Example: Configuring re-DHCP portal authentication with a preauthentication domain

As shown in Figure 84, the host is directly connected to the switch (the access device). The host obtains an IP address through the DHCP server. A portal server acts as both a portal authentication server and a portal Web server. A RADIUS server acts as the authentication/accounting server.

Configure re-DHCP portal authentication. Before passing the authentication, the host is assigned a private IP address and can access only the subnet 192.168.0.0/24. After passing the authentication, the host gets a public IP address and can access other network resources.

• Configure IP addresses for the switch and servers as shown in Figure 84 and make sure the host, switch, and servers can reach each other.

• Configure the RADIUS server correctly to provide authentication and accounting functions.

• For re-DHCP portal authentication, configure a public address pool (20.20.20.0/24) and a private address pool (10.0.0.0/24) on the DHCP server. (Details not shown.)

• For re-DHCP portal authentication:

  • The switch must be configured as a DHCP relay agent.

  • The portal-enabled interface must be configured with a primary IP address (a public IP address) and a secondary IP address (a private IP address).

  For information about DHCP relay agent configuration, see Layer 3—IP Services Configuration Guide.

• Make sure the IP address of the portal device added on the portal server is the public IP address (20.20.20.1) of the switch's interface connecting the host. The private IP address range for the IP address group associated with the portal device is the private subnet 10.0.0.0/24 where the host resides. The public IP address range for the IP address group is the public subnet 20.20.20.0/24.

• If you have configured a preauthentication IP address pool on portal-enabled interfaces, configure a DHCP relay address pool with the same name on the device. For the DHCP relay address pool, specify the subnet address where the unauthenticated users reside (with the export-router keyword specified) and the DHCP server address.

1. Configure a portal preauthentication domain:

   # Create an ISP domain named abc.

   <Switch> system-view
   [Switch] domain abc
   

   # Specify user attribute ACL 3010 in the ISP domain.

   [Switch-isp-abc] authorization-attribute acl 3010
   [Switch-isp-abc] quit
   

   # In ACL 3010, configure a rule to permit access to the subnet 192.168.0.0/24.

   [Switch] acl advanced 3010
   [Switch-acl-ipv4-adv-3010] rule 1 permit ip destination 192.168.0.0 24
   [Switch-acl-ipv4-adv-3010] quit
   

   # Specify ISP domain abc as the portal authentication domain on VLAN-interface 100.

   [Switch] interface vlan-interface 100
   [Switch–Vlan-interface100] portal pre-auth domain abc
   [Switch–Vlan-interface100] quit
   

2. Configure DHCP relay and authorized ARP.

   # Configure DHCP relay.

   [Switch] dhcp enable
   [Switch] dhcp relay client-information record
   [Switch] interface vlan-interface 100
   [Switch–Vlan-interface100] ip address 20.20.20.1 255.255.255.0
   [Switch–Vlan-interface100] ip address 10.0.0.1 255.255.255.0 sub
   [Switch-Vlan-interface100] dhcp select relay
   [Switch-Vlan-interface100] dhcp relay server-address 192.168.0.112
   

   # Enable authorized ARP.

   [Switch-Vlan-interface100] arp authorized enable
   [Switch-Vlan-interface100] quit
   

3. Configure portal authentication:

   # Configure a portal authentication server.

   [Switch] portal server newpt
   [Switch-portal-server-newpt] ip 192.168.0.111 key simple portal
   [Switch-portal-server-newpt] port 50100
   [Switch-portal-server-newpt] quit
   

   # Configure a portal Web server.

   [Switch] portal web-server newpt
   [Switch-portal-websvr-newpt] url http://192.168.0.111:8080/portal
   [Switch-portal-websvr-newpt] quit
   

   # Enable re-DHCP portal authentication on VLAN-interface 100.

   [Switch] interface vlan-interface 100
   [Switch-Vlan-interface100] portal enable method redhcp
   

   # Specify portal Web server newpt on VLAN-interface 100.

   [Switch–Vlan-interface100] portal apply web-server newpt
   

   # Configure the BAS-IP as 20.20.20.1 for portal packets sent from VLAN-interface 100 to the portal authentication server.

   [Switch–Vlan-interface100] portal bas-ip 20.20.20.1
   [Switch–Vlan-interface100] quit
   

# Verify the portal configuration by executing the display portal interface command. (Details not shown.)

# Display information about preauthentication portal users.

[Switch] display portal user pre-auth interface vlan-interface 100
MAC                IP                 VLAN   Interface
0015-e9a6-7cfe     10.10.10.4         100     Vlan-interface100
  State: Online
  VPN instance: --
  Authorization information:
    DHCP IP pool: N/A
    User profile: N/A
    Session group profile: N/A
    ACL number: 3010
    Inbound CAR: N/A
    Outbound CAR: N/A