Configuring Extended Cross-Subnet Portal Authentication - HPE Moonshot 45Gc Security Configuration Manual

Before a user performs portal authentication by using the HPE iNode client, the user can access only
the authentication page http://192.168.0.111:8080/portal. All Web requests the user initiates will be
redirected to the authentication page.
•
If the user passes the authentication but fails the security check, the user can access only the
resources that match ACL 3000.
•
After passing both the authentication and the security check, the user can access Internet
resources that match ACL 3001.
# After the user passes authentication, use the following command to display information about the
portal user.
[Switch] display portal user interface vlan-interface 100
Total portal users: 1
Username: abc
Portal server: newpt
State: Online
Authorization ACL: 3001
VPN instance: --
MAC
0015-e9a6-7cfe

Configuring extended cross-subnet portal authentication

Network requirements
As shown in
Switch B. A portal server acts as both a portal authentication server and a portal Web server. A
RADIUS server acts as the authentication/accounting server.
Configure Switch A for extended cross-subnet portal authentication. Before passing portal
authentication, the host can access only the portal server. After passing portal identity authentication,
the host accepts security check. If the host fails the security check it can access only the subnet
192.168.0.0/24. After passing the security check, the host can access Internet resources.
Figure 57 Network diagram
Configuration prerequisites and guidelines
•
Configure IP addresses for the switch and servers as shown in
host, switch, and servers can reach each other.
•
Configure the RADIUS server properly to provide authentication and accounting functions.
IP
20.20.20.2
Figure 57, Switch A supports portal authentication. The host accesses Switch A through
VLAN Interface
100 Vlan-interface100
166
Figure 57 and make sure the