Integration guide

This guide explains how to connect your network equipment (routers, wireless controllers, access points and switches) and your business systems (PMS, student, patient, ticketing or loyalty systems) to Lango.

Everything in this guide is generated for you, with your own values filled in, on each site's Setup & settings page in your portal. Use this page as the reference.

How it works

1. A guest joins your Wi-Fi (or plugs into a guest port). Your network device intercepts the first web request and redirects the browser to your site's Splash URL (https://lango.localtel.tech/p/<site-key>), adding parameters such as the client MAC, AP and SSID.
2. The guest signs in with their room/ID + last name (checked live against your PMS or directory), an access code, email, or click-through.
3. The platform creates a short-lived, single-use credential and hands it back to your device in one of three ways:
4. RADIUS (most vendors): the guest's browser posts the credential to the device's login URL. The device asks our cloud RADIUS, which replies with Access-Accept, Session-Timeout, Idle-Timeout and bandwidth limits.
5. Controller API (UniFi): the cloud authorises the device's MAC directly.
6. Signed URL (Juniper Mist): the browser is sent to the vendor cloud with an HMAC-signed authorisation.
7. The guest lands on your branded Welcome page, which can offer paid speed upgrades if your package includes them. When the guest checks out in your PMS, or the session expires, the platform sends a RADIUS Disconnect / CoA to remove their access.

Values you need from your portal

General requirements (every vendor)

• Walled garden / pre-auth ACL: allow DNS (UDP/TCP 53) and HTTPS to lango.localtel.tech before login. Without it, the splash page never loads.
• HTTPS redirection: enable it where the vendor supports it. Modern phones only show the portal if the captive-portal check (http://captive.apple.com, connectivitycheck.gstatic.com) is intercepted.
• Time: keep NTP enabled on controllers. RADIUS and TOTP checks depend on correct clocks.
• PAP or CHAP: both are supported. MS-CHAP and EAP are not used for captive portals.
• Accounting: enable it with a 5-minute interim update. This gives you live "online" status, data usage and seamless reconnects.
• MAC authentication (optional): enable "MAC auth / MAC caching" on the site and on your controller so returning devices reconnect silently while their session is still valid.

---

Routers & gateways

MikroTik RouterOS (hotspot) — routers, CCR, hAP, cAP via CAPsMAN

1. RADIUS:

`` /radius add service=hotspot address=<lango.localtel.tech IP> secret=<site secret> authentication-port=1812 accounting-port=1813 timeout=3s /radius incoming set accept=yes port=3799 ``

1. Hotspot profile:

`` /ip hotspot profile set [find default=yes] use-radius=yes login-by=http-chap,http-pap,mac-cookie radius-interim-update=5m nas-port-type=wireless-802.11 /system identity set name=<NAS identifier of your site> ``

1. Walled garden:

`` /ip hotspot walled-garden add dst-host=lango.localtel.tech /ip hotspot walled-garden ip add dst-host=lango.localtel.tech action=accept ``

1. Replace hotspot/login.html with the redirect template. Download it from your site page (Download MikroTik login.html). It forwards mac, ip, link-login-only, link-orig, chap-id and chap-challenge to the splash page. CHAP is computed for you.
2. Rate limits arrive in Mikrotik-Rate-Limit. Upgrades are pushed live with CoA.
3. Wired: run the hotspot on a bridge or VLAN interface. The same setup covers wired guest ports.

Fortinet FortiGate / FortiAP / FortiSwitch

1. User & Authentication → RADIUS Servers: lango.localtel.tech, secret = site secret, PAP. Enable accounting.
2. Create a firewall user group (e.g. Guest-Portal) with the RADIUS server as a remote member. Enter the same name in the site's vendor settings so the platform returns it as Fortinet-Group-Name.
3. SSID or interface: Security mode = Captive Portal, Authentication portal = External, URL = Splash URL, user group = Guest-Portal, exempt lango.localtel.tech.
4. CLI: config user setting → set auth-type http https and set auth-secure-http enable.
5. FortiSwitch / wired: enable captive portal on the FortiLink VLAN interface in the same way.

Sophos Firewall (SFOS) & Sophos Central / Fusion Wireless

• Default (RADIUS backend): add our RADIUS server, create a hotspot (or SSID captive portal) with Backend authentication = RADIUS, and label the username field "Room number" and the password field "Last name". Set the redirect URL to your Welcome URL. Access codes work in both fields.
• UAM mode: if a UAM/CoovaChilli-compatible gateway sits in front, choose uam in the site settings and point the gateway to the Splash URL.

Huawei (AR routers, AC6000 / AirEngine controllers, S-series switches)

radius-server template cloud
 radius-server shared-key cipher <site secret>
 radius-server authentication <portal IP> 1812
 radius-server accounting <portal IP> 1813
 radius-server authorization <portal IP> shared-key cipher <site secret>
url-template name cloud
 url https://lango.localtel.tech/p/<site-key>
 url-parameter login-url ac_url https://<AC IP>:8443 ssid ssid user-mac usermac user-ipaddress userip ap-mac apmac redirect-url url
portal web-authen-server https ssl-policy <policy>
web-auth-server cloud
 url-template cloud
portal-access-profile name cloud
 web-auth-server cloud direct
free-rule-template name default_free_rule
 free-rule 1 destination ip <portal IP> mask 32

Bind the portal-access profile, RADIUS authentication scheme and accounting scheme to an authentication profile. Then apply that to the guest VAP profile, or for wired guests, to the switch access interface. If your firmware posts different field names, change the parameter mapping on the site page. The defaults are ac_url, usermac, userip, apmac, ssid and url; credentials are sent as userName and password.

Ruijie / Reyee (Ruijie Cloud, AC, EG gateways)

• Ruijie Cloud: Authentication → Captive Portal → Policy mode = External, Portal Server URL = Splash URL, RADIUS server = ours, allowlist lango.localtel.tech.
• CLI (AC): aaa authentication cpweb cloud group <radius-group>, web-auth template cpweb → url <Splash URL>, fmt custom (send mac, ip, ssid), and web-auth auth-server submit-url http://1.1.1.1:8082/login.
• Change the parameter mapping on the site page if your firmware differs.

pfSense / OPNsense / OpenWrt / CoovaChilli

Use the Generic RADIUS external portal vendor: point the portal URL to the Splash URL and the RADIUS server to ours, then map the redirect parameters on the site page.

---

Wireless controllers & cloud-managed access points

Cisco Catalyst 9800 / AireOS WLC / Catalyst switches (IOS-XE)

• 9800: Configuration → Security → Web Auth → Parameter map:
• Type webauth, virtual IPv4 (e.g. 192.0.2.1), Redirect for log-in = Splash URL.
• Redirect append for AP MAC / Client MAC / WLAN SSID = ap_mac / client_mac / wlan.
• Pre-auth ACL permitting DNS and lango.localtel.tech.
• AAA method list pointing to our RADIUS servers.
• WLAN: Layer 2 none, Layer 3 Web Policy with this parameter map.
• Enable RFC 3576 (CoA) on the RADIUS server.
• AireOS: Security → Web Auth → Web Login Page → External, URL = Splash URL.
• Catalyst switches (wired): use an ip admission / parameter-map type webauth with the same redirect, RADIUS server group and pre-auth ACL on the guest access ports.

Cisco Meraki (MR / MX / MS)

• Wireless → Access control: Association = Open, Splash page = Sign-on with my RADIUS server, RADIUS servers = ours, accounting on, CoA on.
• Wireless → Splash page: Custom splash URL = Splash URL. Walled garden: lango.localtel.tech.
• Meraki sends RADIUS from its cloud or AP addresses, so set a NAS identifier on the site (or use the username-based routing, which works automatically).

HPE Aruba (Instant, Central, Mobility Controllers, AOS-CX switches)

• Instant / Central: add our RADIUS server (enable CoA/dynamic authorisation). Then create an External captive portal profile:
• Server = lango.localtel.tech, port 443, HTTPS, URL = path of the Splash URL, redirect URL = Welcome URL.
• Enable switch IP (adds switchip).
• Guest SSID: Open, splash = External, auth server = ours.
• Optional: MAC authentication with MAC auth fail-thru.
• The platform posts cmd=authenticate, user and password to https://<switchip>/cgi-bin/login. The default host is securelogin.arubanetworks.com. Use your own domain if you've installed a certificate on the APs.
• Mobility Controller (AOS 8): aaa authentication captive-portal cloud → login-page <Splash URL>, switchip-in-redirection, no enable-welcome-page, and a server group with our RADIUS server.
• AOS-CX switches (wired): port-access captive portal with the same server group and redirect.
• Optional: set an Aruba user role in the site settings to receive Aruba-User-Role.

Ruckus (SmartZone / vSZ, ZoneDirector, Unleashed)

• Add our RADIUS server as both the authentication and accounting service.
• Hotspot (WISPr) Portal: Logon URL = External, Redirect URL = Splash URL, start page = Welcome URL. Walled garden: lango.localtel.tech.
• On SmartZone, SSH in and run no encrypt-mac-ip so MAC and IP arrive in clear text.
• WLAN: authentication type Hotspot (WISPr), method Open.
• Guests must be able to reach the controller on TCP 9998 (HTTPS) or 9997. The platform posts to /SubscriberPortal/hotspotlogin on SmartZone and /login on ZoneDirector or Unleashed.

Ubiquiti UniFi

• Settings → Hotspot / Guest: Authentication = External portal server, host = lango.localtel.tech.
• Turn on HTTPS redirection and add lango.localtel.tech to pre-authorisation access.
• Create a dedicated local admin ("hotspot operator") on the controller and enter its URL, username and password on the site page. The controller must be reachable from the cloud.
• UniFi requests arrive at /guest/s/<site>/ and are matched to your site by your public IP and UniFi site name.

TP-Link Omada (EAP access points, Omada gateways, OC200/OC300, Cloud-Based Controller)

• Settings → Profiles → RADIUS Profile: our server (1812/1813) with the site secret.
• Authentication → Portal: Type = External RADIUS Server, Portal customisation = External Web Portal, URL = Splash URL, landing page = Welcome URL. Pre-authentication access: lango.localtel.tech.
• The platform submits the credentials to /portal/radius/browserauth on your controller (default port 8843) with authType=2. For a Cloud-Based Controller, enter your CBC API host on the site page, e.g. euw1-api-omada-controller.tplinkcloud.com.
• Wired: Omada gateways send gatewayMac instead of apMac. This is handled automatically.

Grandstream GWN (GWN Manager, GWN.Cloud, GCC)

• Profiles → RADIUS: our server with the site secret, accounting interval 300 s.
• Captive Portal → Policy: Splash page = External, External splash server = Splash URL, Authentication = RADIUS, landing page = Welcome URL. Pre-authentication rules: lango.localtel.tech. Enable the policy on the guest SSID.
• The platform redirects to the AP's login_url with username, password and redirect.

D-Link Nuclias (Cloud / Connect)

• Configure → Access point → RADIUS servers: add ours.
• SSID → Captive portal: Sign-on with External Captive Portal, Custom external captive portal, splash URL = Splash URL, authentication = RADIUS. Walled garden: lango.localtel.tech.
• Check the parameter names on your firmware and change the mapping on the site page if needed.

Juniper Mist

• WLAN → Guest portal → Forward to external portal. Portal URL = Splash URL.
• Copy the generated API secret into the site settings and set the portal host for your Mist cloud (e.g. portal.mist.com, portal.eu.mist.com).
• Mist authorises the device itself through a signed URL, so RADIUS isn't used in this flow. Bandwidth limits are set on the WLAN in Mist.

Other vendors

Cambium, Zyxel Nebula, EnGenius, Extreme, H3C, Netgear Insight, Alcatel-Lucent and other vendors with an external captive portal + RADIUS option work through the Generic adapter. Map the redirect parameters the device sends and the field names it expects.

---

Switches & wired guest access

Wired captive portals use the same building blocks: redirect + RADIUS.

802.1X / MAB: devices without a browser (smart TVs, consoles) can use MAC authentication. Enable MAC auth on the site, sign the device in once from a phone or laptop on the same MAC, or add it as an access code. The switch then authenticates the MAC against our RADIUS.

---

Connecting your business systems

Oracle OPERA (hotels)

Oracle Simphony is Oracle's restaurant POS. Guest names and room numbers come from OPERA. Simphony can still issue Wi-Fi access codes on receipts through the voucher API.

Any other system (Mews, Cloudbeds, Protel, Apaleo, RMS, eZee, hospital HIS, SIS, ticketing, CRM)

1. In PMS & API → API keys, generate a key and limit it to one site if you like.
2. Push events from your system or middleware (Zapier, Make, n8n, a small script):

POST https://lango.localtel.tech/api/v1/sites/<site-key>/guests/checkin
Authorization: Bearer cpk_live_…
Content-Type: application/json

{"reservation_id":"884213","room":"1204","last_name":"Otieno","first_name":"Amani","departure":"2026-11-16"}

The room and last_name fields are the two values guests type in: room/bed/student ID/ticket number and surname/PIN, depending on your sector. See the API reference.

Webhooks

You can receive signed events at your own HTTPS endpoint: session.created, session.ended, guest.checked_in, guest.checked_out, posting.requested, payment.paid and payment.failed.

Verify each event: X-Portal-Signature = "sha256=" + HMAC_SHA256(secret, X-Portal-Timestamp + "." + body). Reject timestamps older than 5 minutes.

---

Security model (summary)

• Admin sign-in: password (12+ characters) plus mandatory MFA (authenticator-app TOTP or email code) and 10 single-use recovery codes. Accounts lock after 5 failures. Sessions expire after 30 minutes idle and 12 hours absolute. You can see and revoke your active sessions.
• Platform support access: the super admin can open your portal to help you. Every action is labelled (platform support) in your activity log.
• Guest portal:
• Strict Content-Security-Policy with per-response nonces, and no framing (clickjacking protection).
• Signed welcome and payment links.
• Brute-force limits per device and per room.
• Auto-reconnect needs a device cookie or a matching controller-reported IP, so a spoofed MAC alone can't take over a session.
• Hand-offs only go to private or known vendor hosts, so the portal can't be used as an open redirect.
• Secrets (MFA seeds, controller passwords, payment keys, PMS credentials) are encrypted at rest with AES-256-GCM. API keys are stored hashed.
• RADIUS: per-site shared secrets, Message-Authenticator on every reply (Blast-RADIUS hardening), and verified CoA/Disconnect responses.
• Outbound requests: webhook and PMS URLs can't point at private, link-local or cloud-metadata addresses.