Cross-subnet portal authentication across VPNs

As shown in Figure 68, Switch A, as the PE device connecting the user side, needs to provide cross-subnet portal authentication for hosts in VPN 1 through communication with the RADIUS server and portal server in VPN 3.

• Before enabling portal authentication, be sure to configure the MPLS L3VPN capabilities properly and specify VPN targets for VPN 1 and VPN 3 so that VPN 1 and VPN 3 can communicate with each other. This example gives only the access authentication configuration on the user-side PE. For information about MPLS L3VPN, see MPLS Configuration Guide.

• Configure the RADIUS server properly to provide normal authentication/accounting functions for users.

# Create a RADIUS scheme named rs1 and enter its view.

<SwitchA> system-view
[SwitchA] radius scheme rs1

# Configure the VPN instance to which the RADIUS scheme belongs as vpn3.

[SwitchA-radius-rs1] vpn-instance vpn3

# Set the server type for the RADIUS scheme. When using the IMC server, set the server type to extended.

[SwitchA-radius-rs1] server-type extended

# Specify the primary authentication server and primary accounting server, and configure the keys for communication with the servers.

[SwitchA-radius-rs1] primary authentication 192.168.0.111
[SwitchA-radius-rs1] primary accounting 192.168.0.111
[SwitchA-radius-rs1] key accounting simple radius
[SwitchA-radius-rs1] key authentication simple radius

# Configure the device to not carry the ISP domain name in the username sent to the RADIUS server.

[SwitchA-radius-rs1] user-name-format without-domain

# Specify the source IP address for RADIUS packets to be sent as 3.3.0.3. This address must be the same as that of the access device specified on the server to avoid authentication failures.

[SwitchA-radius-rs1] nas-ip 3.3.0.3
[SwitchA-radius-rs1] quit

# Create an ISP domain named dm1 and enter its view.

[SwitchA] domain dm1

# Configure AAA methods for the ISP domain.

[SwitchA-isp-dm1] authentication portal radius-scheme rs1
[SwitchA-isp-dm1] authorization portal radius-scheme rs1
[SwitchA-isp-dm1] accounting portal radius-scheme rs1
[SwitchA-isp-dm1] quit

# Configure domain dm1 as the default ISP domain for all users. Then, if a user enters a username without any ISP domain at logon, the authentication and accounting methods of the default domain are used for the user.

[SwitchA] domain default enable dm1

# Configure the portal server as follows:

• Name: newpt

• IP address: 192.168.0.111

• VPN: vpn3

• Key: portal, in plain text

• Port number: 50100

• URL: http://192.168.0.111:8080/portal

[SwitchA] portal server newpt ip 192.168.0.111 vpn-instance vpn3 key simple portal port 50100 url http://192.168.0.111:8080/portal

# Enable Layer 3 portal authentication on the interface connecting the user side.

[SwitchA] interface vlan-interface 3
[SwitchA–Vlan-interface3] portal server newpt method layer3
[SwitchA–Vlan-interface3] quit

Execute the display portal interface command to check whether the portal configuration has taken effect. After Host passes portal authentication, perform the display portal user command to view information about online portal users on Switch A.

[SwitchA] display portal user all
 Index:2
 State:ONLINE
 SubState:NONE
 ACL:NONE
 Work-mode:stand-alone
 VPN instance:vpn1
 MAC              IP                Vlan   Interface
 ----------------------------------------------------------------------------
 000d-88f7-c268   3.3.0.1           3      Vlan-interface3
 Total 1 user(s) matched, 1 listed.