Configuring Web Authentication; Overview - ProCurve 2900 Manual

Web and MAC Authentication

Configuring Web Authentication

3-30

Configuring Web Authentication

Overview

1. If you have not already done so, configure a local username and password
pair on the switch.
2. Identify or create a redirect URL for use by authenticated clients.
ProCurve recommends that you provide a redirect URL when using Web
Authentication. If a redirect URL is not specified, web browser behavior
following authentication may not be acceptable.
3. If you plan to use multiple VLANs with Web Authentication, ensure that
these VLANs are configured on the switch and that the appropriate port
assignments have been made. Also, confirm that the VLAN used by
authorized clients can access the redirect URL.
4. Use the ping command in the switch console interface to ensure that the
switch can communicate with the RADIUS server you have configured to
support Web-Auth on the switch.
5. Configure the switch with the correct IP address and encryption key to
access the RADIUS server.
6. (Optional) To use SSL encryption for web authentication login, configure
and enable SSL on the switch.
7. (Optional) To use customized web pages for web authentication login,
configure up to three web servers in your network by specifying the IP
address or URL used to access each server. By configuring multiple web
servers, you provide redundancy for client login in case the primary server
fails.
• Store all customized login web pages (including graphics and HTML
frames) that you create for client login on each web server at the page
path you configure with the aaa port-access web-based ewa-server
command. For information on how to create customized login web
pages, see "Using Customized Login Web Pages for Enhanced Web
Authentication" on page 3-17.
• If you want to use a host name instead of an IP address to configure
access to a web server, you must first configure a Domain Name
System (DNS) server in the network to resolve a URL with a host name
or fully qualified domain name into a specific IP address.