138
source address to a specified destination address, users can access the specified address directly,
without being redirected to the portal authentication page for portal authentication. Usually, you can
configure the IP address of a server that provides certain services (such as software upgrading service)
as the destination IP address of a portal-free rule, so that Layer 2 portal authentication users can access
the services without portal authentication.
Follow these guidelines when you configure a portal-free rule:
•
If you specify both a VLAN and an interface in a portal-free rule, the interface must belong to the
VLAN. Otherwise, the rule does not take effect.
•
You cannot configure two or more portal-free rules with the same filtering criteria. Otherwise, the
system prompts that the rule already exists.
•
A Layer 2 interface in an aggregation group cannot be specified as the source interface of a
portal-free rule, and the source interface of a portal-free rule cannot be added to an aggregation
group.
To configure a portal-free rule:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Configure a portal-free rule.
•
To configure an IPv4 portal-free rule:
portal free-rule
rule-number
{
destination
{
any
|
ip
{
ip-address
mask
{
mask-length
|
netmask
} |
any
}
[
tcp
tcp-port-number
|
udp
udp-port-number
] } |
source
{
any
|
[
interface
interface-type
interface-number
|
ip
{
ip-address
mask
{
mask-length
|
mask
} |
any
} [
tcp
tcp-port-number
|
udp
udp-port-number
] |
mac
mac-address
|
vlan
vlan-id
] * } } *
•
To configure an IPv6 portal-free rule:
portal free-rule
rule-number
{
destination
{
any
|
ipv6
{
ipv6-address
prefix-length
|
any
} } |
source
{
any
|
[
interface
interface-type
interface-number
|
ipv6
{
ipv6-address
prefix-length
|
any
} |
mac
mac-address
|
vlan
vlan-id
] * } } *
Configure at least one
command.
NOTE:
Regardless of whether portal authentication is enabled or not, you can only add or remove a portal-free
rule. You cannot modify it.
Configuring an authentication source subnet
Only Layer 3 portal authentication supports this feature.
By configuring authentication source subnets, you specify that only HTTP packets from users on the
authentication source subnets can trigger portal authentication. If an unauthenticated user is not on any
authentication source subnet, the access device discards all the user's HTTP packets that do not match
any portal-free rule.
