< Home

Delivering VLANs or ACLs to Successfully Authenticated Users on Huawei Agile Controller-Campus

This section includes the following content:

Overview

After an 802.1X user is successfully authenticated on a RADIUS server, the server sends authorization information to the access device of the user. When the Agile Controller-Campus functions as the RADIUS server, it can deliver multiple authorization parameters.
  • ACL-based authorization is classified into:

    • ACL description-based authorization: If ACL description-based authorization is configured on the server, authorization information includes the ACL description. The device matches ACL rules based on the ACL description authorized by the server to control user rights. The ACL number, corresponding description, and ACL rule must be configured on the device.

      The standard RADIUS attribute (011) Filter-Id is used.

    • Dynamic ACL-based authorization: The server authorizes rules in an ACL to the device. Users can access network resources controlled using this ACL. The ACL and ACL rules must be configured on the server. The ACL does not need to be configured on the device.

      The Huawei proprietary RADIUS attribute (26-82) HW-Data-Filter is used.

  • Dynamic VLAN: If dynamic VLAN delivery is configured on the server, authorization information includes the delivered VLAN attribute. After the device receives the delivered VLAN attribute, it changes the VLAN of the user to the delivered VLAN.

    The delivered VLAN does not change or affect the interface configuration. The delivered VLAN, however, takes precedence over the VLAN configured on the interface. That is, the delivered VLAN takes effect after the authentication succeeds, and the configured VLAN takes effect after the user goes offline.

    The following standard RADIUS attributes are used for dynamic VLAN delivery:
    • (064) Tunnel-Type (It must be set to VLAN or 13.)
    • (065) Tunnel-Medium-Type (It must be set to 802 or 6.)
    • (081) Tunnel-Private-Group-ID (For devices running versions earlier than V200R012C00, it can be the VLAN ID or VLAN description. For devices running V200R012C00 and later versions, it can be the VLAN ID, VLAN description, VLAN name, or VLAN pool.)

    To ensure that the RADIUS server delivers VLAN information correctly, all the three RADIUS attributes must be used. In addition, the Tunnel-Type and Tunnel-Medium-Type attributes must be set to the specified values.

The following uses ACL number and dynamic VLAN delivery as an example. The configuration differences between ACL number delivery and dynamic ACL delivery are described in notes.

Networking Requirements

As shown in Figure 1, a large number of employees' terminals in a company connect to the intranet through GE0/0/1 on SwitchA. To ensure network security, the administrator needs to control network access rights of terminals. The requirements are as follows:
  • Before passing authentication, terminals can access the public server (with IP address 192.168.40.1), and download the 802.1X client or update the antivirus database.
  • After passing authentication, terminals can access the service server (with IP address 192.168.50.1) and devices in the laboratory (with VLAN ID 20 and IP address segment 192.168.20.10-192.168.20.100).
Figure 1 Wired access networking diagram

Configuration Logic

Figure 2 Configuration logic of Huawei switch
Table 1 Configuration logic of Huawei Agile Controller-Campus

Item

Description

Creating a department and an account

-

Adding switches

Set parameters for switches connected to the Agile Controller-Campus.

(Optional) adding an authentication rule

Configure the conditions for users to pass the authentication. If no authentication rule is created, the default authentication rule (that allows all users to pass the authentication) of the Agile Controller-Campus is used.

Adding an authorization result

Create network access right profiles so that users granted with different profiles have different network access rights.

Adding an authorization rule

Select network access right profiles and users in an authorization rule so that specified network access rights are granted to specific users.

Configuration Notes

This configuration example applies to all switches running V200R009C00 or a later version, Huawei Agile Controller-Campus in V100R001 functions as the RADIUS server. For the Agile Controller-Campus, the version required is V100R001, V100R002, V100R003.

When the device supports UCL groups, using UCL groups to configure authorization rules is recommended. For details, see section "AAA Configuration" > "Configuring Authorization Rules" in the Configuration Guide - User Access and Authentication.

When you run the access-user arp-detect command to configure the IP address and MAC address of the user gateway as the source IP address and source MAC address of user offline detection packets, ensure that the MAC address of the gateway remains unchanged, especially in active/standby switchover scenarios. If the gateway MAC address is changed, ARP entries of terminals will be incorrect on the device, and the terminals cannot communicate with the device.

Data Plan

Table 2 Service data plan for the access switch

Item

Data

RADIUS scheme

  • Authentication server IP address: 192.168.30.1

  • Authentication server port number: 1812

  • Accounting server IP address: 192.168.30.1

  • Accounting server port number: 1813

  • Shared key for the RADIUS server: Huawei@123

  • Accounting interval: 15 minutes

  • Authentication domain: huawei

Resources accessible to users before authentication

Access rights to the public server are configured using an authentication-free rule. The name of the authentication-free rule profile is default_free_rule.

Resources accessible to users after authentication

Access rights to the laboratory are granted using a dynamic VLAN. The VLAN ID is 20.

Access rights to the service server are granted using an ACL number. The ACL number is 3002.
Table 3 Service data plan for the Agile Controller-Campus

Item

Data

Department

R&D department

Access user

User name: A

Wired access account: A-123

Password: Huawei123

Switch IP address

SwitchA: 10.10.10.1

RADIUS authentication key

Huawei@123

RADIUS accounting key

Huawei@123

Procedure

  1. Configure access switch SwitchA.
    1. Create VLANs and configure the allowed VLANs on interfaces to ensure network connectivity.

      <HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 10 20
[SwitchA] interface gigabitethernet 0/0/1    //Configure the interface connecting to employees' terminals.
[SwitchA-GigabitEthernet0/0/1] port link-type hybrid
[SwitchA-GigabitEthernet0/0/1] port hybrid pvid vlan 10
[SwitchA-GigabitEthernet0/0/1] port hybrid untagged vlan 10
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2    //Configure the interface connecting to the laboratory.
[SwitchA-GigabitEthernet0/0/2] port link-type hybrid
[SwitchA-GigabitEthernet0/0/2] port hybrid untagged vlan 20
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3    //Configure the interface connecting to SwitchB.
[SwitchA-GigabitEthernet0/0/3] port link-type trunk
[SwitchA-GigabitEthernet0/0/3] port trunk allow-pass vlan 10 20
[SwitchA-GigabitEthernet0/0/3] quit
[SwitchA] interface loopback 1
[SwitchA-LoopBack1] ip address 10.10.10.1 24    //Configure an IP address for communication with the Agile Controller-Campus.
[SwitchA-LoopBack1] quit
[SwitchA] interface vlanif 10
[SwitchA-Vlanif10] ip address 192.168.1.10 24
[SwitchA-Vlanif10] quit

    2. Configure network access rights for users after successful authentication.

      In dynamic ACL mode, this step does not need to be configured on the device.

      [SwitchA] acl 3002
[SwitchA-acl-adv-3002] rule 1 permit ip destination 192.168.30.1 0
[SwitchA-acl-adv-3002] rule 2 permit ip destination 192.168.50.1 0
[SwitchA-acl-adv-3002] rule 3 deny ip destination any
[SwitchA-acl-adv-3002] quit

    3. Create and configure a RADIUS server template, an AAA authentication scheme, and an authentication domain.

      # Create and configure the RADIUS server template rd1.
      [SwitchA] radius-server template rd1
[SwitchA-radius-rd1] radius-server authentication 192.168.30.1 1812
[SwitchA-radius-rd1] radius-server accounting 192.168.30.1 1813
[SwitchA-radius-rd1] radius-server shared-key cipher Huawei@123
[SwitchA-radius-rd1] quit
      # Create the AAA authentication scheme abc and set the authentication mode to RADIUS.
      [SwitchA] aaa
[SwitchA-aaa] authentication-scheme abc
[SwitchA-aaa-authen-abc] authentication-mode radius
[SwitchA-aaa-authen-abc] quit
      # Configure the accounting scheme acco1 and set the accounting mode to RADIUS.
      [SwitchA-aaa] accounting-scheme acco1
[SwitchA-aaa-accounting-acco1] accounting-mode radius
[SwitchA-aaa-accounting-acco1] accounting realtime 15
[SwitchA-aaa-accounting-acco1] quit
      # Create the authentication domain huawei, and bind the AAA authentication scheme abc, accounting scheme acco1, and RADIUS server template rd1 to the domain.
      [SwitchA-aaa] domain huawei
[SwitchA-aaa-domain-huawei] authentication-scheme abc
[SwitchA-aaa-domain-huawei] accounting-scheme acco1
[SwitchA-aaa-domain-huawei] radius-server rd1
[SwitchA-aaa-domain-huawei] quit
[SwitchA-aaa] quit

    4. Enable 802.1X authentication.

      # Set the NAC mode to unified.

      [SwitchA] authentication unified-mode

      By default, the unified mode is enabled. Before changing the NAC mode, you must save the configuration. After the mode is changed and the device is restarted, functions of the newly configured mode take effect.

      # Configure the 802.1X access profile d1.
      [SwitchA] dot1x-access-profile name d1
[SwitchA-dot1x-access-profile-d1] dot1x timer client-timeout 30
[SwitchA-dot1x-access-profile-d1] quit
      # Configure an authentication-free rule profile.
      [SwitchA] free-rule-template name default_free_rule
[SwitchA-free-rule-default_free_rule] free-rule 10 destination ip 192.168.40.0 mask 24
[SwitchA-free-rule-default_free_rule] quit

      # Configure the authentication profile p1, bind the 802.1X access profile d1 and authentication-free rule profile default_free_rule to the authentication profile, specify the domain huawei as the forcible authentication domain in the authentication profile, and set the user access mode to multi-authen.

      [SwitchA] authentication-profile name p1
[SwitchA-authen-profile-p1] dot1x-access-profile d1
[SwitchA-authen-profile-p1] free-rule-template default_free_rule
[SwitchA-authen-profile-p1] access-domain huawei force
[SwitchA-authen-profile-p1] authentication mode multi-authen
[SwitchA-authen-profile-p1] quit

      # Bind the authentication profile p1 to GE0/0/1 and enable 802.1X authentication on the interface.

      [SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] authentication-profile p1
[SwitchA-GigabitEthernet0/0/1] quit

      # (Recommended) Configure the source IP address and source MAC address for offline detection packets in a specified VLAN. You are advised to set the user gateway IP address and its corresponding MAC address as the source IP address and source MAC address of offline detection packets.

      [SwitchA] access-user arp-detect vlan 10 ip-address 192.168.1.10 mac-address 2222-1111-1234

  2. Configure the Agile Controller-Campus.
    1. Log in to the Agile Controller-Campus.

      1. Open the Internet Explorer, enter the Agile Controller-Campus access address in the address bar, and press Enter.
        The following table describes addresses for accessing the Agile Controller-Campus.

        Access Mode

        Description

        https://Agile Controller-Campus-IP:8443

        Agile Controller-Campus-IP specifies the IP address of the Agile Controller-Campus.

        IP address of the Agile Controller-Campus

        If port 80 is enabled during installation, you can access the Agile Controller-Campus by entering its IP address without the port number. The Agile Controller-Campus URL will automatically change to https://Agile Controller-Campus-IP:8443.
      2. Enter the administrator user name and password.

        If you log in to the Agile Controller-Campus for the first time, use the super administrator user name admin and password Changeme123. Change the password immediately after logging in. Otherwise, the Agile Controller-Campus cannot be used.

    2. Create a department and an account.

      1. Choose Resource > User > User Management.
      2. Click the Department tab in the operation area on the right, and then click Add under the Department tab to add a department R&D.

      3. Click the User tab in the operation area on the right, and then click Add under the User tab to add a user A.

      4. Click next to user A in Operation to access Account Management. Click Add. Create a common account A-123 and set the password to Huawei123.

      5. In the User tab, select user A. Click Transfer to add user A to the department R&D.

    3. Add switches to the Agile Controller-Campus so that the switches can communicate with the Agile Controller-Campus.

      Choose Resource > Device > Device Management. Click Add in the operation area on the right. Set connection parameters on the Add Device page.

    4. Add an authorization result.

      Perform this step for ACL number and VLAN delivery.

      1. Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and click Add to create an authorization result.

      2. Configure basic information for the authorization result.

        Parameter

        Value

        Description

        Name

        Authorization info for authenticated users

        -

        Service type

        Access service

        -

        VLAN

        20

        The VLAN must be the same as the VLAN configured for R&D employees on the switch.

        ACL number/AAA user group

        3002

        The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

    5. Add an authorization result.

      Perform this step for dynamic ACL and VLAN delivery.

      1. Add a dynamic ACL.
        1. Choose Policy > Permission Control > Policy Element > Dynamic ACL.
        2. Click Add.
        3. Configure basic information for the dynamic ACL and click Add in Rule List.
        4. Configure attributes contained in the dynamic ACL.

      2. Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and click Add to create an authorization result.

      3. Configure basic information for the authorization result.

        Parameter

        Value

        Description

        Name

        Authorization information for users who pass authentication

        -

        Service type

        Access service

        -

        VLAN

        20

        The VLAN ID must be the same as the VLAN ID configured for R&D employees on the switch.

        Dynamic ACL

        3002

        -

    6. Add an authorization rule.

      After a user passes authentication, authorization phase starts. The Agile Controller-Campus grants the user access rights based on the authorization rule.

      1. Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule and click Add to create an authorization rule.

      2. Configure basic information for the authorization rule.

        Parameter

        Value

        Description

        Name

        Authorization rule for authenticated users

        -

        Service type

        Access service

        -

        Department

        R&D department

        -

        Authorization result

        Authorization info for authenticated users

        -

  3. Verify the configuration.

    • An employee can only access the Agile Controller-Campus server and public server before passing authentication.
    • An employee can access the Agile Controller-Campus server, public server, service server, and laboratory after passing authentication.
    • After the employee passes authentication, run the display access-user command on the switch. The command output shows information about the online employee.

Configuration File

#
sysname SwitchA
#
vlan batch 10 20
#
authentication-profile name p1
 dot1x-access-profile d1
 free-rule-template default_free_rule
 access-domain huawei force
#
access-user arp-detect vlan 10 ip-address 192.168.1.10 mac-address 2222-1111-1234
#
radius-server template rd1
 radius-server shared-key cipher %^%#FP@&C(&{$F2HTlPxg^NLS~KqA/\^3Fex;T@Q9A](%^%#
 radius-server authentication 192.168.30.1 1812 weight 80
 radius-server accounting 192.168.30.1 1813 weight 80
#
acl number 3002
 rule 1 permit ip destination 192.168.30.1 0 
 rule 2 permit ip destination 192.168.50.1 0 
 rule 3 deny ip
#
free-rule-template name default_free_rule
 free-rule 10 destination ip 192.168.40.0 mask 255.255.255.0
# 
aaa
 authentication-scheme abc
  authentication-mode radius
 accounting-scheme acco1
  accounting-mode radius
  accounting realtime 15
 domain huawei
  authentication-scheme abc
  accounting-scheme acco1
  radius-server rd1
#
interface Vlanif10
 ip address 192.168.1.10 255.255.255.0
#
interface GigabitEthernet0/0/1
 port link-type hybrid
 port hybrid pvid vlan 10 
 port hybrid untagged vlan 10
 authentication-profile p1
#
interface GigabitEthernet0/0/2
 port link-type hybrid
 port hybrid untagged vlan 20
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface LoopBack1
 ip address 10.10.10.1 255.255.255.0
#  
dot1x-access-profile name d1
#
return
Parent Topic: Typical NAC Configuration (Unified Mode) (the Agile Controller-Campus as the Authentication Server) (V200R009C00 and Later Versions)
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >