• 产品与解决方案
  • 行业解决方案
  • 服务
  • 支持
  • 合作伙伴
  • 新华三人才研学中心
  • 关于我们

H3C vBRAS典型配置案例集-5W100

07-H3C vBRAS支持IPoE Web逃生功能典型配置举例-5W100

本章节下载 07-H3C vBRAS支持IPoE Web逃生功能典型配置举例-5W100  (315.23 KB)

docurl=/cn/Service/Document_Software/Document_Center/Routers/Catalog/NFV/H3C_vBRAS/Configure/Typical_Configuration_Example/H3C_vBRAS_CE-5W100/201807/1089701_30005_0.htm

07-H3C vBRAS支持IPoE Web逃生功能典型配置举例-5W100

H3C vBRAS系列虚拟宽带远程接入服务器IPoE Web逃生功能典型配置举例

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

H3C_彩色.emf

 



1  简介

本文档介绍H3C vBRAS系列虚拟路由器IPoE Web逃生功能典型配置举例。H3C vBRAS虚拟路由器有别于H3C公司以往的各系列物理路由器,是一款运行在标准服务器虚拟机上的纯软件路由器产品。IPoE Web逃生功能是在当检测到Portal服务器不可达时,将认证前域用户切换到逃生组可以直接访问外网;当检测到Portal服务器可达时,用户回到认证前状态,需进行认证方可访问外网;认证成功用户不受影响。

2  配置前提

·     本文档不严格与具体软、硬件版本对应,如果使用过程中与产品实际情况有差异,请参考相关产品手册,或以设备实际情况为准。

·     本文档中的配置均是在实验室环境下进行的配置和验证,配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置,为了保证配置效果,请确认现有配置和以下举例中的配置不冲突。

·     本文档假设您已了解ACL、QOS、策略路由、AAA、NQA、TRACK等特性。

3  配置举例

3.1  组网需求

图1所示:

·     Host作为 DHCP Client经由VXLAN网络以IPoE方式接入到vBRAS接入设备。

·     vBRAS作为DHCP服务器为Host动态分配IP地址。

·     RADIUS服务器通过交换机与vBRAS路由可达。

·     由一台已安装H3C iMC的服务器承担Portal认证服务器和Portal Web服务器的职责。

图1 IPoE Web逃生功能典型配置举例组网图

 

3.2  配置思路

设备配置IPoE Web认证。在IPoE Web配置基础上配置NQA和Track实例并使之联动,配置逃生用户组,在ACL中配置逃生组用户流量通过;最后在IPoE Web接入接口下配置逃生用户组与Track项关联,当检测到Portal服务器不可达时,将认证前域用户切换到逃生组可以直接访问外网;当检测到Portal服务器可达时,用户回到认证前状态,需进行认证方可访问外网。

3.3  使用版本

本举例是在vBRAS1000_H3C-CMW710-E1116-X64版本上进行配置和验证的。

3.4  配置注意事项

建议将IPoE Web认证与Portal认证配置在不同接口上。

3.5  配置步骤

3.5.1  配置vBRAS

# 配置IPoE Web认证(配置过程略)。

# 配置NQA探测,用于检测Portal服务器是否可达。

<vBRAS> system

[vBRAS] nqa entry 1 1

[vBRAS-nqa-1-1] type icmp-echo

[vBRAS-nqa-1-1] quit

# 配置目的IP为Portal服务器IP地址。

[vBRAS-nqa-1-1] destination ip 28.28.28.100

[vBRAS-nqa-1-1] frequency 500

[vBRAS-nqa-1-1] history-record enable

[vBRAS-nqa-1-1] history-record number 10

[vBRAS—nqa-1-1] probe count 3

[vBRAS-nqa-1-1] probe timeout 500

[vBRAS—nqa-1-1] reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only

[vBRAS-nqa-1-1] quit

# 配置Track,关联NQA实例。

[vBRAS] track 11 nqa entry 1 1 reaction 1

# 配置NQA测试组启动并持续测试。

[vBRAS] nqa schedule 1 1 start-time now lifetime forever

# 配置逃生组。

[vBRAS] user-group fail

[vBRAS-fail] quit

# 在QOS策略中允许通过的ACL规则中添加允许逃生用户组的IP报文通过。

[vBRAS] acl advanced 3525

[vBRAS-acl-ipv4-adv-3525] rule 10 permit ip user-group fail

[vBRAS-acl-ipv4-adv-3525] quit

# 接口下配置逃生用户组与Track项关联,当track 11检测失败时,将用户迁移到逃生用户组。

[vBRAS] interface vsi-interface 1

[vBRAS-Vsi-interface1] ip subscriber pre-auth track 11 fail-permit user-group fail

3.6  验证配置

# 在vBRAS查看用户状态,用户处于正常的认证前用户组,无法访问外网。

[vBRAS] display ip subscriber session verbose                                                                                                                                                

Basic:                                                                                                                                                                                         

  Description                 : -                                                                                                                                                              

  Username                    : ipoe                                                                                                                                                          

  Domain                      : a-wifi_pre                                                                                                                                                    

  VPN instance                : N/A                                                                                                                                                            

  IP address                  : 11.0.89.53                                                                                                                                                     

  User address type           : N/A                                                                                                                                                           

  MAC address                 : 000c-2956-4dcc                                                                                                                                                

  Service-VLAN/Customer-VLAN  : -/-                                                                                                                                                            

  Access interface            : Vsi1                                                                                                                                                           

  User ID                     : 0x38200008                                                                                                                                                    

  VPI/VCI(for ATM)            : -/-                                                                                                                                                           

  VSI Index                   : 0                                                                                                                                                              

  VSI link ID                 : 83886080                                                                                                                                                       

  VXLAN ID                    : 1002                                                                                                                                                          

  DNS servers                 : 27.27.27.200                                                                                                                                                  

  IPv6 DNS servers            : N/A                                                                                                                                                            

  DHCP lease                  : 86400 sec                                                                                                                                                      

  DHCP remain lease           : 86384 sec                                                                                                                                                     

  Access time                 : Mar 30 09:15:56 2018                                                                                                                                          

  Online time(hh:mm:ss)       : 00:00:15

  Service node                : Slot 1 CPU 0

  Authentication type         : Web pre-auth

  IPv4 access type            : DHCP

  IPv4 detect state           : N/A

  State                       : Online

                  

AAA:

  ITA policy name             : N/A

  IP pool                     : a-wifi_pre

  IPv6 pool                   : N/A

  Primary DNS server          : N/A

  Secondary DNS server        : N/A

  Primary IPv6 DNS server     : N/A

  Secondary IPv6 DNS server   : N/A

  Session idle cut            : N/A

  Session duration            : 111 sec, remaining: 95 sec

  Traffic quota               : N/A

  Traffic remained            : N/A

  Acct start-fail action      : Online

  Acct update-fail action     : Online

  Acct quota-out action       : Offline

  Dual-stack accounting mode  : Merge

  Max IPv4 multicast addresses: 4

  IPv4 multicast address list : N/A

  Max IPv6 multicast addresses: 4

  IPv6 multicast address list : N/A

  Accounting start time       : Mar 30 09:15:56 2018

  Redirect URL                : http://28.28.28.100:8080/portal

                                         

QoS:

  User profile                : N/A

  Session group profile       : N/A

  User group ACL              : a-wifi (active)

  Inbound CAR                 : N/A

  Outbound CAR                : N/A

  Inbound user priority       : N/A

  Outbound user priority      : N/A

                                

Flow statistic:

  Uplink   packets/bytes      : 0/0

  Downlink packets/bytes      : 0/0

  IPv6 uplink   packets/bytes : 0/0

  IPv6 downlink packets/bytes : 0/0

 

C:\Windows\system32>ping 29.29.0.1

 

正在 Ping 29.29.0.1 具有 32 字节的数据:

请求超时。

请求超时。

请求超时。

请求超时。

 

29.29.0.1 的 Ping 统计信息:

    数据包: 已发送 = 4,已接收 = 0,丢失 = 4 (100% 丢失)

# 当Portal 服务器不可达,查看用户迁移到逃生用户组。

[A-Wifi]ping 28.28.28.100                                                                                                                                                                     

Ping 28.28.28.100 (28.28.28.100): 56 data bytes, press CTRL_C to break                                                                                                                         

Request time out                                                                                                                                                                               

Request time out                                                                                                                                                                              

Request time out                                                                                                                                                                              

Request time out                                                                                                                                                                               

Request time out                                                                                                                                                                               

                                                                                                                                                                                              

--- Ping statistics for 28.28.28.100 ---                                                                                                                                                      

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss                                                                                                                             

                                                                                                                                                   

[A-Wifi]display ip subscriber session  verbose                                                                                                                                                

Basic:                                                                                                                                                                                         

  Description                 : -                                                                                                                                                              

  Username                    : ipoe                                                                                                                                                           

  Domain                      : a-wifi_pre                                                                                                                                                    

  VPN instance                : N/A                                                                                                                                                            

  IP address                  : 11.0.89.53                                                                                                                                                     

  User address type           : N/A                                                                                                                                                            

  MAC address                 : 000c-2956-4dcc                                                                                                                                                

  Service-VLAN/Customer-VLAN  : -/-                                                                                                                                                            

  Access interface            : Vsi1                                                                                                                                                           

  User ID                     : 0x3820000a                                                                                                                                                     

  VPI/VCI(for ATM)            : -/-                                                                                                                                                           

  VSI Index                   : 0                                                                                                                                                              

  VSI link ID                 : 83886080                                                                                                                                                       

  VXLAN ID                    : 1002                                                                                                                                                           

  DNS servers                 : 27.27.27.200                                                                                                                                                  

  IPv6 DNS servers            : N/A                                                                                                                                                            

  DHCP lease                  : 86400 sec                                                                                                                                                      

  DHCP remain lease           : 86367 sec                                                                                                                                                      

  Access time                 : Mar 30 09:19:39 2018                                                                                                                                          

  Online time(hh:mm:ss)       : 00:00:33

  Service node                : Slot 1 CPU 0

  Authentication type         : Web pre-auth

  IPv4 access type            : DHCP

  IPv4 detect state           : N/A

  State                       : Online

       

AAA:

  ITA policy name             : N/A

  IP pool                     : a-wifi_pre

  IPv6 pool                   : N/A

  Primary DNS server          : N/A

  Secondary DNS server        : N/A

  Primary IPv6 DNS server     : N/A

  Secondary IPv6 DNS server   : N/A

  Session idle cut            : N/A

  Session duration            : 111 sec, remaining: 78 sec

  Traffic quota               : N/A

  Traffic remained            : N/A

  Acct start-fail action      : Online

  Acct update-fail action     : Online

  Acct quota-out action       : Offline

  Dual-stack accounting mode  : Merge

  Max IPv4 multicast addresses: 4

  IPv4 multicast address list : N/A

  Max IPv6 multicast addresses: 4

  IPv6 multicast address list : N/A

  Accounting start time       : Mar 30 09:19:39 2018

  Redirect URL                : http://28.28.28.100:8080/portal

                                         

QoS:

  User profile                : N/A

  Session group profile       : N/A

  User group ACL              : fail (active)

  Inbound CAR                 : N/A

  Outbound CAR                : N/A

  Inbound user priority       : N/A

  Outbound user priority      : N/A

                                

Flow statistic:

  Uplink   packets/bytes      : 209/10974

  Downlink packets/bytes      : 0/0

  IPv6 uplink   packets/bytes : 0/0

  IPv6 downlink packets/bytes : 0/0

# 用户在逃生组可访问外网。

C:\Windows\system32>ping 29.29.0.1

正在 Ping 29.29.0.1 具有 32 字节的数据:

来自 29.29.0.1 的回复: 字节=32 时间=1ms TTL=253

来自 29.29.0.1 的回复: 字节=32 时间=1ms TTL=253

来自 29.29.0.1 的回复: 字节=32 时间=10ms TTL=253

来自 29.29.0.1 的回复: 字节=32 时间=1ms TTL=253

 

29.29.0.1 的 Ping 统计信息:

    数据包: 已发送 = 4,已接收 = 4,丢失 = 0 (0% 丢失),

往返行程的估计时间(以毫秒为单位):

    最短 = 1ms,最长 = 10ms,平均 = 3ms

      #Portal服务器可达后,用户回到认证前状态,用户需进行认证,才能访问外网。

   C:\Windows\system32>ping 29.29.0.1

 

正在 Ping 29.29.0.1 具有 32 字节的数据:

请求超时。

请求超时。

请求超时。

请求超时。

 

29.29.0.1 的 Ping 统计信息:

    数据包: 已发送 = 4,已接收 = 0,丢失 = 4 (100% 丢失)

#打开Host上的浏览器,输入认证IP地址,重定向至iMC Portal登录页面,如下图所示。

图2 iMC Portal登录页面

 

# 输入用户名密码后认证完成,可以访问外网。

图3 用户上线成功页面

 

3.7  配置文件

vBRAS的配置文件如下:

#

 sysname vBRAS

#

telnet server enable

#

 irf mac-address persistent always

 irf auto-update enable

 irf auto-merge enable

 irf domain 1016231237

 irf member 1 priority 32

 irf member 2 priority 31

#

 router id 100.100.1.2

#

track 1 interface Ten-GigabitEthernet1/5/0

#

track 2 interface Ten-GigabitEthernet1/6/0

#

track 3 interface Ten-GigabitEthernet2/5/0

#

track 4 interface Ten-GigabitEthernet2/6/0

#

track 11 nqa entry 1 1 reaction 1

#

isis 100

 cost-style wide

 network-entity 04.5090.0100.0100.0100.0088.00

 #

 address-family ipv4 unicast

#

 mpls lsr-id 100.100.1.2

#

 ppp flow-statistics frequency fast

#

 ip fast-forwarding aging-time 60

#

 dhcp enable

 dhcp relay client-information record

#

 lldp global enable

#

 ip subscriber timer traffic 30000

#

 flow-interval 60

#

 password-recovery enable

#

irf-port 1

 port group interface GigabitEthernet1/3/0 type data

 port group interface GigabitEthernet1/4/0 type control

#

irf-port 2

 port group interface GigabitEthernet2/3/0 type data

 port group interface GigabitEthernet2/4/0 type control

#

object-group ip address white

 0 network host name www.163.com

#

traffic classifier 31 operator and

 if-match acl 3899

#

traffic classifier a-wifi_deny operator and

 if-match acl 3528

#

traffic classifier a-wifi_http operator and

 if-match acl 3526

#

traffic classifier a-wifi_https operator and

 if-match acl 3527

#

traffic classifier a-wifi_out operator and

 if-match acl 3529

#

traffic classifier a-wifi_permit operator and

 if-match acl 3525

#

traffic classifier tetong operator and

 if-match acl 3999

#

traffic classifier web_deny operator and

#

traffic behavior 31

 filter deny

#

traffic behavior a-wifi_deny

 filter deny

#

traffic behavior a-wifi_http

 redirect http-to-cpu

#

traffic behavior a-wifi_https

 redirect https-to-cpu

#

traffic behavior a-wifi_out

 filter permit

#

traffic behavior a-wifi_permit

 filter permit

#

traffic behavior tetong

 remark qos-local-id 3999

#

traffic behavior web_deny

#

qos policy a-wifi

 classifier a-wifi_permit behavior a-wifi_permit

 classifier a-wifi_http behavior a-wifi_http

 classifier a-wifi_https behavior a-wifi_https

 classifier a-wifi_deny behavior a-wifi_deny

#

qos policy out

 classifier a-wifi_out behavior a-wifi_out

 classifier a-wifi_deny behavior a-wifi_deny

#

qos policy tetong

 classifier tetong behavior tetong

#

qos policy up1

 classifier 31 behavior 31

#

qos policy web

#

 openflow controller enable

#

dhcp server ip-pool a-wifi_none

 gateway-list 11.1.0.1

 network 11.1.0.0 mask 255.255.0.0

 address range 11.1.0.2 11.1.255.254

#

dhcp server ip-pool a-wifi_pre

 gateway-list 11.0.0.1 export-route

 network 11.0.0.0 mask 255.255.0.0 export-route

 address range 11.0.0.2 11.0.255.254

 dns-list 27.27.27.200

#

policy-based-route tetong permit node 3999

 if-match qos-local-id 3999

 apply next-hop 5.1.1.1

 apply next-hop 29.29.0.2

#

nqa entry 1 1

 type icmp-echo

  destination ip 28.28.28.100

  frequency 500

  history-record enable

  history-record number 10

  probe count 3

  probe timeout 500

  reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only

#

 nqa schedule 1 1 start-time now lifetime forever

#

mpls ldp

#

 l2vpn enable

 l2vpn statistics interval 60

#

vsi a-wifi

 gateway vsi-interface 1

 vxlan 1002

  tunnel 0

#

interface Reth1

 ip address 172.16.17.88 255.255.255.0

 member interface GigabitEthernet1/1/0 priority 32

 member interface GigabitEthernet2/1/0 priority 31

#

interface Reth2

 description downlink

 mtu 2000

 ip address 100.100.100.2 255.255.255.0

 member interface Ten-GigabitEthernet1/5/0.1000 priority 101

 member interface Ten-GigabitEthernet2/5/0.1000 priority 100

#

interface Reth3

 description uplink

 ip address 200.200.200.2 255.255.255.0

 isis enable 100

 isis circuit-level level-2

 isis circuit-type p2p

 isis small-hello

 mpls enable

 mpls ldp enable

 member interface Ten-GigabitEthernet1/6/0.2000 priority 101

 member interface Ten-GigabitEthernet2/6/0.2000 priority 100

 mad arp enable

#

interface NULL0

#

interface LoopBack1

 ip address 100.100.1.1 255.255.255.255

#

interface LoopBack2

 description LoopBack

 ip address 100.100.1.2 255.255.255.255

 isis enable 100

#

interface LoopBack3

 ip address 100.100.1.3 255.255.255.255

 isis enable 100

#

interface GigabitEthernet1/1/0

 port link-mode route

 ip address dhcp-alloc

#

interface GigabitEthernet1/2/0

 port link-mode route

#

interface GigabitEthernet1/3/0

 port link-mode route

#

interface GigabitEthernet1/4/0

 port link-mode route

#

interface GigabitEthernet2/1/0

 port link-mode route

#

interface GigabitEthernet2/2/0

 port link-mode route

#

interface GigabitEthernet2/3/0

 port link-mode route

#

interface GigabitEthernet2/4/0

 port link-mode route

#

interface Ten-GigabitEthernet1/5/0

 port link-mode route

 mtu 2000

 ip address dhcp-alloc

#

interface Ten-GigabitEthernet1/5/0.50

 vlan-type dot1q vid 50

#

interface Ten-GigabitEthernet1/5/0.1000

 vlan-type dot1q vid 1000

#

interface Ten-GigabitEthernet1/6/0

 port link-mode route

 ip address dhcp-alloc

#

interface Ten-GigabitEthernet1/6/0.2000

 vlan-type dot1q vid 2000

#

interface Ten-GigabitEthernet2/5/0

 port link-mode route

#

interface Ten-GigabitEthernet2/5/0.50

 vlan-type dot1q vid 50

#

interface Ten-GigabitEthernet2/5/0.1000

 vlan-type dot1q vid 1000

#

interface Ten-GigabitEthernet2/6/0

 port link-mode route

#

interface Ten-GigabitEthernet2/6/0.2000

 vlan-type dot1q vid 2000

#

interface Vsi-interface1

 ip policy-based-route tetong

 portal bas-ip 100.100.1.3

 ip subscriber l2-connected enable

 ip subscriber initiator dhcp enable

 ip subscriber initiator unclassified-ip enable

 ip subscriber timer quiet 120

 undo ip subscriber user-detect ip

 ip subscriber authentication-method web

 ip subscriber roaming enable

 ip subscriber password ciphertext $c$3$XSv6wTRQGTLHWDzfCsGEQ+G536Q3T5R9bg==

 ip subscriber unclassified-ip domain a-wifi_pre

 ip subscriber pre-auth domain a-wifi_pre

 ip subscriber web-auth domain a-wifi

 ip subscriber username string ipoe

 ip subscriber pre-auth track 11 fail-permit user-group fail

#

interface Tunnel0 mode vxlan

 source 100.100.1.1

 destination 31.31.31.31

#

bgp 65009

 router-id 100.100.1.2

 #

 address-family ipv4 unicast

  network 11.0.0.0 255.255.0.0

  network 211.9.80.0 255.255.240.0

 #

 address-family vpnv4

 #

 ip vpn-instance vrf1

  #

  address-family ipv4 unicast

   import-route direct

   import-route static

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 user-role network-admin

#

line class vty

 user-role network-operator

#

line aux 0 1

 user-role network-operator

#

line con 0 1

 user-role network-admin

#

line vty 0 63

 authentication-mode none

 user-role network-admin

 user-role network-operator

 idle-timeout 0 0

#

 ip route-static 11.0.0.0 16 NULL0 preference 180 description Blackhole-Route

 ip route-static 31.31.31.31 32 100.100.100.1

 ip route-static 172.16.0.0 16 172.16.17.1

 ip route-static 211.9.80.0 20 NULL0 preference 180 description Blackhole-Route

#

 mad exclude interface GigabitEthernet1/1/0

#

 snmp-agent

 snmp-agent local-engineid 800063A280FA163E07CF5200000001

 snmp-agent community write private

 snmp-agent community read public

 snmp-agent sys-info version all

#

 ssh server enable

 ssh user root service-type all authentication-type password

#

 undo arp resolving-route enable

 arp source-mac aging-time 60

#

 qos apply policy a-wifi global inbound

 qos apply policy out global outbound

#

redundancy group A_Wifi

 preempt-delay 5

 member interface Reth2

 member interface Reth3

 node 1

  bind slot 1

  priority 100

  track 1 interface Ten-GigabitEthernet1/5/0

  track 2 interface Ten-GigabitEthernet1/6/0

 node 2

  bind slot 2

  track 3 interface Ten-GigabitEthernet2/5/0

  track 4 interface Ten-GigabitEthernet2/6/0

#

acl advanced 3000

 rule 0 permit ip source 11.0.0.0 0.0.255.255

#

acl advanced 3001

 rule 0 permit ip source 2.2.0.0 0.0.255.255

#

acl advanced 3099

 rule 0 permit ip destination 29.29.0.2 0

#

acl advanced 3525

 rule 0 permit ip destination 28.28.28.100 0 user-group a-wifi

 rule 1 permit ip destination 27.27.27.200 0 user-group a-wifi

 rule 5 permit ip vpn-instance vrf1 destination 28.28.28.100 0 user-group a-wifi

 rule 10 permit ip user-group fail

#

acl advanced 3526

 rule 0 permit tcp destination-port eq www user-group a-wifi

 rule 5 permit tcp vpn-instance vrf1 destination-port eq www user-group a-wifi

#

acl advanced 3527

 rule 0 permit tcp destination-port eq 443 user-group a-wifi

 rule 5 permit tcp vpn-instance vrf1 destination-port eq 443 user-group a-wifi

#

acl advanced 3528

 rule 0 permit ip user-group a-wifi

 rule 5 permit ip vpn-instance vrf1 user-group a-wifi

#

acl advanced 3529

 rule 0 permit ip source 28.28.28.100 0 user-group a-wifi

 rule 1 permit ip source 27.27.27.200 0 user-group a-wifi

 rule 5 permit ip vpn-instance vrf1 source 28.28.28.100 0 user-group a-wifi

#

acl advanced 3899

 rule 0 permit ip destination 100.100.1.1 0

#

user-profile free1

 free-rule acl 3099

#

user-profile tetong

 qos apply policy tetong inbound

#

radius scheme aa

#

radius scheme aaa

 primary authentication 172.16.15.200

 primary accounting 172.16.15.200

 key authentication cipher $c$3$itzc+vpeFDkhR1RnKJUsmyT6XdbuSmdNbw==

 key accounting cipher $c$3$721n+GQFC7t0pV48LIXKz5+4cbrhop2I1w==

 timer realtime-accounting 2

 user-name-format without-domain

 attribute 31 mac-format section three separator - lowercase

#

radius dynamic-author server

 client ip 172.16.15.200 key cipher $c$3$aa50yCTQvxx6DzUQl2ePmLhY6TK1IqC7vg==

#

domain name a-wifi

 authorization-attribute user-profile tetong

 authorization-attribute car inbound cir 4194303 outbound cir 4194303 pir 4194303

 accounting update-fail offline

 nas-id domain-a-wifi

 authentication ipoe radius-scheme aaa

 authorization ipoe radius-scheme aaa

 accounting ipoe radius-scheme aaa

#

domain name a-wifi_none

 authorization-attribute user-group a-wifi

 authorization-attribute ip-pool a-wifi_pre

 authentication ipoe none

 authorization ipoe none

 accounting ipoe none

 user-address-type private-ipv4

 web-server url http://28.28.28.100:8080/portal

 web-server ip 28.28.28.100

 web-server url-parameter userip source-address

 web-server url-parameter mac source-mac section 6 uppercase

#

domain name a-wifi_pre

 authorization-attribute user-group a-wifi

 authorization-attribute ip-pool a-wifi_pre

 authorization-attribute session-timeout 111

 nas-id h3c/vbras:a-wifi_pre

 authentication ipoe none

 authorization ipoe none

 accounting ipoe none

 web-server url http://28.28.28.100:8080/portal

 web-server ip 28.28.28.100

 web-server url-parameter userip source-address

 web-server url-parameter mac source-mac section 1 uppercase

 web-server url-parameter oriUrl original-url

 web-server url-parameter nas-id nas-id

 web-server url-parameter remote-id remote-id

#

domain name ppp

 authorization-attribute ip-pool ppp

 authentication ppp radius-scheme jsct

 authorization ppp radius-scheme jsct

 accounting ppp radius-scheme jsct

 user-address-type private-ipv4

#

domain name system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group a-wifi

#

user-group fail

#

user-group gys

#

user-group system

#

local-user root class manage

 password hash $h$6$zR1H0VQKmsPSrlki$QB3JtZ08KMBi8Gv85yP7uFPqnoF5l0biJjfApRvDod6fdejdI6o1vtjhSLvhfMsge/GBT+FZjAfbkkuQo307wg==

 service-type ftp

 service-type ssh telnet http https

 authorization-attribute user-role network-admin

#

local-user ip class network

 authorization-attribute user-role network-operator

#

local-user ipoe class network

 password cipher $c$3$FD4eC+mzM7K89XgqLWUievRGDyg11cfiqw==

 service-type ipoe

 authorization-attribute session-timeout 111

 authorization-attribute user-role network-operator

#

 ftp server enable

#

 undo portal refresh arp enable

#

portal server A-wifi

 ip 28.28.28.100 key cipher $c$3$jlIVq1QmzD/7Ym8rm9WdCnVeYtViHM0BFA==

#

 netconf soap http enable

 netconf soap https enable

#

 http-redirect https-port 6000

#

return

4  相关资料

·     H3C vBRAS系列虚拟宽带远程接入服务器 http://press.h3c.com/jsp/ir/fileList.do?classID=103&fileID=165210配置指导

·     H3C vBRAS系列虚拟宽带远程接入服务器 http://press.h3c.com/jsp/ir/fileList.do?classID=103&fileID=165210命令参考

不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!

新华三官网
联系我们