直接portal认证实验总结

无线直接portal认证组网需求用户通过无线SSID接入，根据业务需求，接入用户通过vlan20、vlan30和vlan40，3个网段接入，AP管理地址使用vlan10网段，所有网关在AC上，并且通过AC上的DHCP获取地址。用户接入时需要启用portal认证。组网图配置思路在WX3024E上配置portal功能配置IMC服务器配置信息AC配置如下：[H3C_AC-1]dispcu#version5.20,Release3507P18#sysnameH3C_AC-1#domaindefaultenableh3c#telnetserverenable#port-securityenable#portalserverimcip1keycipher$c$3$JE7u4JeHMC5L06LL4Jl1jaJZB0f86sEzurl1:8080/portalserver-typeimc#oapmanagement-ip01slot0#password-recoveryenable#vlan1#vlan10descriptionto_AP#vlan20description_User#vlan30descriptionto_User#vlan40descriptionto_User#vlan100descriptionto_IMC#vlan1000descriptionto_Router#radiusschemeimcserver-typeextendedprimaryauthentication1primaryaccounting1keyauthenticationcipher$c$3$q+rBITlcE79qH12EH3xe3Rc8Nj/fcVy1keyaccountingcipher$c$3$Uiv1821RWnPK4Mi2fIzd29DJ6yKvp38inas-ip54#domainh3cauthenticationportalradius-schemeimcauthorizationportalradius-schemeimcaccountingportalradius-schemeimcaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainsystemaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#dhcpserverip-poolvlan10networkmaskgateway-list54dns-listoption43hex8007000001C0A80AFE#dhcpserverip-poolvlan20networkmaskgateway-list54dns-list#dhcpserverip-poolvlan30networkmaskgateway-list54dns-list#dhcpserverip-poolvlan40networkmaskgateway-list54dns-list#user-groupsystemgroup-attributeallow-guest#local-useradminpasswordcipher$c$3$v9m2UEc3AWP3KbkKm480OAgOcpMkD0pDauthorization-attributelevel3service-typetelnet#wlanrrmdot11amandatory-rate61224dot11asupported-rate918364854dot11bmandatory-rate12dot11bsupported-rate5.511dot11gmandatory-rate125.511dot11gsupported-rate69121824364854#wlanservice-template1cryptossidH3C-VLAN20bindWLAN-ESS20cipher-suiteccmpsecurity-iewpaservice-templateenable#wlanservice-template2cryptossidH3C-VLAN30bindWLAN-ESS30cipher-suiteccmpsecurity-iewpaservice-templateenable#wlanservice-template3cryptossidH3C-VLAN40bindWLAN-ESS40cipher-suiteccmpsecurity-iewpaservice-templateenable#wlanap-groupdefault_groupapap1#interfaceBridge-Aggregation1portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan102030401001000#interfaceNULL0#interfaceVlan-interface1ipaddress00#interfaceVlan-interface10descriptionto_Useripaddress54#interfaceVlan-interface20descriptionto_Useripaddress54portalserverimcmethoddirect#interfaceVlan-interface30descriptionto_Useripaddress54#interfaceVlan-interface40descriptionto_User_vlan40ipaddress54#interfaceVlan-interface100descriptionto_IMCipaddress54#interfaceVlan-interface1000descriptionto_Routeripaddress52#interfaceGigabitEthernet1/0/1portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan102030401001000portlink-aggregationgroup1#interfaceGigabitEthernet1/0/2portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan102030401001000portlink-aggregationgroup1#interfaceWLAN-ESS20portaccessvlan20port-securityport-modepskport-securitytx-key-type11keyport-securitypreshared-keypass-phrase12345678#interfaceWLAN-ESS30portaccessvlan30port-securityport-modepskport-securitytx-key-type11keyport-securitypreshared-keypass-phrase12345678#interfaceWLAN-ESS40portaccessvlan40ort-securityport-modepskpport-securitytx-key-type11keyport-securitypreshared-keypass-phrase12345678wlanapap1modelWA3620i-AGNid1serial-id210235A1BBC146000073radio1service-template1service-template2service-template3radioenableradio2channel6service-template1service-template2service-template3radioenable#iproute-static#wlanipsmalformed-detect-policydefaultsignaturedeauth_floodsignature-id1signaturebroadcast_deauth_floodsignature-id2signaturedisassoc_floodsignature-id3signaturebroadcast_disassoc_floodsignature-id4signatureeapol_logoff_floodsignature-id5signatureeap_success_floodsignature-id6signatureeap_failure_floodsignature-id7signaturepspoll_floodsignature-id8signaturects_floodsignature-id9signaturerts_floodsignature-id10signatureaddba_req_floodsignature-id11signature-policydefaultcountermeasure-policydefaultattack-detect-policydefaultvirtual-security-domaindefaultattack-detect-policydefaultmalformed-detect-policydefaultsignature-policydefaultcountermeasure-policydefault#dhcpserverforbidden-ip54dhcpserverforbidden-ip54dhcpserverforbidden-ip54dhcpserverforbidden-ip54#dhcpenable#user-interfacecon0user-interfacevty04authentication-modeschemeuserprivilegelevel3#return交换机配置如下<H3C-SW01>dispcu#version5.20,Release3507P18#sysnameH3C-SW01#domaindefaultenablesystem#telnetserverenable#oapmanagement-ip00slot1#password-recoveryenable#vlan1#vlan10descriptionto_AP#vlan20descriptionto_User-vlan20#vlan30descriptionto_User-vlan30#vlan40descriptionto_User-vlan40#vlan100descriptionto_IMC#vlan1000descriptionto_Router#domainsystemaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#user-groupsystem#local-useradminpasswordcipher$c$3$078okxl+RPQFofPe76YXbYryBRI3uMKvauthorization-attributelevel3service-typetelnet#interfaceBridge-Aggregation1portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan102030401001000#interfaceNULL0#interfaceVlan-interface1ipaddress01#interfaceGigabitEthernet1/0/1portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan203040porttrunkpvidvlan10poeenable#interfaceGigabitEthernet1/0/2portaccessvlan100poeenable#interfaceGigabitEthernet1/0/3portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan1000poeenable#interfaceGigabitEthernet1/0/4poeenable#interfaceGigabitEthernet1/0/5poeenable#interfaceGigabitEthernet1/0/6poeenable#interfaceGigabitEthernet1/0/7poeenable#interfaceGigabitEthernet1/0/8poeenable#interfaceGigabitEthernet1/0/9poeenable#interfaceGigabitEthernet1/0/10poeenable#interfaceGigabitEthernet1/0/11poeenable#interfaceGigabitEthernet1/0/12poeenable#interfaceGigabitEthernet1/0/13poeenable#interfaceGigabitEthernet1/0/14poeenable#interfaceGigabitEthernet1/0/15poeenable#interfaceGigabitEthernet1/0/16poeenable#interfaceGigabitEthernet1/0/17poeenable#interfaceGigabitEthernet1/0/18poeenable#interfaceGigabitEthernet1/0/19poeenable#interfaceGigabitEthernet1/0/20poeenable#interfaceGigabitEthernet1/0/21poeenable#interfaceGigabitEthernet1/0/22poeenable#interfaceGigabitEthernet1/0/23poeenable#interfaceGigabitEthernet1/0/24poeenable#interfaceGigabitEthernet1/0/25shutdown#interfaceGigabitEthernet1/0/26shutdown#interfaceGigabitEthernet1/0/27shutdown#interfaceGigabitEthernet1/0/28shutdown#interfaceGigabitEthernet1/0/29portlink-typetrunkundoporttrunkpermitvlan1porttrunkpermitvlan102030401001000portlink-aggregationgroup1#interfaceGigabitEthernet1/0/30portlink-typetrunkundoporttrunkpermitvlan1porttrunk