Enabling Layer 3 Portal Authentication; Controlling Access Of Portal Users; Configuring A Portal-Free Rule - HP A6600 Configuration Manual

Enabling Layer 3 portal authentication

Before enabling Layer 3 portal authentication on an interface, make sure of the following:
An IP address is configured for the interface.
•
The interface is not added to any port aggregation group.
•
The portal server to be referenced on the interface exists.
•
Layer 2 portal authentication is not enabled on any ports.
•
To enable Layer 3 portal authentication:
To do...
1. Enter system view.
2. Enter interface view.
3. Enable Layer 3 portal
authentication on the
interface.
On some devices, enable both direct/cross-subnet portal authentication and 802.1X authentication on a
Layer 3 interface, and a user can access the network after passing either authentication. If you enable
both 802.1X authentication and re-DHCP portal authentication on a Layer 3 interface, portal
authentication fails. For information about 802.1X, see
The destination port number that the router uses for sending unsolicited packets to the portal server must
be the same as that which the remote portal server actually uses.
The portal server and its parameters can be deleted or modified only when the portal server is not
referenced by any interface.
Cross-subnet authentication mode (portal server server-name method layer3) does not require Layer 3
forwarding devices between the access device and the authentication clients. However, if there are
Layer 3 forwarding devices between the authentication client and the access device, you must select the
cross-subnet portal authentication mode.
In re-DHCP authentication mode, a client can use a public IP address to send packets before passing
portal authentication. However, responses to the packets are restricted.

Controlling access of portal users

Configuring a portal-free rule

A portal-free rule allows specified users to access specified external websites without portal
authentication.
The matching items for a portal-free rule include the source and destination IP address, source MAC
address, inbound interface, and VLAN. Packets matching a portal-free rule do not trigger portal
authentication, so that users sending the packets can directly access the specified external websites.
Command...
system-view
interface interface-type interface-
number
portal server server-name method
{ direct | layer3 | redhcp }
"Configuring
128
Remarks
—
The interface must be a Layer 3
Ethernet interface.
Required.
Not enabled by default.
802.1X."