Configuring Cross-Subnet Portal Authentication - HP FlexFabric 5700 Series Security Configuration Manual

Authorization ACL: None
VPN instance: --
MAC
0015-e9a6-7cfe

Configuring cross-subnet portal authentication

Network requirements
As shown in
Switch B. A portal server acts as both a portal authentication server and a portal Web server. A RADIUS
server acts as the authentication/accounting server.
Configure Switch A for cross-subnet portal authentication. Before passing the authentication, the host can
access only the portal Web server. After passing the authentication, the user can access Internet
resources.
Figure 52 Network diagram
Configuration prerequisites and guidelines
• Configure IP addresses for the switch and servers as shown in
switch, and servers can reach each other.
Configure the RADIUS server properly to provide authentication and accounting functions.
•
• Make sure the IP address of the portal device added on the portal authentication server is the IP
address (20.20.20.1) of the switch's interface connecting the host. The IP address group associated
with the portal device is the subnet of the host (8.8.8.0/24).
Configuration procedure
Perform the following tasks on Switch A.
1. Configure a RADIUS scheme:
# Create a RADIUS scheme named rs1 and enter its view.
<SwitchA> system-view
[SwitchA] radius scheme rs1
# Specify the primary authentication server and primary accounting server, and configure the keys
for communication with the servers.
[SwitchA-radius-rs1] primary authentication 192.168.0.112
[SwitchA-radius-rs1] primary accounting 192.168.0.112
[SwitchA-radius-rs1] key authentication simple radius
IP
20.20.20.2
Figure 52, Switch A supports portal authentication. The host accesses Switch A through
VLAN Interface
100 Vlan-interface100
149
Figure 52 and make sure the host,