364
unreachable log "Portal server newpt turns down from up." and disables portal authentication on the
access interface, so the host can access the external network without authentication.
Example: Configuring cross-subnet portal authentication for
MPLS L3VPNs
Network configuration
As shown in
, the PE device Router A provides portal authentication for the host in VPN 1.
A portal server in VPN 3 acts as the portal authentication server, portal Web server, and RADIUS
server.
Configure cross-subnet portal authentication on Router A, so the host can access network resources
after passing identity authentication.
Figure 126 Network diagram
Configuration prerequisites
•
Before enabling portal authentication, configure MPLS L3VPN and specify VPN targets for VPN
1 and VPN 3 so that VPN 1 and VPN 3 can communicate with each other. This example
describes only the access authentication configuration on the user-side PE. For information
about MPLS L3VPN configurations, see
MPLS Configuration Guide
.
•
Configure the RADIUS server correctly to provide authentication and accounting functions.
Procedure
Perform the following tasks on Router A.
1.
Configure a RADIUS scheme:
# Create a RADIUS scheme named
rs1
and enter its view.
<RouterA> system-view
[RouterA] radius scheme rs1
# For the RADIUS scheme, specify the VPN instance that is bound to the interface connected to
the portal/RADIUS server. This example uses VPN instance
vpn3
. (For information about the
VPN instance, see the MPLS L3VPN configuration on Router A.)
[RouterA-radius-rs1] vpn-instance vpn3
# Specify the primary authentication server and primary accounting server, and configure the
keys for communication with the servers.
[RouterA-radius-rs1] primary authentication 192.168.0.111
[RouterA-radius-rs1] primary accounting 192.168.0.111
[RouterA-radius-rs1] key accounting simple radius
[RouterA-radius-rs1] key authentication simple radius
# Exclude the ISP domain name from the username sent to the RADIUS server.
[RouterA-radius-rs1] user-name-format without-domain
