HP VSR1000 Security Configuration Manual page 101

Figure 29 Network diagram
Host
8.8.8.2/24
Configuration prerequisites and guidelines
• Configure IP addresses for the router and servers as shown in
router, and servers can reach each other.
Configure the RADIUS server correctly to provide authentication and accounting functions.
•
Make sure the IP address of the portal device added on the portal authentication server is the IP
•
address (20.20.20.1) of the router's interface connecting the host. The IP address group associated
with the portal device is the subnet of the host (8.8.8.0/24).
Configuration procedure
Perform the following configurations on Router A.
1. Configure a RADIUS scheme:
# Create a RADIUS scheme named rs1 and enter its view.
<RouterA> system-view
[RouterA] radius scheme rs1
# Specify the primary authentication server and primary accounting server, and configure the keys
for communication with the servers.
[RouterA-radius-rs1] primary authentication 192.168.0.112
[RouterA-radius-rs1] primary accounting 192.168.0.112
[RouterA-radius-rs1] key authentication simple radius
[RouterA-radius-rs1] key accounting simple radius
# Exclude the ISP domain name from the username sent to the RADIUS server.
[RouterA-radius-rs1] user-name-format without-domain
[RouterA-radius-rs1] quit
# Enable RADIUS session control.
[Router] radius session-control enable
2. Configure an authentication domain:
# Create an ISP domain named dm1 and enter its view.
[RouterA] domain dm1
# Configure AAA methods for the ISP domain.
[RouterA-isp-dm1] authentication portal radius-scheme rs1
[RouterA-isp-dm1] authorization portal radius-scheme rs1
Router A
GE1/0
192.168.0.100/24
GE2/0
20.20.20.1/24
GE1/0
20.20.20.2/24
GE2/0
8.8.8.1/24
Router B
Portal server
192.168.0.111/24
RADIUS server
192.168.0.112/24
91
Figure 29 and make sure the host,