Svensk Elitfotboll runs a single captive-portal platform across every arena in Allsvenskan and Superettan, built with Telia Cygate, powered by Netgraph Sign In. Fans connect once and stay connected for the whole season. SEF BIS gets a live stream of every session, every newsletter consent, every returning visitor. Identified, not anonymous.
Telia Cygate has been SEF's network partner since 2014. The contract was extended in 2025 to run through 2033 — an eight-year commitment to one platform across both leagues. Inside that contract, Netgraph delivers the captive-portal layer: one Sign In tenant covering every Allsvenskan and Superettan arena, with the data feeds wired straight into SEF BIS.
The platform is sized for the league's biggest matchdays, with league-wide capacity on the order of 120,000 concurrent users. It absorbs the matchday burst, attributes every session, and pushes the data forward in real time. No batch jobs, no anonymous Wi-Fi, no per-arena re-implementation.
The portal is owned by SEF and rendered from Netgraph Sign In. Same look, same fields, same consent flow at every arena. The only thing that changes is which club's site the supporter lands on after auth. Built for matchday: one tap on iOS, two on Android, online before the warm-up ends.
Netgraph runs DHCP for every arena and serves a Captive-Portal API endpoint via DHCP Option 114 (RFC 8910). iOS, macOS, Android and Windows read the option natively, query the API, and decide whether to show the portal or skip it. The result for the fan: sign in once in round 1, then every later arena visit is a silent OS handshake. Elfsborg at home in Borås tonight, an away day at Strandvallen next month, IFK Göteborg in Gamla Ullevi the round after that — same identity, same consent, no second sign-in.
Saturday afternoon at Borås Arena, IF Elfsborg home opener. The phone joins the SSID and gets a DHCP lease with Option 114 (RFC 8910), a pointer to the captive-portal API. iOS calls the API, sees no session, opens the SEF portal. The fan fills it in once: email, club, league, consent. Online. The session is now bound to that device for the whole season.
Six weeks later, the same fan is at Strandvallen for Mjällby vs IFK Göteborg. The phone joins the SEF SSID, gets the Option 114 hand-off again. But this time the captive-portal API reports an existing season session. iOS skips the portal completely. The browser jumps straight to mjallby-aif.se. No form, no consent re-prompt, no captive popup.
End of October. The same device has been through seven arenas across both Allsvenskan and Superettan. Every transition has been a silent OS handshake; the only sign-in was in round 1. SEF BIS sees the season-long journey: which arena, which home-club page after redirect, which newsletter clicks. Not 30 anonymous sessions.
The portal redirects post-auth based on which arena the supporter is standing in — not on a global default. An IF Elfsborg home match at Borås Arena lands fans on elfsborg.se. A Mjällby home match at Strandvallen lands them on mjallby-aif.se. Each club gets first-party traffic on its own home days.
Mapping is done on the IP network the device gets a lease in, not on per-AP rules. One subnet, one arena. The redirect ruleset is a single config in the SEF tenant. Telia Cygate rotates it per fixture; Netgraph picks the right redirect based on which subnet the supporter's lease lives in.
Sign In emits a webhook for every meaningful event in a session's lifecycle. SEF subscribes to the events that matter for SEF BIS, the league's analytics engine, and lands them as identified records in real time — not as nightly aggregates.
Every Session Created event carries the email, club preference, league, arena ID and timestamp. SEF BIS attributes the visit to a known supporter, not an anonymous device.
GDPR-tracked consent flips trigger Session Verified events with the consent flag. Newsletter platforms see the change the same minute, no nightly batch.
Session Resumed fires when a device matches a still-valid season session. SEF BIS knows it's the same fan returning — the third home match this autumn, not three new sign-ups.
DHCP Lease Granted carries the originating access point through DHCP Option 82. Even though the redirect itself is IP-network based, SEF BIS still sees which AP the fan associated with. Powers heatmaps, queue-length signals and matchday operations dashboards.
Netgraph runs as the captive-portal and data layer of Telia Cygate's SEF platform. The Service Gateway delivers the integration without changing how Cygate runs the underlying access. SEF owns its tenant and its CRM destinations.
Captive portal · whole-season SSO · webhooks
Integration framework deployed inside Cygate's network
IP-network mapping · DHCP with RFC 8910 / Option 114
Live event stream to SEF BIS · Option 82 AP context
Customer · league operator
Operates Allsvenskan and Superettan: 32 clubs, ~480 matches a season, 2.2 million spectators in 2025. Owns the SEF brand surface, the captive portal experience, and SEF BIS, which consumes the live event data.
svenskelitfotboll.se ↗
Network integrator · prime
Has run SEF's match-arena IT since 2014. Contract extended in 2025 through 2033. Delivers the Wi-Fi fabric, the wired core, the access-point estate across both leagues, and the operational team behind every matchday.
teliacygate.se ↗
Sign In · captive portal & webhooks
Sign In renders the SEF captive portal at every arena, runs DHCP with RFC 8910 / Option 114, computes per-arena site-based redirects, and live-streams session events through the Service Gateway framework into SEF BIS.
Explore Sign In →
infrastructure · Netgraph is a Cisco Solution Partner Cookies help us improve your experience on this site. With your consent we also use first-party cookies to measure how the site is used (no advertising). Read our Privacy Policy for more.
When you visit our website it may store or retrieve information in your browser, mostly as cookies. This information is used to make the site work as you expect and, with your consent, to understand how it is used. Because we respect your privacy, you can choose not to allow some cookies. Note that blocking some of them may affect your experience.
These cookies are needed for the website to function and cannot be switched off. They are usually set only
in response to actions you take, such as signing in to internal areas or filling in a form. They store no
information that identifies you personally (cookie: ng_learn_session).
With your consent, first-party cookies help us understand how the site is used: unique and returning
visitors, approximate city and region, time on a page, and entry and exit pages. We never store your IP
address (cookies: ng_consent, ng_vid, ng_sid). If you do not allow
them, we use only privacy-friendly, cookieless measurement.
