Login
| Title | Size | Downloads |
|---|---|---|
| H3C S3600 Series Ethernet Switches Command Manual-Release 1702(V1.01)-Web Authentication Command.pdf | 129.7 KB |
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 20-Web Authentication Command | 129.7 KB |
Table of Contents
1 Web Authentication Configuration Commands·
Web Authentication Configuration Commands
display web-authentication configuration
display web-authentication connection
web-authentication cut connection
web-authentication max-connection
web-authentication select method
web-authentication timer idle-cut
web-authentication timer max-online
1 Web Authentication Configuration Commands
l Support of customizing Web Authentication pages is added. For specific commands, refer to web-authentication customize.
l Support of HTTPS access for Web Authentication is added. For specific commands, refer to web-authentication protocol.
l Support of setting maximum online time for online users is added. For specific commands, refer to web-authentication timer max-online.
Web Authentication Configuration Commands
display web-authentication configuration
Syntax
display web-authentication configuration
View
Any view
Parameters
None
Description
Use the display web-authentication configuration command to display all Web authentication configurations, including global configurations and configurations on individual ports.
Examples
# Display Web authentication configuration information.
<Sysname> display web-authentication configuration
Status: enabled
Protocol: HTTP
Web Server: IP=30.1.1.2 Port=80
Idle-cut time: 900 sec
Max-online time: 1800 sec
Max-connection of device is: 512
Customized authentication-page information :
Corp-Name: H3C Technologies
Platform-Name: A leading global supplier of IP-based products and solutions
Phone-Num: +86-571-86760000
Email-address: [email protected]
File:
Free IP:
1) IP=10.1.1.0 Net Mask=255.255.255.0
Free User:
1) IP=192.168.0.108 MAC=000d-88f6-44c1
Interface Configuration:
Interface_number method max-connection
Ethernet1/0/1 shared 128
Ethernet1/0/14 shared 128
Table 1-1 Description on the fields of display web-authentication configuration
|
Field |
Description |
|
Status |
Global status of Web authentication |
|
Protocol |
Access protocol for Web authentication, HTTP or HTTPS |
|
Web Server |
IP address and port number of the Web authentication server |
|
Idle-cut time |
idle user checking interval |
|
Max-online time |
Maximum online time of a user |
|
Max-connection of device |
Maximum number of online Web authentication users |
|
Customized authentication-page information |
Customized Web authentication page elements, which may include the company name, subject introduction, contact phone number, contact E-mail address, or the customized Web file |
|
Free IP |
Free IP address range information |
|
Free User |
Authentication-free user information |
|
Interface Configuration |
Configuration information about Web-authentication-enabled ports |
|
Interface_number |
Index of a Web-authentication-enabled port |
|
method |
User access method on the port, Shared or Designated. |
|
max-connection |
Maximum number of online users allowed on the port |
display web-authentication connection
Syntax
display web-authentication connection { all | interface interface-type interface-number | user-name user-name }
View
Any view
Parameters
all: Displays information about all online Web-authentication users.
interface-type interface-number: Type and number of an interface.
user-name: Name of a user, a string of 1 to 184 characters.
Description
Use the display web-authentication connection command to display information about specified or all online Web-authentication users.
Examples
# Display information about all online Web-authentication users.
<Sysname> display web-authentication connection all
Username: 1
MAC: 000d-88f6-44c1 Interface: Ethernet1/0/1
VLAN: 2 Method: Shared
State: ONLINE Online-Time(s): 8
Total 1 connection(s) matched
Table 1-2 Description on the fields of display web-authentication connection
|
Field |
Description |
|
Username |
Name of an online Web-authentication user |
|
MAC |
MAC address of the user |
|
Interface |
Access port of the user |
|
VLAN |
VLAN the user belongs to |
|
Method |
Access method of the user, Shared or Designated. |
|
State |
User status |
|
Online-Time(s) |
Online time of the user |
web-authentication customize
Syntax
web-authentication customize { corp-name corporation-text | email email-string | phone-num phonenum-string | platform-name platform-text | file web-file }
undo web-authentication customize { corp-name | email | phone-num | platform-name | file | all }
View
System view
Parameters
corp-name: Specifies the company name to be displayed on Web authentication pages.
corporation-text: Company name, a string of 1 to 64 characters that can contain spaces.
email: Specifies the E-mail address to be displayed on Web authentication pages.
email-string: E-mail address, a string of 1 to 64 characters that can contain spaces. If it contains spaces, it must be enclosed with a pair of double quotation marks.
phone-num: Specifies the phone number to be displayed on Web authentication pages.
phonenum-string: Phone number, a string of 1 to 32 characters that can contain spaces. If it contains spaces, it must be enclosed with a pair of double quotation marks.
platform-name: Specifies the subject to be displayed on Web authentication pages.
platform-text: Subject introduction, a string of 1 to 128 characters that can contain spaces.
file: Specifies the customized Web file.
web-file: Name of the customized Web file, a string of 1 to 142 characters.
all: Restores all customized items to the defaults.
Description
Use the web-authentication customize command to customize the company name, subject, contact phone number, contact E-mail address, or the customized Web file to be displayed on authentication pages. After the configuration, the customized information will be displayed on all Web pages provided during the authentication process.
Use the undo web-authentication customize command to restore the specified or all customized items to the defaults.
By default, no customized information is configured to be displayed on Web authentication pages.
Examples
# Customize information to be displayed on Web authentication pages as follows:
l Company name: H3C Technologies
l E-mail: [email protected]
l Phone number: +86-571-86760000
l Subject: A leading global supplier of IP-based products and solutions
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication customize corp-name H3C Technologies
[Sysname] web-authentication customize email [email protected]
[Sysname] web-authentication customize phone-num +86-571-86760000
[Sysname] web-authentication customize platform-name A leading global supplier of IP-based products and solutions
After the above configuration, the customized information will be displayed on the Web authentication page, as shown in Figure 1-1.
Figure 1-1 Web authentication page with customized information
web-authentication cut connection
Syntax
web-authentication cut connection { all | mac mac-address | user-name user-name | interface interface-type interface-number }
View
System view
Parameters
all: Specifies all online users.
mac mac-address: Specifies an user by the user’s MAC address.
user-name user-name: Specifies a user by the user’s name, which is a string of 1 to 184 characters.
interface-type interface-number: Specifies all users on a port.
Description
Use the web-authentication cut connection command to forcibly log out the specified or all users.
Examples
# Forcibly log out all online users on Ethernet 1/0/2.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication cut connection interface Ethernet1/0/2
web-authentication enable
Syntax
web-authentication enable
undo web-authentication enable
View
System view
Parameters
None
Description
Use the web-authentication enable command to enable Web authentication globally.
Use the undo web-authentication enable command to disable Web authentication globally.
Web authentication cannot be enabled when one of the following features is enabled, and vice versa: 802.1x, MAC authentication, port security, port aggregation and IRF.
Examples
# Enable Web authentication globally.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication web-server ip 192.168.0.56 port 80
[Sysname] web-authentication enable
web-authentication free-ip
Syntax
web-authentication free-ip ip-address { mask-length | mask }
undo web-authentication free-ip { ip-address { mask-length | mask } | all }
View
System view
Parameters
ip-address: IP address.
mask-length: Mask length, ranging from 1 to 32.
mask: Mask address.
Description
Use the web-authentication free-ip command to set a free IP address range, which can be accessed by users before they pass Web authentication.
Use the undo web-authentication free-ip command to remove the setting or all such settings.
By default, no free IP address range is set.
l The to-be-set free IP address range cannot include the Web authentication server’s IP address.
l At most four free IP address range can be set.
Examples
# Set IP address range 10.1.1.0/24 as a free address range.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication free-ip 10.1.1.0 24
web-authentication free-user
Syntax
web-authentication free-user ip ip-address mac mac-address
undo web-authentication free-user { ip ip-address mac mac-address | all }
View
System view
Parameters
ip-address: IP address of a user.
mac-address: MAC address of the user, in the format of H-H-H (for example, 000d-88f6-44c1).
all: Deletes all authentication-free user settings.
Description
Use the web-authentication free-user command to set an authentication-free user, so that a user whose source IP and MAC addresses are both identical with those of the authentication-free user can access the network without the necessary to pass the Web authentication.
Use the undo web-authentication free-user command to remove the setting or all such settings.
By default, no authentication-free user is set.
l You can set up to eight authentication-free users.
l After a user gets online in shared access method, if you configure an authentication-free user whose IP address and MAC address are the same as those of the online user, the online user will be forced to get offline.
Examples
# Set the user with IP address 192.168.0.108 and MAC address 0010-0020-0030 as an authentication-free user.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication free-user ip 192.168.0.108 mac 0010-0020-0030
web-authentication max-connection
Syntax
web-authentication max-connection number
undo web-authentication max-connection
View
System view, Ethernet Port view
Parameters
number: Maximum number of online Web-authentication users.
Description
Use the web-authentication max-connection command to limit the number of online Web authentication users on the device or on the current port. When this threshold is reached, no more users can pass the Web authentication on the device or port.
This configuration can only be performed on ports in shared access method.
By default, a port allows up to 128 online Web-authentication users, and a device allows up to 512 online Web-authentication users.
Examples
# Configure Ethernet 1/0/1 to allow at most 100 online Web-authentication users.
System View: return to User View with Ctrl+Z.
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] web-authentication select method shared
[Sysname-Ethernet1/0/1] web-authentication max-connection 100
web-authentication protocol
Syntax
web-authentication protocol { http | https server-policy policy-name }
undo web-authentication protocol
View
System view
Parameters
http: Specifies that clients use HTTP to access the authentication pages. Authentication information is not encrypted in this mode.
https: Specifies that clients use HTTPS to access the authentication pages. Authentication information is encrypted in this mode.
policy-name: Specifies the SSL server policy by its name, a string of 1 to 16 characters.
Description
Use the web-authentication protocol command to specify the access protocol for Web authentication. If you specify the access protocol as HTTPS, authentication information exchanged between the switch and its clients will be in ciphertext.
Use the undo web-authentication protocol command to restore the default.
By default, HTTP is used between the switch and its clients.
Note that:
l You must configure this command before enabling Web authentication. That is, after enabling Web authentication, you cannot change the access protocol for Web authentication.
l Before configuring HTTPS access for Web authentication, be sure to configure the SSL server policy and request a certificate for the PKI domain of the SSL server policy.
l After modifying the used SSL server policy, you need to disable Web authentication and then enable it again in system view to make the changes take effect.
l Only SSL 3.0 and TLS 1.0 are supported. SSL 2.0 is not supported.
l With HTTPS access for Web authentication configured on the switch, clients need to use HTTP 1.1 to log in. Otherwise, the speed of opening the authentication page will be very low.
Examples
# Configure HTTPS access for Web authentication, specifying to use SSL server policy pt_ssl.
<Sysname> system-view
[Sysname] web-authentication protocol https server-policy pt_ssl
web-authentication select method
Syntax
web-authentication select method { shared | designated }
undo web-authentication select
View
Port view
Parameters
shared: Sets the Web authentication access method on the port to shared.
designated: Sets the Web authentication access method on the port to designated.
Description
Use the web-authentication select command to enable Web authentication on the current port and set the Web authentication access method on the port.
Use the undo web-authentication select command to disable Web authentication on the port.
There are two Web authentication access methods:
l shared: In this mode, the port allows multiple Web authentication users to be online at the same time.
l designated: In this mode, the port allows only one Web authentication user to be online at a time.
This configuration takes effect only when Web authentication is enabled globally. If Web authentication is not enabled globally, this configuration will only be saved.
You are not allowed to enable Web authentication on a port if:
l The port is an access port, or,
l The port belongs to an aggregation group.
Examples
# Enable Web authentication on Ethernet 1/0/1 and set the Web authentication access method to shared.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] web-authentication select method shared
web-authentication timer idle-cut
Syntax
web-authentication timer idle-cut timer
undo web-authentication timer idle-cut
View
System view
Parameters
timer: Interval for checking whether an online user is idle. It ranges from 10 to 86400 seconds. Value 0 means the idle user checking function is disabled.
Description
Use the web-authentication timer idle-cut command to set the idle user checking interval for Web authentication.
Use the undo web-authentication timer idle-cut command to restore the default.
By default, the idle user checking interval is 900 seconds for Web authentication.
The idle user checking interval is the interval at which the system checks whether a user is idle. When a user is found idle, if the corresponding MAC address entry has not been aged out, the system keeps the user online; otherwise, the system logs off the user. You are recommended to set the interval to a value that is greater than half of the MAC address entry aging time but less than the MAC address entry aging time.
Examples
# Set the idle user checking interval to 500 seconds for Web authentication.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication timer idle-cut 500
web-authentication timer max-online
Syntax
web-authentication timer max-online timer
undo web-authentication timer max-online
View
System view
Parameters
timer: Maximum online time specified for online users, in the range of 10 to 86400, in seconds. Value 0 means there is no limit to the online time of users.
Description
Use the web-authentication timer max-online command to set the maximum online time for online users. If a user does not log off after the online timer expires, the switch will log off the user forcibly.
Use the undo web-authentication timer max-online command to restore the default.
By default, the maximum online time for users is 1800 seconds.
Examples
# Set the maximum online time of users to 36000 seconds.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication timer max-online 36000
web-authentication web-server
Syntax
web-authentication web-server ip ip-address [ port port-number ]
undo web-authentication web-server
View
System view
Parameters
ip-address: IP address of the Web authentication server. It must be a valid unicast address.
port-number: Port number of the Web authentication server. It ranges from 1 to 50000, with 80 as the default.
Description
Use the web-authentication web-server ip command to set the IP address and port number of the Web authentication server, which will be used for Web authentication of users.
Use the undo web-authentication web-server command to restore the default.
By default, no Web authentication server IP address is set and the port number is 80.
Before enabling Web authentication globally, you should first set the IP address of the Web authentication server.
Examples
# Set the IP address and port number of the Web authentication server to 192.168.0.56 and 80.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] web-authentication web-server ip 192.168.0.56 port 80
