Configuring Web Authentication or Fast Authentication
Web authentication requires a user who wants to access the network to enter the username and password on the authentication page of a web authentication server for authentication. Fast authentication is an authentication mode in which a user accesses the authentication page of a web authentication server for authentication, without entering the username and password.
Context
When configuring web authentication or fast authentication, you need the following parameters:
IP address and VPN instance of the server
Port number of the server
Shared key of the server
Whether the NetEngine 8000 F reports its own IP address to the server
Portal protocol version, listening port number, and source interface sending portal packets
Pages to which users are redirected
- For security purposes, use an eight-character or longer password that contains at least two types of the following: uppercase letters, lowercase letters, digits, and special characters.
- You are advised to configure your password in ciphertext mode and change it periodically.
Procedure
- Configure a web authentication server.
- Run web-auth-server { ip-address | ipv6-address } [ vpn-instance instance-name ] [ port port-number ] [ key { simple simple-key | cipher cipher-key } ] [ nas-ip-address ][ detect-time detect-time ] [ user-query { exclude pre-domain | version1 } ]
A web authentication server is configured.
For security purposes, you are advised to use CHAP authentication on the web server and encrypt user names and passwords during authentication.
- Run web-auth-server { ip-address | ipv6-address } [ vpn-instance instance-name ] [ port port-number ] [ key { simple simple-key | cipher cipher-key } ] [ nas-ip-address ][ detect-time detect-time ] [ user-query { exclude pre-domain | version1 } ]
- Specify an IP address to be used by the keyword to receive portal packets from the web authentication server.
- (Optional) Configure the portal protocol.
- Run web-auth-server source from packet-destination-ip
The source IP address in the packets sent to the web authentication server as the destination IP address of the received packets is configured.
web-auth-server source from packet-destination-ip command and web-auth-server source interface { interface-type interface-number | interface-name } command are mutually exclusive.
- (Optional) Run whitelist session-car web-auth-server disable
The whitelist session CAR function is disabled.
Disabling this function is not usually recommended.
- Run web-auth-server source from packet-destination-ip
- (Optional) Configure the Portal Server.
- Configure the Portal Server.
- Run the portal-server { ip-address | ipv6-address | redirect-limit limit-value | url url-string | url-parameter } command to set the mandatory portal service parameters for the domain, including the port server's IP address, number of mandatory redirects, URL for mandatory redirect, and URL parameters carried in the redirect URL.
- (Optional) Run the portal-server redirect-key user-mac-address user-mac-address [ simple [ type1 ] | cipher { aes128 { cbc | gcm } | des } ] command to configure the user MAC address carried in the redirect packets of mandatory portal service.
(Optional) Run the portal-server url-parameter shared-key-cipher [ shared-key-cipher ] command to configure the key required for carrying the encrypted MAC address in the redirect packet.
If the portal-server redirect-key user-mac-address user-mac-address [ cipher aes128 { cbc | gcm } | des ] command, but not the portal-server url-parameter shared-key-cipher [ shared-key-cipher ], the MAC address is not carried in the redirect packet of the portal service.
- (Optional) Run the portal-server user-first-url-key { user-number | default-name } command to enable the function of redirecting to the homepage URL for the portal server.
- (Optional) Run the portal-server identical-url command to enable the function of using the unified URL for the portal server.
- (Optional) Run the portal-redirect command to configure the captive portal timeout period.
- Configure the Portal Server.
- (Optional) Configure mandatory web authentication.
Mandatory web authentication enables the NetEngine 8000 F to redirect the access request of a user to a specified web server when the user accesses an unauthorized address before being authenticated, facilitating user authentication.
- (Optional) Run any of the following commands:
- To configure a redirection URL for mandatory web authentication, run the web-server url redirect-url command.
- To configure specified keywords carried in the URL of a web page pushed by the portal server, run the web-server url-parameter command.
- To configure an IPv4 address or both IPv4 and IPv6 addresses for the web server, run the web-server ip-address [ ipv6–address ] [ slave ] command.
ipv6–address must be specified for dual-stack web users.
- To configure the HTTP mode of the web server, run the web-server mode { get | post } command.
- To configure the keyword of a customized portal attribute, run the web-server redirect-key { mscg-ip mscg-ip-key | mscg-name mscg-name-key | user-ip-address user-ip-key | user-location user-location-key | nas-logic-sysname nas-logic-sysname-key | user-mac-address { user-mac-key [ simple [ type1 ] | cipher { aes128 [ cbc | gcm ] | des } ] }, web-server redirect-key mscg-ipv6 mscg-ipv6-key,web-server redirect-key ap-mac-address ap-mac-key [ simple [ type1 ] | cipher { aes128 [ cbc | gcm ] | des } ], web-server redirect-key ssid ssid-key, or web-server redirect-key agent-remote-id agent-remote-id-key command.
- (Optional) To configure the keyword for generating ciphertext user MAC address or AP MAC address to be displayed, run the web-server url-parameter { shared-key [ shared-key ] | shared-key-cipher [ shared-key-cipher ] } command.
This step is mandatory only if the web-server redirect-key command with cipher aes128 configured has been run.
- To configure the keyword of a user IP address, run the web-server user-first-url-key { key-name | default-name } command.
A redirection URL must be configured in the pre-authentication domain for a dual-stack web user. Otherwise, mandatory web authentication may fail.
- (Optional) Run mac-authentication enable
MAC address authentication is enabled.
MAC address authentication is used to simplify web authentication. If MAC address authentication is enabled, a web authentication user needs to enter the username and password only at the first authentication during which the RADIUS server records the user's MAC address. When web authentication needs to be performed for the user again, the RADIUS server authenticates the user based on the user's MAC address without the user entering the username and password again.
This command is usually used together with the authening authen-fail online authen-domain domain-name command on the live network. After these two commands are run, if a user fails MAC authentication, the user will enter a redirection domain in which the user can enter the username and password for web authentication. After web authentication succeeds, the user enters the authentication domain and can access network resources.
- (Optional) Run any of the following commands:
- (Optional) Configure the function to allow web users to directly log in to the post-authentication domain.
- (Optional) Configure web performance optimization.
- (Optional) Run access-user login session-limit reply error-code message.
The error code and message returned by the device to the portal server if web users switch from the pre-authentication domain to the authentication domain and the number of users using the same account has reached the upper limit is configured.
- (Optional) Configure IP address reassignment.
- (Optional) Configure the device not to assign IPv6 addresses to users from a pre-authentication domain.
This function is mutually exclusive with the secondary address assignment enabled using the reallocate-ip-address command.
- Configure pre-authentication and authentication domains and an authentication method on a BAS interface.
Web authentication users are considered unauthorized users before they are authenticated. Therefore, they cannot obtain IP addresses or access the web authentication server.
This means web authentication cannot be performed on web authentication users. To resolve this problem, all unauthenticated web authentication users are assigned to a default domain configured on an interface. This default domain is called the default pre-authentication domain. Unauthenticated web authentication users can obtain IP addresses from the default pre-authentication domain and access the web authentication server through the authorities granted to the default pre-authentication domain for web authentication.
- Run commit
The configuration is committed.