H3C Access Controllers
Comware 7 Remote Portal Authentication on an AC Hierarchy Network with Dual-Link Central AC Backup
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring remote portal authentication on an AC hierarchy network with dual-link central AC backup· 1

Network configuration· 1

Analysis· 2

Software version used· 2

Restrictions and guidelines· 2

Procedures· 3

Editing the AP’s configuration file· 3

Configuring central AC 1· 3

Configure central AC 2· 6

Configuring the local AC· 9

Configuring the Layer 3 switch· 9

Configuring the Layer 2 switch· 10

Configuring the DHCP server 11

Configuring the RADIUS server 11

Configuring the portal server 14

Verifying the configuration· 17

Configuration files· 17

Related documentation· 22

 

Introduction

The following information provides an example of configuring remote portal authentication for clients on an AC hierarchy network where two central ACs are deployed for redundancy.

Prerequisites

The following information applies to Comware 7-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access controllers and access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of AAA, WLAN user authentication, WLAN access, and WLAN high availability.

Example: Configuring remote portal authentication on an AC hierarchy network with dual-link central AC backup

Network configuration

As shown in Figure 1, the AC hierarchy network contains two central ACs WX5560H, one local AC WX3510H, and one AP WA5320H. The AP and client obtain an IP address from the DHCP server, and the IMC server acts as both the portal authentication server and RADIUS server. Configure the devices to meet the following requirements:

·     The central ACs operate in master/backup mode and back up each other.

·     The master central AC has all licenses registered, and it can synchronize the licenses to the backup central AC by using the AP license synchronization feature.

·     The AC rediscovery feature is configured on the central ACs. For the AP to associate with the local AC, enable the AC rediscovery feature in the view of the manual AP. In addition, configure the central ACs to add the IP address of the local AC to the CAPWAP Control IP Address message element in the discovery responses sent to the AP. The AP, central ACs, and the local AC are reachable to each other so that the AP can associate with a central AC when the local AC fails.

·     Use direct portal authentication for wireless clients.

Figure 1 Network diagram

 

Analysis

·     For GigabitEthernet 1/0/1 to forward client data traffic in VLAN 200, edit the configuration file of the AP and upload the file to the central ACs.

·     For portal users that have been authenticated on an AC to roam to another AC to access the network resources without re-authentication, enable roaming for portal users.

·     To avoid portal authentication failure caused by frequent portal client onboarding and offboarding, disable the Rule ARP entry feature for portal clients.

·     For the RADIUS server to dynamically change client authorization information or forcibly disconnect a wireless client, enable the RADIUS session-control feature on the central ACs.

Software version used

This example was created and verified on Release 5426.

Restrictions and guidelines

·     Make sure the settings are the same on the primary and backup central ACs.

·     Make sure the software versions are the same for the primary and backup central ACs.

·     Central ACs on an AC hierarchy network do not support IRF.

·     Use the serial ID labeled on the AP's rear panel to specify an AP.

·     On the local AC, do not enable the auto AP feature. In addition, create a manual AP for the AP in local AC view on the central ACs for the central ACs to manage the AP.

·     For dual-link central AC backup to operate correctly, configure the local AC and manual AP settings on both central ACs. Make sure the priority settings on the local AC, the master central AC, and the backup central AC are correctly configured so that the local AC can re-associate with the master central AC when the master central AC recovers.

Procedures

Editing the AP’s configuration file

# Edit the AP’s configuration file, name it apmap.txt and upload the configuration file to the AC.

System-view

vlan 200

vlan 300

interface gigabitethernet1/0/1

port link-type trunk

port trunk permit vlan 1 200 300

Configuring central AC 1

1.     Configure interfaces on central AC 1:

# Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The central AC will use this IP address to establish a management tunnel with the local AC.

<Central-AC1> system-view

[Central-AC1] vlan 100

[Central-AC1-vlan100] quit

[Central-AC1] interface vlan-interface 100

[Central-AC1-Vlan-interface100] ip address 2.2.1.1 24

[Central-AC1-Vlan-interface100] quit

2.     Configure a local AC for central AC 1:

# Create local AC 3510 with model WX3510H and enter local AC view.

[Central-AC1] wlan local-ac name 3510 model WX3510H

# Specify the serial ID of the local AC.

[Central-AC1-wlan-local-ac-3510] serial-id 210235A1JNB165000120

# Set the priority to 7 for tunnel establishment to the local AC.

[Central-AC1-wlan-local-ac-3510] priority 7

# Enable master CAPWAP tunnel preemption.

[Central-AC1-wlan-local-ac-3510] wlan tunnel-preempt enable

[Central-AC1-wlan-local-ac-3510] quit

3.     Configure portal authentication for clients:

¡     Configure a RADIUS scheme:

# Create a RADIUS scheme named imc and enter RADIUS scheme view.

[Central-AC1] radius scheme imc

# Specify the IP address of the primary RADIUS authentication server.

[Central-AC1-radius-imc] primary authentication 192.168.0.111

# Specify the IP address of the primary RADIUS accounting server.

[Central-AC1-radius-imc] primary accounting 192.168.0.111

# Set the shared key to 123456 in plaintext form for secure communication with the RADIUS authentication server.

[Central-AC1-radius-imc] key authentication simple 123456

# Set the shared key to 123456 in plaintext form for secure communication with the RADIUS accounting server.

[Central-AC1-radius-imc] key accounting simple 123456

# Configure the AC to remove the domain name from the usernames sent to the RADIUS servers.

[Central-AC1-radius-imc] user-name-format without-domain

# Specify IP address 2.2.1.1 as the source IP address for outgoing RADIUS packets.

[Central-AC1-radius-imc] nas-ip 2.2.1.1

[Central-AC1-radius-imc] quit

# Enable RADIUS session-control.

[Central-AC1] radius session-control enable

¡     Configure an authentication domain:

# Create ISP domain imc and enter its view.

[Central-AC1] domain imc

# Configure the ISP domain to use RADIUS scheme imc for portal user authentication.

[Central-AC1-isp-imc] authentication lan-access radius-scheme imc

# Configure the ISP domain to use RADIUS scheme imc for portal user authorization.

[Central-AC1-isp-imc] authorization lan-access radius-scheme imc

# Configure the ISP domain to use RADIUS scheme imc for portal user accounting.

[Central-AC1-isp-imc] accounting lan-access radius-scheme imc

# Set the idle timeout period to 15 minutes for the users in the imc ISP domain.

[Central-AC1-isp-imc] authorization-attribute idle-cut 15 1024

[Central-AC1-isp-imc] quit

4.     Configure a wireless service:

# Create a service template named st1 and enter its view.

[Central-AC1] wlan service-template st1

# Configure the SSID as service.

[Central-AC1-wlan-st-st1] ssid service

Specify VLAN 200 in the service template.

[Central-AC1-wlan-st-st1] vlan 200

# Specify the authentication domain as imc for portal users.

[Central-AC1-wlan-st-st1] portal domain imc

# Enable the service template.

[Central-AC1-wlan-st-st1] service-template enable

[Central-AC1-wlan-st-st1] quit

5.     Configure portal authentication:

# Create a portal authentication server named newpt, specify IP address 192.168.0.111 as the IP address of the authentication server, and specify 50100 as the portal service port number.

[Central-AC1] portal server newpt

[Central-AC1-portal-server-newpt] ip 192.168.0.111 key simple radius

[Central-AC1-portal-server-newpt] port 50100

# Specify CMCC as the type of portal authentication server newpt.

[Central-AC1-portal-server-newpt] server-type cmcc

[Central-AC1-portal-server-newpt] quit

# Create a portal Web server named newpt and specify http://192.168.0.111:8080/portal as the URL of the server.

[Central-AC1] portal web-server newpt

[Central-AC1-portal-websvr-newpt] url http://192.168.0.111:8080/portal

# Add parameters ssid, wlanuserip, and wlanacname to the URL of portal Web server newpt. Specify the AP's SSID, the IP address of the client, and the AC's name as the values for the parameters, respectively. (The parameters are required to be carried in the URL of a portal Web server of the CMCC type.)

[Central-AC1-portal-websvr-newpt] url-parameter ssid ssid

[Central-AC1-portal-websvr-newpt] url-parameter wlanuserip source-address

[Central-AC1-portal-websvr-newpt] url-parameter wlanacname value Central-AC1

# Specify CMCC as the type of portal Web server newpt.

[Central-AC1-portal-websvr-newpt] server-type cmcc

[Central-AC1-portal-websvr-newpt] quit

# Configure a destination-based portal-free rule numbered 0 to permit traffic destined for IP address 192.168.0.111 (the portal Web server).

[Central-AC1] portal free-rule 0 destination ip 192.168.0.111 24

# Configure two portal-free rules, allowing access to the DNS server without portal authentication.

[Central-AC1] portal free-rule 1 destination ip any udp 53

[Central-AC1] portal free-rule 2 destination ip any tcp 53

# Enable portal roaming.

[Central-AC1] portal roaming enable

# Disable the Rule ARP entry feature for portal clients.

[Central-AC1] undo portal refresh arp enable

# Enable direct IPv4 portal authentication on service template st1.

[Central-AC1] wlan service-template st1

[Central-AC1-wlan-st-st1] portal enable method direct

# Specify IPv4 portal Web server newpt on service template st1 for portal authentication.

[Central-AC1-wlan-st-st1] portal apply web-server newpt

# On service template st1, configure the BAS-IP attribute as 2.2.1.1 for portal packets sent to the portal authentication server.

[Central-AC1-wlan-st-st1] portal bas-ip 2.2.1.1

[Central-AC1-wlan-st-st1] quit

6.     Create a manual AP:

# Create a manual AP named ap1, and specify the AP model and serial ID.

[Central-AC1] wlan ap ap1 model WA5320H

[Central-AC1-wlan-ap-ap1] serial-id 210235A1SVC15C000011

# Enable AC rediscovery.

[Central-AC1-wlan-ap-ap1] control-address enable

# Specify a local AC.

[Central-AC1-wlan-ap-ap1] control-address ip 2.2.2.1

# Specify a backup AC for the central AC.

[Central-AC1-wlan-ap-ap1] backup-ac ip 2.2.1.2

# Enable automatic switch-back after a local-central AC switchover.

[Central-AC1-wlan-ap-ap1] switch-back enable

# Deploy a configuration file to the AP.

[Central-AC1-wlan-ap-ap1] map-configuration cfa0:/apmap.txt

# Bind WLAN service template st1 to radio 1.

[Central-AC1-wlan-ap- ap1] radio 1

[Central-AC1-wlan-ap- ap1-radio-1] radio enable

[Central-AC1-wlan-ap- ap1-radio-1] service-template st1 vlan 300

[Central-AC1-wlan-ap- ap1-radio-1] quit

[Central-AC1-wlan-ap- ap1] quit

7.     Configure a static route:

# Configure a static route, whose next hop address is 2.2.1.100, IP address of the L3 switch.

[Central-AC1] ip route-static 0.0.0.0 24 2.2.1.100

Configure central AC 2

1.     # Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The central AC will use this IP address to establish a management tunnel with the local AC.

<Central-AC1> system-view

[Central-AC1] vlan 100

[Central-AC1-vlan100] quit

[Central-AC1] interface vlan-interface 100

[Central-AC1-Vlan-interface100] ip address 2.2.1.2 24

[Central-AC1-Vlan-interface100] quit

2.     Configure a local AC for central AC 2:

# Create local AC 3510 with model WX3510H and enter local AC view.

[Central-AC2] wlan local-ac name 3510 model WX3510H

# Specify the serial ID of the local AC.

[Central-AC2-wlan-local-ac-3510] serial-id 210235A1JNB165000120

# Set the priority to 7 for tunnel establishment to the local AC.

[Central-AC2-wlan-local-ac-3510] priority 7

# Enable master CAPWAP tunnel preemption.

[Central-AC2-wlan-local-ac-3510] wlan tunnel-preempt enable

[Central-AC2-wlan-local-ac-3510] quit

3.     Configure portal authentication for clients:

¡     Configure a RADIUS scheme:

# Create a RADIUS scheme named imc and enter RADIUS scheme view.

[Central-AC2] radius scheme imc

# Specify the IP address of the primary RADIUS authentication server.

[Central-AC2-radius-imc] primary authentication 192.168.0.111

# Specify the IP address of the primary RADIUS accounting server.

[Central-AC2-radius-imc] primary  accounting 192.168.0.111

# Set the shared key to 123456 in plaintext form for secure communication with the RADIUS authentication server.

[Central-AC2-radius-imc] key authentication simple 123456

# Set the shared key to 123456 in plaintext form for secure communication with the RADIUS accounting server.

[Central-AC2-radius-imc] key accounting simple 123456

# Configure the AC to remove the domain name from the usernames sent to the RADIUS servers.

[Central-AC2-radius-imc] user-name-format without-domain

# Specify IP address 2.2.1.1 as the source IP address for outgoing RADIUS packets.

[Central-AC2-radius-imc] nas-ip 2.2.1.1

[Central-AC2-radius-imc] quit

# Enable RADIUS session-control.

[Central-AC2] radius session-control enable

¡     Configure an authentication domain:

# Create ISP domain imc and enter its view.

[Central-AC2] domain imc

# Configure the ISP domain to use RADIUS scheme imc for portal user authentication.

[Central-AC2-isp-imc] authentication lan-access radius-scheme imc

# Configure the ISP domain to use RADIUS scheme imc for portal user authorization.

[Central-AC2-isp-imc] authorization lan-access radius-scheme imc

# Configure the ISP domain to use RADIUS scheme imc for portal user accounting.

[Central-AC2-isp-imc] accounting lan-access radius-scheme imc

# Set the idle timeout period to 15 minutes and the minimum traffic that must be generated in the idle timeout period to 1024 bytes for the users in the imc ISP domain.

[Central-AC2-isp-imc] authorization-attribute idle-cut 15 1024

[Central-AC2-isp-imc] quit

4.     Configure a wireless service:

# Create a service template named st1 and enter its view.

[Central-AC2] wlan service-template st1

# Configure the SSID as service.

[Central-AC2-wlan-st-st1] ssid service

# Specify VLAN 200 in the service template.

[Central-AC2-wlan-st-st1] vlan 200

# Specify the authentication domain as imc for portal users.

[Central-AC2-wlan-st-st1] portal domain imc

# Enable the service template.

[Central-AC2-wlan-st-st1] service-template enable

[Central-AC2-wlan-st-st1] quit

5.     Configure portal authentication:

# Create a portal authentication server named newpt, specify IP address 192.168.0.111 as the IP address of the authentication server, and specify 50100 as the portal service port number.

[Central-AC2] portal server newpt

[Central-AC2-portal-server-newpt] ip 192.168.0.111 key simple radius

[Central-AC2-portal-server-newpt] port 50100

# Specify CMCC as the type of portal authentication server newpt.

[Central-AC2-portal-server-newpt] server-type cmcc

[Central-AC2-portal-server-newpt] quit

# Create a portal Web server named newpt and specify http://192.168.0.111:8080/portal as the URL of the server.

[Central-AC2] portal web-server newpt

[Central-AC2-portal-websvr-newpt] url http://192.168.0.111:8080/portal

# Add parameters ssid, wlanuserip, and wlanacname to the URL of portal Web server newpt. Specify the AP's SSID, the IP address of the client, and the AC's name as the values for the parameters, respectively. (The parameters are required to be carried in the URL of a portal Web server of the CMCC type.)

[Central-AC2-portal-websvr-newpt] url-parameter ssid ssid

[Central-AC2-portal-websvr-newpt] url-parameter wlanuserip source-address

[Central-AC2-portal-websvr-newpt] url-parameter wlanacname value Cnetral-AC2

# Specify CMCC as the type of portal Web server newpt.

[Central-AC2-portal-websvr-newpt] server-type cmcc

[Central-AC2-portal-websvr-newpt] quit

# Configure a destination-based portal-free rule numbered 0 to permit traffic destined for IP address 192.168.0.111 (the portal Web server).

[Central-AC2] portal free-rule 0 destination ip 192.168.0.111 24

# Configure two portal-free rules, allowing access to the DNS server without portal authentication.

[Central-AC2] portal free-rule 1 destination ip any udp 53

[Central-AC2] portal free-rule 2 destination ip any tcp 53

# Enable portal roaming.

[Central-AC2] portal roaming enable

# Disable the Rule ARP entry feature for portal clients.

[Central-AC2] undo portal refresh arp enable

# Enable direct IPv4 portal authentication on service template st1.

[Central-AC2] wlan service-template st1

[Central-AC2-wlan-st-st1] portal enable method direct

# Specify IPv4 portal Web server newpt on service template st1 for portal authentication.

[Central-AC2-wlan-st-st1] portal apply web-server newpt

# On service template st1, configure the BAS-IP attribute as 2.2.1.2 for portal packets sent to the portal authentication server.

[Central-AC2-wlan-st-st1] portal bas-ip 2.2.1.2

[Central-AC2-wlan-st-st1] quit

6.     Create a manual AP:

# Create a manual AP named ap1, and specify the AP model and serial ID.

[Central-AC2] wlan ap ap1 model WA5320H

[Central-AC2-wlan-ap-ap1] serial-id 210235A1SVC15C000011

# Enable AC rediscovery.

[Central-AC2-wlan-ap-ap1] control-address enable

# Specify the local AC.

[Central-AC2-wlan-ap-ap1] control-address ip 2.2.2.1

# Specify central AC 1 as the backup AC for central AC 2.

[Central-AC2-wlan-ap-ap1] backup-ac ip 2.2.1.1

# Enable automatic switch-back after a local-central AC switchover.

[Central-AC2-wlan-ap-ap1] switch-back enable

# Deploy a configuration file to the AP.

[Central-AC2-wlan-ap-ap1] map-configuration cfa0:/apmap.txt

# Bind WLAN service template st1 to radio 1.

[Central-AC2-wlan-ap-ap1] radio 1

[Central-AC2-wlan-ap-ap1-radio-1] radio enable

[Central-AC2-wlan-ap-ap1-radio-1] service-template st1 vlan 300

[Central-AC2-wlan-ap-ap1-radio-1] quit

[Central-AC2-wlan-ap-ap1] quit

7.     Configure a static route:

# Configure a static route, whose next hop address is 2.2.1.100, IP address of the Layer 3 switch.

[Central-AC2] ip route-static 0.0.0.0 0 24 2.2.1.100

Configuring the local AC

1.     Configure the local AC feature:

# Enable the local AC feature.

<Local AC> system-view

[Local AC] wlan local-ac enable

# Specify central ACs for the local AC.

[Local AC] wlan central-ac ip 2.2.1.1

[Local AC] wlan central-ac ip 2.2.1.2

# Configure the local AC to use VLAN 100 to establish a tunnel with the central ACs.

[Local AC] wlan local-ac capwap source-vlan 100

2.     Configure interfaces:

# Create VLAN 100, create VLAN-interface 100, and assign an IP address to the VLAN interface. The local AC will use this IP address to establish CAPWAP tunnels with the central ACs.

[Local AC] vlan 100

[Local AC-vlan100] quit

[Local AC] interface Vlan-interface100

[Local AC-Vlan-interface100] ip address 2.2.1.10 255.255.0.0

[Local AC-Vlan-interface100] quit

# Create VLAN 200, create VLAN-interface 200, and assign an IP address to the VLAN interface. The local AC assigns VLAN 200 to an AP when the AP comes online.

[Local AC] vlan 200

[Local AC-vlan200] quit

[Local AC] interface Vlan-interface200

[Local AC-Vlan-interface200] ip address 2.2.2.1 255.255.255.0

[Local AC-Vlan-interface200] dhcp server apply ip-pool vlan200

[Local AC-Vlan-interface200] quit

# Create VLAN 300, create VLAN-interface 300, and assign an IP address to the VLAN interface. The local AC assigns this VLAN to a wireless client when the client comes online.

[Local AC] vlan 300

[Local AC-vlan300] quit

[Local AC] interface Vlan-interface300

[Local AC-Vlan-interface300] ip address 2.2.3.1 255.255.255.0

[Local AC-Vlan-interface300] dhcp server apply ip-pool vlan300

[Local AC-Vlan-interface300] quit

Configuring the Layer 3 switch

# Create VLAN 100, create VLAN-interface 100, and assign an IP address to the VLAN interface. The switch will use this VLAN to forward data and control packets between the central ACs and the local AC. # Create VLAN 200, create VLAN-interface 200, and assign an IP address to the VLAN interface. The switch will use this VLAN to forward CAPWAP tunnel packets between the local AC and the AP.

<L3 switch> system-view

[L3 switch] vlan 100

[L3 switch-vlan100] quit

[L3 switch] interface vlan-interface 100

[L3 switch-Vlan-interface100] ip address 2.2.1.100 255.255.255.0 

[L3 switch-Vlan-interface100] quit

[L3 switch] vlan 200

[L3 switch-vlan200] quit

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] ip address 2.2.2.100 255.255.255.0 

[L3 switch-Vlan-interface200] quit

# Create VLAN 300 for wireless clients, create VLAN-interface 300, and assign an IP address to the VLAN interface.

[L3 switch] vlan 300

[L3 switch-vlan300] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] ip address 2.2.3.100 255.255.255.0 

[L3 switch-Vlan-interface300] quit

# Configure GigabitEthernet 1/0/1 that connects the Layer 3 switch to central AC 1 as a trunk port, and assign the port to VLAN 100, VLAN 200, and VLAN 300.

[L3 switch] interface gigabitethernet 1/0/1

[L3 switch-GigabitEthernet1/0/1] port link-type trunk

[L3 switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200 300

[L3 switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 that connects the Layer 3 switch to the Layer 2 switch as a trunk port, remove the port from VLAN 1, and assign the port to VLAN 200 and VLAN 300.

[L3 switch] interface gigabitethernet 1/0/2

[L3 switch-GigabitEthernet1/0/2] port link-type trunk 

[L3 switch-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[L3 switch-GigabitEthernet1/0/2] port trunk permit vlan 200 300

[L3 switch-GigabitEthernet1/0/2] quit

Configuring the Layer 2 switch

# Create VLAN 200 and VLAN 300. The switch will use VLAN 200 for AP access and use VLAN 300 for wireless client access.

<L2 switch> system-view

[L2 switch] vlan 200

[L2 switch-vlan200] quit

[L2 switch] vlan 300

[L2 switch-vlan300] quit

# Configure GigabitEthernet 1/0/1 that connects the Layer 3 switch to the Layer 2 switch as a trunk port, remove the port from VLAN 1, and assign the port to VLAN 200 and VLAN 300.

[L2 switch] interface gigabitethernet 1/0/1

[L2 switch-GigabitEthernet1/0/1] port link-type trunk 

[L2 switch-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[L2 switch-GigabitEthernet1/0/1] port trunk permit vlan 200 300

[L2 switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 that connects the Layer 2 switch to the AP as an access port, assign the port to VLAN 200, and enable PoE on the port.

[L2 switch] interface gigabitethernet 1/0/2

[L2 switch-GigabitEthernet1/0/2] port link-type access 

[L2 switch-GigabitEthernet1/0/2] port access vlan 200

[L2 switch-GigabitEthernet1/0/2] poe enable

[L2 switch-GigabitEthernet1/0/2] quit

Configuring the DHCP server

# Configure GigabitEthernet 1/0/1 that connects the DHCP server to the Layer 2 switch as a trunk port, and assign the port to VLAN 200 and VLAN 300.

<DHCP Server> system-view

[DHCP Server] interface gigabitethernet 1/0/1

[DHCP Server-GigabitEthernet1/0/1] port link-type trunk

[DHCP Server-GigabitEthernet1/0/1] port trunk permit vlan 200 300

[DHCP Server-GigabitEthernet1/0/1] quit

# Create VLAN 200, create VLAN-interface 200, and assign an IP address to the VLAN interface.

[DHCP Server] vlan 200

[DHCP Server-vlan200] quit

[DHCP Server] interface vlan-interface 200

[DHCP Server-Vlan-interface200] ip address 2.2.2.200 255.255.255.0

[DHCP Server-Vlan-interface100] quit

# Create VLAN 300, create VLAN-interface 300, and assign an IP address to the VLAN interface.

[DHCP Server] vlan 300

[DHCP Server-vlan300] quit

[DHCP Server] interface vlan-interface 300

[Dhcp Server-Vlan-interface300] ip address 2.2.3.200 255.255.255.0

[DHCP Server-Vlan-interface300] quit

# Enable the DHCP service.

[DHCP Server] dhcp enable

# Configure DHCP address pool vlan200. In the address pool, specify 2.2.2.200 as the gateway IP address and 2.2.2.0/24 as the subnet for dynamic allocation, and then exclude 2.2.2.200 and 2.2.2.1 from dynamic allocation.

[DHCP Server] dhcp server ip-pool vlan200

[DHCP Server-dhcp-pool-vlan200] gateway-list 2.2.2.200

[DHCP Server-dhcp-pool-vlan200] network 2.2.2.0 mask 255.255.255.0

[DHCP Server-dhcp-pool-vlan200] forbidden-ip 2.2.2.200 2.2.2.1

[DHCP Server-dhcp-pool-vlan200] quit

# Configure DHCP address pool vlan300. In the address pool, specify 2.2.3.100 as the gateway IP address, 2.2.2.0/24 as the subnet for dynamic allocation, and 8.8.8.8 as the DNS server address, and then exclude 2.2.2.100 and 2.2.2.1 from dynamic allocation.

[DHCP Server] dhcp server ip-pool vlan300

[DHCP Server-dhcp-pool-vlan300] gateway-list 2.2.3.100

[DHCP Server-dhcp-pool-vlan300] network 2.2.2.0 mask 255.255.255.0

[DHCP Server-dhcp-pool-vlan300] dns-list 8.8.8.8

[DHCP Server-dhcp-pool-vlan300] forbidden-ip 2.2.2.100 2.2.2.1

Configuring the RADIUS server

In this example, the RADIUS server runs IMC PLAT 7.1 (E0303p13), IMC EIA 7.1 (F0302p08), and IMC EIP 7.1 (F0302p08).

1.     Add an access device.

a.     Log in to IMC and click the User tab.

b.     From the navigation pane, select User Access Policy > Access Device Management > Access Device.

c.     Click Add.

d.     In the Device List area, click Add Manually to open the Add Access Device Manually page. Enter 2.2.2.1 in the Start IP field and then click OK.

e.     In the Access Configuration area, set the shared key to radius, which must be the same as that configured on the AC.

f.     Use the default settings for other parameters.

g.     Click OK.

Figure 2 Adding an access device

 

2.     Add an access policy.

a.     From the navigation pane, select User Access Policy > Access Policy.

b.     Click Add.

c.     Enter the access policy name.

d.     Select the Ungrouped service group.

e.     Use the default settings for other parameters.

Figure 3 Adding an access policy

 

3.     Add an access service.

a.     From the navigation pane, select User Access Policy > Access Service.

b.     Click Add.

c.     Enter the service name.

d.     Select AccessPolicy.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 4 Adding an access service

 

4.     Add an access user.

a.     From the navigation pane, select Access User > All Access Users.

b.     Click Add.

c.     Select an existing access user or click Add User to add a new access user.

d.     Set the password.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 5 Adding an access user

 

Configuring the portal server

1.     Configure the portal authentication service:

a.     From the navigation pane, select User Access Policy > Portal Service > Server.

b.     Configure the portal server parameters as needed.

This example uses the default settings.

c.     Click OK.

Figure 6 Configuring the portal server

 

2.     Configure an IP address group:

a.     From the navigation pane, select User Access Policy > Portal Service > IP Group.

b.     Click Add.

c.     Enter the IP group name.

d.     Enter the start IP address and end IP address of the IP group.

Make sure the client IP address is in the IP group.

e.     Select a service group.

This example uses the default group Ungrouped.

f.     Select Normal from the Action list.

g.     Click OK.

Figure 7 Adding an IP address group

 

3.     Add a portal device:

a.     From the navigation pane, select User Access Policy > Portal Service > Device.

b.     Click Add.

c.     Enter the device name.

d.     Select CMCC 1.0 for Version.

e.     Enter the IP address of the AC's interface connected to the client.

f.     Set whether to support the portal server heartbeat and user heartbeat functions.

In this example, select No for both Support Server Heartbeat and Support User Heartbeat.

g.     Enter the key, which must be the same as that configured on the AC.

h.     Select Directly Connected for Access Method.

i.     Use the default settings for other parameters.

j.     Click OK.

Figure 8 Adding a portal device

 

4.     Associate the portal device with the IP address group:

a.     Click the Port Group icon in the Operation field of device NAS.

Figure 9 Device list

 

b.     Click Add.

c.     Enter the port group name.

d.     Select the configured IP address group.

The IP address used by the user to access the network must be within this IP address group.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 10 Adding a port group

Verifying the configuration

# Use the configured username and password to perform portal authentication through a Web browser on the client. Before passing portal authentication, the user can access only the authentication page http://192.168.0.111:8080/portal. All Web requests from the user will be redirected to the authentication page. After passing portal authentication, the user can access other network resources.

# Display information about all portal users.

[Central-AC1] display portal user all

Total portal users: 1

Username: Client

  Portal server: newpt

  State: Online

  VPN instance: N/A

  MAC             IP                    VLAN    Interface

  0021-6330-0933  2.2.3.143             300     Vlan-interface300

  Authorization information:

    DHCP IP pool: vlan300

    User profile: N/A

    Session group profile: N/A

    ACL number: N/A

    Inbound CAR: N/A

    Outbound CAR: N/A

Configuration files

·     Layer 3 switch:

#

vlan 100

#

vlan 200

#             

vlan 300

#

interface Vlan-interface100

 ip address 2.2.1.100 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.100 255.255.255.0

#

interface Vlan-interface300

 ip address 2.2.3.100 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200 300

#

interface GigabitEthernet1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 200 300

#

·     Central AC 1:

#

vlan 100

#

wlan service-template st1

 ssid service

 vlan 200

 portal enable method direct

 portal domain imc

 portal bas-ip 2.2.1.1

 portal apply web-server newpt

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.1.1 255.255.255.0

#

 ip route-static 0.0.0.0 24 2.2.1.100

#

 radius session-control enable

#

radius scheme imc

 primary authentication 192.168.0.111

 primary accounting 192.168.0.111

 key authentication cipher $c$3$inPh3pDjv+jZhbhAmYd7sPQMF8bJX0VmvA==

 key accounting cipher $c$3$lZDbA3Qutvq0fWYBaI4ESvGfDW2uBOfF1A==

 user-name-format without-domain

 nas-ip 2.2.1.1

#

domain imc

 authorization-attribute idle-cut 15 1024

 authentication lan-access radius-scheme imc

 authorization lan-access radius-scheme imc

 accounting lan-access radius-scheme imc

#

portal free-rule 0 destination ip 192.168.0.0 255.255.255.0

portal free-rule 1 destination ip any udp 53

portal free-rule 2 destination ip any tcp 53

#

portal web-server newpt

 url http://192.168.0.111:8080/portal

 server-type cmcc

 url-parameter ssid ssid

 url-parameter wlanacname value Central-AC1

 url-parameter wlanuserip source-address

#

portal server newpt

 ip 192.168.0.111 key cipher $c$3$8MR9sJDNDI9wpjox6qMBHOLQcTVlY7f9

 server-type cmcc

#

wlan ap ap1 model WA5320H

 serial-id 210235A1SVC15C000011

 switch-back enable

 map-configuration cfa0:/apmap.txt

 backup-ac ip 2.2.1.2

 control-address enable

 control-address ip 2.2.2.1

 vlan 1

 radio 1

  radio enable

  service-template st1 vlan 300

#

wlan local-ac name 3510 model WX3510H

 serial-id 210235A1JNB165000120

 priority 7

 wlan tunnel-preempt enable

#

·     Central AC 2:

#

vlan 100

#

wlan service-template st1

 ssid service

 vlan 200

 portal enable method direct

 portal domain imc

 portal bas-ip 2.2.1.1

 portal apply web-server newpt

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.1.1 255.255.255.0

#

 ip route-static 0.0.0.0 24 2.2.1.100

#

 radius session-control enable

#

radius scheme imc

 primary authentication 192.168.0.111

 primary accounting 192.168.0.111

 key authentication cipher $c$3$inPh3pDjv+jZhbhAmYd7sPQMF8bJX0VmvA==

 key accounting cipher $c$3$lZDbA3Qutvq0fWYBaI4ESvGfDW2uBOfF1A==

 user-name-format without-domain

 nas-ip 2.2.1.1

#

domain imc

 authorization-attribute idle-cut 15 1024

 authentication lan-access radius-scheme imc

 authorization lan-access radius-scheme imc

 accounting lan-access radius-scheme imc

#

portal free-rule 0 destination ip 192.168.0.0 255.255.255.0

portal free-rule 1 destination ip any udp 53

portal free-rule 2 destination ip any tcp 53

#

portal web-server newpt

 url http://192.168.0.111:8080/portal

 server-type cmcc

 url-parameter ssid ssid

 url-parameter wlanacname value Central-AC2

 url-parameter wlanuserip source-address

#

portal server newpt

 ip 192.168.0.111 key cipher $c$3$8MR9sJDNDI9wpjox6qMBHOLQcTVlY7f9

 server-type cmcc

#

wlan ap ap1 model WA5320H

 serial-id 210235A1SVC15C000011

 switch-back enable

 map-configuration cfa0:/apmap.txt

 backup-ac ip 2.2.1.1

 control-address enable

 control-address ip 2.2.2.1

 vlan 1

 radio 1

  radio enable

  service-template st1 vlan 300

#

wlan local-ac name 3510 model WX3510H

 serial-id 210235A1JNB165000120

 priority 7

 wlan tunnel-preempt enable

#

·     Layer 2 switch:

#

vlan 200

#

vlan 300

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 200 300

#

interface GigabitEthernet1/0/2

 port link-type access

 port access vlan 200

 poe enable

#

·     DHCP server:

#

vlan 200

#

vlan 300

#

dhcp server ip-pool vlan200

 gateway-list 2.2.2.200

 network 2.2.2.0 mask 255.255.255.0

 forbidden-ip 2.2.2.1

 forbidden-ip 2.2.2.200

#

dhcp server ip-pool vlan300

 gateway-list 2.2.3.100

 dns-list 8.8.8.8

 forbidden-ip 2.2.2.1

 forbidden-ip 2.2.2.100

#

interface Vlan-interface200

 ip address 2.2.2.200 255.255.255.0

#

interface Vlan-interface300

 ip address 2.2.3.200 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 200 300

#

·     Local AC:

#

 wlan local-ac enable

#

vlan 100

#

vlan 200

#             

vlan 300

#

interface Vlan-interface100

 ip address 2.2.1.10 255.255.0.0

#

interface Vlan-interface200

 ip address 2.2.2.1 255.255.255.0

 dhcp server apply ip-pool vlan200

#

interface Vlan-interface300

 ip address 2.2.3.1 255.255.255.0

 dhcp server apply ip-pool vlan300

#

 wlan local-ac capwap source-vlan 100

#

 wlan central-ac ip 2.2.1.1

 wlan central-ac ip 2.2.1.2

#

Related documentation

·     High Availability Command Reference in H3C Access Controllers Command References

·     High Availability Configuration Guide in H3C Access Controllers Configuration Guides

·     User Access and Authentication Command Reference in H3C Access Controllers Command References

·     User Access and Authentication Configuration Guide in H3C Access Controllers Configuration Guides

·     WLAN Access Command Reference in H3C Access Controllers Command References

·     WLAN Access Configuration Guide in H3C Access Controllers Configuration Guides