web-server redirect-key

Usage Scenario

Mandatory web authentication is a function that enables the to redirect the access request of a user to the web server when a user accesses an unauthorized address before being authenticated, facilitating user authentication.

If a customized Portal attribute is configured, after the receives a user packet that needs to be redirected, the adds the keyword and corresponding attribute to the string of the redirection URL in the redirection packet and sends the packet to the user. After receiving this redirection packet, the user accesses the web server. The access packet carries the device IP address, user IP address, user's physical location information, and corresponding keyword. The forwards the packet to the web server. The web server parses the packet based on the keyword and pops up the request homepage to the user based on the user information in the packet.

If homepage popup is configured and the web server support this function, when the user passes the web authentication, the web server refreshes the web page being browsing by the user to the homepage requested by the user before authentication. The user does not need to type this homepage again. If homepage popup is configured, when the user passes the web authentication, the user is forcibly redirected to the Portal page. To access the requested homepage, the user needs to type this homepage again.

If the mandatory web server is different from the web authentication server, the cannot identify whether the mandatory web server is Up or Down, but can identify whether the web authentication server is Up or Down. To enable the to identify whether the mandatory Web server is Up or Down based on the status of the web authentication server, you can run the web-server { <ip-address>| url <url> } [ bind web-auth-server <ip-address> [ vpn-instance <vpn-instance> ] ]command to bind the mandatory web server to the web authentication server.

If there are two web authentication servers in active/standby mode, after the mandatory web server is bound to the web authentication server, you can run the web-server { <ip-address>| url <url> } [ bind web-auth-server <ip-address> [ vpn-instance <vpn-instance> ] ] slave command to configure the standby mandatory web server.

To enable the device to add the Option 82 information delivered through the subscription-id sub-attribute of the hw-avpair (26-188) attribute to the URL string in a redirection packet to be sent to a user, run the web-server redirect-key subscription-id [subscription-id] command.

NOTE:

• The web-server redirect-key subscription-id [subscription-id] and web-server redirect-key agent-remote-id agent-remote-id commands are mutually exclusive.
• The Option 82 information added to the URL string in a web redirection packet takes effect only after the web-server redirect-key subscription-id [subscription-id] command is run and the RADIUS-delivered attribute value of the subscription-id sub-attribute is not empty.

Precautions

This command is supported only on the admin VS.

• When you run the web-server command in the AAA domain view, check whether the web authentication server to which the active/standby server in IP mode is the same as that in URL mode. If they are different, you cannot run the web-server command.
• The active web server must be different from the standby Web server.
• To delete the web authentication server, you must remove the binding of the web authentication server.
• You must bind the web authentication server in the system view; otherwise, the binding fails.
• If the web-auth-server source interface command is not run in the system view, run the web-server redirect-key mscg-ip command and the web-server command in the AAA domain view. In this way, a source interface's route can be used as a customized parameter of this source interface when an IPv6 user switches between the authentication domain and pre-authentication domain.
• When users are forcibly redirected to the web server, if you do not want the actual user MAC address or AP MAC address to be displayed, run the web-server redirect-key command with cipher configured. Then the user MAC address or AP MAC address is displayed in ciphertext. shared-key or shared-key-cipher in the web-server url-parameter { shared-key | shared-key-cipher } command is used to generate the ciphertext user MAC address or AP MAC address to be displayed.The default encryption mode for the keywords of user MAC and AP MAC addresses is AES-GCM-128. If you want the device to use the DES encryption mode, specify the des keyword in the web-server redirect-key command,AES-GCM-128 is recommended, because DES is insecure.
• If the web-server redirect-key user-mac-address <user-mac-address> [ cipher { aes128 [ cbc | gcm ] | des } ] command, instead of the web-server url-parameter{ shared-key [ <shared-key>] | shared-key-cipher [ <shared-key-cipher> ] } command, is run in the AAA domain view, redirection packets do not carry user MAC addresses.
• If the web-server redirect-key ap-mac-address <ap-mac-key> [ cipher { aes128 [ cbc | gcm ] | des } ] command, instead of the web-server url-parameter{ shared-key [ <shared-key>] | shared-key-cipher [ <shared-key-cipher> ] } command, is run in the AAA domain view, redirection packets do not carry AP-MAC addresses.
• Specifies that only the first eight bytes of shared-key-cipher configured in web-server url-parameter{ shared-key [ <shared-key>] | shared-key-cipher [ <shared-key-cipher> ] } are used as the key for MAC address encryption when the DES algorithm is used.