Configuring Portal Stateful Failover - HP 3600 v2 Series Security Configuration Manual

# Configure AAA methods for the ISP domain.
[SwitchA-isp-dm1] authentication portal radius-scheme rs1
[SwitchA-isp-dm1] authorization portal radius-scheme rs1
[SwitchA-isp-dm1] accounting portal radius-scheme rs1
[SwitchA-isp-dm1] quit
# Configure domain dm1 as the default ISP domain for all users. Then, if a user enters the username
without the ISP domain at logon, the authentication and accounting methods of the default domain are
used for the user.
[SwitchA] domain default enable dm1
Configure the ACL (ACL 3000 ) for resources on subnet 192.168.0.0/24 and the ACL (ACL 3001)
3.
for Internet resources
NOTE:
On the security policy server, specify ACL 3000 as the isolation ACL and ACL 3001 as the security ACL.
[SwitchA] acl number 3000
[SwitchA-acl-adv-3000] rule permit ip destination 192.168.0.0 0.0.0.255
[SwitchA-acl-adv-3000] rule deny ip
[SwitchA-acl-adv-3000] quit
[SwitchA] acl number 3001
[SwitchA-acl-adv-3001] rule permit ip
[SwitchA-acl-adv-3001] quit
Configure portal authentication
4.
# Configure the portal server as follows:
Name: newpt
•
• IP address: 192.168.0.1 1 1
Key: portal
•
Port number: 50100
•
URL: http://192.168.0.1 1 1:8080/portal.
•
[SwitchA]
http://192.168.0.111:8080/portal
# Enable portal authentication on the interface connecting Switch B.
[SwitchA] interface vlan-interface 4
[SwitchA–Vlan-interface4] portal server newpt method layer3
[SwitchA–Vlan-interface4] quit
On Switch B, configure a default route to subnet 192.168.0.0/24, setting the next hop as 20.20.20.1.
(Details not shown)

Configuring portal stateful failover

Network requirements
As shown in
Switch B support portal authentication. Configure stateful failover between Switch A and Switch B to
support portal service backup and use VRRP to implement traffic switchover between the switches. More
specifically,
portal server newpt
Figure 72, a failover link is present between Switch A and Switch B. Both Switch A and
ip 192.168.0.111
171
key portal port 50100 url