Portal Authentication Mode - 3Com MSR 50 Series Configuration Manual

1854 C 98: P
HAPTER ORTAL
c
Portal Authentication
Mode
C
ONFIGURATION
CAUTION:
Since the portal client is identified by IP address, to avoid authentication failure
■
resulted from address translation, be sure that there is no device with network
address translation (NAT) enabled between the authentication client, access
device, portal server, and authentication/accounting server when portal
authentication is enabled on the device.
Currently a RADIUS server serves as the portal-enabled
■
authentication/accounting server.
There are two kinds of portal authentication: non-Layer 3 authentication and Layer
3 authentication.
Non-Layer 3 authentication
Non-Layer 3 authentication falls into two categories:
Direct authentication
■
Before authentication, a user manually configures a public IP address or directly
obtains a public IP address through DHCP, and can only access the portal server
and predefined free websites. After passing authentication, the user can access
the Internet. The process of direct authentication is simpler than that of re-DHCP
authentication.
Re-DHCP authentication
■
Before authentication, a user gets a private IP address through DHCP and can only
access the portal server and predefined free websites. After passing
authentication, the user is assigned a public IP address so that he or she can access
the Internet. No public IP address is allocated to those who fails authentication.
This solves the problem about IP address planning and allocation. This is very
useful. For example, a service provider allocates public IP addresses to broadband
users in a residential community only when they access external networks.
Layer 3 authentication
Layer 3 portal authentication is similar to direct authentication. However, in
Layer-3 portal authentication mode, a Layer 3 forwarding device can be present
between the authentication client and the access device.
Differences between Layer 3 authentication and non-Layer 3
authentication
Networking mode
■
From this point of view, the difference between these two authentication modes
lies in whether or not a Layer 3 forwarding device can be present between the
authentication client and the access device. The former supports Layer 3
forwarding devices, while the latter does not.
User identifier
■
In Layer 3 authentication mode, a user is uniquely identified by the IP address
because the mode supports Layer 3 forwarding devices between the
authentication client and the access device, but the access device may not learn