Example for Configuring Portal Authentication to Control User Access to the Enterprise Network (Authentication Point on Aggregation Switch)

Procedure

1. Configure the access switch to ensure network connectivity.

   The following provides the configuration for SwitchA, the access switch connecting to the R&D department. The configuration for SwitchB, the access switch connecting to the marketing department, is similar.

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchA
   [SwitchA] vlan 101
   [SwitchA-vlan101] quit
   [SwitchA] interface gigabitethernet 0/0/1    //Interface connected to the R&D department
   [SwitchA-GigabitEthernet0/0/1] port link-type access
   [SwitchA-GigabitEthernet0/0/1] port default vlan 101
   [SwitchA-GigabitEthernet0/0/1] quit
   [SwitchA] interface gigabitethernet 0/0/2    //Interface connected to the aggregation switch
   [SwitchA-GigabitEthernet0/0/2] port link-type trunk
   [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 101
   [SwitchA-GigabitEthernet0/0/2] quit

2. Configure the aggregation switch.
   1. Create VLANs and configure the VLANs allowed by interfaces so that packets can be forwarded.

      <HUAWEI> system-view
      [HUAWEI] sysname SwitchC
      [SwitchC] dhcp enable    //Enable the DHCP service.
      [SwitchC] vlan batch 101 to 103
      [SwitchC] interface gigabitethernet 1/0/1    //Interface of the access switch connected to the R&D department
      [SwitchC-GigabitEthernet1/0/1] port link-type trunk
      [SwitchC-GigabitEthernet1/0/1] port trunk allow-pass vlan 101
      [SwitchC-GigabitEthernet1/0/1] quit
      [SwitchC] interface vlanif 101
      [SwitchC-Vlanif101] ip address 192.168.0.1 255.255.255.0    //IP address segment assigned to R&D employees
      [SwitchC-Vlanif101] dhcp select interface
      [SwitchC-Vlanif101] dhcp server dns-list 172.16.1.2
      [SwitchC-Vlanif101] quit
      [SwitchC] interface gigabitethernet 1/0/2    //Interface of the access switch connected to the marketing department
      [SwitchC-GigabitEthernet1/0/2] port link-type trunk
      [SwitchC-GigabitEthernet1/0/2] port trunk allow-pass vlan 102
      [SwitchC-GigabitEthernet1/0/2] quit
      [SwitchC] interface vlanif 102
      [SwitchC-Vlanif102] ip address 192.168.1.1 255.255.255.0    //IP address segment assigned to marketing employees.
      [SwitchC-Vlanif102] dhcp select interface
      [SwitchC-Vlanif102] dhcp server dns-list 172.16.1.2
      [SwitchC-Vlanif102] quit
      [SwitchC] interface gigabitethernet 1/0/3    //Interface connected to the server area
      [SwitchC-GigabitEthernet1/0/3] port link-type access
      [SwitchC-GigabitEthernet1/0/3] port default vlan 103
      [SwitchC-GigabitEthernet1/0/3] quit
      [SwitchC] interface vlanif 103
      [SwitchC-Vlanif103] ip address 172.16.1.254 255.255.255.0    //Configure the gateway address for the server area.
      [SwitchC-Vlanif103] quit

   2. Configure parameters for connecting to the RADIUS server.

      [SwitchC] radius-server template policy    //Create the RADIUS server template policy.
      [SwitchC-radius-policy] radius-server authentication 172.16.1.1 1812 source ip-address 172.16.1.254    //Configure the IP address and port number of the RADIUS authentication server.
      [SwitchC-radius-policy] radius-server accounting 172.16.1.1 1813 source ip-address 172.16.1.254    //Configure the IP address and port number of the RADIUS accounting server.
      [SwitchC-radius-policy] radius-server shared-key cipher Admin@123    //Set the authentication key and accounting key to Admin@123.
      [SwitchC-radius-policy] quit
      [SwitchC] aaa    //Enter the AAA view.
      [SwitchC-aaa] authentication-scheme auth    //Configure the authentication scheme auth.
      [SwitchC-aaa-authen-auth] authentication-mode radius    //Set the authentication mode to RADIUS.
      [SwitchC-aaa-authen-auth] quit
      [SwitchC-aaa] accounting-scheme acco    //Configure the accounting scheme acco.
      [SwitchC-aaa-accounting-acco] accounting-mode radius    //Set the accounting mode to RADIUS.
      [SwitchC-aaa-accounting-acco] accounting realtime 15    //Set the real-time accounting interval to 15 minutes.
      [SwitchC-aaa-accounting-acco] quit
      [SwitchC-aaa] domain portal    //Configure a domain.
      [SwitchC-aaa-domain-portal] authentication-scheme auth    //Bind the authentication scheme auth to the domain.
      [SwitchC-aaa-domain-portal] accounting-scheme acco    //Bind the accounting scheme acco to the domain.
      [SwitchC-aaa-domain-portal] radius-server policy    //Bind the RADIUS server template policy to the domain.
      [SwitchC-aaa-domain-portal] quit
      [SwitchC-aaa] quit
      [SwitchC] domain portal  //Configure portal as the global default domain.

   3. Configure parameters for connecting to the Portal server.

      [SwitchC] web-auth-server portal_huawei    //Configure the Portal server template portal_huawei.
      [SwitchC-web-auth-server-portal_huawei] server-ip 172.16.1.1    //Set the Portal server IP address.
      [SwitchC-web-auth-server-portal_huawei] source-ip 172.16.1.254    //Set the IP address that the switch uses to communicate with the Portal server.
      [SwitchC-web-auth-server-portal_huawei] port 50200    //Set the destination port number in the packets that the switch sends to the Portal server to 50200, which is the same as the port number that the Portal server uses to receive packets. The default destination port number on the switch is 50100, and you must change it to 50200 manually, so that it matches the port number on the Portal server.
      [SwitchC-web-auth-server-portal_huawei] shared-key cipher Admin@123    //Configure the shared key for communication with the Portal server, which must be the same as that configured on the Portal server.
      [SwitchC-web-auth-server-portal_huawei] url http://access.example.com:8080/portal    //Configure the URL for the Portal authentication page, in which access.example.com indicates the host name of the Portal server. The domain name is recommended in the URL so that the Portal authentication page can be pushed to users faster and more securely. To use the domain name in the URL, you must configure the mapping between this domain name access.example.com and Portal server IP address on the DNS server in advance.
      [SwitchC-web-auth-server-portal_huawei] quit
      [SwitchC] web-auth-server listening-port 2000    //Configure the port number that the switch uses to process Portal protocol packets. The default port number is 2000. If the port number is changed on the server, change it accordingly on the switch.
      [SwitchC] portal quiet-period    //Enable the quiet function for Portal authentication users. If the number of times that a Portal authentication user fails to be authenticated within 60 seconds exceeds the specified value, the device discards the user's Portal authentication request packets for a period to prevent impact of frequent authentication failures on the system.
      [SwitchC] portal quiet-times 5    //Configure the maximum number of authentication failures within 60 seconds before the device quiets a Portal authentication user.
      [SwitchC] portal timer quiet-period 240    //Set the quiet period to 240 seconds.

   4. Enable Portal authentication.

      [SwitchC] authentication unified-mode    //Set the NAC mode to unified. By default, the unified mode is enabled. After the NAC mode is changed, save the configuration and restart the device to make the configuration take effect.
      [SwitchC] interface vlanif 101
      [SwitchC-Vlanif101] authentication portal    //Enable Portal authentication on the interface.
      [SwitchC-Vlanif101] web-auth-server portal_huawei direct    //Bind the Portal server template to the interface, so the interface can control user access to the enterprise network. If user terminals and the switch are connected through a Layer 2 network, set the Portal authentication mode to direct. If user terminals and the switch are connected through a Layer 3 network, set the Portal authentication mode to layer3.
      [SwitchC-Vlanif101] quit
      [SwitchC] interface vlanif 102
      [SwitchC-Vlanif102] authentication portal    //Enable Portal authentication on the interface connecting to the marketing department.
      [SwitchC-Vlanif102] web-auth-server portal_huawei direct    //Bind the Portal server template to the interface, so the interface can control user access to the enterprise network. If user terminals and the switch are connected through a Layer 2 network, set the Portal authentication mode to direct. If user terminals and the switch are connected through a Layer 3 network, set the Portal authentication mode to layer3.
      [SwitchC-Vlanif102] quit

      # (Recommended) Configure the source IP address and source MAC address for offline detection packets in a specified VLAN. You are advised to set the user gateway IP address and its corresponding MAC address as the source IP address and source MAC address of offline detection packets. This function does not take effect for users who use Layer 3 Portal authentication.

      [SwitchC] access-user arp-detect vlan 101 ip-address 192.168.0.1 mac-address 2222-1111-1234
      [SwitchC] access-user arp-detect vlan 102 ip-address 192.168.1.1 mac-address 2222-1111-1234

   5. Configure network access rights for the pre-authentication domain and post-authentication domain.

      [SwitchC] authentication free-rule 1 destination ip 172.16.1.2 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the DNS server before the authentication.
      [SwitchC] authentication free-rule 2 destination ip 172.16.1.3 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the web server before the authentication.
      [SwitchC] acl 3001    //Configure the post-authentication domain for R&D employees.
      [SwitchC-acl-adv-3001] rule 1 permit ip    //Allow R&D employees to access all resources.
      [SwitchC-acl-adv-3001] quit
      [SwitchC] acl 3002    //Configure the post-authentication domain for marketing employees.
      [SwitchC-acl-adv-3002] rule 1 deny ip destination 172.16.1.4 0    //Prevent marketing employees from accessing the code library.
      [SwitchC-acl-adv-3002] rule 2 deny ip destination 172.16.1.5 0    //Prevent marketing employees from accessing the issue tracking system.
      [SwitchC-acl-adv-3002] rule 3 permit ip    //Allow marketing employees to access other resources.
      [SwitchC-acl-adv-3002] quit

3. Configure the Agile Controller-Campus.
   1. Log in to the Agile Controller-Campus.
      1. Open the Internet Explorer, enter the Agile Controller-Campus address in the address box, and press Enter.
         The following table provides two types of Agile Controller-Campus addresses.

         Address Format	Description
         https://Agile Controller-Campus-IP:8443	In the address, Agile Controller-Campus-IP indicates the Agile Controller-Campus IP address.
         Agile Controller-Campus IP address	If port 80 is enabled during installation, you can access the Agile Controller-Campus by simply entering its IP address without the port number. The Agile Controller-Campus address will automatically change to https://Agile Controller-Campus-IP:8443.

      2. Enter the administrator account and password.

         If you log in to the Agile Controller-Campus for the first time, use the super administrator account admin and password Changeme123. Change the password immediately after logging in. Otherwise, the Agile Controller-Campus cannot be used.

   2. Create departments and accounts. The following describes how to create the R&D department. Create the Marketing department similarly.
      1. Choose Resource > User > User Management.
      2. Click the Department tab in the operation area on the right. Then click Add under the Department tab, and add the department R&D.

         

         

      3. Click the User tab in the operation area on the right. Then click Add under the User tab, and add the user A.

         

         

      4. Click in the Operation column on the right of user A. The Account Management page is displayed. Click Add, and create a common account A-123 with the password Huawei123.

         

      5. On the User tab page, select user A and click Transfer to add user A to the R&D department.

         

   3. Add a switch to the Agile Controller-Campus and configure related parameters to ensure normal communication between the Agile Controller-Campus and switch.
      1. Choose Resource > Device > Device Management.
      2. Click Add.
      3. Configure parameters for the switch.

         Parameter	Value	Description
         Name	SW	-
         IP Address	172.16.1.254	The interface must be able to communicate with the SC.
         Device series	Huawei Quidway Series	-
         Authentication Key	Admin@123	It must be the same as the shared key of the RADIUS authentication server configured on the switch.
         Charging Key	Admin@123	It must be the same as the shared key of the RADIUS accounting server configured on the switch.
         Real-time charging interval (minute)	15	It must be the same as the real-time accounting interval configured on the switch.
         Port	2000	This is the port that the switch uses to communicate with the Portal server. Retain the default value.
         Portal Key	Admin@123	It must be the same as the Portal shared key configured on the switch.
         Allowed IP Addresses	192.168.0.1/24; 192.168.1.1/24	-

         

      4. Click OK.

   4. Configure employee authorization. This example describes how to configure R&D employee authorization. The configuration procedure for marketing employees is the same, except that the network resources the two types of employees can access are different.
      1. Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and configure resources that R&D employees can access after authentication and authorization.

         Parameter	Value	Description
         Name	R&D employee post-authentication domain	-
         Service Type	Access Service	-
         ACL Number/AAA User Group	3001	The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

         

      2. Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule, and specify the authorization conditions for R&D employees.

         Parameter	Value	Description
         Name	R&D employee authorization rule	-
         Service Type	Access User	-
         Department	R&D	-
         Authorization Result	R&D employee post-authentication domain	-

         

4. Verify the configuration.
   • Employees can access only the Agile Controller-Campus, DNS, and web servers before authentication.
   • The Portal authentication page is pushed to an employee when the employee attempts to visit an Internet website. After the employee enters the correct account and password, the requested web page is displayed.
   • R&D employee A can access the Internet, code library, and issue tracking system after authentication. Marketing employee B can access the Internet but not the code library and issue tracking system after authentication.
   • After an employee is authenticated, run the display access-user command on the switch. The command output shows that the employee is online.