Huawei Quidway S3700 Series Configuration Manual page 90

Quidway S3700 Series Ethernet Switches
Configuration Guide - Security
Procedure
Step 1 Set the IP address of the Layer 3 interface connected to the user.
<Quidway> system-view
[Quidway] vlan 10
[Quidway-vlan10] quit
[Quidway] interface gigabitethernet 0/0/3
[Quidway-GigabitEthernet0/0/3] port link-type access
[Quidway-GigabitEthernet0/0/3] port default vlan 10
[Quidway-GigabitEthernet0/0/3] quit
[Quidway] interface vlanif 10
[Quidway-Vlanif10] ip address 192.168.1.10 24
[Quidway-Vlanif10] quit
Step 2 Configure a RADIUS server template.
# Configure a RADIUS server template rd1.
[Quidway] radius-server template rd1
# Set the IP address and port number of the primary RADIUS authentication server.
[Quidway-radius-rd1] radius-server authentication 192.168.2.30 1812
# Set the key and retransmission count of the RADIUS server.
[Quidway-radius-rd1] radius-server shared-key cipher hello
[Quidway-radius-rd1] radius-server retransmit 2
[Quidway-radius-rd1] quit
Step 3 Create an authentication scheme web1 and set the authentication method to RADIUS
authentication.
[Quidway] aaa
[Quidway-aaa] authentication-scheme web1
[Quidway-aaa-authen-1] authentication-mode radius
[Quidway-aaa-authen-1] quit
Step 4 Create a domain isp1 and bind the authentication scheme and RADIUS server template to the
domain.
[Quidway-aaa] domain isp1
[Quidway-aaa-domain-isp1] authentication-scheme web1
[Quidway-aaa-domain-isp1] radius-server rd1
Step 5 Configure the Web authentication function.
# Set the IP address and URL of the Web authentication server
[Quidway] web-auth-serer isp1
[Quidway-web-auth-server-isp1] server-ip 192.168.2.20
[Quidway-web-auth-server-isp1] url http://www.isp1.com
# Bind the Web authentication server to the Layer 3 interface.
[Quidway] interface vlanif 10
[Quidway-Vlanif10] web-auth-server isp1
[Quidway-Vlanif10] quit
# Configure a free rule to redirect the user to the Web authentication page when the user starts
the Web browser.
[Quidway] portal free-rule 20 destination ip 192.168.2.20 mask 24
Step 6 Verify the configuration.
Run the display web-auth-server configuration command on the Switch, and you can view
the configuration of the Web authentication server.
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
2 NAC Configuration
source any
77