Example: Configuring triple authentication to support authorization VLAN and authentication failure VLAN

Network configuration

As shown in Figure 93, the terminals are connected to the device to access the IP network. Configure triple authentication on the device's Layer 2 interface connected to the terminals. A terminal passing one of the three authentication methods, 802.1X authentication, Web authentication, and MAC authentication, can access the IP network.

Figure 93: Network diagram

Procedure

  1. Make sure the terminals, the servers, and the device can reach each other. (Details not shown.)

  2. Configure the RADIUS server to provide normal authentication, authorization, and accounting for users. In this example, configure the following on the RADIUS server:

    • An 802.1X user with username userdot.

    • A Web authentication user with username userpt.

    • A MAC authentication user with a username and password both being the MAC address of the printer f07d6870725f.

    • An authorization VLAN (VLAN 3).

  3. Configure the IP address of server update as the authentication-free IP address.

    <Device> system-view
    [Device] web-auth free-ip 2.2.2.2 24
    
  4. Edit authentication pages, compress the pages to a .zip file named defaultfile and upload the .zip file to the device by FTP. (Details not shown.)

  5. Configure DHCP:

    # Configure VLANs and IP addresses for the VLAN interfaces, and add ports to specific VLANs. (Details not shown.)

    # Enable DHCP.

    [Device] dhcp enable
    

    # Exclude the IP address of the update server from dynamic address assignment.

    [Device] dhcp server forbidden-ip 2.2.2.2
    

    # Configure DHCP address pool 1 to assign IP addresses and other configuration parameters to clients on subnet 192.168.1.0.

    [Device] dhcp server ip-pool 1
    [Device-dhcp-pool-1] network 192.168.1.0 mask 255.255.255.0
    [Device-dhcp-pool-1] expired day 0 hour 0 minute 1
    [Device-dhcp-pool-1] gateway-list 192.168.1.1
    [Device-dhcp-pool-1] quit
    

    # Configure DHCP address pool 2 to assign IP address and other configuration parameters to clients on subnet 2.2.2.0.

    [Device] dhcp server ip-pool 2
    [Device-dhcp-pool-2] network 2.2.2.0 mask 255.255.255.0
    [Device-dhcp-pool-2] expired day 0 hour 0 minute 1
    [Device-dhcp-pool-2] gateway-list 2.2.2.1
    [Device-dhcp-pool-2] quit
    

    # Configure DHCP address pool 3 to assign IP address and other configuration parameters to clients on subnet 3.3.3.0.

    [Device] dhcp server ip-pool 3
    [Device-dhcp-pool-3] network 3.3.3.0 mask 255.255.255.0
    [Device-dhcp-pool-3] expired day 0 hour 0 minute 1
    [Device-dhcp-pool-3] gateway-list 3.3.3.1
    [Device-dhcp-pool-3] quit
    

    # Configure DHCP address pool 4, and bind the printer's MAC address f07d-6870-725f to IP address 3.3.3.111/24 in this address pool.

    [Device] dhcp server ip-pool 4
    [Device-dhcp-pool-4] static-bind ip-address 3.3.3.111 mask 255.255.255.0 client-identifier f07d-6870-725f
    [Device-dhcp-pool-4] quit
    
  6. Configure Web authentication:

    # Configure the local Web server to use HTTP. Configure file defaultfile.zip as the default authentication page file of the local Web server.

    [Device] portal local-web-server http
    [Device-portal-local-websvr-http] default-logon-page defaultfile.zip
    [Device-portal-local-websvr-http] quit
    

    # Assign IP address 4.4.4.4 to interface Loopback 0.

    [Device] interface loopback 0
    [Device-LoopBack0] ip address 4.4.4.4 32
    [Device-LoopBack0] quit
    

    # Create a Web authentication server named webserver.

    # Specify the listening IP address of the local portal server as 4.4.4.4.

    [Device] web-auth server webserver
    

    #Configure the redirection URL of the Web authentication server as http://4.4.4.4/portal/.

    [Device-web-auth-server-webserver] url http://4.4.4.4/portal/
    

    #Specify 4.4.4.4 as the IP address and 80 as the port number of Web authentication server.

    [Device-web-auth-server-webserver] ip 4.4.4.4 port 80
    [Device-web-auth-server-webserver] quit
    

    # Configure the IP address of Update server as the authentication-free IP address.

    [Device] web-auth free-ip 2.2.2.2 24
    

    # Enable Web authentication on HundredGigE 1/0/1 and specify VLAN 2 as the Auth-Fail VLAN.

    [Device] interface hundredgige 1/0/1
    [Device–HundredGigE1/0/1] port link-type hybrid
    [Device–HundredGigE1/0/1] mac-vlan enable
    [Device–HundredGigE1/0/1] web-auth enable apply server webserver
    [Device–HundredGigE1/0/1] web-auth auth-fail vlan 2
    [Device–HundredGigE1/0/1] quit
    
  7. Configure 802.1X authentication:

    # Enable 802.1X authentication globally.

    [Device] dot1x
    

    # Enable 802.1X authentication (MAC-based access control required) on HundredGigE 1/0/1, and specify VLAN 2 as the Auth-Fail VLAN.

    [Device] interface hundredgige 1/0/1
    [Device–HundredGigE1/0/1] dot1x port-method macbased
    [Device–HundredGigE1/0/1] dot1x
    [Device–HundredGigE1/0/1] dot1x auth-fail vlan 2
    [Device–HundredGigE1/0/1] quit
    
  8. Configure MAC authentication:

    # Enable MAC authentication globally.

    [Device] mac-authentication
    

    # Enable MAC authentication on HundredGigE 1/0/1, and specify VLAN 2 as the guest VLAN.

    [Device] interface hundredgige 1/0/1
    [Device–HundredGigE1/0/1] mac-authentication
    [Device–HundredGigE1/0/1] mac-authentication guest-vlan 2
    [Device–HundredGigE1/0/1] quit
    
  9. Configure a RADIUS scheme:

    # Create a RADIUS scheme named rs1.

    [Device] radius scheme rs1
    

    # Specify the primary authentication and accounting servers and keys.

    [Device-radius-rs1] primary authentication 1.1.1.2
    [Device-radius-rs1] primary accounting 1.1.1.2
    [Device-radius-rs1] key authentication simple radius
    [Device-radius-rs1] key accounting simple radius
    

    # Specify usernames sent to the RADIUS server to carry no domain names.

    [Device-radius-rs1] user-name-format without-domain
    [Device-radius-rs1] quit
    
  10. Configure an ISP domain:

    # Create an ISP domain named triple.

    [Device] domain triple
    

    # Configure the domain to use RADIUS scheme rs1 for authentication, authorization and accounting of LAN access users.

    [Device-isp-triple] authentication lan-access radius-scheme rs1
    [Device-isp-triple] authorization lan-access radius-scheme rs1
    [Device-isp-triple] accounting lan-access radius-scheme rs1
    [Device-isp-triple] quit
    

    # Configure domain triple as the default domain. If a username entered by a user includes no ISP domain name, the AAA methods of the default domain is used.

    [Device] domain default enable triple
    

Verifying the configuration

  1. Verify that the Web user can pass Web authentication.

    # On the Web user terminal, use a Web browser to access an external network and then enter the correct username and password on the authentication page http://4.4.4.4/portal/logon.html. (Details not shown.)

    # Use the display web-auth user command to display information about online users.

    [Device] display web-auth user
      Total online web-auth users: 1
    
    User Name: userpt
      MAC address: 6805-ca17-4a0b
      Access interface: HundredGigE1/0/1
      Initial VLAN: 14
      Authorization VLAN: 3
      Authorization ACL ID: N/A
      Authorization user profile: N/A
    
  2. Verify that the printer can pass MAC authentication.

    # Connect the printer to the network. (Details not shown.)

    # Display information about online MAC authentication users.

    [Device] display mac-authentication connection
    Total connections: 1
    Slot ID: 1
    User MAC address: f07d-6870-725f
    Access interface: HundredGigE1/0/1
    Username: f07d6870725f
    User access state: Successful
    Authentication domain: triple
    Initial VLAN: 14
    Authorization untagged VLAN: 3
    Authorization tagged VLAN: N/A
    Authorization VSI: N/A
    Authorization ACL ID: N/A
    Authorization user profile: N/A
    Authorization URL: N/A
    Termination action: Default
    Session timeout period: N/A
    Online from: 2015/01/04 18:01:43
    Online duration: 0h 0m 2s
    
  3. Verify that the 802.1X user can pass 802.1X authentication.

    # On the 802.1X client, initiate 802.1X authentication and enter the correct username and password. (Details not shown.)

    # Display information about online 802.1X users.

    Total connections: 1
    Slot ID: 1
    User MAC address: 7446-a091-84fe
    Access interface: HundredGigE1/0/1
    Username: userdot
    User access state: Successful
    Authentication domain: triple
    IPv4 address: 3.3.3.2
    Authentication method: CHAP
    Initial VLAN: 14
    Authorization untagged VLAN: 3
    Authorization tagged VLAN list: N/A
    Authorization VSI: N/A
    Authorization ACL ID: N/A
    Authorization user profile: N/A
    Authorization URL: N/A
    Termination action: Default
    Session timeout period: N/A
    Online from: 2015/01/04 18:13:01
    Online duration: 0h 0m 14s
    
  4. Verify that users that pass authentication have been assigned authorization VLANs.

    # Display MAC-VLAN entries of online users.

    [Device] display mac-vlan all
      The following MAC VLAN addresses exist:
      S:Static  D:Dynamic
      MAC ADDR         MASK             VLAN ID   PRIO   STATE
      --------------------------------------------------------
      6805-ca17-4a0b   ffff-ffff-ffff   3         0      D
      f07d-6870-725f   ffff-ffff-ffff   3         0      D
      7446-a091-84fe   ffff-ffff-ffff   3         0      D
      Total MAC VLAN address count:3 
    
  5. Verify that online users have been assigned IP addresses.

    [Device] display dhcp server ip-in-use
    IP address       Client-identifier/    Lease expiration          Type
                      Hardware address
     3.3.3.111        01f0-7d68-7072-5f     Jan  4 18:14:17 2015      Auto:(C)
     3.3.3.2          0168-05ca-174a-0b     Jan  4 18:15:01 2015      Auto:(C)
     3.3.3.3          0174-46a0-9184-fe     Jan  4 18:15:03 2015      Auto:(C)
    
  6. When a terminal fails authentication, it is added to VLAN 2. You can use the previous display commands to display the MAC-VLAN entry and IP address of the terminal. (Details not shown.)