Configuring Isp Domain Attributes - H3C SR8800-F Configuration Manual

Configuring ISP domain attributes

Setting ISP domain status
By placing the ISP domain in active or blocked state, you allow or deny network service requests
from users in the domain.
To set ISP domain status:
Step
1. Enter system view.
2. Enter ISP domain view.
3. Place the ISP domain in
active or blocked state.
Configuring authorization attributes for an ISP domain
The device assigns the authorization attributes in the ISP domain to the authenticated users that do
not receive these attributes from the server. However, if the idle cut attribute is configured in the ISP
domain, the device assigns the attribute to the authenticated users. If no idle cut attribute is
configured in the ISP domain, the device uses the idle cut attribute assigned by the server. The
device supports the following authorization attributes:
•
Authorization ACL—The device restricts authenticated users to access only the network
resources permitted by the ACL.
•
Authorization CAR action—The attribute controls the traffic flow of authenticated users.
•
Idle cut—It enables the device to check the traffic of each online user at the specified direction
in the domain at the idle timeout interval. The device logs out an online user if the user's total
traffic in the idle timeout period at the specified direction is less than the specified minimum
traffic.
•
IPv4 address pool—The device assigns IPv4 addresses from the pool to authenticated users
in the domain.
•
Default authorization user profile—When a user passes authentication, it typically obtains an
authorization user profile from the local or remote server. If the user does not obtain any user
profile, the device authorizes the default user profile of the ISP domain to the user. The device
will restrict the user's behavior based on the profile.
•
Authorization session group profile—The device restricts authenticated users' behaviors
based on the settings in the authorization session group profile.
•
Authorization session timeout timer—The device logs out a user when the session timeout
timer for the user expires.
•
Authorization IPv6 address prefix—The device authorizes the IPv6 address prefix to
authenticated users in the domain.
•
IPv6 address pool—The device assigns IPv6 addresses from the pool to authenticated users
in the domain.
•
DNS server address—The attribute specifies the DNS server that offers DNS services to the
authenticated users in the domain.
•
Redirect URL—The device redirects PPP users in the domain to the URL after they pass
authentication.
•
Authorization user group—Authenticated users in the domain obtain all attributes of the user
group.
Command
system-view
domain isp-name
state { active | block }
55
Remarks
N/A
N/A
By default, an ISP domain is in
active state, and users in the
domain can request network
services.