HPE FlexNetwork 10500 Series Security Configuration Manual page 250

•
For re-DHCP portal authentication:
The switch must be configured as a DHCP relay agent.

The portal-enabled interface must be configured with a primary IP address (a public IP

address) and a secondary IP address (a private IP address).
For information about DHCP relay agent configuration, see Layer 3—IP Services Configuration
Guide.
•
Make sure the IP address of the portal device added on the portal server is the public IP
address (20.20.20.1) of the switch's interface connecting the host. The private IP address range
for the IP address group associated with the portal device is the private subnet 10.0.0.0/24
where the host resides. The public IP address range for the IP address group is the public
subnet 20.20.20.0/24.
•
If you have configured a preauthentication IP address pool on portal-enabled interfaces,
configure a DHCP relay address pool with the same name on the device. For the DHCP relay
address pool, specify the subnet address where the unauthenticated users reside (with the
export-router keyword specified) and the DHCP server address.
Configuration procedure
Perform the following tasks on the switch.
1. Configure a preauthentication domain:
# Create an ISP domain named abc and enter its view.
<Switch> system-view
[Switch] domain abc
# Specify authorization ACL 3010 in the domain.
[Switch-isp-abc] authorization-attribute acl 3010
[Switch-isp-abc] quit
# Configure a rule to permit access to the subnet 192.168.0.0/24.
[Switch] acl advanced 3010
[Switch-acl-ipv4-adv-3010] rule 1 permit ip destination 192.168.0.0 24
[Switch-acl-ipv4-adv-3010] quit
# Configure preauthentication domain abc on VLAN-interface 100.
[Switch] interface vlan-interface 100
[Switch–Vlan-interface100] portal pre-auth domain abc
[Switch–Vlan-interface100] quit
2. Configure DHCP relay and authorized ARP.
# Configure DHCP relay.
[Switch] dhcp enable
[Switch] dhcp relay client-information record
[Switch] interface vlan-interface 100
[Switch–Vlan-interface100] ip address 20.20.20.1 255.255.255.0
[Switch–Vlan-interface100] ip address 10.0.0.1 255.255.255.0 sub
[Switch-Vlan-interface100] dhcp select relay
[Switch-Vlan-interface100] dhcp relay server-address 192.168.0.112
# Enable authorized ARP.
[Switch-Vlan-interface100] arp authorized enable
[Switch-Vlan-interface100] quit
3. Configure portal authentication:
# Configure a portal authentication server.
[Switch] portal server newpt
[Switch-portal-server-newpt] ip 192.168.0.111 key simple portal
233