84
•
Supports multiple authentication modes. For example, re-DHCP authentication implements a
flexible address assignment scheme and saves public IP addresses. Cross-subnet
authentication can authenticate users who reside in a different subnet than the access device.
A typical portal system consists of the following components:
•
Authentication
client
—A Web browser that runs HTTP/HTTPS or a user host that runs a
portal client application.
•
Access
device
—Broadband access device such as a switch or a router.
•
Portal authentication server
—Receives authentication requests from authentication clients
and interacts user authentication information with the access device.
•
Portal Web server
—Pushes the Web authentication page to authentication clients and
forwards user authentication information (username and password) to the portal authentication
server.
The portal authentication server and the portal Web server are usually the same device, but
they can also be separate devices.
•
AAA
server
—Interacts with the access device to implement authentication, authorization,
accounting for portal users.
Portal authentication server
A portal authentication server receives authentication requests from authentication clients and
interacts user authentication information with the access device.
Portal authentication server detection
During portal authentication, if the communication between the access device and portal
authentication server is broken, both of the following occur:
•
New portal users are not able to log in.
•
The online portal users are not able to log out normally.
To address this problem, the access device needs to be able to detect the reachability changes of the
portal server quickly and take corresponding actions to deal with the changes.
With the detection feature enabled, the device periodically detects portal login, logout, or heartbeat
packets sent by a portal authentication server to determine the reachability of the server. If the device
receives a portal packet within a detection timeout and the portal packet is valid, the device
determines the portal authentication server to be reachable. Otherwise, the device determines the
portal authentication server to be unreachable.
You can configure the device to take one or more of the following actions when the server
reachability status changes:
•
Sending a trap message to the NMS. The trap message contains the name and current state of
the portal authentication server.
•
Sending a log message, which contains the name, the current state, and the original state of the
portal authentication server.
Portal user synchronization
Once the access device loses communication with a portal authentication server, the portal user
information on the access device and the server might be inconsistent after the communication
resumes. To address this problem, the device provides the portal user synchronization feature. This
feature is implemented by sending and detecting portal synchronization packets, as follows:
1.
The portal authentication server sends the online user information to the access device in a
synchronization packet at the user heartbeat interval.
The user heartbeat interval is set on the portal authentication server.
2.
Upon receiving the synchronization packet, the access device compares the users carried in
the packet with its own user list and performs the following operations:
