Configuring Direct Portal Authentication With Extended Functions - H3C S5500-EI Series Security Configuration Manual

[SwitchA–Vlan-interface4] quit
On Switch B, configure a default route to subnet 192.168.0.0/24, setting the next hop as 20.20.20.1.
(Details not shown.)
Configuring direct portal authentication with extended
functions
Network requirements
As shown in
The host is directly connected to the switch and the switch is configured for direct extended portal
•
authentication. The host is assigned with a public network IP address either manually or through
DHCP. If the host fails security check after passing identity authentication, the host can access only
subnet 192.168.0.0/24. After passing security check, the host can access Internet resources.
• A RADIUS server serves as the authentication/accounting server.
Figure 68 Network diagram
Configuration procedure
Configure IP addresses for the host, switch, and servers as shown in
reach each other.
Configure the RADIUS server properly to provide authentication and accounting functions for users.
Configure the switch:
Configure a RADIUS scheme:
1.
# Create a RADIUS scheme named rs1 and enter its view.
<Switch> system-view
[Switch] radius scheme rs1
# Set the server type for the RADIUS scheme. When using the CAMS/IMC server, set the server
type to extended.
[Switch-radius-rs1] server-type extended
# Specify the primary authentication server and primary accounting server, and configure the keys
for communication with the servers.
[Switch-radius-rs1] primary authentication 192.168.0.112
[Switch-radius-rs1] primary accounting 192.168.0.112
Figure 68:
173
Figure 68 and make sure they can