Configuring Cross-Subnet Portal Authentication - HPE Moonshot 45Gc Security Configuration Manual

Configuring cross-subnet portal authentication

Network requirements
As shown in
Switch B. A portal server acts as both a portal authentication server and a portal Web server. A
RADIUS server acts as the authentication/accounting server.
Configure Switch A for cross-subnet portal authentication. Before passing the authentication, the
host can access only the portal Web server. After passing the authentication, the user can access
Internet resources.
Figure 54 Network diagram
Configuration prerequisites and guidelines
•
Configure IP addresses for the switch and servers as shown in
host, switch, and servers can reach each other.
•
Configure the RADIUS server properly to provide authentication and accounting functions.
•
Make sure the IP address of the portal device added on the portal authentication server is the IP
address (20.20.20.1) of the switch's interface connecting the host. The IP address group
associated with the portal device is the subnet of the host (8.8.8.0/24).
Configuration procedure
Perform the following tasks on Switch A.
1. Configure a RADIUS scheme:
# Create a RADIUS scheme named rs1 and enter its view.
<SwitchA> system-view
[SwitchA] radius scheme rs1
# Specify the primary authentication server and primary accounting server, and configure the
keys for communication with the servers.
[SwitchA-radius-rs1] primary authentication 192.168.0.112
[SwitchA-radius-rs1] primary accounting 192.168.0.112
[SwitchA-radius-rs1] key authentication simple radius
[SwitchA-radius-rs1] key accounting simple radius
# Exclude the ISP domain name from the username sent to the RADIUS server.
[SwitchA-radius-rs1] user-name-format without-domain
[SwitchA-radius-rs1] quit
# Enable RADIUS session control.
[SwitchA] radius session-control enable
2. Configure an authentication domain:
Figure 54, Switch A supports portal authentication. The host accesses Switch A through
157
Figure 54 and make sure the