H3C AC進(jìn)行Portal認(rèn)證.doc

資料收集于網(wǎng)絡(luò)，如有侵權(quán)請聯(lián)系網(wǎng)站刪除一、組網(wǎng)需求：在BYOD組網(wǎng)方案下，我們主要通過iNode客戶端、HTTP網(wǎng)頁、終端Mac地址以及DHCP的Option屬性這四種方式獲取終端的操作系統(tǒng)和廠商信息，實(shí)現(xiàn)終端識別以便完成相應(yīng)的權(quán)限策略控制。其中DHCP的Option屬性方式可普遍用戶各種場景。由于部署DHCP服務(wù)器并安裝Agent插件的方式比較繁瑣，這里我們以普通Portal認(rèn)證為例介紹一種通過無線控制器的DHCP-snooping功能獲取記錄終端的option 55（終端操作系統(tǒng)）和option 60（終端廠商）信息并通過Radius屬性上報(bào)給iMC服務(wù)器的典型配置。WX系列AC、Fit AP、交換機(jī)、便攜機(jī)（安裝有無線網(wǎng)卡）、iMC服務(wù)器及其他智能終端。二、組網(wǎng)圖：三、配置步驟：1、AC版本要求WX系列AC從B109D012合入該特性，因此只有這個(gè)版本號及其以后的版本支持DHCP-snooping功能獲取記錄終端的option 55（終端操作系統(tǒng)）和option 60（終端廠商）信息并通過Radius屬性上報(bào)給iMC服務(wù)器。WX系列AC可通過下面的命令查看內(nèi)部版本號：_display versionH3C Comware Platform SoftwareComware Software, Version 5.20, Release 2607P18Comware Platform Software Version COMWAREV500R002B109D022H3C WX5540E Software Version V200R006B09D022Copyright (c) 2004-2014 Hangzhou H3C Tech. Co., Ltd. All rights reserved.Compiled Feb 25 2014 11:08:07, RELEASE SOFTWAREH3C WX5540E uptime is 1 week, 4 days, 0 hour, 49 minutes2、AC側(cè)配置及說明#version 5.20, Release 3120P17#sysname WX3024-AC#domain default enable system#telnet server enable#port-security enable#/配置portal server、ip、key、url以及server-type，注意這里server-type必須配置為imcportal server imc ip 2 key cipher $c$3$6uB5v4kaCg1aSOJkOqX+= url 2:8080/portal server-type imc/配置portal free-rule放通AC內(nèi)聯(lián)口portal free-rule 0 source interface GigabitEthernet1/0/1 destination any#oap management-ip 01 slot 0#password-recovery enable#vlan 1#vlan 24#/配置radius策略，注意server-type必須選擇extended模式，注意user-name-format及nas-ip的配置必須與iMC接入策略和接入服務(wù)里配置保持一致。radius scheme imcserver-type extendedprimary authentication 2primary accounting 2key authentication cipher $c$3$Myv0nhgPjC4vsMforZW3iCiW5KkP7Q=key accounting cipher $c$3$dCEXJGp71WPyrPK4hsPJd6sdTYf01A=user-name-format without-domainnas-ip 02#/配置domaindomain imcauthentication portal radius-scheme imcauthorization portal radius-scheme imcaccounting portal radius-scheme imcaccess-limit disablestate activeidle-cut disableself-service-url disabledomain systemaccess-limit disablestate activeidle-cut disableself-service-url disable#/配置AP注冊dhcp pooldhcp server ip-pool 1network mask #/配置終端業(yè)務(wù)dhcp pooldhcp server ip-pool option55network mask gateway-list 54dns-list #user-group systemgroup-attribute allow-guest#local-user adminpassword cipher $c$3$iMGlwEx7o4TNbMqd7OaOAwB5SWSzOrKEauthorization-attribute level 3service-type telnet#wlan rrmdot11a mandatory-rate 6 12 24dot11a supported-rate 9 18 36 48 54dot11b mandatory-rate 1 2dot11b supported-rate 5.5 11dot11g mandatory-rate 1 2 5.5 11dot11g supported-rate 6 9 12 18 24 36 48 54#/配置無線服務(wù)模板wlan service-template 10 clearssid option55bind WLAN-ESS 10service-template enable#wlan ap-group default_groupap ap1ap ap2#interface NULL0#/與iMC互聯(lián)ip及vlan接口interface Vlan-interface1ip address 02 # /終端業(yè)務(wù)互聯(lián)ip及vlan接口，接口下開啟portal，注意portal domain及portal nas-ip配置需要與iMC服務(wù)器portal設(shè)備保持一致interface Vlan-interface24ip address portal server imc method directportal domain imcportal nas-ip 02#interface GigabitEthernet1/0/1port link-type trunkport trunk permit vlan all#/配置wlan-ess接口interface WLAN-ESS10port access vlan 24#wlan ap ap2 model WA2610H-GN id 2serial-id 219801A0FH9136Q00287radio 1 service-template 10 radio enable#/開啟dhcp-snooping，使能dhcp-snooping記錄用戶的option 55和option 60信息功能dhcp-snoopingdhcp-snooping binding record user-identity#/配置默認(rèn)路由ip route-static 54#snmp-agentsnmp-agent local-engineid 800063A203000FE2873066snmp-agent community read publicsnmp-agent community write privatesnmp-agent sys-info version all#/使能dhcpdhcp enable#user-interface con 0user-interface vty 0 4authentication-mode schemeuser privilege level 3#return 3、iMC側(cè)配置請參考KMS-21434WX系列AC與iMC配合實(shí)現(xiàn)無線Portal認(rèn)證典型配置，這里不再贅述。4、結(jié)果驗(yàn)證及抓包1）AC上查看在線的客戶端和portal在線用戶信息：dis wlan clientTotal Number of Clients : 2 Client InformationSSID: option55-MAC Address User Name APID/RID IP Address VLAN-2477-0391-7720 -NA- 2/1 2428e1-4cb5-8249 -NA- 2/1 24-dis portal user allIndex:12State:ONLINESubState:NONEACL:NONEWork-mode:stand-aloneMAC IP Vlan Interface-2477-0391-7720 24 Vlan-interface24Index:13State:ONLINESubState:NONEACL:NONEWork-mode:stand-aloneMAC IP Vlan Interface-28e1-4cb5-8249 24 Vlan-interface24Total 2 user(s) matched, 2 listed.2）iMC上通過終端設(shè)備管理查看終端的廠商、類型以及操作系統(tǒng)等信息：3）查看AC的debugging信息，可以清楚看到Radius的code=1報(bào)文里攜帶了option 55和option 60的屬性字段：*Apr 26 16:37:06:936 2000 WX3024-AC RDS/7/DEBUG: Send attribute list:*Apr 26 16:37:06:946 2000 WX3024-AC RDS/7/DEBUG:1 User-name 8 c0946760 CHAP_Challenge 18 6EFCA7E2624584E38EA53882A4A12C904 NAS-IP-Address 6 0232 NAS-Identifier 11 WX3024-AC5 NAS-Port 6 1681820087 NAS_Port_Id 18 0100010000000024*Apr 26 16:37:06:986 2000 WX3024-AC RDS/7/DEBUG:61 NAS-Port-Type 6 19H3C-26 Connect_ID 6 216 Service-Type 6 27 Framed-Protocol 6 25531 Caller-ID 19 36432D38382D31342D35392D38392D384330 Called-station-Id 28 74-25-8A-33-81-70:option55*Apr 26 16:37:07:027 2000 WX3024-AC RDS/7/DEBUG:44 Acct-Session-Id 16 100032616371608 Framed-Address 6 H3C-255Product-ID 12 H3C WX3024H3C-60 Ip-Host-Addr 32 6c:88:14:59:89:8cH3C-208 DHCP-Option55 14 010F03062C2E2F1F2179F92BH3C-209 DHCP-Option60 10 4D53465420352E30*Apr 26 16:37:07:077 2000 WX3024-AC RDS/7/DEBUG:H3C-59 NAS-Startup-Timestamp 6 956750400*Apr 26 16:37:07:087 2000 WX3024-AC RDS/7/DEBUG:1、購買“女性化”Event: Begin to switch RADIUS server when sending 0 packet.（二）大學(xué)生對DIY手工藝品消費(fèi)態(tài)度分析*Apr 26 16:37:07:108 2000 WX3024-AC RDS/7/DEBUG: The RD TWL timer has resumeed.朋友推薦 宣傳廣告 逛街時(shí)發(fā)現(xiàn)的 上網(wǎng)%Apr 26 16:37:07:118 2000 WX3024-AC RDS/6/RDS_SUCC: -IfName=Vlan-interface24-VlanId=24-MACAddr=6C:88:14:59:89:8C-IPAddr=-IPv6Addr=N/A-UserName=c09467imc; User got online successfully.%Apr 26 16:37:07:138 2000 WX3024-AC PORTAL/5/PORTAL_USER_LOGON_SUCCESS: -UserName=c09467-IPAddr=-IfName=Vlan-interface24-VlanID=24-MACAddr=6c88-1459-898c-APMAC=7425-8A33-8170-SSID=option55-NasId=-NasPortId=; User got online successfully.*Apr 26 16:37:07:169 2000 WX3024-AC RDS/7/DEBUG: Malloc seed:38 in 2