## Prerequisites

- This guide assumes the network is using the **cnMaestro Cloud Controller**.
- The Cambium system has AP(s) linked to the cnMaestro Controller.
- The Cambium system already has basic traffic routing working with existing SSIDs.
- An **Intel-based host** is required in the network to run the [RadSecProxy](https://github.com/novalabsxyz/radsec-proxy) container.

# High Level Steps

1. Deploy RadSecProxy container and record IP address of host
2. Create AP Group
3. Build WLAN Helium Passpoint SSID
4. Configure AAA Servers
5. Add the NAS-ID to the WLAN AAA Policy
6. Configure Passpoint and 3GPP Carrier Info
7. Assign APs to the new Group

## Deploy RadSecProxy Container

RADIUS messages used to authenticate users and for session accounting are transmitted unsecured and over UDP by default. By directing these messages internally within your secure network to a **RadSecProxy**, UDP traffic is converted to a **TLS-protected TCP connection** to the Helium Network core AAA servers.

### Prerequisites

- Intel-based machine with **Docker** installed.
- The host has a **private IP address** reachable from your cnMaestro controller.
- ACLs or firewalls allow cnMaestro and the Docker container to communicate via UDP on ports **1812** (auth) and **1813** (accounting).

### Container Deployment

Unzip and untar the Helium RadSec Docker package:

```bash
    tar -xvzf Helium_RadSec_Docker.tar.gz
```

This will unpack:

- `Dockerfile` — Docker build instructions
- `radsecproxy.conf` — preconfigured to connect to Helium AAA servers
- `docker-compose.yml` — to start/stop the container as a daemon

Copy the three Helium-provided certificates into the same directory:

- `ca.pem` — root CA certificate
- `cert.pem` — user certificate
- `key.pem` — private key paired with the certificate

Start the container:

```bash
    sudo docker compose up -d
```

To stop the container:

```bash
    sudo docker compose down
```

## Create AP Group

1. From the **home** view of your cnMaestro controller, go to **Configuration → Wi-Fi Profiles**

2. In _Wi-Fi Profiles_, select **AP Groups** → **Add New**.
3. Under **Basic Settings**, scroll down and click **Create WLAN**.

## Build WLAN

1. In **WLAN settings** set:
   - **Name:**`Helium Enterprise` (or your preferred name)
   - **WiFi-Offload type:**`Custom`
   - **SSID:**`Helium`
   - **Security:**`WPA3 Enterprise`
   - **Client Isolation:**`Network Wide`

2. On the left panel, go to **AAA Servers**.

3. Under **Authentication Server**:
   - **Host:** IP of your RadSecProxy host (e.g., `192.168.1.203`)
   - **Secret:**`mysecret` (must match `radsecproxy.conf` which has the default secret 'mysecret')
   - **Port:**`1812`
4. Under **Accounting Server**, repeat the steps above but set **Port = 1813**.

5. Under **Accounting Mode**, click the drop down and select **Start-Interim-Stop**

6. At the bottom, set **Interim Update Interval = 300**.

7. Under **Advanced Settings → NAS-Identifier**, select **Custom** and enter the **NAS ID** provided by the Helium team for carrier offload approval.

8. Click **Save**.

## Configure Passpoint

1. Go to the **Passpoint** tab and enable it under _Basic Settings_.

2. Set **Access Network Type:**`Chargeable Public`

3. Fill in **Venue Group** and **Venue Type** with your venue details.

4. Scroll down, under **Domain Names**, click **Add New** and enter:
   - `freedomfi.com`
5. Under **NAI Realm List**, click **Add New**:

- **Name:**`freedomfi.com`
   - **Method:**`EAP-TLS`
   - **Authentication:**`Credential Type → Certificate`
   - Click **Save**

Add new again for the next NAI Realm:
   - **Name:**`hellohelium.com`
   - **EAP:**`2`
   - **Method:**`EAP-TLS`
   - **Authentication 1:**`Credential Type → Certificate`
   - Click **Save**

7. Save the configuration again.

8. Scroll down to **IP Address Type Information**:
   - **IPv4 Type:**`Double NAT`
   - **IPv6 Type:**`Not Available`

## Assign the WLAN to the AP Group

1. Go to **Monitor and Manage → AP Groups**
2. Select your new AP group `Helium`
3. Go to the **Configuration** tab.
4. Scroll down to **WLAN** add the `Helium Enterprise` WLAN we created if it's not already there.