Example: Configuring triple authentication to support authorization VLAN and authentication failure VLAN

As shown in Figure 93, the terminals are connected to the device to access the IP network. Configure triple authentication on the device's Layer 2 interface connected to the terminals. A terminal passing one of the three authentication methods, 802.1X authentication, Web authentication, and MAC authentication, can access the IP network.

• The Web authentication terminal uses DHCP to get an IP address in 192.168.1.0/24 before authentication and in 3.3.3.0/24 after passing authentication. If the terminal fails authentication, it requests IP addresses in 2.2.2.0/24 through DHCP.

  You can use the access device or an attached device as the DHCP server. In this example, the access device (the device) provides the DHCP service.

• The 802.1X terminal uses DHCP to get an IP address in 192.168.1.0/24 before authentication and in 3.3.3.0/24 after passing authentication. If the terminal fails authentication, it requests IP addresses in 2.2.2.0/24 through DHCP.

• After passing authentication, the printer obtains IP address 3.3.3.111/24 that is bound with its MAC address through DHCP.

• Use the remote RADIUS server to perform authentication, authorization, and accounting. Configure the device to remove the ISP domain names from usernames sent to the RADIUS server.

• Configure the local Web authentication server on the device to use listening IP address 4.4.4.4. Configure the device to send a default authentication page to the Web user and forward authentication data by using HTTP.

• Configure VLAN 3 as the authorization VLAN. Users passing authentication are added to this VLAN.

• Configure VLAN 2 as the authentication failure VLAN. Users failing authentication are added to this VLAN.

1. Make sure the terminals, the servers, and the device can reach each other. (Details not shown.)

2. Configure the RADIUS server to provide normal authentication, authorization, and accounting for users. In this example, configure the following on the RADIUS server:

   • An 802.1X user with username userdot.

   • A Web authentication user with username userpt.

   • A MAC authentication user with a username and password both being the MAC address of the printer f07d6870725f.

   • An authorization VLAN (VLAN 3).

3. Configure the IP address of server update as the authentication-free IP address.

   <Device> system-view
   [Device] web-auth free-ip 2.2.2.2 24
   

4. Edit authentication pages, compress the pages to a .zip file named defaultfile and upload the .zip file to the device by FTP. (Details not shown.)

5. Configure DHCP:

   # Configure VLANs and IP addresses for the VLAN interfaces, and add ports to specific VLANs. (Details not shown.)

   # Enable DHCP.

   [Device] dhcp enable
   

   # Exclude the IP address of the update server from dynamic address assignment.

   [Device] dhcp server forbidden-ip 2.2.2.2
   

   # Configure DHCP address pool 1 to assign IP addresses and other configuration parameters to clients on subnet 192.168.1.0.

   [Device] dhcp server ip-pool 1
   [Device-dhcp-pool-1] network 192.168.1.0 mask 255.255.255.0
   [Device-dhcp-pool-1] expired day 0 hour 0 minute 1
   [Device-dhcp-pool-1] gateway-list 192.168.1.1
   [Device-dhcp-pool-1] quit
   

   # Configure DHCP address pool 2 to assign IP address and other configuration parameters to clients on subnet 2.2.2.0.

   [Device] dhcp server ip-pool 2
   [Device-dhcp-pool-2] network 2.2.2.0 mask 255.255.255.0
   [Device-dhcp-pool-2] expired day 0 hour 0 minute 1
   [Device-dhcp-pool-2] gateway-list 2.2.2.1
   [Device-dhcp-pool-2] quit
   

   # Configure DHCP address pool 3 to assign IP address and other configuration parameters to clients on subnet 3.3.3.0.

   [Device] dhcp server ip-pool 3
   [Device-dhcp-pool-3] network 3.3.3.0 mask 255.255.255.0
   [Device-dhcp-pool-3] expired day 0 hour 0 minute 1
   [Device-dhcp-pool-3] gateway-list 3.3.3.1
   [Device-dhcp-pool-3] quit
   

   # Configure DHCP address pool 4, and bind the printer's MAC address f07d-6870-725f to IP address 3.3.3.111/24 in this address pool.

   [Device] dhcp server ip-pool 4
   [Device-dhcp-pool-4] static-bind ip-address 3.3.3.111 mask 255.255.255.0 client-identifier f07d-6870-725f
   [Device-dhcp-pool-4] quit
   

6. Configure Web authentication:

   # Configure the local Web server to use HTTP. Configure file defaultfile.zip as the default authentication page file of the local Web server.

   [Device] portal local-web-server http
   [Device-portal-local-websvr-http] default-logon-page defaultfile.zip
   [Device-portal-local-websvr-http] quit
   

   # Assign IP address 4.4.4.4 to interface Loopback 0.

   [Device] interface loopback 0
   [Device-LoopBack0] ip address 4.4.4.4 32
   [Device-LoopBack0] quit
   

   # Create a Web authentication server named webserver.

   # Specify the listening IP address of the local portal server as 4.4.4.4.

   [Device] web-auth server webserver
   

   #Configure the redirection URL of the Web authentication server as http://4.4.4.4/portal/.

   [Device-web-auth-server-webserver] url http://4.4.4.4/portal/
   

   #Specify 4.4.4.4 as the IP address and 80 as the port number of Web authentication server.

   [Device-web-auth-server-webserver] ip 4.4.4.4 port 80
   [Device-web-auth-server-webserver] quit
   

   # Configure the IP address of Update server as the authentication-free IP address.

   [Device] web-auth free-ip 2.2.2.2 24
   

   # Enable Web authentication on HundredGigE 1/0/1 and specify VLAN 2 as the Auth-Fail VLAN.

   [Device] interface hundredgige 1/0/1
   [Device–HundredGigE1/0/1] port link-type hybrid
   [Device–HundredGigE1/0/1] mac-vlan enable
   [Device–HundredGigE1/0/1] web-auth enable apply server webserver
   [Device–HundredGigE1/0/1] web-auth auth-fail vlan 2
   [Device–HundredGigE1/0/1] quit
   

7. Configure 802.1X authentication:

   # Enable 802.1X authentication globally.

   [Device] dot1x
   

   # Enable 802.1X authentication (MAC-based access control required) on HundredGigE 1/0/1, and specify VLAN 2 as the Auth-Fail VLAN.

   [Device] interface hundredgige 1/0/1
   [Device–HundredGigE1/0/1] dot1x port-method macbased
   [Device–HundredGigE1/0/1] dot1x
   [Device–HundredGigE1/0/1] dot1x auth-fail vlan 2
   [Device–HundredGigE1/0/1] quit
   

8. Configure MAC authentication:

   # Enable MAC authentication globally.

   [Device] mac-authentication
   

   # Enable MAC authentication on HundredGigE 1/0/1, and specify VLAN 2 as the guest VLAN.

   [Device] interface hundredgige 1/0/1
   [Device–HundredGigE1/0/1] mac-authentication
   [Device–HundredGigE1/0/1] mac-authentication guest-vlan 2
   [Device–HundredGigE1/0/1] quit
   

9. Configure a RADIUS scheme:

   # Create a RADIUS scheme named rs1.

   [Device] radius scheme rs1
   

   # Specify the primary authentication and accounting servers and keys.

   [Device-radius-rs1] primary authentication 1.1.1.2
   [Device-radius-rs1] primary accounting 1.1.1.2
   [Device-radius-rs1] key authentication simple radius
   [Device-radius-rs1] key accounting simple radius
   

   # Specify usernames sent to the RADIUS server to carry no domain names.

   [Device-radius-rs1] user-name-format without-domain
   [Device-radius-rs1] quit
   

10. Configure an ISP domain:

    # Create an ISP domain named triple.

    [Device] domain triple
    

    # Configure the domain to use RADIUS scheme rs1 for authentication, authorization and accounting of LAN access users.

    [Device-isp-triple] authentication lan-access radius-scheme rs1
    [Device-isp-triple] authorization lan-access radius-scheme rs1
    [Device-isp-triple] accounting lan-access radius-scheme rs1
    [Device-isp-triple] quit
    

    # Configure domain triple as the default domain. If a username entered by a user includes no ISP domain name, the AAA methods of the default domain is used.

    [Device] domain default enable triple
    

1. Verify that the Web user can pass Web authentication.

   # On the Web user terminal, use a Web browser to access an external network and then enter the correct username and password on the authentication page http://4.4.4.4/portal/logon.html. (Details not shown.)

   # Use the display web-auth user command to display information about online users.

   [Device] display web-auth user
     Total online web-auth users: 1
   
   User Name: userpt
     MAC address: 6805-ca17-4a0b
     Access interface: HundredGigE1/0/1
     Initial VLAN: 14
     Authorization VLAN: 3
     Authorization ACL ID: N/A
     Authorization user profile: N/A
   

2. Verify that the printer can pass MAC authentication.

   # Connect the printer to the network. (Details not shown.)

   # Display information about online MAC authentication users.

   [Device] display mac-authentication connection
   Total connections: 1
   Slot ID: 1
   User MAC address: f07d-6870-725f
   Access interface: HundredGigE1/0/1
   Username: f07d6870725f
   User access state: Successful
   Authentication domain: triple
   Initial VLAN: 14
   Authorization untagged VLAN: 3
   Authorization tagged VLAN: N/A
   Authorization VSI: N/A
   Authorization ACL ID: N/A
   Authorization user profile: N/A
   Authorization URL: N/A
   Termination action: Default
   Session timeout period: N/A
   Online from: 2015/01/04 18:01:43
   Online duration: 0h 0m 2s
   

3. Verify that the 802.1X user can pass 802.1X authentication.

   # On the 802.1X client, initiate 802.1X authentication and enter the correct username and password. (Details not shown.)

   # Display information about online 802.1X users.

   Total connections: 1
   Slot ID: 1
   User MAC address: 7446-a091-84fe
   Access interface: HundredGigE1/0/1
   Username: userdot
   User access state: Successful
   Authentication domain: triple
   IPv4 address: 3.3.3.2
   Authentication method: CHAP
   Initial VLAN: 14
   Authorization untagged VLAN: 3
   Authorization tagged VLAN list: N/A
   Authorization VSI: N/A
   Authorization ACL ID: N/A
   Authorization user profile: N/A
   Authorization URL: N/A
   Termination action: Default
   Session timeout period: N/A
   Online from: 2015/01/04 18:13:01
   Online duration: 0h 0m 14s
   

4. Verify that users that pass authentication have been assigned authorization VLANs.

   # Display MAC-VLAN entries of online users.

   [Device] display mac-vlan all
     The following MAC VLAN addresses exist:
     S:Static  D:Dynamic
     MAC ADDR         MASK             VLAN ID   PRIO   STATE
     --------------------------------------------------------
     6805-ca17-4a0b   ffff-ffff-ffff   3         0      D
     f07d-6870-725f   ffff-ffff-ffff   3         0      D
     7446-a091-84fe   ffff-ffff-ffff   3         0      D
     Total MAC VLAN address count:3 
   

5. Verify that online users have been assigned IP addresses.

   [Device] display dhcp server ip-in-use
   IP address       Client-identifier/    Lease expiration          Type
                     Hardware address
    3.3.3.111        01f0-7d68-7072-5f     Jan  4 18:14:17 2015      Auto:(C)
    3.3.3.2          0168-05ca-174a-0b     Jan  4 18:15:01 2015      Auto:(C)
    3.3.3.3          0174-46a0-9184-fe     Jan  4 18:15:03 2015      Auto:(C)
   

6. When a terminal fails authentication, it is added to VLAN 2. You can use the previous display commands to display the MAC-VLAN entry and IP address of the terminal. (Details not shown.)