H3C Access Points
Comware 7 Remote 802.1X Authentication (IPv6)
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document version: 6W100-20201125

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring remote authentication for 802.1X clients (IPv6) 1

Network configuration· 1

Prerequisites· 1

Procedures· 2

Configuring the fat AP· 2

Configuring the switch· 3

Configuring the RADIUS server 4

Verifying the configuration· 7

Configuration files· 7

Related documentation· 9

 

Introduction

The following information provides an example to configure remote 802.1X authentication for control of access to an IPv6 wireless network.

Prerequisites

The following information applies to Comware 7-based access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of WLAN access, WLAN authentication, and 802.1X.

Example: Configuring remote authentication for 802.1X clients (IPv6)

Network configuration

As shown in Figure 1:

·     The switch acts as a DHCPv6 server to assign IPv6 addresses to the fat AP and the client.

·     The fat AP uses the RADIUS server to authenticate the client. In this example, IMC acts as the RADIUS server.

·     The fat AP uses open system authentication at the data link layer for the client. This is the default authentication method.

Figure 1 Network diagram

 

Prerequisites

Make sure the client, fat AP, switch, and RADIUS server have network connectivity.

Procedures

Configuring the fat AP

1.     Configure interfaces:

# Create VLAN 100 and VLAN-interface 100, and configure the VLAN interface to obtain an IPv6 address through DHCP. The fat AP will use the IPv6 address of this VLAN interface to communicate with the RADIUS server.

<AP> system-view

[AP] vlan 100

[AP-vlan100] quit

[AP] interface vlan-interface 100

[AP-Vlan-interface100] ipv6 address dhcp-alloc

[AP-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200. VLAN 200 will be used for client access.

[AP] vlan 200

[AP-vlan200] quit

[AP] interface vlan-interface 200

2.     Configure RADIUS-based 802.1X authentication:

# Configure EAP relay as the method for the fat AP to exchange packets with the RADIUS server.

<AP> system-view

[AP] dot1x authentication-method eap

# Create RADIUS scheme imcc and enter its view.

[AP] radius scheme imcc

# Specify the IPv6 address of the primary RADIUS authentication server.

[AP-radius-imcc] primary authentication ipv6 2003::2 1812

# Specify the IPv6 address of the primary RADIUS accounting server.

[AP-radius-imcc] primary accounting ipv6 2003::2 1813

# Set the shared key to 12345678 in plaintext form for secure communication with the RADIUS authentication server.

[AP-radius-imcc] key authentication simple 12345678

# Set the shared key to 12345678 in plaintext form for secure communication with the RADIUS accounting server.

[AP-radius-imcc] key accounting simple 12345678

# Exclude the domain name from usernames sent to the RADIUS servers.

[AP-radius-imcc] user-name-format without-domain

[AP-radius-imcc] quit

3.     Create ISP domain imc and configure the ISP domain to use RADIUS scheme imcc for 802.1X user authentication, authorization, and accounting.

[AP] domain imc

[AP-isp-imc] authentication lan-access radius-scheme imcc

[AP-isp-imc] authorization lan-access radius-scheme imcc

[AP-isp-imc] accounting lan-access radius-scheme imcc

[AP-isp-imc] quit

4.     Configure a wireless service:

# Create service template service and enter its view.

[AP] wlan service-template service

# Set the access authentication mode to 802.1X authentication, and specify ISP domain imc for authenticating the 802.1X client.

[AP-wlan-st-service] client-security authentication-mode dot1x

[AP-wlan-st-service] dot1x domain imc

# Set the SSID of the service template to service.

[AP-wlan-st-service] ssid service

# Set the VLAN of the service template to VLAN 200.

[AP-wlan-st-service] vlan 200

# Set the AKM mode to 802.1X, specify the CCMP cipher suite, and enable the RSN IE in beacon and probe responses.

[AP-wlan-st-service] akm mode dot1x

[AP-wlan-st-service] cipher-suite ccmp

[AP-wlan-st-service] security-ie rsn

# Enable the service template.

[AP-wlan-st-service] service-template enable

[AP-wlan-st-service] quit

# Bind service template service to interface WLAN-Radio 1/0/1.

[AP] interface wlan-radio 1/0/1

[AP-WLAN-Radio1/0/1] undo shutdown

[AP-WLAN-Radio1/0/1] service-template service

[AP-WLAN-Radio1/0/1] quit

Configuring the switch

1.     Configure interfaces:

# Create VLAN 100 and VLAN-interface 100, enable the DHCPv6 server on the VLAN interface, apply pool 100 to the VLAN interface, and assign an IPv6 address to the VLAN interface. The switch will use this IPv6 address to communicate with the fat AP.

<Switch> system-view

[Switch] vlan 100

[Switch-vlan100] quit

[Switch] interface vlan-interface 100

[Switch-Vlan-interface100] ipv6 dhcp select server

[Switch-Vlan-interface100] ipv6 dhcp server apply pool 100

[Switch-Vlan-interface100] ipv6 address 2010::1/64

[Switch-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200, enable the DHCPv6 server on the VLAN interface, apply pool 200 to the VLAN interface, and assign an IPv6 address to the VLAN interface. This VLAN will be used for client access.

[Switch] vlan 200

[Switch-vlan200] quit

[Switch] interface vlan-interface 200

[Switch-Vlan-interface200] ipv6 dhcp select server

[Switch-Vlan-interface200] ipv6 dhcp server apply pool 200

[Switch-Vlan-interface200] ipv6 address 2::1:0:0:1/96

[Switch-Vlan-interface200] quit

# Configure the port connected to the fat AP. Set the port link type to trunk, permit traffic from all VLANs to pass through the port, and set the PVID of the port to VLAN 100.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] port link-type trunk

[Switch-GigabitEthernet1/0/1] port trunk permit vlan all

[Switch-GigabitEthernet1/0/1] port trunk pvid vlan 100

[Switch-GigabitEthernet1/0/1] quit

2.     Configure the DHCP server:

# Enable the DHCP service.

[Switch] dhcp enable

# Configure DHCPv6 address pool 100 for AP address assignment. In the address pool, specify 2010::1 as the gateway IP address and 2010::/64 as the subnet for dynamic allocation.

[Switch] ipv6 dhcp pool 100

[Switch-dhcp6-pool-100] network 2010::/64

[Switch-dhcp6-pool-100] gateway-list 2010::1

[Switch-dhcp6-pool-100] quit

# Configure DHCPv6 address pool 200 for client address assignment. In the address pool, specify 2::1:0:0:1 as the gateway IP address and 2::1:0:0:0/96 as the subnet for dynamic allocation.

[Switch] ipv6 dhcp pool 200

[Switch-dhcp-pool-vlan100] network 2::1:0:0:0/96

[Switch-dhcp-pool-vlan100] gateway-list 2::1:0:0:1

[Switch-dhcp-pool-vlan100] quit

Configuring the RADIUS server

Restrictions and guidelines

This example uses IMC PLAT 7.3 (E0605) and UAM 7.3 (E0512) to show the procedure.

Make sure the EAP-PEAP certificate has been installed on the server.

Adding the fat AP as an access device to IMC

1.     Log in to IMC and click the User tab.

2.     From the navigation pane, select User Access Policy > Access Device Management > Access Device.

3.     Click Add.

The Add Access Device page opens.

4.     In the Access Configuration area, configure the following parameters, as shown in Figure 2:

¡     Enter 12345678 in the Shared Key and Confirm Shared Key fields. The shared key must be the same as the authentication and accounting shared keys configured on the fat AP.

¡     Use the default values for other parameters.

5.     In the Device List area, click Select or Add Manually to add the fat AP at 2010::2 as an access device.

6.     Click OK.

Figure 2 Adding an access device

 

Adding an access policy

1.     Click the User tab.

2.     From the navigation pane, select User Access Policy > Access Policy.

3.     Click Add.

4.     On the Add Access Policy page, configure the following parameters, as shown in Figure 3:

¡     Enter dot1x in the Access Policy Name field.

¡     Set the certificate type to EAP-PEAP and set the certificate subtype to EAP-MSCHAPv2.

The certificate subtype on the IMC server must be the same as the identity authentication method configured on the wireless client.

¡     Use the default values for other parameters.

5.     Click OK.

Figure 3 Adding an access policy

 

Adding an access service

1.     Click the User tab.

2.     From the navigation pane, select User Access Policy > Access Service.

3.     Click Add.

4.     On the Add Access Service page, configure the following parameters, as shown in Figure 4:

¡     Enter dot1x in the Service Name field.

¡     Select dot1x from the Default Access Policy list.

¡     Use the default values for other parameters.

5.     Click OK.

Figure 4 Adding an access service

 

Adding an access user

1.     Click the User tab.

2.     From the navigation pane, select Access User > All Access Users.

3.     Click Add.

The Add Access User page opens.

4.     In the Access Information area, configure the following parameters, as shown in Figure 5:

a.     Click Select or Add User to associate the user with IMC Platform user user.

b.     Enter dot1x in the Account Name field.

c.     Enter dot1x in the Password and Confirm Password fields.

5.     In the Access Service area, select dot1x from the list.

6.     Click OK.

Figure 5 Adding an access user account

 

Verifying the configuration

# Verify that the client can pass 802.1X authentication to access the wireless network. (Details not shown.)

# Display online 802.1X user information to verify that the client has come online.

[AP] display dot1x connection

Total connections: 1

User MAC address                   : 68ef-4338-9513

AP name                            : fatap

Radio ID                           : 1

SSID                               : service

BSSID                              : d461-fe59-4d22

Username                           : dot1x

Authentication domain              : imc

Authentication method              : EAP

Initial VLAN                       : 200

Authorization VLAN                 : 200

Authorization ACL number           : N/A

Authorization user profile         : N/A

Authorization CAR                  : N/A

Termination action                 : Radius-Request

Session timeout period             : 86400 s

Online from                        : 2018/09/16 00:16:21

Online duration                    : 0h 0m 26s

Configuration files

·     Fat AP:

#

vlan 100

#

vlan 200

#

wlan service-template service

 ssid service

 vlan 200

 client-security authentication-mode dot1x

 dot1x domain bbb

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.2.1 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.1.1 255.255.255.0

#

domain bbb

 authentication lan-access local

 authorization lan-access local

 accounting lan-access local

#

local-user localuser class network

 password cipher $c$3$+5Yra0KsaLci/RxEa4lyYKxxiw6jwMCcOg==

 service-type lan-access

#

wlan ap office model WA4320i-ACN

 serial-id 210235A1GQC158004457

 radio 1

  radio enable

  service-template service

#

·     Switch:

#

vlan 100

#

vlan 200

#

dhcp server ip-pool 100

 network 2.2.2.0 mask 255.255.255.0

 gateway-list 2.2.2.1

#

dhcp server ip-pool 200

 network 2.2.1.0 mask 255.255.255.0

 gateway-list 2.2.1.1

#

interface Vlan-interface100

 ip address 2.2.2.100 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.1.2 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/2

 port link-type access

 port access permit vlan 100

 poe enable

#

Related documentation

·     Network Connectivity Configuration Guide in H3C Access Points Configuration Guides

·     Network Connectivity Command Reference in H3C Access Points Command References

·     User Access and Authentication Configuration Guide in H3C Access Points Configuration Guides

·     User Access and Authentication Command Reference in H3C Access Points Command References

·     WLAN Access Configuration Guide in H3C Access Points Configuration Guides

·     WLAN Access Command Reference in H3C Access Points Command References