Configuring Isp Domain Attributes - HP MSR Series Configuration Manual

•
An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo
domain command, change the domain to a non-default ISP domain by using the undo domain
default enable command.
•
You can modify the settings of the system-defined ISP domain system, but you cannot delete
the domain.
•
An ISP domain cannot be deleted when it accommodates users who are assigned to
nonexistent domains. Before you use the undo domain command, restore the default setting
of the ISP domain by using the undo domain if-unknown command.
To create an ISP domain:
Step
1. Enter system view.
2. Create an ISP domain and
enter ISP domain view.
3. Return to system view.
4. (Optional.) Specify the
default ISP domain.
5. (Optional.) Specify the ISP
domain to accommodate
users who are assigned to
nonexistent domains.

Configuring ISP domain attributes

In an ISP domain, you can configure the following attributes:
•
Domain status—By placing the ISP domain in active or blocked state, you allow or deny
network service requests from users in the domain.
•
Authorization attributes—The device assigns the authorization attributes in the ISP domain to
the authenticated users who do not receive these attributes from the server. However, if the idle
cut attribute is configured in the ISP domain, the device assigns the attribute to the
authenticated users. If no idle cut attribute is configured in the ISP domain, the device uses the
idle cut attribute assigned by the server. The device supports the following authorization
attributes:
Authorization ACL—The device restricts authenticated users to access only the network
resources permitted by the ACL. For portal users, the authorization ACL can be configured
in a preauthentication domain to authorize access to network resources before users pass
authentication.
Authorization CAR action—The attribute controls the traffic flow of authenticated users.
For portal users, the authorization CAR action can be configured in a preauthentication
domain to control traffic flow before users pass authentication.
Idle cut—It enables the device to check the traffic of each online user in the domain at the
idle timeout interval. The device logs out any users in the domain whose total traffic in the
idle timeout period is less than the specified minimum traffic.
IPv4 address pool—The device assigns IPv4 addresses from the pool to authenticated
IPoE, portal, or PPP users in the domain.
Default authorization user profile—When a user passes authentication, it typically
obtains an authorization user profile from the local or remote server. If the user does not
obtain any user profile, the device authorizes the default user profile of the ISP domain to
the user. The device will restrict the user's behavior based on the profile. For portal users,
the authorization user profile can be configured in a preauthentication domain to restrict
user behaviors before users pass authentication.
Command
system-view
domain isp-name
quit
domain default enable
isp-name
domain if-unknown
isp-domain-name
47
Remarks
N/A
By default, the device has a
system-defined ISP domain system.
N/A
By default, the default ISP domain is the
system-defined ISP domain system.
By default, no ISP domain is specified to
accommodate users who are assigned
to nonexistent domains.