117
to the portal server's web authentication homepage. For extended portal functions, authentication
clients must run the portal client software.
2.
On the authentication homepage/authentication dialog box, the user enters and submits the
authentication information, which the portal server then transfers to the access device.
3.
Upon receiving the authentication information, the access device communicates with the
authentication/accounting server for authentication and accounting.
4.
After successful authentication, the access device checks whether there is a corresponding security
policy for the user. If there is not one, it allows the user to access the Internet. Otherwise, the client
communicates with the access device and the security policy server for security check. If the client
passes security check, the security policy server authorizes the user to access the Internet resources.
NOTE:
•
Portal authentication supports NAT traversal whether it is initiated by a web client or an HP iNode.
When the portal authentication client is on a private network but the portal server is on a public
network and the access device is enabled with NAT, network address translations performed on the
access device do not affect portal authentication.
•
Only a RADIUS server can serve as the remote authentication/accounting server in a portal system.
•
To implement security check, the client must be the HP iNode client.
Portal authentication modes
Portal authentication may work at Layer 2 or Layer 3 of the OSI model.
The router does not support Layer 2 portal authentication and local portal server.
Layer 2 portal authentication
Enable Layer 2 portal authentication on an access device's Layer 2 ports that connect authentication
clients, so that only clients whose MAC addresses pass authentication can access the external network.
Only the local portal server provided by the access device supports Layer 2 portal authentication.
Layer 2 portal authentication allows the authentication server to assign different VLANs according to user
authentication results so that access devices can thereby control user access to resources. After a client
passes authentication, the authentication server can assign an authorized VLAN to allow the user to
access the resources in the VLAN. If a client fails authentication, the authentication server can assign an
Auth-Fail VLAN. Layer 3 portal authentication does not support VLAN assignment.
Layer 3 portal authentication
Enable Layer 3 authentication on an access device's Layer 3 interfaces that connect authentication
clients. Portal authentication performed on a Layer 3 interface can be direct authentication, re-DHCP
authentication, or cross-subnet authentication. In direct authentication and re-DHCP authentication, no
Layer-3 forwarding devices exist between the authentication client and the access device. In cross-subnet
authentication, Layer-3 forwarding devices may exist between the authentication client and the access
device.
Direct authentication
Before authentication, a user manually configures a public IP address or directly obtains a public IP
address through DHCP and can access only the portal server and predefined free websites. After
passing authentication, the user can access the network resources. The process of direct authentication is
simpler than that of re-DHCP authentication.
