H3C Access Controllers
Dual-Link Backup Remote Portal Authentication in Centralized Forwarding
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring remote portal authentication for dual-link AC backup and centralized forwarding· 1

Network configuration· 1

Analysis· 2

Restrictions and guidelines· 2

Procedures· 3

Configuring AC 1· 3

Configuring AC 2· 6

Configuring the switch· 8

Configuring the DHCP server 10

Configuring the IMC server 10

Verifying the configuration· 16

Configuration files· 17

Related documentation· 22

 

Introduction

The following information provides an example for configuring remote portal authentication with centralized forwarding.

Prerequisites

The following information applies to Comware-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access controllers and access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of WLAN high availability, AAA, portal, and WLAN access.

Example: Configuring remote portal authentication for dual-link AC backup and centralized forwarding

Network configuration

As shown in Figure 1, the AP and the client obtain IP addresses from the DHCP server. The IMC server acts as the portal authentication server, portal Web server, RADIUS server, and MAC binding server.

Configure the devices to meet the following requirements:

·     The AP associates with both ACs and the two ACs to back up each other. When the master AC (AC 1) fails, the backup AC (AC 2) takes over, and the AP can provide services correctly through the backup AC.

·     Direct portal authentication is used for wireless clients.

·     Before passing portal authentication, the client can access only the portal Web server. After passing the authentication, the client can access other network resources.

·     The client can access network resources through any Layer 2 ports in its access VLAN without re-authentication.

·     The IMC server can dynamically modify user authorization information and log off clients.

Figure 1 Network diagram

 

Analysis

·     To allow an authenticated user to access network resources on any Layer 2 ports in its access VLAN without re-authentication, you must enable the portal roaming feature.

·     To avoid possible authentication failure caused by frequent logins and logouts of portal clients in a short time, disable the Rule ARP entry feature.

·     To allow the RADIUS server to modify user authorization information and log off users, enable the RADIUS session-control feature.

Restrictions and guidelines

When you configure remote portal authentication for dual-link AC backup and centralized forwarding, follow these restrictions and guidelines:

·     Use the actual serial ID of an AP to uniquely identify that AP.

·     If you configure manual APs, make sure the manual APs configured on the two ACs have the same AP name and identifier (serial ID or MAC address).

·     Make sure the two ACs are of the same version.

·     Make sure the portal authentication server type and portal Web server type configured on the ACs are the same as the actual server type. This example uses an IMC server.

·     To avoid possible authentication failure caused by frequent logins and logouts of portal clients in a short time, disable the Rule ARP entry feature.

·     To allow the RADIUS server to modify user authorization information and log off users, enable the RADIUS session-control feature.

·     URLs redirected from the ACs to the portal Web server do not carry parameters by default. You can configure the parameters to carry as needed.

·     If you enable portal authentication in VLAN interface view, only centralized forwarding is supported. If you enable portal authentication in service template view, both centralized forwarding and local forwarding are supported. This example enables portal authentication in service template view.

·     Make sure the two ACs have the same portal-free rule settings, including the rule numbers.

Procedures

Configuring AC 1

1.     Configure AC interfaces:

# Create VLAN 100 and VLAN-interface 100. Assign the VLAN interface an IP address. The AC will use this IP address to establish a CAPWAP tunnel with the AP.

<AC1> system-view

[AC1] vlan 100

[AC1-vlan100] quit

[AC1] interface vlan-interface 100

[AC1-Vlan-interface100] ip address 2.2.1.1 24

[AC1-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200. Assign the VLAN interface an IP address. Clients will use this VLAN to access the WLAN.

[AC1] vlan 200

[AC1-vlan200] quit

[AC1] interface vlan-interface 200

[AC1-Vlan-interface200] ip address 2.2.2.1 24

[AC1-Vlan-interface200] quit

# Configure GigabitEthernet 1/0/1 that connects AC 1 to the switch as a trunk port, and assign it to VLAN 100 and VLAN 200.

[AC1] interface gigabitethernet 1/0/1

[AC1-GigabitEthernet1/0/1] port link-type trunk

[AC1-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[AC1-GigabitEthernet1/0/1] quit

2.     Configure a static route to the IMC server.

[AC1] ip route-static 192.168.0.0 255.255.0.0 2.2.2.100

3.     Configure wireless services:

# Create service template st1 and enter its view.

[AC1] wlan service-template st1

# Specify the SSID as service.

[AC1-wlan-st-st1] ssid service

# Assign clients coming online through the service template to VLAN 200.

[AC1-wlan-st-st1] vlan 200

# Specify the AKM mode as PSK, and configure the preshared key as 12345678 in plain text.

[AC1-wlan-st-st1] akm mode psk

[AC1-wlan-st-st1] preshared-key pass-phrase simple 12345678

# Specify the cipher suite as CCMP and the security IE as RSN.

[AC1-wlan-st-st1] cipher-suite ccmp

[AC1-wlan-st-st1] security-ie rsn

# Configure the AC to forward client traffic. (Skip this step if the client data traffic forwarder is the AC by default.)

[AC1-wlan-st-st1] client forwarding-location ac

[AC1-wlan-st-st1] quit

4.     Configure the AP:

 

NOTE: In large-scale networks, configure AP groups instead of single APs as a best practice.

 

# Create AP office, and specify the AP model and serial ID.

[AC1] wlan ap office model WA6320

[AC1-wlan-ap-office] serial-id 219801A28N819CE0002T

[AC1-wlan-ap-office] quit

# Create AP group group1 and add AP office to AP group group1.

[AC1] wlan ap-group group1

[AC1-wlan-ap-group-group1] ap office

# Set the AP connection priority to 7.

[AC1-wlan-ap-group-group1] priority 7

# Specify AC 2 as the backup AC for AC 1. Set the backup AC address as the IP address of VLAN-interface 100 on AC 2.

[AC1-wlan-ap-group-group1] backup-ac ip 2.2.1.2

# Enable master CAPWAP tunnel preemption.

[AC1-wlan-ap-group-group1] wlan tunnel-preempt enable

# Bind service template st1 to radio 2 in AP group group1.

[AC1-wlan-ap-group-group1] ap-model WA6320

[AC1-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC1-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template st1

# Enable radio 2.

[AC1-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC1-wlan-ap-group-group1-ap-model-WA6320-radio-2] quit

[AC1-wlan-ap-group-group1-ap-model-WA6320] quit

[AC1-wlan-ap-group-group1] quit

5.     Configure a RADIUS scheme:

# Create RADIUS scheme rs1.

[AC1] radius scheme rs1

# Specify the IP addresses of the primary authentication and accounting RADIUS servers.

[AC1-radius-rs1] primary authentication 192.168.0.111

[AC1-radius-rs1] primary accounting 192.168.0.111

# Specify shared keys for RADIUS authentication and accounting.

[AC1-radius-rs1] key authentication simple radius

[AC1-radius-rs1] key accounting simple radius

# Configure AC 1 to remove the ISP domain name from the usernames sent to the RADIUS servers.

[AC1-radius-rs1] user-name-format without-domain

[AC1-radius-rs1] nas-ip 2.2.2.1

[AC1-radius-rs1] quit

# Enable RADIUS session-control.

[AC1] radius session-control enable

6.     Configure the authentication domain:

# Create domain dm1 and enter its view.

[AC1] domain dm1

# Configure the domain to use RADIUS scheme rs1 for authentication, authorization, and accounting.

[AC1-isp-dm1] authentication portal radius-scheme rs1

[AC1-isp-dm1] authorization portal radius-scheme rs1

[AC1-isp-dm1] accounting portal radius-scheme rs1

# Set the client idle timeout to 15 minutes and set the minimum threshold to 1024 bytes for clients in ISP domain dm1.

[AC1-isp-dm1] authorization-attribute idle-cut 15 1024

[AC1-isp-dm1] quit

7.     Configure portal authentication:

# Create the portal authentication server newpt, specify the server IP address as 192.168.0.111, and set the destination UDP port number to 50100 for the AC to send unsolicited portal packets to the portal authentication server.

[AC1] portal server newpt

[AC1-portal-server-newpt] ip 192.168.0.111 key simple radius

[AC1-portal-server-newpt] port 50100

[AC1-portal-server-newpt] quit

# Configure the URL for the portal Web server newpt as http://192.168.0.111:8080/portal.

[AC1] portal web-server newpt

[AC1-portal-websvr-newpt] url http://192.168.0.111:8080/portal

[AC1-portal-websvr-newpt] quit

# Configure an IPv4-based portal-free rule to permit portal Web server traffic.

[AC1] portal free-rule 0 destination ip 192.168.0.111 24

# Configure IPv4-based portal-free rules to permit DNS server traffic.

[AC1] portal free-rule 1 destination ip any udp 53

[AC1] portal free-rule 2 destination ip any tcp 53

# Enable intra-VLAN roaming for portal users.

[AC1] portal roaming enable

# Disable the Rule ARP entry feature for portal clients.

[AC1] undo portal refresh arp enable

# Enable validity check on wireless portal clients.

[AC1] portal host-check enable

# Enable direct IPv4 portal authentication for service template st1.

[AC1] wlan service-template st1

[AC1-wlan-st-st1] portal enable method direct

# Configure the authentication domain for IPv4 portal users as dm1 on service template st1.

[AC1-wlan-st-st1] portal domain dm1

# Specify portal Web server newpt on service template st1 to redirect portal user HTTP or HTTPS requests to the server.

[AC1-wlan-st-st1] portal apply web-server newpt

# Specify the BAS IP as the IP address of VLAN-interface 200, from which clients come online from AC 1.

[AC1-wlan-st-st1] portal bas-ip 2.2.2.1

# Enable the service template.

[AC1–wlan-st-st1] service-template enable

[AC1-wlan-st-st1] quit

Configuring AC 2

1.     Configure AC interfaces:

# Create VLAN 501 and VLAN-interface 100. Assign the VLAN interface an IP address. The AC will use this IP address to establish a CAPWAP tunnel with the AP.

<AC2> system-view

[AC2] vlan 100

[AC2-vlan100] quit

[AC2] interface vlan-interface 100

[AC2-Vlan-interface100] ip address 2.2.1.2 24

[AC2-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200. Assign the VLAN interface an IP address. Clients will use this VLAN to access the WLAN.

[AC2] vlan 200

[AC2-vlan200] quit

[AC2] interface vlan-interface 200

[AC2-Vlan-interface200] ip address 2.2.2.2 24

[AC2-Vlan-interface200] quit

# Configure GigabitEthernet 1/0/1 that connects AC 1 to the switch as a trunk port, and assign it to VLAN 100 and VLAN 200.

[AC2] interface gigabitethernet 1/0/1

[AC2-GigabitEthernet1/0/1] port link-type trunk

[AC2-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[AC2-GigabitEthernet1/0/1] quit

2.     Configure a static route to the IMC server.

[AC2] ip route-static 192.168.0.0 255.255.0.0 2.2.2.100

3.     Configure wireless services:

# Create service template st1 and enter its view.

[AC2] wlan service-template st1

# Specify the SSID as service.

[AC2-wlan-st-st1] ssid service

# Assign clients coming online through the service template to VLAN 200.

[AC2-wlan-st-st1] vlan 200

# Specify the AKM mode as PSK, and configure the preshared key as 12345678 in plain text.

[AC2-wlan-st-st1] akm mode psk

[AC2-wlan-st-st1] preshared-key pass-phrase simple 12345678

# Specify the cipher suite as CCMP and the security IE as RSN.

[AC2-wlan-st-st1] cipher-suite ccmp

[AC2-wlan-st-st1] security-ie rsn

# Configure the AC to forward client traffic. (Skip this step if the client data traffic forwarder is the AC by default.)

[AC2-wlan-st-st1] client forwarding-location ac

[AC2-wlan-st-st1] quit

4.     Configure the AP:

 

NOTE: In large-scale networks, configure AP groups instead of single APs as a best practice.

 

# Create AP office, and specify the AP model and serial ID.

[AC2] wlan ap office model WA6320

[AC2-wlan-ap-office] serial-id 219801A28N819CE0002T

[AC2-wlan-ap-office] quit

# Create AP group group1 and add AP office to AP group group1.

[AC2] wlan ap-group group1

[AC2-wlan-ap-group-group1] ap office

# Set the AP connection priority to 6.

[AC2-wlan-ap-group-group1] priority 6

# Specify AC 1 as the backup AC for AC 2. Set the backup AC address as the IP address of VLAN-interface 100 on AC 1.

[AC2-wlan-ap-group-group1] backup-ac ip 2.2.1.1

# Enable master CAPWAP tunnel preemption.

[AC2-wlan-ap-group-group1] wlan tunnel-preempt enable

# Bind service template st1 to radio 2 in AP group group1.

[AC2-wlan-ap-group-group1] ap-model WA6320

[AC2-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC2-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template st1

# Enable radio 2.

[AC2-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC2-wlan-ap-group-group1-ap-model-WA6320-radio-2] quit

[AC2-wlan-ap-group-group1-ap-model-WA6320] quit

[AC2-wlan-ap-group-group1] quit

5.     Configure a RADIUS scheme:

# Create RADIUS scheme rs1.

[AC2] radius scheme rs1

# Specify the IP addresses of the primary authentication and accounting RADIUS servers.

[AC2-radius-rs1] primary authentication 192.168.0.111

[AC2-radius-rs1] primary accounting 192.168.0.111

# Specify shared keys for RADIUS authentication and accounting.

[AC2-radius-rs1] key authentication simple radius

[AC2-radius-rs1] key accounting simple radius

# Configure AC 1 to remove the ISP domain name from the usernames sent to the RADIUS servers.

[AC2-radius-rs1] user-name-format without-domain

[AC2-radius-rs1] nas-ip 2.2.2.2

[AC2-radius-rs1] quit

# Enable RADIUS session-control.

[AC2] radius session-control enable

6.     Configure the authentication domain:

# Create domain dm1 and enter its view.

[AC2] domain dm1

# Configure the domain to use RADIUS scheme rs1 for authentication, authorization, and accounting.

[AC2-isp-dm1] authentication portal radius-scheme rs1

[AC2-isp-dm1] authorization portal radius-scheme rs1

[AC2-isp-dm1] accounting portal radius-scheme rs1

# Set the client idle timeout to 15 minutes and set the minimum threshold to 1024 bytes for clients in ISP domain dm1.

[AC2-isp-dm1] authorization-attribute idle-cut 15 1024

[AC2-isp-dm1] quit

7.     Configure portal authentication:

# Create the portal authentication server newpt, specify the server IP address as 192.168.0.111, and set the destination UDP port number to 50100 for the AC to send unsolicited portal packets to the portal authentication server.

[AC2] portal server newpt

[AC2-portal-server-newpt] ip 192.168.0.111 key simple radius

[AC2-portal-server-newpt] port 50100

[AC2-portal-server-newpt] quit

# Configure the URL for the portal Web server newpt as http://192.168.0.111:8080/portal .

[AC2] portal web-server newpt

[AC2-portal-websvr-newpt] url http://192.168.0.111:8080/portal

[AC2-portal-websvr-newpt] quit

# Configure an IPv4-based portal-free rule to permit portal Web server traffic.

[AC2] portal free-rule 0 destination ip 192.168.0.111 24

# Configure IPv4-based portal-free rules to permit DNS server traffic.

[AC2] portal free-rule 1 destination ip any udp 53

[AC2] portal free-rule 2 destination ip any tcp 53

# Enable intra-VLAN roaming for portal users.

[AC2] portal roaming enable

# Disable the Rule ARP entry feature for portal clients.

[AC2] undo portal refresh arp enable

# Enable validity check on wireless portal clients.

[AC2] portal host-check enable

# Enable direct IPv4 portal authentication for service template st1.

[AC2] wlan service-template st1

[AC2-wlan-st-st1] portal enable method direct

# Configure the authentication domain for IPv4 portal users as dm1 on service template st1.

[AC2-wlan-st-st1] portal domain dm1

# Specify portal Web server newpt on service template st1 to redirect user HTTP or HTTPS requests to the server.

[AC2-wlan-st-st1] portal apply web-server newpt

# Specify the BAS IP as the IP address of VLAN-interface 200, from which clients come online from AC 2.

[AC2-wlan-st-st1] portal bas-ip 2.2.2.2

# Enable the service template.

[AC2–wlan-st-st1] service-template enable

[AC2-wlan-st-st1] quit

Configuring the switch

# Create VLAN 100 for forwarding CAPWAP tunnel traffic between AC and AP.

<Switch> system-view

[Switch] vlan 100

[Switch-vlan100] quit

# Create VLAN 200 for forwarding client traffic.

[Switch] vlan 200

[Switch-vlan200] quit

# Create VLAN 2 for connecting to the IMC server.

[Switch] vlan 2

[Switch-vlan2] quit

# Add the interface that connects the switch to the IMC server to VLAN 2. (Details not shown.)

# Configure GigabitEthernet 1/0/1 that connects the switch to AC 1 as a trunk port, and assign it to VLAN 100 and VLAN 200.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] port link-type trunk

[Switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 that connects the switch to the AP as a trunk port, and assign the interface to VLAN 100.

[Switch] interface gigabitethernet 1/0/2

[Switch-GigabitEthernet1/0/2] port link-type access

[Switch-GigabitEthernet1/0/2] port access vlan 100

# Enable PoE.

[Switch-GigabitEthernet1/0/2] poe enable

[Switch-GigabitEthernet1/0/2] quit

# Configure GigabitEthernet 1/0/3 that connects the switch to AC 2 as a trunk port, and assign it to VLAN 100 and VLAN 200.

[Switch] interface gigabitethernet 1/0/3

[Switch-GigabitEthernet1/0/3] port link-type trunk

[Switch-GigabitEthernet1/0/3] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/3] quit

# Configure GigabitEthernet 1/0/4 that connects the switch to the DHCP server as a trunk port, and assign it to VLAN 100 and VLAN 200.

[Switch] interface gigabitethernet 1/0/4

[Switch-GigabitEthernet1/0/4] port link-type trunk

[Switch-GigabitEthernet1/0/4] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/4] quit

# Assign an IP address to VLAN-interface 200.

[Switch] interface vlan-interface 200

[Switch-Vlan-interface200] ip address 2.2.2.100 255.255.255.0

[Switch-Vlan-interface200] quit

# Assign an IP address to VLAN-interface 2. This address will be used as the gateway address for the IMC server.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.0.100 255.255.255.0

[Switch-Vlan-interface2] quit

Configuring the DHCP server

# Configure GigabitEthernet 1/0/1 that connects the server to the switch as a trunk port, and assign it to VLAN 100 and VLAN 200.

[DHCP Server] interface gigabitethernet 1/0/1

[DHCP Server-GigabitEthernet1/0/1] port link-type trunk

[DHCP Server-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[DHCP Server-GigabitEthernet1/0/1] quit

# Create VLAN 100, and assign an IP address to VLAN-interface 100.

[DHCP Server] vlan 100

[DHCP Server-vlan100] quit

[DHCP Server] interface vlan-interface 100

[DHCP Server-Vlan-interface100] ip address 2.2.1.200 255.255.255.0

[DHCP Server-Vlan-interface100] quit

# Create VLAN 200, and assign an IP address to VLAN-interface 200.

[DHCP Server] vlan 200

[DHCP Server-vlan200] quit

[DHCP Server] interface vlan-interface 200

[DHCP Server-Vlan-interface200] ip address 2.2.2.200 255.255.255.0

[DHCP Server-Vlan-interface200] quit

# Enable DHCP.

[DHCP Server] dhcp enable

# Create a DHCP address pool named VLAN100 for the AP, specify the DHCP server as the gateway, and exclude the IP addresses of AC 1, AC 2, and DHCP server from dynamic allocation.

[DHCP Server] dhcp server ip-pool VLAN100

[DHCP Server-dhcp-pool-vlan100] gateway-list 2.2.1.200

[DHCP Server-dhcp-pool-vlan100] network 2.2.1.0 mask 255.255.255.0

[DHCP Server-dhcp-pool-vlan100] forbidden-ip 2.2.1.200 2.2.1.1 2.2.1.2

[DHCP Server-dhcp-pool-vlan100] quit

# Create a DHCP address pool named VLAN200 for the client, specify the switch as the gateway, specify the DNS server address as 8.8.8.8, and exclude the IP addresses of AC 1, AC 2, and switch from dynamic allocation.

[DHCP Server] dhcp server ip-pool VLAN200

[DHCP Server-dhcp-pool-vlan200] gateway-list 2.2.2.100

[DHCP Server-dhcp-pool-vlan200] network 2.2.2.0 mask 255.255.255.0

[DHCP Server-dhcp-pool-vlan200] dns-list 8.8.8.8

[DHCP Server-dhcp-pool-vlan200] forbidden-ip 2.2.2.100 2.2.2.1 2.2.2.2

[DHCP Server-dhcp-pool-vlan200] quit

Configuring the IMC server

In this example, the IMC server runs IMC PLAT 7.3 (E0605), IMC EIA 7.3 (E0512), and IMC EIP 7.3 (E0512).

Configure the RADIUS server

1.     Add AC 1 as an access device:

a.     Log in to IMC and click the User tab.

b.     From the navigation pane, select User Access Policy > Access Device Management > Access Device.

c.     Click Add.

The Add Access Device page opens.

d.     In the Access Configuration area, configure the following parameters:

-     Enter radius in the Shared Key and Confirm Shared Key fields. Make sure the key is the same as the key configured on the ACs.

-     Use the default values for other parameters.

e.     In the Device List area, click Select or Add Manually to add AC 1 at 2.2.2.1 as an access device.

f.     Click OK.

Figure 2 Adding an access device

 

2.     Repeat the previous step to add AC 2 as an access device.

The IP address of AC 2 is 2.2.2.2.

3.     Add an access policy.

a.     From the navigation pane, select User Access Policy > Access Policy.

b.     Click Add.

c.     Enter the access policy name. In this example, the name is AccessPolicy.

d.     Select the Ungrouped service group.

e.     Use the default settings for other parameters.

Figure 3 Adding an access policy

 

4.     Add an access service.

a.     From the navigation pane, select User Access Policy > Access Service.

b.     Click Add.

c.     Enter the service name. In this example, the service name is RadiusServer.

d.     Select AccessPolicy.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 4 Adding an access service

 

5.     Add an access user.

a.     From the navigation pane, select Access User > All Access Users.

b.     Click Add.

c.     Select an existing access user or click Add User to add a new access user.

d.     Specify the account name. In this example, the name is client.

e.     Set the password. In this example, the password is 1234567.

f.     Select service RadiusServer.

g.     Use the default settings for other parameters.

h.     Click OK.

Figure 5 Adding an access user

 

Configure the portal server

1.     Configure portal authentication:

a.     Click the User tab.

b.     Select User Access Policy > Portal Service > Server from the navigation tree to open the portal server configuration page.

c.     Permit different ports to be bound to the same IP address group, and configure the other portal server parameters as needed.

This example uses the default settings.

d.     Click OK.

Figure 6 Portal authentication server configuration

 

2.     Configure the IP address group:

a.     Select User Access Policy > Portal Service > IP Group from the navigation tree to open the portal IP address group configuration page.

b.     Click Add to open the page as shown in Figure 7.

c.     Enter the IP group name. In this example, the name is Portal_user.

d.     Enter the start IP address and end IP address of the IP group.

Make sure the client IP address is in the IP group.

e.     Select a service group.

This example uses the default group Ungrouped.

f.     Select Normal from the Action list.

g.     Click OK.

Figure 7 Adding an IP address group

 

3.     Add AC 1 as a portal device:

a.     Select User Access Policy > Portal Service > Device from the navigation tree to open the portal device configuration page.

b.     Click Add to open the page as shown in Figure 8.

c.     Enter the device name.

d.     Specify the version as Portal 2.0.

e.     Enter the portal BAS-IP configured on AC 1 as the IP address.

f.     Set whether to support the portal server heartbeat and user heartbeat functions.

In this example, select No for both Support Server Heartbeat and Support User Heartbeat.

g.     Enter the key, which must be the same as that configured on the AC.

h.     Select Directly Connected from the Access Method list.

i.     Use the default settings for other parameters.

j.     Click OK.

Figure 8 Adding a portal device

 

4.     Repeat the previous step to add AC 2 as a portal device.

5.     Associate AC 1 with the IP address group:

a.     As shown in Figure 9, click the Port Group Information Management icon  for the device to open the port group configuration page.

b.     Click Add to open the page as shown in Figure 10.

c.     Enter the port group name. In this example, the name is Portal_user.

d.     Select the configured IP address group.

The IP address used by the user to access the network must be within this IP address group.

e.     Use the default settings for other parameters.

f.     Click OK.

Figure 9 Device list

 

Figure 10 Adding a port group

 

6.     Repeat the previous step to associate AC 2 with the IP address group.

Verifying the configuration

# Make the AP come online.

# Verify that the AP first associates with AC 1. Shut down VLAN-interface 100 on AC 1, wait 3 minutes, and verify that the AP associates with AC 2 and the AP state on AC 2 is R/M.

# Bring up VLAN-interface 100 on AC 1. Verify that the AP state becomes R/M on AC 1 and R/B on AC 2.

<AC1> display wlan ap all

Total number of APs: 1

Total number of connected APs: 1

Total number of connected manual APs: 1

Total number of connected auto APs: 0

Total number of connected common APs: 1

Total number of connected WTUs: 0

Total number of inside APs: 0

Maximum supported APs: 64

Remaining APs: 63

Total AP licenses: 16

Local AP licenses: 16

Server AP licenses: 0

Remaining Local AP licenses: 15

Sync AP licenses: 0

                                 AP information

 State : I = Idle,      J  = Join,       JA = JoinAck,    IL = ImageLoad

         C = Config,    DC = DataCheck,  R  = Run,   M = Master,  B = Backup

AP name                        APID  State Model           Serial ID

office                         1     R/M   WA6320          219801A28N819CE0002T

 

<AC2> display wlan ap all

Total number of APs: 1

Total number of connected APs: 1

Total number of connected manual APs: 1

Total number of connected auto APs: 0

Total number of connected common APs: 1

Total number of connected WTUs: 0

Total number of inside APs: 0

Maximum supported APs: 64

Remaining APs: 63

Total AP licenses: 16

Local AP licenses: 16

Server AP licenses: 0

Remaining Local AP licenses: 16

Sync AP licenses: 0

 

                                 AP information

 State : I = Idle,      J  = Join,       JA = JoinAck,    IL = ImageLoad

         C = Config,    DC = DataCheck,  R  = Run,   M = Master,  B = Backup

AP name                        APID  State Model           Serial ID

office                         1     R/B   WA6320          219801A28N819CE0002T

# Verify that all Web requests are redirected to the portal authentication page (http://192.168.0.111:8080/portal) before you pass portal authentication, and you can access Internet resources after being authenticated.

# View online port user information generated on AC 1.

[AC1] display portal user all

Total portal users: 1

Username: Client

  AP name: office

  Radio ID: 2

  SSID: service

  Portal server: newpt

  State: Online

  VPN instance: N/A

  MAC             IP                    VLAN    Interface

  0021-6330-0933  2.2.2.3               200     WLAN-BSS1/0/3

  Authorization information:

    DHCP IP pool: N/A

    User profile: N/A

    Session group profile: N/A

    ACL number: N/A

    Inbound CAR: N/A

    Outbound CAR: N/A

Configuration files

·     AC 1:

#

vlan 100

#

vlan 200

#

wlan service-template st1

 ssid service

 vlan 200

client forwarding-location ac

 akm mode psk

 preshared-key pass-phrase cipher $c$3$oLf6pOZ6bxrf25nodjOJKYEfnZ6g6ErccHyQ

 cipher-suite ccmp

 security-ie rsn

 portal enable method direct

 portal domain dm1

 portal bas-ip 2.2.2.1

 portal apply web-server newpt

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.1.1 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.1 255.255.255.0

#

interface gigabitethernet 1/0/1

port link-type trunk

port trunk permit vlan 1 100 200

#

 ip route-static 192.168.0.0 16 2.2.2.100

#

 radius session-control enable

#

radius scheme rs1

 primary authentication 192.168.0.111

 primary accounting 192.168.0.111

 key authentication cipher $c$3$Sqgqz7lDs4XPnethmAgyAKVlke7qwEkYbQ==

 key accounting cipher $c$3$4J/JBRGwqB4F213furJMkB6JWYXBFjWE6g==

 user-name-format without-domain

 nas-ip 2.2.2.1

#

domain dm1

 authorization-attribute idle-cut 15 1024

 authentication portal radius-scheme rs1

 authorization portal radius-scheme rs1

 accounting portal radius-scheme rs1

#

portal host-check enable

portal free-rule 0 destination ip 192.168.0.0 255.255.255.0

portal free-rule 1 destination ip any udp 53

portal free-rule 2 destination ip any tcp 53

#

portal web-server newpt

 url http://192.168.0.111:8080/portal

#

portal server newpt

 ip 192.168.0.111 key cipher $c$3$AkTEB7OgMYnCqsfDeplhoAgXUek/rVrLZw==

#

wlan ap-group group1

 priority 7

 wlan tunnel-preempt enable

 backup-ac ip 2.2.1.2

 ap office

 ap-model WA6320

radio 1

  radio 2

   radio enable

   service-template st1

#

wlan ap office model WA6320

 serial-id 219801A28N819CE0002T

#

·     AC 2:

#

vlan 100

#

vlan 200

#

wlan service-template st1

 ssid service

 vlan 200

client forwarding-location ac

 akm mode psk

 preshared-key pass-phrase cipher $c$3$oLf6pOZ6bxrf25nodjOJKYEfnZ6g6ErccHyQ

 cipher-suite ccmp

 security-ie rsn

portal enable method direct

 portal domain dm1

 portal bas-ip 2.2.2.2

 portal apply web-server newpt

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.1.2 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.2 255.255.255.0

#

interface gigabitethernet 1/0/1

port link-type trunk

port trunk permit vlan 1 100 200

#

 ip route-static 192.168.0.0 16 2.2.2.100

#

 radius session-control enable

#

radius scheme rs1

 primary authentication 192.168.0.111

 primary accounting 192.168.0.111

 key authentication cipher $c$3$Sqgqz7lDs4XPnethmAgyAKVlke7qwEkYbQ==

 key accounting cipher $c$3$4J/JBRGwqB4F213furJMkB6JWYXBFjWE6g==

 user-name-format without-domain

 nas-ip 2.2.2.2

#

domain dm1

 authorization-attribute idle-cut 15 1024

 authentication portal radius-scheme rs1

 authorization portal radius-scheme rs1

 accounting portal radius-scheme rs1

#

portal host-check enable

portal free-rule 0 destination ip 192.168.0.0 255.255.255.0

portal free-rule 1 destination ip any udp 53

portal free-rule 2 destination ip any tcp 53

#

portal web-server newpt

 url http://192.168.0.111:8080/portal

#

portal server newpt

 ip 192.168.0.111 key cipher $c$3$AkTEB7OgMYnCqsfDeplhoAgXUek/rVrLZw==

#

wlan ap-group group1

 priority 6

 wlan tunnel-preempt enable

 backup-ac ip 2.2.1.1

 ap office

 ap-model WA6320

radio 1

  radio 2

   radio enable

   service-template st1

#

wlan ap office model WA6320

 serial-id 219801A28N819CE0002T

#

·     Switch:

#

vlan 2

#

vlan 100

#

vlan 200

#

interface Vlan-interface2

 ip address 192.168.0.100 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.100 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/2

 port link-type access

 port access vlan 100

 poe enable

#

interface GigabitEthernet1/0/3

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/4

 port link-type trunk

 port trunk permit vlan 1 100 200

·     DHCP server:

#

 dhcp enable

#

vlan 100

#

vlan 200

#

dhcp server ip-pool VLAN100

 gateway-list 2.2.1.200

 network 2.2.1.0 mask 255.255.255.0

 forbidden-ip 2.2.1.1

 forbidden-ip 2.2.1.2

 forbidden-ip 2.2.1.200

#

dhcp server ip-pool VLAN200

 gateway-list 2.2.2.100

 network 2.2.2.0 mask 255.255.255.0

 dns-list 8.8.8.8

 forbidden-ip 2.2.2.1

 forbidden-ip 2.2.2.2

 forbidden-ip 2.2.2.100

#

interface Vlan-interface100

 ip address 2.2.1.200 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.200 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

Related documentation

·     AAA Management Command Reference in H3C Access Controllers Command References

·     AAA Management Configuration Guide in H3C Access Controllers Configuration Guides

·     AP Management Command Reference in H3C Access Controllers Command References

·     AP Management Configuration Guide in H3C Access Controllers Configuration Guides

·     Portal Authentication Command Reference in H3C Access Controllers Command References

·     Portal Authentication Configuration Guide in H3C Access Controllers Configuration Guides

·     WLAN Access Command Reference in H3C Access Controllers Command References

·     WLAN Access Configuration Guide in H3C Access Controllers Configuration Guides

·     WLAN High Availability Command Reference in H3C Access Controllers Command References

·     WLAN High Availability Configuration Guide in H3C Access Controllers Configuration Guides