Portal Authentication Process - H3C S7500E Series Operation Manual

Operation Manual – Portal
H3C S7500E Series Ethernet Switches
From this point of view, the difference between these two authentication modes lies in
whether or not a Layer 3 forwarding device can be present between the authentication
client and the access device. The former supports Layer 3 forwarding devices, while
the latter does not.
User identifier
In Layer 3 authentication mode, a client is uniquely identified by an IP address. This is
because the mode supports Layer 3 forwarding devices between the authentication
client and the access device but the access device does not learn the MAC address of
the authentication client. In non-Layer 3 authentication mode, a client is uniquely
identified by the combination of its IP address and MAC address because the access
device can learn the MAC address of the authentication client.
Due to the above differences, when the MAC address of an authentication client
remains the same but the IP address changes, a new portal authentication will be
triggered in Layer-3 authentication mode but will not be triggered in non-Layer 3
authentication mode. In non-Layer 3 authentication mode, a new portal authentication
will be triggered only when both the MAC and IP address of the authentication client are
changed.

1.1.5 Portal Authentication Process

Direct authentication and Layer 3 authentication share the same authentication
process. When it comes to re-DHCP authentication, the process is different for the
presence of two address allocation procedures.
I. Direct authentication/Layer 3 authentication process
Figure 1-2 Direct authentication/Layer 3 authentication process
For portal authentication, the direct authentication/Layer 3 authentication process is as
follows:
1) A portal user initiates an authentication request through HTTP. When HTTP
packets arrive at the access device, the access device allows those destined for
1-5
Chapter 1 Portal Configuration