H3C Access Controllers

Comware 7 Remote Portal Authentication

(IPv6) Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring IPv6 remote portal authentication· 1

Network configuration·· 1

Analysis· 2

Restrictions and guidelines· 2

Procedures· 2

Configuring IMC·· 2

Configuring the AC·· 8

Configuring the switch·· 12

Verifying the configuration·· 14

Configuration files· 16

Related documentation· 19

 

Introduction

The following information provides examples for configuring IPv6 remote portal authentication.

Prerequisites

The following information applies to Comware 7-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access controllers and access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of AAA, portal, and WLAN.

Example: Configuring IPv6 remote portal authentication

Network configuration

As shown in Figure 1, the switch acts as both a DHCP server and a DHCPv6 server. The AP and the client obtain IPv4 and IPv6 addresses from the switch.

To implement remote portal authentication, perform the following tasks:

·     Configure direct portal authentication.

·     Configure a portal authentication server and a portal Web server on IMC.

·     Configure a RADIUS server as the authentication server and accounting server.

Figure 1 Network diagram

 

Analysis

To allow an authenticated user to access network resources on any Layer 2 ports in its access VLAN without re-authentication, enable portal roaming.

To avoid possible authentication failure caused by frequent logins and logouts of portal clients in a short time, disable the Rule ARP entry feature for portal clients.

For the RADIUS server to dynamically change user authorization information or forcibly disconnect users, enable the RADIUS session-control feature.

To allow portal users to access both IPv4 and IPv6 networks after passing one type (IPv4 or IPv6) of portal authentication, enable portal to support IPv4/IPv6 dual stack.

Restrictions and guidelines

When you configure remote portal authentication, follow these restrictions and guidelines:

·     Use the serial ID labeled on the AP's rear panel to specify an AP.

·     Make sure the types of the portal authentication server and portal Web server specified on the AC are the same as those actually used.

·     By default, the portal Web server URL redirected to users does not carry parameters. You can configure the parameters to be carried in the redirection URL as needed.

Procedures

Configuring IMC

This example uses the IMC server to describe the RADIUS server and portal server configuration. The IMC server runs on IMC PLAT 7.1, IMC EIA 7.1, and IMC EIP 7.1.

Configuring the RADIUS server

1.     Add an access device.

a.     Log in to IMC and click the User tab.

b.     From the navigation tree, select User Access Policy > Access Device Management > Access Device.

c.     Click Add.

The Add Access Device page opens.

d.     In the Access Configuration area, set the shared key to radius, which must be the same as that configured on the AC.

e.     In the Device List area, perform the following operations:

-     Click Add Manually to open the Add Access Device Manually page. Enter the start IPv4 address 192.168.1.1 and then click OK.

-     Click Add IPv6 Dev to open the Add Access Device Manually page. Enter the start IPv6 address 2001::1 and then click OK.

f.     Use the default settings for other parameters.

g.     Click OK.

Figure 2 Adding an access device

 

2.     Add an access policy.

a.     From the navigation tree, select User Access Policy > Access Policy.

b.     Click Add.

The Add Access Policy page opens.

c.     Enter the access policy name.

d.     Select a service group.

e.     Use the default settings for other parameters.

Figure 3 Adding an access policy

 

3.     Add an access service.

a.     From the navigation tree, select User Access Policy > Access Service.

b.     Click Add.

The Add Access Service page opens.

c.     Enter the service name.

d.     Select the access policy configured in the previous step as the default access policy.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 4 Adding an access service

 

4.     Add an access user.

a.     From the navigation tree, select Access User > All Access Users.

b.     Click Add.

The Add Access User page opens.

c.     Click Select to select an existing access user or click Add User to add a new access user.

d.     Set the password.

e.     Select the access service configured in the previous step.

f.     Use the default settings for other parameters.

g.     Click OK.

Figure 5 Adding an access user

 

Configuring the portal server

1.     Configure the portal authentication server:

a.     From the navigation tree, select User Access Policy > Portal Service > Server to open the portal server configuration page, as shown in Figure 6.

b.     Configure the portal server parameters as needed.

This example uses the default settings.

c.     Click OK.

Figure 6 Configuring the portal server

 

2.     Configure IP address groups:

a.     From the navigation tree, select User Access Policy > Portal Service > IP Group.

b.     Click Add.

The Add IP Group page opens.

c.     Enter an IP group name.

d.     Select No from the IPv6 field for an IPv4 address group and Yes for an IPv6 address group.

e.     Enter the start IP address and end IP address of the IP group.

Make sure the client IP address is in the IP group.

f.     Select a service group.

This example uses the default group Ungrouped.

g.     Select Normal from the Action list.

This step is required only for adding an IPv4 address group.

h.     Click OK.

Figure 7 Adding an IPv4 address group

 

Figure 8 Adding an IPv6 address group

 

3.     Add portal devices:

a.     From the navigation tree, select User Access Policy > Portal Service > Device.

b.     Click Add.

The Add Device page opens.

c.     Enter a device name.

d.     Select a portal version.

For adding an IPv4 portal device, select Portal 2.0. For adding an IPv6 portal device, select Portal 3.0.

e.     Enter the IP address of the AC's interface connected to the client.

f.     Set whether to support the portal server heartbeat and user heartbeat functions.

In this example, select No for both Support Server Heartbeat and Support User Heartbeat.

g.     Enter the key, which must be the same as that configured on the AC.

h.     Select Directly Connected for Access Method.

i.     Use the default settings for other parameters.

j.     Click OK.

Figure 9 Adding an IPv4 portal device

 

Figure 10 Adding an IPv6 portal device

 

4.     Associate the portal devices with the IP address groups:

a.     Click the Port Group icon in the Operation field of devices NAS4 and NAS6, as shown in Figure 11.

Figure 11 Device list

 

b.     Click Add to open the Add Port Group page.

c.     Enter the port group name.

d.     Select the configured IP address group.

The IP address used by the user to access the network must be within this IP address group.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 12 Adding an IPv4 port group

 

Figure 13 Adding an IPv6 port group

 

Committing configuration changes

# From the navigation tree, select User Access Policy > Service Parameters > Validate System Configuration to commit the configuration changes.

Configuring the AC

1.     Configure interfaces on the AC:

# Create VLAN 100 and VLAN-interface 100. Assign an IPv4 address and an IPv6 address to the VLAN interface. The AC will establish a CAPWAP tunnel with the AP in this VLAN.

<AC> system-view

[AC] vlan 100

[AC-vlan100] quit

[AC] interface vlan-interface 100

[AC-Vlan-interface100] ip address 192.168.1.1 24

[AC-Vlan-interface100] ipv6 address 2001::1 64

[AC-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200. Assign an IPv4 address and an IPv6 address to the VLAN interface. The AC will use VLAN 200 for client access.

[AC] vlan 200

[AC-vlan200] quit

[AC] interface vlan-interface 200

[AC-Vlan-interface200] ip address 192.168.2.1 24

[AC-Vlan-interface200] ipv6 address 2004::1 64

[AC-Vlan-interface200] quit

# Configure GigabitEthernet1/0/1 (the port connected to the switch) as a trunk port, and assign the port to VLAN 1, VLAN 100, and VLAN 200.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] port trunk permit vlan 1 100 200

[AC-GigabitEthernet1/0/1] quit

2.     Configure a static IPv4 route and a static IPv6 route to the IMC server:

[AC] ip route-static 192.168.3.0 255.255.255.0 192.168.2.2

[AC] ipv6 route-static 2003:: 64 2004::2

3.     Configure a wireless service:

# Create a service template named st1 and enter its view.

[AC] wlan service-template st1

# Set the SSID of service template st1 to service.

[AC-wlan-st-st1] ssid service

# Assign clients coming online through service template st1 to VLAN 200.

[AC-wlan-st-service] vlan 200

# Enable snooping ND packets and snooping DHCPv6 packets on service template st1.

[AC-wlan-st-st1] client ipv6-snooping nd-learning enable

[AC-wlan-st-st1] client ipv6-snooping dhcpv6-learning enable

# Enable service template st1.

[AC–wlan-st-st1] service-template enable

[AC-wlan-st-st1] quit

# Create an AP named office with model WA4320i-CAN and set its serial ID to 219801A0CNC138011454.

[AC] wlan ap office model WA4320i-ACN

[AC-wlan-ap-office] serial-id 219801A0CNC138011454

# Deploy configuration file map.txt to the AP.

[AC-wlan-ap-office] map-configuration map.txt

# Enter the view of radio 2.

[AC-wlan-ap-office] radio 2

# Bind service template st1 to radio 2 in AP office.

[AC-wlan-ap-office-radio-2] service-template st1

# Enable radio 2.

[AC-wlan-ap-office-radio-2] radio enable

[AC-wlan-ap-office-radio-2] quit

[AC-wlan-ap-office] quit

4.     Configure an IPv4 RADIUS scheme:

# Create a RADIUS scheme named rs1 and enter its view.

[AC] radius scheme rs1

# Specify the primary authentication server and primary accounting server, and configure the keys for communication with the servers.

[AC-radius-rs1] primary authentication 192.168.3.2

[AC-radius-rs1] primary accounting 192.168.3.2

[AC-radius-rs1] key authentication simple radius

[AC-radius-rs1] key accounting simple radius

# Configure the AC to remove the domain name from the usernames sent to the RADIUS servers.

[AC-radius-rs1] user-name-format without-domain

# Specify IP address 192.168.1.1 as the source IP address for outgoing RADIUS packets.

[AC-radius-rs1] nas-ip 192.168.1.1

[AC-radius-rs1] quit

5.     Configure an IPv6 RADIUS scheme:

# Create a RADIUS scheme named rs2 and enter its view.

[AC] radius scheme rs2

# Specify the primary authentication server and primary accounting server, and configure the keys for communication with the servers.

[AC-radius-rs2] primary authentication ipv6 2003::2

[AC-radius-rs2] primary accounting ipv6 2003::2

[AC-radius-rs2] key authentication simple radius

[AC-radius-rs2] key accounting simple radius

# Configure the AC to remove the domain name from the usernames sent to the RADIUS servers.

[AC-radius-rs2] user-name-format without-domain

# Specify IPv6 address 2001::1 as the source IP address for outgoing RADIUS packets.

[AC-radius-rs2] nas-ip ipv6 2001::1

[AC-radius-rs2] quit

# Enable the RADIUS session-control feature.

[AC] radius session-control enable

Configure the RADIUS DAS feature:

# Enable the RADIUS DAS feature and enter RADIUS DAS view.

[AC] radius dynamic-author server

# Specify a session-control client at IPv4 address 192.168.3.2 and shared key radius in plaintext form.

[AC-radius-da-server] client ip 192.168.3.2 key simple radius

# Specify a session-control client at IPv6 address 2003::2 and shared key radius in plaintext form.

[AC-radius-da-server] client ipv6 2003::2 key simple radius

[AC-radius-da-server] quit

6.     Configure an IPv4 authentication domain:

# Create an ISP domain named dm1 and enter its view.

[AC] domain dm1

# Configure the authentication and authorization methods as RADIUS and the accounting method as none for the ISP domain.

[AC-isp-dm1] authentication portal radius-scheme rs1

[AC-isp-dm1] authorization portal radius-scheme rs1

[AC-isp-dm1] accounting portal none

# Configure the idle cut feature for users in the ISP domain. Log out a user if the user's traffic is less than 1024 bytes in 15 minutes.

[AC-isp-dm1] authorization-attribute idle-cut 15 1024

[AC-isp-dm1] quit

7.     Configure an IPv6 authentication domain:

# Create an ISP domain named dm2 and enter its view.

[AC] domain dm2

# Configure the authentication and authorization methods as RADIUS and the accounting method as none for the ISP domain.

[AC-isp-dm2] authentication portal radius-scheme rs2

[AC-isp-dm2] authorization portal radius-scheme rs2

[AC-isp-dm2] accounting portal none

# Configure the idle cut feature for users in the ISP domain. Log out a user if the user's traffic is less than 1024 bytes in 15 minutes.

[AC-isp-dm2] authorization-attribute idle-cut 15 1024

[AC-isp-dm2] quit

8.     Configure portal authentication:

# Create an IPv4 portal authentication server named newptv4, and specify IP address 192.168.3.2 for the authentication server.

[AC] portal server newptv4

[AC-portal-server-newptv4] ip 192.168.3.2 key simple 123456

[AC-portal-server-newptv4] quit

# Create an IPv6 portal authentication server named newptv6, and specify IPv6 address 2003::2 for the authentication server.

[AC] portal server newptv6

[AC-portal-server-newptv6] ipv6 2003::2 key simple 123456

[AC-portal-server-newptv6] quit

# Create an IPv4 portal Web server named newptv4 and specify http://192.168.3.2:8080/portal as the URL of the server.

[AC] portal web-server newptv4

[AC-portal-websvr-newptv4] url http://192.168.3.2:8080/portal

# Add parameters ssid, wlanuserip, and wlanacname to the redirection URL for portal Web server newptv4. Specify the AP's SSID, the IP address of the client, and the AC's name as the value for the ssid, wlanuserip, and wlanacname parameters, respectively.

[AC-portal-websvr-newptv4] url-parameter ssid ssid

[AC-portal-websvr-newptv4] url-parameter wlanuserip source-address

[AC-portal-websvr-newptv4] url-parameter wlanacname value AC

[AC-portal-websvr-newptv4] quit

# Create an IPv6 portal Web server named newptv6 and specify http://[2003::2]:8080/portal as the URL of the server.

[AC] portal web-server newptv6

[AC-portal-websvr-newptv6] url http://[2003::2]:8080/portal

# Add parameters ssid, wlanuserip, and wlanacname to the redirection URL for portal Web server newptv6. Specify the AP's SSID, the IPv6 address of the client, and the AC's name as the value for the ssid, wlanuserip, and wlanacname parameters, respectively.

[AC-portal-websvr-newptv6] url-parameter ssid ssid

[AC-portal-websvr-newptv6] url-parameter wlanuserip source-address

[AC-portal-websvr-newptv6] url-parameter wlanacname value AC

[AC-portal-websvr-newptv6] quit

# Enable portal roaming.

[AC] portal roaming enable

# Disable the Rule ARP entry feature for portal clients.

[AC] undo portal refresh arp enable

# Enable validity check on wireless portal clients.

[AC] portal host-check enable

# Enable direct IPv4 portal authentication and direct IPv6 portal authentication on service template st1.

[AC] wlan service-template st1

[AC-wlan-st-st1] portal enable method direct

[AC-wlan-st-st1] portal ipv6 enable method direct

# Specify ISP domain dm1 as the portal authentication domain for IPv4 portal users.

[AC-wlan-st-st1] portal domain dm1

# Specify ISP domain dm2 as the portal authentication domain for IPv6 portal users.

[AC-wlan-st-st1] portal ipv6 domain dm2

# Specify IPv4 portal Web server newptv4 and IPv6 portal Web server newptv6 on service template st1 for portal authentication.

[AC-wlan-st-st1] portal apply web-server newptv4

[AC-wlan-st-st1] portal ipv6 apply web-server newptv6

# Enable portal to support IPv4/IPv6 dual stack on service template st1.

[AC-wlan-st-st1] portal dual-stack enable

# Configure the BAS-IP attribute as 192.168.2.1 and the BAS-IPv6 attribute as 2004::1.

[AC-wlan-st-st1] portal bas-ip 192.168.2.1

[AC-wlan-st-st1] portal bas-ipv6 2004::1

[AC-wlan-st-st1] quit

# Configure a source-based portal-free rule. Set the rule number to 3 and the source interface to aggregate interface 1. This rule allows the portal user on the aggregate interface to access network resources without authentication.

[AC] portal free-rule 3 source interface Bridge-Aggregation1

Configuring the switch

1.     Configure interfaces on the switch:

# Create VLAN 100. The switch will use this VLAN to forward traffic on the CAPWAP tunnel between the AC and the AP.

<Switch> system-view

[Switch] vlan 100

[Switch-vlan100] quit

# Create VLAN 200. The switch will use this VLAN to forward client traffic.

[Switch] vlan 200

[Switch-vlan200] quit

# Create VLAN 2.

[Switch] vlan 2

[Switch-vlan2] quit

# Configure GigabitEthernet 1/0/1 (the port connected to the AC) as a trunk port and assign the trunk port to VLAN 1, VLAN 100, and VLAN 200.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] port link-type trunk

[Switch-GigabitEthernet1/0/1] port trunk permit vlan 1 100 200

[Switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 (the port connected to the AP) as an access port and assign the access port to VLAN 100.

[Switch] interface gigabitethernet 1/0/2

[Switch-GigabitEthernet1/0/2] port link-type access

[Switch-GigabitEthernet1/0/2] port access vlan 100

# Enable PoE on the access port.

[Switch-GigabitEthernet1/0/2] poe enable

[Switch-GigabitEthernet1/0/2] quit

# Create VLAN-interface 1 and assign an IPv4 address and an IPv6 address to the VLAN interface.

[Switch] interface vlan-interface 1

[Switch-Vlan-interface1] ip address 192.168.3.1 255.255.255.0

[Switch-Vlan-interface1] ipv6 address 2003::1 64

[Switch-Vlan-interface1] quit

# Create VLAN-interface 100 and assign an IPv4 address and an IPv6 address to the VLAN interface.

[Switch] interface vlan-interface 100

[Switch-Vlan-interface100] ip address 192.168.1.2 255.255.255.0

[Switch-Vlan-interface100] ipv6 address 2001::2 64

[Switch-Vlan-interface100] quit

# Create VLAN-interface 200 and assign an IPv4 address and an IPv6 address to the VLAN interface.

[Switch] interface vlan-interface 200

[Switch-Vlan-interface200] ip address 192.168.2.2 255.255.255.0

[Switch-Vlan-interface200] ipv6 address 2004::2 64

[Switch-Vlan-interface200] quit

2.     Configure the DHCP server:

# Enable DHCP.

[Switch] dhcp enable

# Configure DHCP address pool named 100 and specify subnet 192.168.1.0/24 and gateway address 192.168.1.1 for the DHCP address pool. The switch will assign an IPv4 in this DHCP address pool to the AP.

[Switch] dhcp server ip-pool 100

[Switch-dhcp-pool-100] network 192.168.1.0 mask 255.255.255.0

[Switch-dhcp-pool-100] gateway-list 192.168.1.1

# Configure Option 43 that specifies the AC's IPv4 address in hexadecimal notation in DHCP address pool 100.

[Switch-dhcp-pool-100] option 43 hex 8007000001c0a80101

[Switch-dhcp-pool-100] quit

# Configure DHCP address pool named 200 and specify subnet 192.168.2.0/24 and gateway address 192.168.2.2 for the DHCP address pool. The switch will assign an IPv4 address in this DHCP address pool to the client.

[Switch] dhcp server ip-pool 200

[Switch-dhcp-pool-200] network 192.168.2.0 mask 255.255.255.0

[Switch-dhcp-pool-200] gateway-list 192.168.2.2

[Switch-dhcp-pool-200] quit

3.     Configure the DHCPv6 server:

# Create DHCPv6 address pool named 1 and specify subnet 2001::/64 for the DHCPv6 address pool. The switch will assign an IPv6 address in this DHCP address pool to the AP.

[Switch] ipv6 dhcp pool 1

[Switch-dhcp6-pool-1] network 2001::/64

# Configure Option 52 that specifies the AC's IPv6 address in DHCPv6 address pool 1.

[Switch-dhcp6-pool-1] option 52 hex 20010000000000000000000000000001

[Switch-dhcp6-pool-1] quit

[Switch] ipv6 dhcp server forbidden-address 2001::1

# Apply DHCPv6 address pool 1 to VLAN-interface 100, and enable the DHCPv6 server on the VLAN interface.

[Switch] interface vlan-interface 100

[Switch-Vlan-interface100] ipv6 dhcp server apply pool 1

[Switch-Vlan-interface100] ipv6 dhcp select server

# Set the M flag to 1 and the O flag to 1 in RA advertisements to be sent on VLAN-interface 100.

[Switch-Vlan-interface100] ipv6 nd autoconfig managed-address-flag

[Switch-Vlan-interface100] ipv6 nd autoconfig other-flag

# Disable RA message suppression.

[Switch-Vlan-interface100] undo ipv6 nd ra halt

[Switch-Vlan-interface100] quit

# Create DHCPv6 address pool named 2 and specify subnet 2004::/64 for the DHCPv6 address pool. The switch will assign an IPv6 address in this DHCP address pool to the client.

[Switch] ipv6 dhcp pool 2

[Switch-dhcp6-pool-2] network 2004::/64

[Switch-dhcp6-pool-2] quit

# Exclude IPv6 address 2004::1 in the DHCPv6 address pool from dynamic allocation.

[Switch] ipv6 dhcp server forbidden-address 2004::1

# Apply DHCPv6 address pool 2 to VLAN-interface 200, and enable the DHCPv6 server on the VLAN interface.

[Switch] interface Vlan-interface 200

[Switch-Vlan-interface200] ipv6 dhcp server apply pool 2

[Switch-Vlan-interface200] ipv6 dhcp select server

# Set the M flag to 1 and the O flag to 1 in RA advertisements to be sent on VLAN-interface 200.

[Switch-Vlan-interface200] ipv6 nd autoconfig managed-address-flag

[Switch-Vlan-interface200] ipv6 nd autoconfig other-flag

# Disable RA message suppression.

[Switch-Vlan-interface200] undo ipv6 nd ra halt

[Switch-Vlan-interface200] quit

Verifying the configuration

1.     Verify that the dual-stack client can access network resources after passing IPv4 portal authentication.

a.     Use the configured username and password to perform IPv4 portal authentication through a Web browser on the client.

b.     Verify that all Web requests of the user will be redirected to the portal authentication page (http://192.168.3.2:8080/portal) before the client passes IPv4 portal authentication. After the user passes IPv4 portal authentication, the user can access network resources. (Details not shown.)

c.     Display information about all portal users on the AC after the client passes IPv4 authentication.

[AC] display portal user all

Total portal users: 1

Username: client

  AP name: office

  Radio ID: 2

  SSID: service

  Portal server: newptv4

  State: Online

  VPN instance: N/A

  MAC             IP                    VLAN    Interface

  3829-5a40-9589  192.168.2.3           200     WLAN-BSS1/0/2

  Authorization information:

    DHCP IP pool: N/A

    User profile: N/A

    Session group profile: N/A

    ACL number: N/A

    Inbound CAR: N/A

    Outbound CAR: N/A

The output shows that the client has come online.

2.     Verify that the dual-stack client can access network resources after passing IPv6 portal authentication.

a.     Use the configured username and password to perform IPv6 portal authentication through a Web browser on the client.

b.     Verify that all Web accesses of the user are redirected to the portal authentication page (http://[2003::2]:8080/portal) before the client passes IPv6 portal authentication. After the user passes IPv6 portal authentication, the user can access network resources. (Details not shown.)

c.     Display the online portal user information on the AC after the client passes authentication.

[AC] display portal user all

Total portal users: 1

Username: Client

  AP name: office

  Radio ID: 2

  SSID: service

  Portal server: newptv6

  State: Online

  VPN instance: N/A

  MAC             IP                    VLAN    Interface

  3829-5a40-9589  2004::4549:7C7F:392E: 200     WLAN-BSS1/0/2

                  EE57

  Authorization information:

    DHCP IP pool: N/A

    User profile: N/A

    Session group profile: N/A

    ACL number: N/A

    Inbound CAR: N/A

    Outbound CAR: N/A

The output shows that the client has come online.

Configuration files

·     AC:

#

vlan 100

#

vlan 200

#

wlan service-template st1

 ssid service

 vlan 200

 client ipv6-snooping nd-learning enable

 client ipv6-snooping dhcpv6-learning enable

 portal enable method direct

 portal domain dm1

 portal bas-ip 192.168.2.1

 portal apply web-server newptv4

 portal ipv6 enable method direct

 portal ipv6 domain dm2

 portal bas-ipv6 2004::1

 portal ipv6 apply web-server newptv6

 portal dual-stack enable

 service-template enable

#

interface Vlan-interface100

 ip address 192.168.1.1 255.255.255.0

 ipv6 address 2001::1/64

#

interface Vlan-interface200

 ip address 192.168.2.1 255.255.255.0

 ipv6 address 2004::1/64

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 100 200

#

 ip route-static 192.168.3.0 24 192.168.2.2

 ipv6 route-static 2003:: 64 2004::2

#

 radius session-control enable

#

radius scheme rs1

 primary authentication 192.168.3.2

 primary accounting 192.168.3.2

 key authentication cipher $c$3$2m4BXR2X65vE59L0SyyHH0tRVpkKDgym9w==

 key accounting cipher $c$3$4ieHsnXQVnQ7GwywFS+H0MoQdb6SEmJSRg==

 user-name-format without-domain

 nas-ip 192.168.1.1

#

radius scheme rs2

 primary authentication ipv6 2003::2

 primary accounting ipv6 2003::2

 key authentication cipher $c$3$8bAMsBFXCGlbmynTi08YCxotgTXYwzES0w==

 key accounting cipher $c$3$QeTcfxJGTnPJ98PsCSbLnaZP6KAG6q42aQ==

 user-name-format without-domain

 nas-ip ipv6 2001::1

#

radius dynamic-author server

 client ip 192.168.3.2 key cipher $c$3$l9xAYe5vBJQMTOv6quHJFXtZlti404CjBg==

 client ipv6 2003::2 key cipher $c$3$ELOjfzKgjUoRbJ/wZX0E9eVdGBFeTQzmHA==

#

domain dm1

 authorization-attribute idle-cut 15 1024

 authentication portal radius-scheme rs1

 authorization portal radius-scheme rs1

 accounting portal none

#

domain dm2

 authorization-attribute idle-cut 15 1024

 authentication portal radius-scheme rs2

 authorization portal radius-scheme rs2

 accounting portal none

#

 portal host-check enable

#

portal web-server newptv4

 url http://192.168.3.2:8080/portal

 url-parameter ssid ssid

 url-parameter wlanacname value AC

 url-parameter wlanuserip source-address

#

portal web-server newptv6

 url http://[2003::2]:8080/portal

 url-parameter ssid ssid

 url-parameter wlanacname value AC

 url-parameter wlanuserip source-address

#

portal server newptv4

 ip 192.168.3.2 key cipher $c$3$XkIMNqFj0It2yZOqdfPeOeasD0Jk4oJQFA==

#

portal server newptv6

 ipv6 2003::2 key cipher $c$3$9MzqVffE//Ma5x4a4gJOSQKrnSBS5EslXg==

#

wlan ap office model WA4320i-ACN

 serial-id 219801A0CNC138011454

 radio 2

  radio enable

  service-template st1

#

Return

·     Switch:

#

 ipv6 dhcp server forbidden-address 2001::1

 ipv6 dhcp server forbidden-address 2004::1

#

vlan 1

#

vlan 100

#

vlan 200

#

dhcp server ip-pool 100

 gateway-list 192.168.1.1

 network 192.168.1.0 mask 255.255.255.0

 option 43 hex 8007000001c0a80101

#

dhcp server ip-pool 200

 gateway-list 192.168.2.2

 network 192.168.2.0 mask 255.255.255.0

#

ipv6 dhcp pool 1

 network 2001::/64

 option 52 hex 20010000000000000000000000000001

#

ipv6 dhcp pool 2

 network 2004::/64

#

interface Vlan-interface1

 ip address 192.168.3.1 255.255.255.0

 ipv6 address 2003::1/64

#

interface Vlan-interface100

 ip address 192.168.1.2 255.255.255.0

 ipv6 dhcp select server

 ipv6 dhcp server apply pool 1

 ipv6 address 2001::2/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface Vlan-interface200

 ip address 192.168.2.2 255.255.255.0

 ipv6 dhcp select server

 ipv6 dhcp server apply pool 2

 ipv6 address 2004::2/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/2

 port access vlan 100

 poe enable

#

Return

Related documentation

·     Security Command Reference in H3C Access Controllers Command References

·     Security Configuration Guide in H3C Access Controllers Configuration Guides

·     WLAN Command Reference in H3C Access Controllers Command References

·     WLAN Configuration Guide in H3C Access Controllers Configuration Guides