Layer-3 hotspot mode
In most simple on-premise deployments, HSG controls hotspot access in layer-2 mode - HSG tracks per client session based on a combination of client device MAC and IP addresses. In layer-2 mode, the clients sit in the same network as the HSG hotspot instance LAN/VLAN interface, and HSG has visibility on both client MAC and IP.
But in some more complex deployments, where the clients could come from a different internal network, eg.
Remote intranet sites via MPLS/VPN, or
From behind a layer 3 core switch.
Senario #1 is particularly true for services provides managing many customers using a central HSG (each customer maps to a dedicated hotspot instance within HSG), and each customer network is connected via a VPN tunnel back to central HSG.
In above scenarios, clients traffic routes across a layer 3 network before reaching to HSG, and HSG can only "see" client IP address in each request (the client MAC will be rewritten to downstream router MAC when routed across the router), so HSG can only control client access in layer 3 mode by tracking client IP address, because client MAC is no longer visible to HSG.
Below topology elaborates scenario #2. and it's similar for #1 (instead of a layer 3 router, it could be a intranet WAN/MPLS/VPN network).
Important notes for running in layer-3 mode:
All the hotspot instances must be running on VLAN, eg. the user data link between HSG LAN interface and downstream router has to be a VLAN (so that HSG sees tagged traffic). You can have different hotspot instances (different VLANs) for different customers or departments, for different access controls and portals etc. In above example, vlan10 is the data link between HSG and core router, and hotspot is enable on vlan10 interface within HSG, so that the user traffic coming from vlan20 is routed by core router and tagged with vlan10 when reaching HSG.
Client DHCP pool is assigned by downstream router or external DHCP server (eg. for vlan20) with addresses in different subnets as HSG hotspot instance VLAN interface subnet (eg. for vlan10).
Each hotspot instance can cover one or multiple user VLANs (depends on how the downstream router configures). NOTE: for each hotspot instance configuration, you need to define "client-network x.x.x.x y.y.y.0", and if this instance covers multiple client networks/VLANs, you must make sure this configured network supersede all clients subnets. For example, you may have 3 client VLANs, 172.16.1.0/24, 172.16.2.0/24, 172.16.3.0/24, then your "client-network" should be configured as 172.16.0.0/22 ("client-network 172.16.0.0 255.255.252.0")
Configure "client-static" to be the same range of "client-network", so that it accepts client IPs issued by external DHCP server.
Configure hotspot-server IP and make sure it's within the "client-network" range, eg. "hotspot-server 172.16.1.1 port 5000 5001", and this IP is excluded from external DHCP server pool.
Do NOT perform NAT on the downstream router for the client subnets, so that HSG can "see" the original client source IP addresses
On HSG, add route for client subnets pointing back to downstream router (else you can run OSPF between HSG and downstream router as well), so that HSG can route return traffic back to clients.
Sample config on HSG
-------------------------------------------------
NOTE: layer3 mode has no visibility on client MAC address.
you can't see client MAC in above output.
in RADIUS access records, the MAC shown is actually the downstream router MAC (it will appear same for all users).
-------------------------------------------------
Sample config on router (can be any other 3rd-party router)
-------------------------------------------------
!hostname core-router!interface eth0 enable!interface eth1 description "DHCP for AP management" enable ip address 192.168.9.1/24 dhcp-server range 192.168.9.2 192.168.9.254!interface vlan 0 10 description "transit hotspot VLAN" enable ip address 172.16.10.2/24!interface vlan 1 20 description "user VLAN" enable ip address 172.16.20.1/24 dhcp-server range 172.16.20.2 172.16.20.254!ip dhcp-server start!ip default-gateway 172.16.10.1!