89
ARP and ND detections apply only to direct and re-DHCP portal authentication. ICMP detection
applies to all portal authentication modes.
If the device receives no packets from a portal user within the idle time, the device detects the user's
online status as follows:
•
ICMP or ICMPv6 detection
—Sends ICMP or ICMPv6 requests to the user at configurable
intervals to detect the user status.
{
If the device receives a reply within the maximum number of detection attempts, it
determines that the user is online and stops sending detection packets. Then, the device
resets the idle timer and repeats the detection process when the timer expires.
{
If the device receives no reply after the maximum number of detection attempts, the device
logs out the user.
•
ARP or ND detection
—Sends ARP or ND requests to the user and detects the ARP or ND
entry status of the user at configurable intervals.
{
If the ARP or ND entry of the user is refreshed within the maximum number of detection
attempts, the device considers that the user is online and stops the detection. Then the
device resets the idle timer and repeats the detection process when the timer expires.
•
If the ARP or ND entry of the user is not refreshed after the maximum number of detection
attempts, the device logs out the user.
ISP domains
The device manages users based on ISP domains. An ISP domain includes authentication,
authorization, and accounting methods for users. The device determines the ISP domain and access
type of a user. It also uses the methods configured for the access type in the domain to control the
user's access.
The device supports the following authentication methods:
•
No
authentication
—This method trusts all users and does not perform authentication. For
security purposes, do not use this method.
•
Local
authentication
—The device authenticates users by itself, based on the locally
configured user information including the usernames, passwords, and attributes. Local
authentication allows high speed and low cost, but the amount of information that can be stored
is limited by the size of the storage space.
•
Remote
authentication
—The device works with a remote RADIUS server or TACACS server
to authenticate users. The server manages user information in a centralized manner. Remote
authentication provides high capacity, reliable, and centralized authentication services for
multiple devices. You can configure backup methods to be used when the remote server is not
available.
The device supports the following authorization methods:
•
No
authorization
—The device performs no authorization exchange. The following default
authorization information applies after users pass authentication:
{
Non-login users can access the network.
{
FTP, SFTP, and SCP users have the root directory of the device set as the working directory.
However, the users do not have permission to access the root directory.
{
Other login users obtain the default user role.
•
Local
authorization
—The device performs authorization according to the user attributes
locally configured for users.
•
Remote
authorization
—The device works with a remote RADIUS server or TACACS server to
authorize users. RADIUS authorization is bound with RADIUS authentication. RADIUS
authorization can work only after RADIUS authentication is successful, and the authorization
information is included in the Access-Accept packet. TACACS authorization is separate from
