Key Configuration Check

Check whether the built-in Portal server is enabled, including whether the server is enabled and the authentication mode is PAP, and whether the IP address, protocol, and port of the server are correct.

[HUAWEI] display portal local-server
Portal local-server config       :
 server status                   : enable
 Heartbeat-check status          : disable
 server ip                       : 200.1.1.1
 authentication method           : pap // Only PAP is supported for the AD/LDAP server.
 protocol                        : https
 https ssl-policy                : default_policy
 server max-user                 : 1024
 server port                     : 2000

If the built-in Portal server function is disabled, use either of the following two methods to enable the function:

• Enable the built-in Portal server of the HTTP protocol.

  #
  portal local-server ip 200.1.1.1
  portal local-server http port 2000
  portal local-server authentication-method pap
  #

• Enable the built-in Portal server of the HTTPS protocol.

  #
  portal local-server ip 200.1.1.1
  portal local-server https ssl-policy default_policy port 2000
  portal local-server authentication-method pap
  #

Find the corresponding VAP profile based on the SSID, and check the configurations of the VAP profile, including the configuration of the authentication profile.

1. Run the display vap-profile all command to check all VAP profiles and find the corresponding VAP profile based on the SSID.

   [HUAWEI] display vap-profile all
   FMode   : Forward mode
   STA U/D : Rate limit client up/down
   VAP U/D : Rate limit VAP up/down
   BR2G/5G : Beacon 2.4G/5G rate
   ---------------------------------------------------------------
   Name              FMode    Type     VLAN      AuthType   STA U/D(Kbps)  VAP U/D(Kbps)  BR2G/5G(Mbps)  Reference  SSID
   ---------------------------------------------------------------
   default           direct   service  VLAN 1    Open         -/-          -/-             1/6            0         HUAWEI-WLAN
   vap_localportal tunnel   service  VLAN 200  Open+Portal  -/-          -/-             1/6            3         localportal_test
   ---------------------------------------------------------------
   Total: 2

2. Check the configuration of the VAP profile, and find the authentication profile bound to the VAP profile.

   [HUAWEI] wlan
   [HUAWEI-wlan-view] vap-profile name vap_localportal
   [HUAWEI-wlan-vap-prof-vap_localportal]display this
   #
    forward-mode tunnel
    service-vlan vlan-id 200
    ssid-profile localportal
    authentication-profile authen_localportal
   #

3. Check the configuration of the authentication profile. It must have a Portal access profile bound.

   [HUAWEI] authentication-profile name authen_localportal
   [HUAWEI-authentication-profile-authen_localportal] display this
   #
   authentication-profile name authendot1x
    portal-access-profile access_localportal
    access-domain domain_test
   #

4. Check the configuration of the Portal access profile. The built-in Portal server must be enabled.

   [HUAWEI] portal-access-profile name access_localportal
   [HUAWEI-portal-access-profile-access_localportal] display this
   #
   portal-access-profile name access_localportal
    portal local-server enable
   #

In LDAP authentication scenarios, the authentication mode must be set to LDAP authentication and the LDAP server template must be applied. In AD authentication scenarios, the authentication mode must be set to AD authentication and the AD server template must be applied.

The authentication mode is specified in an authentication scheme. An authentication scheme can be applied using either of the following two methods: Method 1: Apply it to an authentication profile directly. Method 2: Apply it to a domain, which is then bound to the authentication profile. The first method has a higher priority than the second method. If both methods are configured, the first method takes effect, and the default or forcible domain configured in the authentication profile using the second method does not take effect.

• Method 1: Apply an authentication scheme to an authentication profile.

  LDAP authentication: When an authentication scheme is applied to an authentication profile, apply an LDAP server template to the authentication profile.

  [HUAWEI] authentication-profile name authen_localportal
  [HUAWEI-authentication-profile-authen_localportal] display this
  #
  authentication-profile name authen_localportal
   portal-access-profile access_localportal
   authentication-scheme ldap
   ldap-server ldap_test
  #

  AD authentication: When an authentication scheme is applied to an authentication profile, apply an AD server template to the authentication profile.

  [HUAWEI] authentication-profile name authen_localportal
  [HUAWEI-authentication-profile-authen_localportal] display this
  #
  authentication-profile name authen_localportal
   portal-access-profile access_localportal
   authentication-scheme ad
   ldap-server ad_test
  #

• Method 2: Apply an authentication scheme to a domain.
  • LDAP authentication: When an authentication scheme is applied to a domain, apply an LDAP server template to the domain.

    [HUAWEI] aaa
    [HUAWEI-aaa] domain domain_test
    [HUAWEI-aaa-domain-domain_test] display this
    #
     domain domain_test
      authentication-scheme ldap
      ldap-server ldap_test
    #

    Subsequently, configure the default or forcible domain in the authentication profile. You are advised to configure a default domain without specifying the access type in the authentication profile.

    [HUAWEI] authentication-profile name authen_localportal
    [HUAWEI-authentication-profile-authen_localportal] display this
    #
    authentication-profile name authen_localportal
     portal-access-profile access_localportal
     access-domain domain_test
    #

  • AD authentication: When an authentication scheme is applied to a domain, apply an AD server template to the domain.

    [HUAWEI] aaa
    [HUAWEI-aaa] domain domain_test
    [HUAWEI-aaa-domain-domain_test] display this
    #
     domain domain_test
      authentication-scheme ad
      ldap-server ad_test
    #

    Subsequently, configure the default or forcible domain in the authentication profile. You are advised to configure a default domain without specifying the access type in the authentication profile.

    [HUAWEI] authentication-profile name authen_localportal
    [HUAWEI-authentication-profile-authen_localportal] display this
    #
    authentication-profile name authen_localportal
     portal-access-profile access_localportal
     access-domain domain_test
    #

  The authentication domain for a terminal is selected in descending order of priority: forcible domain for a specified access type > forcible domain with no access type specified > valid domain carried in the user name > default domain for a specified access type > default domain with no access type specified > global default domain. The following are configuration examples of different domains:

  • Forcible domain for a specified access type:

    [HUAWEI-authentication-profile-authen_portal] display this
    #
    authentication-profile name authen_portal
     portal-access-profile access_portal
     access-domain domain_test portal force

  • Forcible domain with no access type specified:

    [HUAWEI-authentication-profile-authen_portal] display this
    #
    authentication-profile name authen_portal
     portal-access-profile access_portal
     access-domain domain_test force

  • Valid domain carried in the user name: The user name used for authentication contains the domain name in @ format, and the domain has been created on the device.
  • Default domain for a specified access type:

    [HUAWEI-authentication-profile-authen_portal] display this
    #
    authentication-profile name authen_portal
     portal-access-profile access_portal
     access-domain domain_test portal

  • Default domain with no access type specified:

    [HUAWEI-authentication-profile-authen_portal] display this
    #
    authentication-profile name authen_portal
     portal-access-profile access_portal
     access-domain domain_test

  • Global default domain: It is specified by the domain xxx command in the system view.

When configuring an LDAP server template, pay attention to the authentication server address, Base DN, administrator DN and password, and server type.

The user-filter field depends on the type of the interconnected server and is configured based on the specific server requirements. For example, the user-filter field of an AD LDAP server is sAMAccountName, that of an Open LDAP server or IBM Tivoli LDAP server is cn, and that of a Sun ONE LDAP server is uid.

[HUAWEI] ldap-server template ldap_test
[HUAWEI-ldap-ldap_test] display this
#
ldap-server template ldap_test
 ldap-server authentication 12.12.12.9 389
 ldap-server authentication manager cn=administrator,cn=users xxxx
 undo ldap-server authentication base-dn dc=my-domain,dc=com
 ldap-server authentication base-dn dc=test1,dc=com
 ldap-server server-type ad-ldap
 ldap-server group-filter ou
 ldap-server user-filter sAMAccountName
 ldap-server pki-realm test  //In V2R22C00 and later versions, the domain name must be specified.
#

When configuring an AD server template, pay attention to the authentication server address, Base DN, administrator DN and password, and server hostname.

[HUAWEI] ad-server template ad_test
[HUAWEI] display this
#
ad-server template ad_test
 ad-server pki-realm test //In V200R022C00 and later versions, the domain name must be specified.
 ad-server authentication 12.12.12.9 88
 ad-server authentication base-dn dc=test1,dc=com
 ad-server authentication manager cn=administrator,cn=users xxxxx
 ad-server authentication host-name WIN-LVA6RGM4LD6.test1.com
 ad-server authentication ldap-port 389
 ad-server user-filter sAMAccountName
 ad-server group-filter ou
#