A：
External Portal Authentication Overview
Portal authentication is a method used for Network Admission Control (NAC) and is also called web authentication. To access the Internet, the user must pass authentication on the Portal. Portal authentication supports Portal 2.0, Hypertext Transfer Protocol (HTTP), and Hypertext Transfer Protocol Secure (HTTPS). When a Huawei AC is interconnected with a Cisco ISE, Portal authentication is implemented based on HTTP or HTTPS.
When the AC is interconnected with the Cisco ISE, HTTPS and HTTP can be used in Portal authentication. The configurations for the two authentication methods are similar. The following uses HTTPS as an example.
For the configuration for external Portal authentication on the AC, see 4.
For the configuration on the Cisco ISE server, see 5.
Applicable Products and Versions
Product | Version |
|---|---|
Product | V200R007C20 |
Cisco ISE | 2.0.0.306 |
Service Requirements
To improve WLAN security, an enterprise performs external Portal authentication using HTTP or HTTPS to access-control users.
Networking Requirements
AC networking mode: Layer 2 bypass mode
DHCP deployment mode: The AC functions as the DHCP server to assign IP addresses to APs, and SwitchB functions as the DHCP server to assign IP addresses to STAs.
Service data forwarding mode: direct forwarding
Authentication mode: external Portal authentication
Security policy: open system authentication
Data Planning
Configuration Item | Data |
|---|---|
Management VLAN | VLAN 100 |
Service VLAN | VLAN 101 |
DHCP server | The AC functions as the DHCP server to assign IP addresses to APs, and SwitchB functions as the DHCP server to assign IP addresses to STAs. |
IP address pool for APs | 10.23.100.2 to 10.23.100.254/24 |
IP address pool for the STAs | 10.23.101.2 to 10.23.101.254/24 |
IP address of the AC's source interface | VLANIF 100: 10.23.100.1/24 |
IP address of the AC for connecting to the DHCP server | 10.23.102.2 |
IP address of the AC for connecting to STAs | 10.0.0.1 |
AP group |
|
AP group |
|
SSID profile |
|
Security profile |
|
Portal authentication parameters | Portal authentication scheme name: wlan-net Portal server template name: wlan-net
|
Portal access profile |
|
| URL template |
|
Authentication profile |
|
VAP profile |
|
Configuration Item | Data |
|---|---|
Department | Huawei |
Account | Account: huawei Password: huawei123 |
Device name | AC6605 |
Device's IP address | 10.23.102.2/32 |
RADIUS shared key | huawei@123 |
Authentication protocol |
|
Configuration Roadmap
Configure network interworking.
Configure the AC and SwitchB to assign IP addresses to APs and STAs, respectively.
Configure APs to go online.
Configure WLAN service parameters.
Configure Portal authentication on the AC.
Configure the Cisco ISE server.
Configuration Notes
Configure port isolation on the interfaces of the device directly connected to APs. If port isolation is not configured and direct forwarding is used, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.
The AC and server must have the same RADIUS shared key.
Procedure
Configure network interworking.
<HUAWEI> system-view[HUAWEI] sysname SwitchA[SwitchA] vlan batch 100 101[SwitchA] interface gigabitethernet 0/0/1[SwitchA-GigabitEthernet0/0/1] port link-type trunk[SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100[SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101[SwitchA-GigabitEthernet0/0/1] port-isolate enable[SwitchA-GigabitEthernet0/0/1] quit[SwitchA] interface gigabitethernet 0/0/2[SwitchA-GigabitEthernet0/0/2] port link-type trunk[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101[SwitchA-GigabitEthernet0/0/2] quit
<HUAWEI> system-view[HUAWEI] sysname SwitchB[SwitchB] vlan batch 100 to 104[SwitchB] interface gigabitethernet 0/0/1[SwitchB-GigabitEthernet0/0/1] port link-type trunk[SwitchB-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101[SwitchB-GigabitEthernet0/0/1] quit[SwitchB] interface gigabitethernet 0/0/2[SwitchB-GigabitEthernet0/0/2] port link-type trunk[SwitchB-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 102[SwitchB-GigabitEthernet0/0/2] quit[SwitchB] interface gigabitethernet 0/0/3[SwitchB-GigabitEthernet0/0/3] port link-type trunk[SwitchB-GigabitEthernet0/0/3] port trunk pvid vlan 103[SwitchB-GigabitEthernet0/0/3] port trunk allow-pass vlan 103[SwitchB-GigabitEthernet0/0/3] quit[SwitchB] interface gigabitethernet 0/0/4[SwitchB-GigabitEthernet0/0/4] port link-type trunk[SwitchB-GigabitEthernet0/0/4] port trunk pvid vlan 104[SwitchB-GigabitEthernet0/0/4] port trunk allow-pass vlan 104[SwitchB-GigabitEthernet0/0/4] quit[SwitchB] interface vlanif 102[SwitchB-Vlanif102] ip address 10.23.102.1 24[SwitchB-Vlanif102] quit[SwitchB] interface vlanif 103[SwitchB-Vlanif103] ip address 10.23.103.2 24[SwitchB-Vlanif103] quit[SwitchB] interface vlanif 104[SwitchB-Vlanif104] ip address 10.23.104.1 24[SwitchB-Vlanif104] quit[SwitchB] ip route-static 0.0.0.0 0.0.0.0 10.23.104.2
<AC6605> system-view[AC6605] sysname AC[AC] vlan batch 100 101 102[AC] interface gigabitethernet 0/0/1[AC-GigabitEthernet0/0/1] port link-type trunk[AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 102[AC-GigabitEthernet0/0/1] quit[AC] interface vlanif 102[AC-Vlanif102] ip address 10.23.102.2 24[AC-Vlanif102] quit[AC] ip route-static 10.23.103.0 24 10.23.102.1
<Huawei> system-view[Huawei] sysname Router[Router] interface gigabitethernet 0/0/1[Router-GigabitEthernet0/0/1] ip address 10.23.104.2 24[Router-GigabitEthernet0/0/1] quit[Router] ip route-static 10.23.101.0 24 10.23.104.1
Configure the AC and SwitchB to function as DHCP servers to assign IP addresses to APs and STAs respectively.
[AC] dhcp enable[AC] interface vlanif 100[AC-Vlanif100] ip address 10.23.100.1 24[AC-Vlanif100] dhcp select interface[AC-Vlanif100] quit
Configure the DNS server as required. The common methods are as follows:
In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
[SwitchB] dhcp enable[SwitchB] interface vlanif 101[SwitchB-Vlanif101] ip address 10.23.101.1 24[SwitchB-Vlanif101] dhcp select interface[SwitchB-Vlanif101] quit
[SwitchB] ip route-static 10.0.0.1 32 10.23.102.2
In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
Configure APs to go online.
# Create an AP group to which the APs with the same configuration can be added.
[AC] wlan[AC-wlan-view] ap-group name ap-group1[AC-wlan-ap-group-ap-group1] quit
# Create a regulatory domain profile, configure the AC country code in the profile, and bind the profile to the AP group.
[AC-wlan-view] regulatory-domain-profile name default[AC-wlan-regulate-domain-default] country-code cn[AC-wlan-regulate-domain-default] quit[AC-wlan-view] ap-group name ap-group1[AC-wlan-ap-group-ap-group1] regulatory-domain-profile defaultWarning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu e?[Y/N]:y [AC-wlan-ap-group-ap-group1] quit[AC-wlan-view] quit
# Configure the AC's source interface.
[AC] capwap source interface vlanif 100
# Import the APs offline to the AC and add the APs to the AP group ap-group1. Configure names for the APs based on the AP locations, so that you can know where the APs are located. For example, if the AP with MAC address 60de-4476-e360 is deployed in area 1, name the AP area
NOTE:
The default AP authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.
In this example, the AP5030DN is used and has two radios: radio 0 and radio 1. Radio 0 and radio 1 operate on the 2.4 GHz and 5 GHz bands respectively.
[AC] wlan[AC-wlan-view] ap auth-mode mac-auth[AC-wlan-view] ap-id 0 ap-mac 60de-4476-e360[AC-wlan-ap-0] ap-name area_1[AC-wlan-ap-0] ap-group ap-group1Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y [AC-wlan-ap-0] quit
# After the AP is powered on, run the display ap all command to check the AP state. If the State field displays nor, the AP has gone online.
[AC-wlan-view] display ap allTotal AP information: nor : normal [1] -------------------------------------------------------------------------------- ID MAC Name Group IP Type State STA Uptime -------------------------------------------------------------------------------- 0 60de-4476-e360 area_1 ap-group1 10.23.100.254 AP5030DN nor 0 10S -------------------------------------------------------------------------------- Total: 1
Configure external Portal authentication on the AC.
Configure RADIUS authentication parameters.
# Configure a RADIUS server template.
[AC] radius-server template wlan-net[AC-radius-wlan-net] radius-server authentication 10.23.103.1 1812 source ip-address 10.23.102.2[AC-radius-wlan-net] radius-server shared-key cipher huawei@123[AC-radius-wlan-net] quit
# Create an AAA scheme and set the authentication method to RADIUS.
[AC] aaa[AC-aaa] authentication-scheme wlan-net[AC-aaa-authen-wlan-net] authentication-mode radius[AC-aaa-authen-wlan-net] quit[AC-aaa] quit
Configure a Portal server profile.
Ensure that the Portal server IP address and URL are configured correctly and are the same as those on the Portal server.
The ISE Portal URL is in format of https://10.23.103.1:8443/portal/PortalSetup.action#portal=0ce17ad0-6d90-11e5-978e-005056bf2f0a and can be obtained through 5.e. Replace the question mark (?) in the URL with the pond sign (#).
[AC] http secure-server ssl-policy default_policy[AC] http secure-server enable[AC] portal https-redirect enable[AC] portal web-authen-server https ssl-policy default_policy port 8443 //Parse the HTTPS authentication request from users and send authentication information to the server. [AC] interface loopback 0[AC-LoopBack0] ip address 10.0.0.1 32 //This IP address is used by the AC to communicate with STAs. STAs send their user names and passwords to this IP address. [AC-LoopBack0] quit[AC] url-template name test[AC-url-template-test] url https://10.23.103.1:8443/portal/PortalSetup.action#portal=0ce17ad0-6d90-11e5-978e-005056bf2f0a[AC-url-template-test] parameter start-mark #[AC-url-template-test] url-parameter login-url switch_url https://10.0.0.1:8443/login[AC-url-template-test] quit[AC] free-rule-template name default[AC-free-rule-default] free-rule 0 destination ip 10.0.0.1 mask 255.255.255.255[AC-free-rule-default] quit[AC] web-auth-server wlan-net[AC-web-auth-server-wlan-net] server-ip 10.23.103.1[AC-web-auth-server-wlan-net] url-template test[AC-web-auth-server-wlan-net] protocol http[AC-web-auth-server-wlan-net] source-ip 10.23.102.2[AC-web-auth-server-wlan-net] http get-method enable //Parse the HTTP authentication request from users and send authentication information to the server. [AC-web-auth-server-wlan-net] quit
Configure the Portal access profile wlan-net and configure Layer 3 Portal authentication.
[AC] portal-access-profile name wlan-net[AC-portal-access-profile-wlan-net] web-auth-server wlan-net layer3[AC-portal-access-profile-wlan-net] quit
Create the authentication profile wlan-net.
[AC] authentication-profile name wlan-net[AC-authentication-profile-wlan-net] portal-access-profile wlan-net[AC-authentication-profile-wlan-net] authentication-scheme wlan-net[AC-authentication-profile-wlan-net] free-rule-template default[AC-authentication-profile-wlan-net] radius-server wlan-net[AC-authentication-profile-wlan-net] quit
Configure WLAN service parameters.
# Create the security profile wlan-net and retain the default security policy (open system authentication).
[AC] wlan[AC-wlan-view] security-profile name wlan-net[AC-wlan-sec-prof-wlan-net] quit
# Create the SSID profile wlan-net and set the SSID name to wlan-net.
[AC-wlan-view] ssid-profile name wlan-net[AC-wlan-ssid-prof-wlan-net] ssid wlan-net[AC-wlan-ssid-prof-wlan-net] quit
# Create the VAP profile wlan-net, configure the direct data forwarding mode and service VLANs, and bind the security profile, authentication profile, and SSID profile to the VAP profile.
[AC-wlan-view] vap-profile name wlan-net[AC-wlan-vap-prof-wlan-net] forward-mode direct-forward[AC-wlan-vap-prof-wlan-net] service-vlan vlan-id 101[AC-wlan-vap-prof-wlan-net] security-profile wlan-net[AC-wlan-vap-prof-wlan-net] ssid-profile wlan-net[AC-wlan-vap-prof-wlan-net] authentication-profile wlan-net[AC-wlan-vap-prof-wlan-net] quit
# Bind the VAP profile wlan-net to the AP group and apply the profile to radio 0 and radio 1 of the AP.
[AC-wlan-view] ap-group name ap-group1[AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0[AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1[AC-wlan-ap-group-ap-group1] quit[AC-wlan-view] quit
Configure the Cisco ISE.
# Log in to the Cisco ISE server.
# Enter the access address of the Cisco ISE server in the address box, which is in the format of https://Cisco ISE IP. Cisco ISE IP is the IP address of the Cisco ISE server.
# On the displayed page, enter the user name and password to log in to the Cisco ISE server.
Add the AC so that the Cisco ISE can interwork with the AC.
# Choose . In the pane on the left side, click Add and create a device profile named Huawei. Set Supported Protocols to RADIUS. Then, click Submit.
# Choose . In the pane on the right side, click Add. Set the device name to AC6605, IP address to 10.23.102.2/32, and RADIUS shared key to huawei@123. Then, click Submit.
Configure the authentication protocol.
# Choose . Select Default Network Access and click Edit.
# Select Allow CHAP. For other parameters, use the default settings. Click Save.
Add a user.
# Choose . In the pane on the right side, click Add to create the account with the user name of huawei and password of huawei123. Then, click Submit.
Obtain the URL of the ISE Portal.
# Choose . On the Guest Portals page, select Self-Registered Guest Portal(default) and click Edit.
# On the Portals Settings and Customization page, click Portal test URL and copy the link from the address bar.
On the AC, check whether users can pass RADIUS authentication.
[AC] test-aaa huawei huawei123 radius-template wlan-netInfo: Account test succeed.
Verify the configuration.
The WLAN with SSID wlan-net is available for STAs connected to the AP.
The wireless STA obtains an IP address after it associates with the WLAN.
When a user opens the browser on the STA, the user is redirected to the Portal authentication page. After the user enters the correct user name and password and is successfully authenticated, the user can access the Internet.
After authentication succeeds, run the display access-user access-type command on the AC. The command output shows online users.
[AC] display access-user access-type portal ------------------------------------------------------------------------------ UserID Username IP address MAC Status ------------------------------------------------------------------------------ 460 huawei 10.23.101.254 8000-6e74-e78a Success ------------------------------------------------------------------------------ Total: 1, printed: 1
For details, see the WLAN Product Interoperation Configuration Guide.
Step 1 Log in to the enterprise technical support website at http://support.huawei.com/enterprise.
Step 2 Click WLAN.
Step 3 Click the name of the product to be queried, for example, AC6605.
Step 4 Choose Configuration & Commissioning > Interoperation Configuration Guide to find the WLAN Product Interoperation Configuration Guide.
WLAN Product Interoperation Configuration Guide
