
4. From the Venue drop-down list, select the venue you created.
5. From the Floor drop-down list, select Default Floor.
   If you have created a floor, you can select the floor you created. In this example, select WatchGuard Test Floor.
6. Type or paste the Name and MAC Address of the WatchGuard access point.
7. (Optional) Click Add One or Add Range to add the MAC address of the access point.

8. Click Create.

Create a Guest Wi-Fi Portal

To create a Guest Wi-Fi portal in Beonic:

1. In the navigation bar, click WiFi.
2. Select Portals > Add New.
3. On the Setup page, type a Portal Name. In this example, type WatchGuard Test Portal.
4. From the Languages drop-down list, select one or more languages.
5. From the Default Languages drop-down list, select one language.
6. From the Assign a Venue drop-down list, select the venue you created. In this example, select WatchGuard Test Venue.
   If you have created a user access group, select the group assigned to your venue.
7. Clear the Enable Interstitial Page check box so that it is not selected. For more information about the Interstitial Page, go to Create a Captive Portal Survey.

8. Click Next.
9. On the Template page, select a template or a saved template. In this example, we select Coco.

10. Click Next.
11. On the New User page, customize your new user page.
    • You can add new widgets to your page or delete existing ones.

12. Click Next.
13. Customize the Return User page.
    • You can add new widgets to your page or delete existing ones.

8. Click Next.
   
9. Customize your landing page. This Landing Page overrides any Landing Page setting in your WatchGuard Cloud configuration.
   • You can add widgets or delete existing ones.
   • You can also use a specified external page as the landing page.
   • If you selected the Enable Interstitial Page check box on the Setup page, you will access the Interstitial Page instead of the Landing page.

9. Click Next.
10. Preview your settings.

11. Click Publish twice.

Test the Beonic Integration

To test the Beonic integration with WatchGuard Cloud:

1. Use a wireless client to connect to the SSID you created in WatchGuard Cloud.
   The user browser is redirected to the Beonic splash page.
2. Complete the information requested to connect through the splash page.
   The configured Landing Page appears.
3. Access the Internet through the captive portal.
   

For more information about the wireless client details, from the Beonic user interface, select Engage > Registrations. When you click the client status icon, you can view the client's MAC address and activity.