Huawei Wireless Access Controllers V200R003C00 Web Platform Configuration Guide-Example for Configuring Built-in Portal Authentication for Local Users

18.10 Example for Configuring Built-in Portal Authentication for Local Users

Networking Requirements

As shown in Figure 18-10, an enterprise connects the AC to the aggregation switch in bypass mode to manage the AP in centralized manner and provide a WLAN with the SSID huawei so that users can access the network anywhere at any time. The AC functions as the DHCP server to assign IP addresses to the AP and STA.

Due to openness of the WLAN, there are security risks. To manage users in centralized manner, Portal authentication is configured on the AC. Any user that attempts to access the Internet is redirected to the Portal authentication page. Users are authorized to access the Internet after entering the correct user names and passwords. If the enterprise has a few number of users, the AC can function as the Portal server to authenticate users locally to reduce costs.

Figure 18-10 Networking for configuring built-in Portal authentication for local users
a854b4ae7342460f93bb09525142f6b7

Data Preparation

Item	Data
Management VLAN for the AP	VLAN 100
Service VLAN for STAs	VLAN 101
DHCP server	The AC functions as the DHCP server for the AP and STAs.
IP address pool for the AP	192.168.100.2 to 192.168.100.254/24
IP address pool for STAs	192.168.101.3 to 192.168.101.254/24 DNS: 8.8.8.8 Address that cannot be assigned: 192.168.101.2 of Router
AC ID/Country code	0/CN
AC's source interface	VLANIF 100
WLAN radio profile	Name: radio WMM profile: wmm
WLAN service set	Name: huawei SSID: huawei WLAN ESS interface: WLAN-ESS1 Security profile: security Traffic profile: traffic Data forwarding mode: tunnel forwarding
AP's gateway	VLANIF 100: 192.168.100.1
STA's gateway	VLANIF101: 192.168.101.1
STA user name and password	User name: huawei Password: huawei123 Authentication domain: default
Built-in Portal server	IP address: 192.168.101.1 SSL policy: default_policy (the certificate in the PKI domain is obtained in self-signed mode) Port number: 2000 Authentication mode: CHAP

Configuration Roadmap

The configuration roadmap is as follows:

Use the configuration wizard to configure the AP to go online on the AC. Configure a management VLAN and a service VLAN.
Configure a DNS server address in the DHCP address pool of the service VLAN to provide the DNS service for the STA.
Configure a static route so that the AC forwards the packet to the router after receiving the packet from the STA.
Configure a built-in Portal server to authenticate users locally and use the authenticate domain default for Portal authentication.
Use the configuration wizard to configure the WLAN service and deliver the WLAN service to the AP.

Procedure

Configure the access switch, aggregation switch, and router.

# Add GE0/0/1 and GE0/0/2 on the access switch to VLAN 100 (the default VLAN of GE0/0/1).
# On the aggregation switch, add GE0/0/1 and GE0/0/2 to the management VLAN 100, and add GE0/0/2 and GE0/0/3 to the service VLAN 101.
# Assign an IP address 192.168.101.2 to GE0/0/1 on Router and configure the router as the default gateway for the AC.
Configure the AP to go online on the AC.
1. Choose Configuration Wizard > Configuration Wizard > AP Online Configuration Wizard. The AP Online Configuration Wizard page is displayed.
2. Configure the Ethernet interface.
  
  # On the Configure Ethernet Interface page, click next to GigabitEthernet0/0/1 to add the interface to VLAN 100 and VLAN 101 in tagged mode.
3. Configure virtual interfaces.
  
  # Click Create on the Configure Virtual Interface page. The Create Virtual Interfacepage is displayed.
  # Configure an IP address 192.168.100.1/24 for VLANIF 100.
  
  # Configure an IP address 192.168.101.1/24 for VLANIF101.
  # Click Next.
4. Configure DHCP.
  
  # Click Create on the Configure DHCP page. The Create IP Pool page is displayed.
  # Configure an IP address pool for VLANIF 100.
  
  # Configure an IP address pool for VLANIF 101. Specify that the IP address 192.168.101.2 in this address pool cannot be automatically assigned to STAs.
  
  # Click Next.
5. Configure the AC.
6. Confirm the settings.
  
  On the Confirm Settings page, confirm that the settings are correct and then click Finish.
Configure DNS.

# Choose IP Service > DHCP > IP Pool and click next to Vlanif101 in IP Pool List to configure the DNS server address for the STA.
Configure a static route.

# Choose IP Service > Route > Static Route Configuration to create a static route.
Configure a local authentication user.

# Choose Security Management > AAA > User Management to create a local authentication user.
Configure a built-in Portal server.

# Choose Security Management > Portal Authentication > Built-in Portal Server, set parameters for the built-in Portal server, and click Apply.
Configure the WLAN service.
1. Choose Configuration Wizard > Configuration Wizard > WLAN Configuration Wizard. The WLAN Configuration Wizard page is displayed.
2. Select Common WLAN Service and click Next.
3. Add the AP.
  
  # Click Create on the Configure AP page. The Create AP page is displayed.
  # Set AP type to AP6010DN-AGN and MAC address to 60de-4476-e360 on the Create AP page to add the AP.
  
  Select the AP and click Next.
4. Configure the radio.
  
  # Select 2.4 GHz.
  # Create a radio profile named radio. Create a WMM profile named wmm and use the default settings in the profile.
  
  # Click Next.
5. Configure the WLAN service.
  
  # On the Configure WLAN Service page, click Create to create a service set.
  
  # Create a traffic profile named traffic.
  
  # Create a security profile named security.
  
  # Create an ESS interface.
  
  # Select the created security profile, traffic profile, ESS interface, click Advanced, and set Forwarding mode to Tunnel.
  
  # Click OK and then click Next.
6. Confirm the settings.
  # Confirm that the settings are correct, and then click Finish. In the message that is displayed, confirm that the configuration is to be delivered to the AP.
Verify the configuration.
1. The WLAN with the SSID huawei is available for the STA.
2. The STA can associate with the WLAN and obtain an IP address 192.168.101.x/24 and its gateway address is 192.168.101.1.
3. Choose Terminal Management > Terminal Management > STA Management. You can see that the STA goes online successfully and obtains an IP address.
4. When a user opens the browser and enters an IP address, the user is redirected to the Portal authentication page. Enter the user name and password and click Login.
5. If the following page is displayed, the user is successfully authenticated and can access the Internet. Do not close this page when you access the Internet.