121
Cross-subnet authentication
Cross-subnet authentication is similar to direct authentication, except it allows Layer 3 forwarding devices
to exist between the authentication client and the access device.
In direct authentication, re-DHCP authentication, and cross-subnet authentication, a user's IP address
uniquely identifies the user. After a user passes authentication, the access device generates an ACL for
the user based on the user's IP address to control forwarding of the packets from the user. Because no
Layer 3 forwarding device exists between authentication clients and the access device in direct
authentication and re-DHCP authentication, the access device can learn the user MAC addresses. The
access device can enhance its capability of controlling packet forwarding by using the learned MAC
addresses.
Portal authentication process
Direct authentication and cross-subnet authentication share the same authentication process. Re-DHCP
authentication has a different process as it has two address allocation procedures.
Direct authentication/cross-subnet authentication process (with CHAP/PAP authentication)
Figure 38
Direct authentication/cross-subnet authentication process
The direct/cross-subnet authentication process is as follows:
1.
A portal user access the Internet through HTTP, and the HTTP packet arrives at the access device.
{
If the packet matches a portal free rule, the access device allows the packet to pass.
{
If the packet does not match any portal-free rule, the access device redirects the packet to the
portal Web server. The portal Web server pushes the Web authentication page to the user for
him to enter his username and password.
2.
The portal Web server submits the user authentication information to the portal authentication
server.
3.
The portal authentication server and the access device exchange CHAP messages. This step is
skipped for PAP authentication. The portal authentication server decides the method (CHAP or PAP)
to use.
4.
The portal authentication server adds the username and password into an authentication request
packet and sends it to the access device. Meanwhile, the portal authentication server starts a timer
to wait for an authentication reply packet.
AAA server
Authentication
client
Portal
authentication
server
Access
device
1) Initiate a connection
3) CHAP authentication
4) Authentication request
6) Authentication reply
5) RADIUS
authentication
7) Notify login
success
8) Authentication reply
acknowledgment
Security
policy server
10) Authorization
Timer
9) Security check
Portal Web
server
2) User information
