131
Step Command
Remarks
3.
Specify the VPN instance to
which the portal Web server
belongs.
vpn-instance vpn-instance-name
By default, the portal Web server
belongs to the public network.
4.
Specify the URL of the portal
Web server.
url
url-string
By default, no URL is specified.
5.
Configure the parameters to
be carried in the URL when
the device redirects it to
users.
url-parameter param-name
{
original-url
|
source-address
|
source-mac
|
value expression
}
By default, no redirection URL
parameters are configured.
Enabling portal authentication on an interface
You must first enable portal authentication on an access interface before it can perform portal
authentication for connected clients.
When a portal-enabled interface receives a portal packet, it checks the source IP address and VPN
information of the packet. If the packet matches a locally configured portal authentication server, the
interface regards the packet valid and sends an authentication response packet to the portal
authentication server. Otherwise, the interface drops the packet. After a user logs in to the device,
the user interacts with the portal authentication server as needed.
Configuration restrictions and guidelines
When you enable portal authentication on an interface, follow these restrictions and guidelines:
•
Make sure the interface has a valid IP address before you enable re-DHCP portal
authentication on the interface.
•
Do not add the interface enabled with portal authentication to an aggregation group. Otherwise,
portal authentication does not take effect.
•
Cross-subnet authentication mode (
layer3
) does not require Layer 3 forwarding devices
between the access device and the portal authentication clients. However, if a Layer 3
forwarding device exists between the authentication client and the access device, you must use
the cross-subnet portal authentication mode.
•
With re-DHCP portal authentication, configure authorized ARP on the interface as a best
practice to make sure only valid users can access the network. With authorized ARP configured
on the interface, the interface learns ARP entries only from the users who have obtained a
public address from DHCP.
•
An IPv6 portal server does not support the re-DHCP portal authentication mode.
•
You can enable both IPv4 portal authentication and IPv6 portal authentication on an interface.
Configuration procedure
To enable portal authentication on an interface:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
The interface must be a
Layer 3 interface.
3.
Enable portal authentication
on the interface.
•
To enable IPv4 portal
authentication:
portal enable method
{
direct
|
Enable IPv4 portal
authentication, IPv6 portal
