H3CAC进行Portal认证Word文件下载.docx

1、2、AC侧配置及说明#version 5.20, Release 3120P17sysname WX3024-ACdomain default enable systemtelnet server enableport-security enable/配置portal server、ip、key、url以及server-type，注意这里server-type必须配置为imcportal server imc ip 172.16.0.22 key cipher $c$3$6uB5v4kaCg1aSOJkOqX+= url 172.16.0.22:8080/portal server-type

2、imc/配置portal free-rule放通AC联口portal free-rule 0 source interface GigabitEthernet1/0/1 destination anyoap management-ip 192.168.0.101 slot 0password-recovery enablevlan 1vlan 24/配置radius策略，注意server-type必须选择extended模式，注意user-name-format及nas-ip的配置必须与iMC接入策略和接入服务里配置保持一致。radius scheme imcserver-type exten

3、dedprimary authentication 172.16.0.22primary accounting 172.16.0.22key authentication cipher $c$3$Myv0nhgPjC4vsMforZW3iCiW5KkP7Q=key accounting cipher $c$3$dCEXJGp71WPyrPK4hsPJd6sdTYf01A=user-name-format without-domainnas-ip 172.16.0.202/配置domaindomain imcauthentication portal radius-scheme imcautho

4、rization portal radius-scheme imcaccounting portal radius-scheme imcaccess-limit disablestate activeidle-cut disableself-service-url disabledomain system/配置AP注册dhcp pooldhcp server ip-pool 1network 192.168.0.0 mask 255.255.255.0/配置终端业务dhcp pooldhcp server ip-pool option55network 192.168.24.0 mask 25

5、5.255.255.0gateway-list 192.168.24.254dns-list 8.8.8.8user-group systemgroup-attribute allow-guestlocal-user adminpassword cipher $c$3$iMGlwEx7o4TNbMqd7OaOAwB5SWSzOrKEauthorization-attribute level 3service-type telnetwlan rrmdot11a mandatory-rate 6 12 24dot11a supported-rate 9 18 36 48 54dot11b mand

6、atory-rate 1 2dot11b supported-rate 5.5 11dot11g mandatory-rate 1 2 5.5 11dot11g supported-rate 6 9 12 18 24 36 48 54/配置无线服务模板wlan service-template 10 clearssid option55bind WLAN-ESS 10service-template enablewlan ap-group default_groupap ap1ap ap2interface NULL0/与iMC互联ip及vlan接口interface Vlan-interfa

7、ce1ip address 172.16.0.202 255.255.255.0# /终端业务互联ip及vlan接口，接口下开启portal，注意portal domain及portal nas-ip配置需要与iMC服务器portal设备保持一致interface Vlan-interface24ip address 192.168.24.1 255.255.255.0portal server imc method directportal domain imcportal nas-ip 172.16.0.202interface GigabitEthernet1/0/1port link-

8、type trunkport trunk permit vlan all/配置wlan-ess接口interface WLAN-ESS10port access vlan 24wlan ap ap2 model WA2610H-GN id 2serial-id 219801A0FH9136Q00287radio 1 service-template 10 radio enable/开启dhcp-snooping，使能dhcp-snooping记录用户的option 55和option 60信息功能dhcp-snoopingdhcp-snooping binding record user-id

9、entity/配置默认路由ip route-static 0.0.0.0 0.0.0.0 192.168.24.254snmp-agentsnmp-agent local-engineid 800063A203000FE2873066snmp-agent community read publicsnmp-agent community write privatesnmp-agent sys-info version all/使能dhcpdhcp enableuser-interface con 0user-interface vty 0 4authentication-mode scheme

10、user privilege level 3return3、iMC侧配置请参考KMS-21434WX系列AC与iMC配合实现无线Portal认证典型配置，这里不再赘述。4、结果验证及抓包1）AC上查看在线的客户端和portal在线用户信息：WX3024-ACdis wlan clientTotal Number of Clients : 2 Client InformationSSID: option55-MAC Address User Name APID/RID IP Address VLAN2477-0391-7720 -NA- 2/1192.168.24.2 2428e1-4cb5-8

11、249 192.168.24.3 dis portal user allIndex:12State:ONLINESubState:NONEACL:Work-mode:stand-aloneMAC IP VlanInterface-2477-0391-7720 192.168.24.2 24 Vlan-interface241328e1-4cb5-8249 192.168.24.3Total 2 user（s） matched, 2 listed.2）iMC上通过终端设备管理查看终端的厂商、类型以及操作系统等信息：3）查看AC的debugging信息，可以清楚看到Radius的code=1报文里

12、携带了option 55和option 60的属性字段：*Apr 26 16:37:06:936 2000 WX3024-AC RDS/7/DEBUG: Send attribute list:946 2000 WX3024-AC RDS/7/DEBUG:1 User-name 8 c0946760 CHAP_Challenge 18 6EFCA7E2624584E38EA53882A4A12C904 NAS-IP-Address 6 172.16.0.20232 NAS-Identifier 11 WX3024-AC5 NAS-Port 6 1681820087 NAS_Port_Id 18

13、 00024986 2000 WX3024-AC RDS/7/DEBUG:61 NAS-Port-Type 6 19H3C-26 Connect_ID 6 216 Service-Type 6 27 Framed-Protocol 6 25531 Caller-ID 19 36432D38382D31342D35392D38392D384330 Called-station-Id 28 74-25-8A-33-81-70:option5507:027 2000 WX3024-AC RDS/7/DEBUG:44 Acct-Session-Id 16 1608 Framed-Address 6 1

14、92.168.24.4H3C-255Product-ID 12 H3C WX3024H3C-60 Ip-Host-Addr 32 192.168.24.4 6c:88:14:59:89:8cH3C-208 DHCP-Option55 14 010F03062C2E2F1F2179F92BH3C-209 DHCP-Option60 10 4DE30077 2000 WX3024-AC RDS/7/DEBUG:H3C-59 NAS-Startup-Timestamp 6 956750400087 2000 WX3024-AC RDS/7/DEBUG:Event: Begin to switch R

15、ADIUS server when sending 0 packet.108 2000 WX3024-AC RDS/7/DEBUG: The RD TWL timer has resumeed.%Apr 26 16:118 2000 WX3024-AC RDS/6/RDS_SUCC: -IfName=Vlan-interface24-VlanId=24-MACAddr=6C:8C-IPAddr=192.168.24.4-IPv6Addr=N/A-UserName=c09467imc; User got online successfully.138 2000 WX3024-AC PORTAL/

16、5/PORTAL_USER_LOGON_SUCCESS: -UserName=c09467-IPAddr=192.168.24.4-IfName=Vlan-interface24-VlanID=24-MACAddr=6c88-1459-898c-APMAC=7425-8A33-8170-SSID=option55-NasId=-NasPortId=;169 2000 WX3024-AC RDS/7/DEBUG: Malloc seed:38 in 172.16.0.22 for User ID:21179 2000 WX3024-AC RDS/7/DEBUG: Modify NAS-IP to

17、 172.16.0.202.189 2000 WX3024-AC RDS/7/DEBUG: Send: IP=172.16.0.22, UserIndex=21, ID=38, RetryTimes=0, Code=1, Length=2794）通过抓包我们也可以看到这个属性字段：四、配置关键点：1、portal server的server-type必须选择imc，radius scheme的server-type必须选择extended。2、全局视图下开启dhcp-snooping和dhcp-snooping binding record user-identity。3、AC本身并不支持终端操作系统和厂商识别，只是把相关option 55和option 60信息传送给iMC完成终端识别。