Typical NAC Configuration (Unified Mode) (the Agile Controller-Campus as the Authentication Server) (V200R009C00 and Later Versions)

S300, S500, S2700, S3700, S5700, S6700, S7700, and S9700 Series Switches Typical Configuration Examples(V100 and V200)

This document provides campus networks typical configuration examples and feature typical configuration examples. "Campus Networks Typical Configuration Examples" provides typical campus network networking modes and a variety of deployment examples."Feature Typical Configuration Examples" provides typical configuration examples of a single feature on a switch. You can configure required features after deploying a campus network.

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Typical NAC Configuration (Unified Mode) (the Agile Controller-Campus as the Authentication Server) (V200R009C00 and Later Versions)

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch)
Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Aggregation Switch)
Configuring 802.1X and MAC Address Authentication for Access Users on Huawei Agile Controller-Campus
Delivering VLANs or ACLs to Successfully Authenticated Users on Huawei Agile Controller-Campus
Identifying Types of Terminals Accessing the Network on Huawei Agile Controller-Campus

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch)

This section includes the following content:

Introduction to Portal authentication
Networking Requirements
Configuration Logic
Configuration Notes
Data Plan
Procedure
Configuration Files

Introduction to Portal authentication

Portal authentication is also called web authentication, when a user accesses the network, the user must be first authenticated on the Portal website. If the authentication fails, the user can access only certain network resources. After the authentication succeeds, the user can access other network resources. Portal authentication has the following advantages:

Ease of use: In most cases, Portal authentication does not require the client to have additional software installed and allows the client to be directly authenticated on a web page.
Convenient operations: Portal authentication achieves service expansion on the Portal page, including advertisement push, responsibility announcement, and enterprise publicity.
Mature technology: Portal authentication has been widely used in networks of carriers, fast food chains, hotels, and schools.
Flexible deployment: Portal authentication implements access control at the access layer or at the ingress of key data.
Flexible user management: Portal authentication can be performed on users based on the combination of user names and any one of VLANs, IP addresses, and MAC addresses.

Enterprises often choose Portal authentication for guests because they move frequently.

Networking Requirements

An enterprise needs to deploy an identity authentication system to control employees' network access rights and allow only authorized users to access the network. The enterprise has the following requirements:

The authentication operations should be simple. The authentication system only performs access authorization. Minimum client software is installed on user terminals.
To facilitate network reconstruction and reduce investments, the enterprise requires the authentication point be deployed on the core switch.
A unified identity authentication mechanism is used to authenticate all terminals accessing the campus network and deny access from unauthorized terminals.
R&D employees can connect only to public servers (such as the web and DNS servers) of the enterprise before the authentication, and can connect to both the intranet (code library and issue tracking system) and Internet after being authenticated.
Marketing employees can connect only to public servers (such as the web and DNS servers) of the enterprise before the authentication, and can connect only to the Internet after being authenticated.

Figure 3-205 Portal authentication deployed at the core layer

Configuration Logic

Figure 3-206 Configuration logic of Huawei switch

Table 3-98 Configuration logic of Huawei Agile Controller-Campus

Item	Description
Creating a department and an account	-
Adding switches	Set parameters for switches connected to the Agile Controller-Campus.
(Optional) adding an authentication rule	Configure the conditions for users to pass the authentication. If no authentication rule is created, the default authentication rule (that allows all users to pass the authentication) of the Agile Controller-Campus is used.
Adding an authorization result	Create network access right profiles so that users granted with different profiles have different network access rights.
Adding an authorization rule	Select network access right profiles and users in an authorization rule so that specified network access rights are granted to specific users.

Configuration Notes

This configuration example applies to all switches running V200R009C00 or a later version.
Huawei's Agile Controller-Campus in V100R001 functions as the Portal server and RADIUS server in this example. For the Agile Controller-Campus, the version required is V100R001, V100R002, V100R003.
The RADIUS authentication and accounting shared keys and Portal shared key on the switch must be the same as those on the Agile Controller-Campus server.
By default, the switch allows the packets from RADIUS and Portal servers to pass. You do not need to configure authentication-free rules for the two servers on the switch.

Data Plan

Table 3-99 VLAN plan

VLAN ID	Function
101	VLAN for R&D employees
102	VLAN for marketing employees
103	VLAN for connection between the aggregation switch and core switch
104	VLAN to which interfaces connecting to the servers belong

Table 3-100 Network data plan

Item		Data	Description
Access switch (connecting to the R&D department)		Interface number: GE0/0/1 VLAN: 101	Connects to employees' PCs.
Access switch (connecting to the R&D department)		Interface number: GE0/0/2 VLAN: 101	Connects to the aggregation switch.
Access switch (connecting to the marketing department)		Interface number: GE0/0/1 VLAN: 102	Connects to employees' PCs.
Access switch (connecting to the marketing department)		Interface number: GE0/0/2 VLAN: 102	Connects to the aggregation switch.
Aggregation switch		Interface number: GE1/0/1 VLAN: 101 VLANIF101 IP address: 192.168.0.1	Connects to the access switch of the R&D department. Functions as the gateway for R&D employees.
		Interface number: GE1/0/2 VLAN: 102 VLANIF102 IP address: 192.168.1.1	Connects to the access switch of the marketing department. Functions as the gateway for marketing employees.
		Interface number: GE1/0/3 VLAN: 103 VLANIF103 IP address: 172.16.2.1	Connects to the core switch.
Core switch		Interface number: GE1/0/1 VLAN: 103 VLANIF103 IP address: 172.16.2.2	Connects to the aggregation switch.
Core switch		Interface number: GE1/0/2 VLAN: 104 VLANIF104 IP address: 172.16.1.254	Connects to the server area and functions as the gateway for the servers.
Server	Agile Controller-Campus (RADIUS server + Portal server)	IP address: 172.16.1.1	-
	DNS server	IP address: 172.16.1.2	-
	Web server	IP address: 172.16.1.3	-
	Code library	IP address: 172.16.1.4	-
	Issue tracking system	IP address: 172.16.1.5	-

Table 3-101 Service data plan

Item	Data	Description
Core switch	Number of the ACL for R&D employees' post-authentication domain: 3001	You need to enter this ACL number when configuring authorization rules and results on the Agile Controller-Campus.
	Number of the ACL for marketing employees' post-authentication domain: 3002	You need to enter this ACL number when configuring authorization rules and results on the Agile Controller-Campus.
	Authentication server: IP address: 172.16.1.1 Port number: 1812 RADIUS shared key: YsHsjx_202206	The Service Controller (SC) of the Agile Controller-Campus integrates the RADIUS server and Portal server. Therefore, IP addresses of the authentication server, accounting server, authorization server, and Portal server are the SC's IP address. Configure a RADIUS accounting server to collect user login and logout information. The port numbers of the authentication server and accounting server must be the same as the authentication and accounting port numbers of the RADIUS server. Configure an authorization server to enable the RADIUS server to deliver authorization rules to the switch. The RADIUS shared key of the authorization server must be the same as those of the authentication server and accounting server.
	Accounting server: IP address: 172.16.1.1 Port number: 1813 RADIUS shared key: YsHsjx_202206 Accounting interval: 15
	Portal server: IP address: 172.16.1.1 Port number that the switch uses to process Portal protocol packets: 2000 Destination port number in the packets that the switch sends to the Portal server: 50200 Portal authentication shared key: YsHsjx_202206
Agile Controller-Campus	Host name: access.example.com	Users can use the domain name to access the Portal server.
	Device IP address: 172.16.1.254	-
	Authentication port: 1812	-
	Accounting port: 1813	-
	RADIUS shared key: YsHsjx_202206	The RADIUS shared key must be the same as that configured on the switch.
	Port number that the Portal server uses to receive packets: 50200	-
	Portal shared key: YsHsjx_202206	It must be the same as the Portal authentication shared key configured on the switch.
	Department: R&D User: A Account: A-123 Password: YsHsjx_202207 Department: Marketing User: B Account: B-123 Password: YsHsjx_202207	Two departments and two corresponding accounts have been created on the Agile Controller-Campus: R&D department and an R&D employee account A-123; Marketing department and a marketing employee account B-123.
Pre-authentication domain	Agile Controller-Campus (including RADIUS server and Portal server), DNS server, and web server	-
Post-authentication domain	R&D employees: code library, issue tracking system, and Internet Marketing employees: Internet	-

Procedure

Configure the access switch to ensure network connectivity.

The following provides the configuration for SwitchA, the access switch connecting to the R&D department. The configuration for SwitchB, the access switch connecting to the marketing department, is similar to that for SwitchA.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan 101
[SwitchA-vlan101] quit
[SwitchA] interface gigabitethernet 0/0/1    //Interface connected to the R&D department
[SwitchA-GigabitEthernet0/0/1] port link-type access
[SwitchA-GigabitEthernet0/0/1] port default vlan 101
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2    //Interface connected to the aggregation switch
[SwitchA-GigabitEthernet0/0/2] port link-type trunk
[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 101
[SwitchA-GigabitEthernet0/0/2] quit

Configure the core switch.

Create VLANs and configure the VLANs allowed by interfaces so that packets can be forwarded.

<HUAWEI> system-view
[HUAWEI] sysname SwitchD
[SwitchD] vlan batch 103 104
[SwitchD] interface gigabitethernet 1/0/1    //Interface connected to the aggregation switch
[SwitchD-GigabitEthernet1/0/1] port link-type trunk
[SwitchD-GigabitEthernet1/0/1] port trunk allow-pass vlan 103
[SwitchD-GigabitEthernet1/0/1] quit
[SwitchD] interface vlanif 103
[SwitchD-Vlanif103] ip address 172.16.2.2 255.255.255.0
[SwitchD-Vlanif103] quit
[SwitchD] interface gigabitethernet 1/0/2    //Interface connected to the server area
[SwitchD-GigabitEthernet1/0/2] port link-type access
[SwitchD-GigabitEthernet1/0/2] port default vlan 104
[SwitchD-GigabitEthernet1/0/2] quit
[SwitchD] interface vlanif 104
[SwitchD-Vlanif104] ip address 172.16.1.254 255.255.255.0    //Configure the gateway address for the server area.
[SwitchD-Vlanif104] quit
[SwitchD] ip route-static 192.168.0.0 255.255.255.0 172.16.2.1    //Configure routes to the network segment assigned to the R&D department.
[SwitchD] ip route-static 192.168.1.0 255.255.255.0 172.16.2.1    //Configure routes to the network segment assigned to the marketing department.

Configure network access rights for users after successful authentication.

[SwitchD] acl 3001    //Configure the post-authentication domain for R&D employees.
[SwitchD-acl-adv-3001] rule 1 permit ip    //Allow R&D employees to access all resources.
[SwitchD-acl-adv-3001] quit
[SwitchD] acl 3002    //Configure the post-authentication domain for marketing employees.
[SwitchD-acl-adv-3002] rule 1 deny ip destination 172.16.1.4 0    //Prevent marketing employees from accessing the code library.
[SwitchD-acl-adv-3002] rule 2 deny ip destination 172.16.1.5 0    //Prevent marketing employees from accessing the issue tracking system.
[SwitchD-acl-adv-3002] rule 3 permit ip    //Allow marketing employees to access other resources.
[SwitchD-acl-adv-3002] quit

Configure parameters for connecting to the RADIUS server.

[SwitchD] radius-server template policy    //Create the RADIUS server template policy.
[SwitchD-radius-policy] radius-server authentication 172.16.1.1 1812    //Configure the IP address and port number of the RADIUS authentication server.
[SwitchD-radius-policy] radius-server accounting 172.16.1.1 1813    //Configure the IP address and port number of the RADIUS accounting server.
[SwitchD-radius-policy] radius-server shared-key cipher YsHsjx_202206    //Set the authentication key and accounting key to YsHsjx_202206.
[SwitchD-radius-policy] quit
[SwitchD] aaa    //Enter the AAA view.
[SwitchD-aaa] authentication-scheme auth    //Configure the authentication scheme auth.
[SwitchD-aaa-authen-auth] authentication-mode radius    //Set the authentication mode to RADIUS.
[SwitchD-aaa-authen-auth] quit
[SwitchD-aaa] accounting-scheme acco    //Configure the accounting scheme acco.
[SwitchD-aaa-accounting-acco] accounting-mode radius    //Set the accounting mode to RADIUS.
[SwitchD-aaa-accounting-acco] accounting realtime 15    //Set the real-time accounting interval to 15 minutes.
[SwitchD-aaa-accounting-acco] quit
[SwitchD-aaa] domain portal    //Configure a domain.
[SwitchD-aaa-domain-portal] authentication-scheme auth    //Bind the authentication scheme auth to the domain.
[SwitchD-aaa-domain-portal] accounting-scheme acco    //Bind the accounting scheme acco to the domain.
[SwitchD-aaa-domain-portal] radius-server policy    //Bind the RADIUS server template policy to the domain.
[SwitchD-aaa-domain-portal] quit
[SwitchD-aaa] quit
[SwitchD] domain portal  //Configure portal as the global default domain.

Configure parameters for connecting to the Portal server.

[SwitchD] web-auth-server portal_huawei //In V200R020C10SPC100 and later versions, you must also run the web-auth-server server-source or server-source command to configure the local gateway address used to receive and respond to the packets sent by the Portal server, so as to implement Portal authentication.
[SwitchD-web-auth-server-portal_huawei] server-ip 172.16.1.1 //Set the Portal server IP address.
[SwitchD-web-auth-server-portal_huawei] source-ip 172.16.1.254 //Set the IP address that the switch uses to communicate with the Portal server.
[SwitchD-web-auth-server-portal_huawei] port 50200 //Set the destination port number in the packets that the switch sends to the Portal server to 50200, which is the same as the port number that the Portal server uses to receive packets. The default destination port number on the switch is 50100, and you must change it to 50200 manually, so that it matches the port number on the Portal server.
[SwitchD-web-auth-server-portal_huawei] shared-key cipher YsHsjx_202206 //Configure the shared key for communication with the Portal server, which must be the same as that configured on the Portal server.
[SwitchD-web-auth-server-portal_huawei] url http://access.example.com:8080/portal //Configure the URL for the Portal authentication page, in which access.example.com indicates the host name of the Portal server. The domain name is recommended in the URL so that the Portal authentication page can be pushed to users faster and more securely. To use the domain name in the URL, you must configure the mapping between this domain name access.example.com and Portal server IP address on the DNS server in advance.
[SwitchD-web-auth-server-portal_huawei] quit
[SwitchD] web-auth-server listening-port 2000 //Configure the port number that the switch uses to process Portal protocol packets. The default port number is 2000. If the port number is changed on the server, change it accordingly on the switch.
[SwitchD] portal quiet-period //Enable the quiet function for Portal authentication users. If the number of times that a Portal authentication user fails to be authenticated within 60 seconds exceeds the specified value, the device discards the user's Portal authentication request packets for a period to prevent impact of frequent authentication failures on the system.
[SwitchD] portal quiet-times 5 //Configure the maximum number of authentication failures within 60 seconds before the device quiets a Portal authentication user.
[SwitchD] portal timer quiet-period 240 //Set the quiet period to 240 seconds.

Enable Portal authentication.

# Set the NAC mode to unified.

[SwitchD] authentication unified-mode    //Set the NAC mode to unified. By default, the switch works in unified mode. After changing the NAC mode from common to unified, save the configuration and restart the switch to make the configuration take effect.

# Configure a Portal access profile.

[SwitchD] portal-access-profile name web1
[SwitchD-portal-acces-profile-web1] web-auth-server portal_huawei layer3
[SwitchD-portal-acces-profile-web1] quit

# Configure an authentication-free rule profile and specify resources that users can access without authentication.

In versions earlier than V200R012C00, if the URL of Portal server needs to be analyzed by DNS and the DNS server is on the upstream network of the NAS device, you also need to create authentication-free rules and ensure that the DNS server is included in the authentication-free rules. In V200R012C00 and later versions, the NAS device automatically allows DNS packets to pass through and no authentication-free rule is required in Portal authentication.

[SwitchD] free-rule-template name default_free_rule
[SwitchD-free-rule-default_free_rule] free-rule 1 destination ip 172.16.1.2 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the DNS server before the authentication.
[SwitchD-free-rule-default_free_rule] free-rule 2 destination ip 172.16.1.3 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the web server before the authentication.
[SwitchD-free-rule-default_free_rule] quit

# Configure an authentication profile.

[SwitchD] authentication-profile name p1
[SwitchD-authen-profile-p1] portal-access-profile web1    //Bind the Portal access profile web1.
[SwitchD-authen-profile-p1] quit

# Enable Portal authentication.

[SwitchD] interface vlanif 103
[SwitchD-Vlanif103] authentication-profile p1
[SwitchD-Vlanif103] quit

Configure the Agile Controller-Campus.

Open the Internet Explorer, enter the Agile Controller-Campus address in the address box, and press Enter.

The following table provides two types of Agile Controller-Campus addresses.

Address Format	Description
https://Agile Controller-Campus-IP:8443	In the address, Agile Controller-Campus-IP indicates the Agile Controller-Campus IP address.
Agile Controller-Campus IP address	If port 80 is enabled during installation, you can access the Agile Controller-Campus by simply entering its IP address without the port number. The Agile Controller-Campus address will automatically change to https://Agile Controller-Campus-IP:8443.

Enter the administrator account and password.

Create departments and accounts. The following describes how to create the R&D department. Create the Marketing department similarly.
1. Choose Resource > User > User Management.
2. Click the Department tab in the operation area on the right. Then click Add under the Department tab, and add the department R&D.
3. Click the User tab in the operation area on the right. Then click Add under the User tab, and add the user A.
4. Click in the Operation column on the right of user A. The Account Management page is displayed. Click Add, and create a common account A-123 with the password YsHsjx_202207.
5. On the User tab page, select user A and click Transfer to add user A to the R&D department.

Add a switch to the Agile Controller-Campus and configure related parameters to ensure normal communication between the Agile Controller-Campus and switch.

Choose Resource > Device > Device Management.
Click Add.

Configure parameters for the switch.

Parameter	Value	Description
Name	SW	-
IP Address	172.16.1.254	The interface must be able to communicate with the SC.
Device series	Huawei Quidway Series	-
Authentication Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS authentication server configured on the switch.
Charging Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS accounting server configured on the switch.
Real-time charging interval (minute)	15	It must be the same as the real-time accounting interval configured on the switch.
Port	2000	This is the port that the switch uses to communicate with the Portal server. Retain the default value.
Portal Key	YsHsjx_202206	It must be the same as the Portal shared key configured on the switch.
Allowed IP Addresses	192.168.0.1/24; 192.168.1.1/24	-

Click OK.

Configure employee authorization. This example describes how to configure R&D employee authorization. The configuration procedure for marketing employees is the same, except that the network resources the two types of employees can access are different.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and configure resources that R&D employees can access after authentication and authorization.

Parameter	Value	Description
Name	R&D employee post-authentication domain	-
Service Type	Access Service	-
ACL Number/AAA User Group	3001	The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule, and specify the authorization conditions for R&D employees.
Parameter

Value

Description

Name

R&D employee authorization rule

-

Service Type

Access User

-

Department

R&D

-

Authorization Result

R&D employee post-authentication domain

-

Verify the configuration.
- Employees can access only the Agile Controller-Campus, DNS, and web servers before authentication.
- The Portal authentication page is pushed to an employee when the employee attempts to visit an Internet website. After the employee enters the correct account and password, the requested web page is displayed.
- R&D employee A can access the Internet, code library, and issue tracking system after authentication. Marketing employee B can access the Internet but not the code library and issue tracking system after authentication.
- After an employee is authenticated, run the display access-user command on the switch. The command output shows that the employee is online.

Parameter	Value	Description
Name	R&D employee authorization rule	-
Service Type	Access User	-
Department	R&D	-
Authorization Result	R&D employee post-authentication domain	-

Configuration Files

# Configuration file of the access switch for the employee department (The configuration file of the access switch for the marketing department is similar.)

#
sysname SwitchA
#
vlan batch 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 101
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 101
#
return

# Configuration file of the aggregation switch

#
sysname SwitchC
#
vlan batch 101 to 103
#
dhcp enable
#
interface Vlanif101
 ip address 192.168.0.1 255.255.255.0
 dhcp select interface
 dhcp server dns-list 172.16.1.2
#
interface Vlanif102
 ip address 192.168.1.1 255.255.255.0
 dhcp select interface
 dhcp server dns-list 172.16.1.2
#
interface Vlanif103
 ip address 172.16.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk
 port trunk allow-pass vlan 101
#
interface GigabitEthernet1/0/2
 port link-type trunk
 port trunk allow-pass vlan 102
#
interface GigabitEthernet1/0/3
 port link-type trunk
 port trunk allow-pass vlan 103
#
ip route-static 172.16.1.0 255.255.255.0 172.16.2.2
#
return

# Configuration file of the core switch

#
sysname SwitchD
#
vlan batch 103 to 104
#
authentication-profile name p1
 portal-access-profile web1
#
domain portal
#
radius-server template policy
 radius-server shared-key cipher %#%#1*yT+0O\X;V}hP,G^TMN7mTXA^mIz)SoR:86;lNK%#%#
 radius-server authentication 172.16.1.1 1812 weight 80
 radius-server accounting 172.16.1.1 1813 weight 80
#
acl number 3001
 rule 1 permit ip
acl number 3002
 rule 1 deny ip destination 172.16.1.4 0
 rule 2 deny ip destination 172.16.1.5 0
 rule 3 permit ip
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.2 mask 255.255.255.255
 free-rule 2 destination ip 172.16.1.3 mask 255.255.255.255
# 
web-auth-server portal_huawei
 server-ip 172.16.1.1
 port 50200
 shared-key cipher %#%#q9a^<=Ct5'=0n40/1g}/m6Mo,U9u5!s(GYM}Z{<~%#%#
 url http://access.***.com:8080/portal
 source-ip 172.16.1.254
#
portal-access-profile name web1 
 web-auth-server portal_huawei layer3 
#
aaa
 authentication-scheme auth
  authentication-mode radius
 accounting-scheme acco
  accounting-mode radius
  accounting realtime 15
 domain portal
  authentication-scheme auth
  accounting-scheme acco
  radius-server policy
#
interface Vlanif103
 ip address 172.16.2.2 255.255.255.0
 authentication-profile p1
#
interface Vlanif104
 ip address 172.16.1.254 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk
 port trunk allow-pass vlan 103
#
interface GigabitEthernet1/0/2
 port link-type access
 port default vlan 104
#
ip route-static 192.168.0.0 255.255.255.0 172.16.2.1
ip route-static 192.168.1.0 255.255.255.0 172.16.2.1
#
portal quiet-period
portal timer quiet-period 240
portal quiet-times 5
#
return

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Aggregation Switch)

This section includes the following content:

Introduction to Portal authentication
Networking Requirements
Configuration Logic
Configuration Notes
Data Plan
Procedure
Configuration Files

Introduction to Portal authentication

Ease of use: In most cases, Portal authentication does not require the client to have additional software installed and allows the client to be directly authenticated on a web page.
Convenient operations: Portal authentication achieves service expansion on the Portal page, including advertisement push, responsibility announcement, and enterprise publicity.
Mature technology: Portal authentication has been widely used in networks of carriers, fast food chains, hotels, and schools.
Flexible deployment: Portal authentication implements access control at the access layer or at the ingress of key data.
Flexible user management: Portal authentication can be performed on users based on the combination of user names and any one of VLANs, IP addresses, and MAC addresses.

Enterprises often choose Portal authentication for guests because they move frequently.

Networking Requirements

The authentication operations should be simple. The authentication system only performs access authorization. Minimum client software is installed on user terminals.
Moderate security control is required. To facilitate maintenance, a moderate number of authentication points need to be deployed on the aggregation switch.
A unified identity authentication mechanism is used to authenticate all terminals accessing the campus network and deny access from unauthorized terminals.
R&D employees can connect only to public servers (such as the web and DNS servers) of the enterprise before the authentication, and can connect to both the intranet (code library and issue tracking system) and Internet after being authenticated.
Marketing employees can connect only to public servers (such as the web and DNS servers) of the enterprise before the authentication, and can connect only to the Internet after being authenticated.

Figure 3-207 Portal authentication deployed at the aggregation layer

Configuration Logic

Figure 3-208 Configuration logic of Huawei switch

Table 3-102 Configuration logic of Huawei Agile Controller-Campus

Item	Description
Creating a department and an account	-
Adding switches	Set parameters for switches connected to the Agile Controller-Campus.
(Optional) adding an authentication rule	Configure the conditions for users to pass the authentication. If no authentication rule is created, the default authentication rule (that allows all users to pass the authentication) of the Agile Controller-Campus is used.
Adding an authorization result	Create network access right profiles so that users granted with different profiles have different network access rights.
Adding an authorization rule	Select network access right profiles and users in an authorization rule so that specified network access rights are granted to specific users.

Configuration Notes

This configuration example applies to all switches running V200R009C00 or a later version.
Huawei's Agile Controller-Campus in V100R001 functions as the Portal server and RADIUS server in this example. For the Agile Controller-Campus, the version required is V100R001, V100R002, V100R003.
The RADIUS authentication and accounting shared keys and Portal shared key on the switch must be the same as those on the Agile Controller-Campus server.
By default, the switch allows the packets from RADIUS and Portal servers to pass. You do not need to configure authentication-free rules for the two servers on the switch.

When you run the access-user arp-detect command to configure the IP address and MAC address of the user gateway as the source IP address and source MAC address of user offline detection packets, ensure that the MAC address of the gateway remains unchanged, especially in active/standby switchover scenarios. If the gateway MAC address is changed, ARP entries of terminals will be incorrect on the device, and the terminals cannot communicate with the device.

Data Plan

Table 3-103 VLAN plan

VLAN ID	Function
101	VLAN for R&D employees
102	VLAN for marketing employees
103	VLAN to which interfaces connecting to the servers belong

Table 3-104 Network data plan

Item		Data	Description
Access switch (connecting to the R&D department)		Interface number: GE0/0/1 VLAN: 101	Connects to employees' PCs.
Access switch (connecting to the R&D department)		Interface number: GE0/0/2 VLAN: 101	Connects to the aggregation switch.
Access switch (connecting to the marketing department)		Interface number: GE0/0/1 VLAN: 102	Connects to employees' PCs.
Access switch (connecting to the marketing department)		Interface number: GE0/0/2 VLAN: 102	Connects to the aggregation switch.
Aggregation switch		Interface number: GE1/0/1 VLAN: 101 VLANIF101 IP address: 192.168.0.1	Connects to the access switch of the R&D department. Functions as the gateway for R&D employees.
		Interface number: GE1/0/2 VLAN: 102 VLANIF102 IP address: 192.168.1.1	Connects to the access switch of the marketing department. Functions as the gateway for marketing employees.
		Interface number: GE1/0/3 VLAN: 103 VLANIF103 IP address: 172.16.1.254	Connects to the enterprise server area. Functions as the gateway for servers.
Server	Agile Controller-Campus (RADIUS server + Portal server)	IP address: 172.16.1.1	-
	DNS server	IP address: 172.16.1.2	-
	Web server	IP address: 172.16.1.3	-
	Code library	IP address: 172.16.1.4	-
	Issue tracking system	IP address: 172.16.1.5	-

Table 3-105 Service data plan

Item	Data	Description
Aggregation switch	Number of the ACL for R&D employees' post-authentication domain: 3001	You need to enter this ACL number when configuring authorization rules and results on the Agile Controller-Campus.
	Number of the ACL for marketing employees' post-authentication domain: 3002	You need to enter this ACL number when configuring authorization rules and results on the Agile Controller-Campus.
	Authentication server: IP address: 172.16.1.1 Port number: 1812 RADIUS shared key: YsHsjx_202206	The Service Controller (SC) of the Agile Controller-Campus integrates the RADIUS server and Portal server. Therefore, IP addresses of the authentication server, accounting server, authorization server, and Portal server are the SC's IP address. Configure a RADIUS accounting server to collect user login and logout information. The port numbers of the authentication server and accounting server must be the same as the authentication and accounting port numbers of the RADIUS server. Configure an authorization server to enable the RADIUS server to deliver authorization rules to the switch. The RADIUS shared key of the authorization server must be the same as those of the authentication server and accounting server.
	Accounting server: IP address: 172.16.1.1 Port number: 1813 RADIUS shared key: YsHsjx_202206 Accounting interval: 15
	Portal server: IP address: 172.16.1.1 Port number that the switch uses to process Portal protocol packets: 2000 Destination port number in the packets that the switch sends to the Portal server: 50200 Portal authentication shared key: YsHsjx_202206
Agile Controller-Campus	Host name: access.example.com	Users can use the domain name to access the Portal server.
	Device IP address: 172.16.1.254	-
	Authentication port: 1812	-
	Accounting port: 1813	-
	RADIUS shared key: YsHsjx_202206	The RADIUS shared key must be the same as that configured on the switch.
	Port number that the Portal server uses to receive packets: 50200	-
	Portal shared key: YsHsjx_202206	It must be the same as the Portal authentication shared key configured on the switch.
	Department: R&D User: A Account: A-123 Password: YsHsjx_202207 Department: Marketing User: B Account: B-123 Password: YsHsjx_202207	Two departments and two corresponding accounts have been created on the Agile Controller-Campus: R&D department and an R&D employee account A-123; Marketing department and a marketing employee account B-123.
Pre-authentication domain	Agile Controller-Campus (including RADIUS server and Portal server), DNS server, and web server	-
Post-authentication domain	R&D employees: code library, issue tracking system, and Internet Marketing employees: Internet	-

Procedure

Configure the access switch to ensure network connectivity.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan 101
[SwitchA-vlan101] quit
[SwitchA] interface gigabitethernet 0/0/1    //Interface connected to the R&D department
[SwitchA-GigabitEthernet0/0/1] port link-type access
[SwitchA-GigabitEthernet0/0/1] port default vlan 101
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2    //Interface connected to the aggregation switch
[SwitchA-GigabitEthernet0/0/2] port link-type trunk
[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 101
[SwitchA-GigabitEthernet0/0/2] quit

Configure the aggregation switch.

Create VLANs and configure the VLANs allowed by interfaces so that packets can be forwarded.

<HUAWEI> system-view
[HUAWEI] sysname SwitchC
[SwitchC] dhcp enable    //Enable the DHCP service.
[SwitchC] vlan batch 101 to 103
[SwitchC] interface gigabitethernet 1/0/1    //Interface of the access switch connected to the R&D department
[SwitchC-GigabitEthernet1/0/1] port link-type trunk
[SwitchC-GigabitEthernet1/0/1] port trunk allow-pass vlan 101
[SwitchC-GigabitEthernet1/0/1] quit
[SwitchC] interface vlanif 101
[SwitchC-Vlanif101] ip address 192.168.0.1 255.255.255.0    //IP address segment assigned to R&D employees
[SwitchC-Vlanif101] dhcp select interface
[SwitchC-Vlanif101] dhcp server dns-list 172.16.1.2
[SwitchC-Vlanif101] quit
[SwitchC] interface gigabitethernet 1/0/2    //Interface of the access switch connected to the marketing department
[SwitchC-GigabitEthernet1/0/2] port link-type trunk
[SwitchC-GigabitEthernet1/0/2] port trunk allow-pass vlan 102
[SwitchC-GigabitEthernet1/0/2] quit
[SwitchC] interface vlanif 102
[SwitchC-Vlanif102] ip address 192.168.1.1 255.255.255.0    //IP address segment assigned to marketing employees.
[SwitchC-Vlanif102] dhcp select interface
[SwitchC-Vlanif102] dhcp server dns-list 172.16.1.2
[SwitchC-Vlanif102] quit
[SwitchC] interface gigabitethernet 1/0/3    //Interface connected to the server area
[SwitchC-GigabitEthernet1/0/3] port link-type access
[SwitchC-GigabitEthernet1/0/3] port default vlan 103
[SwitchC-GigabitEthernet1/0/3] quit
[SwitchC] interface vlanif 103
[SwitchC-Vlanif103] ip address 172.16.1.254 255.255.255.0    //Configure the gateway address for the server area.
[SwitchC-Vlanif103] quit

Configure network access rights for users after successful authentication.

[SwitchC] acl 3001    //Configure the post-authentication domain for R&D employees.
[SwitchC-acl-adv-3001] rule 1 permit ip    //Allow R&D employees to access all resources.
[SwitchC-acl-adv-3001] quit
[SwitchC] acl 3002    //Configure the post-authentication domain for marketing employees.
[SwitchC-acl-adv-3002] rule 1 deny ip destination 172.16.1.4 0    //Prevent marketing employees from accessing the code library.
[SwitchC-acl-adv-3002] rule 2 deny ip destination 172.16.1.5 0    //Prevent marketing employees from accessing the issue tracking system.
[SwitchC-acl-adv-3002] rule 3 permit ip    //Allow marketing employees to access other resources.
[SwitchC-acl-adv-3002] quit

Configure parameters for connecting to the RADIUS server.

[SwitchC] radius-server template policy    //Create the RADIUS server template policy.
[SwitchC-radius-policy] radius-server authentication 172.16.1.1 1812 source ip-address 172.16.1.254    //Configure the IP address and port number of the RADIUS authentication server.
[SwitchC-radius-policy] radius-server accounting 172.16.1.1 1813 source ip-address 172.16.1.254    //Configure the IP address and port number of the RADIUS accounting server.
[SwitchC-radius-policy] radius-server shared-key cipher YsHsjx_202206    //Set the authentication key and accounting key to YsHsjx_202206.
[SwitchC-radius-policy] quit
[SwitchC] aaa    //Enter the AAA view.
[SwitchC-aaa] authentication-scheme auth    //Configure the authentication scheme auth.
[SwitchC-aaa-authen-auth] authentication-mode radius    //Set the authentication mode to RADIUS.
[SwitchC-aaa-authen-auth] quit
[SwitchC-aaa] accounting-scheme acco    //Configure the accounting scheme acco.
[SwitchC-aaa-accounting-acco] accounting-mode radius    //Set the accounting mode to RADIUS.
[SwitchC-aaa-accounting-acco] accounting realtime 15    //Set the real-time accounting interval to 15 minutes.
[SwitchC-aaa-accounting-acco] quit
[SwitchC-aaa] domain portal    //Configure a domain.
[SwitchC-aaa-domain-portal] authentication-scheme auth    //Bind the authentication scheme auth to the domain.
[SwitchC-aaa-domain-portal] accounting-scheme acco    //Bind the accounting scheme acco to the domain.
[SwitchC-aaa-domain-portal] radius-server policy    //Bind the RADIUS server template policy to the domain.
[SwitchC-aaa-domain-portal] quit
[SwitchC-aaa] quit
[SwitchC] domain portal  //Configure portal as the global default domain.

Configure parameters for connecting to the Portal server.

[SwitchC] web-auth-server portal_huawei //Configure the Portal server template portal_huawei.In V200R020C10SPC100 and later versions, you must also run the web-auth-server server-source or server-source command to configure the local gateway address used to receive and respond to the packets sent by the Portal server, so as to implement Portal authenticatio
[SwitchC-web-auth-server-portal_huawei] server-ip 172.16.1.1 //Set the Portal server IP address.
[SwitchC-web-auth-server-portal_huawei] source-ip 172.16.1.254 //Set the IP address that the switch uses to communicate with the Portal server.
[SwitchC-web-auth-server-portal_huawei] port 50200 //Set the destination port number in the packets that the switch sends to the Portal server to 50200, which is the same as the port number that the Portal server uses to receive packets. The default destination port number on the switch is 50100, and you must change it to 50200 manually, so that it matches the port number on the Portal server.
[SwitchC-web-auth-server-portal_huawei] shared-key cipher YsHsjx_202206 //Configure the shared key for communication with the Portal server, which must be the same as that configured on the Portal server.
[SwitchC-web-auth-server-portal_huawei] url http://access.example.com:8080/portal //Configure the URL for the Portal authentication page, in which access.example.com indicates the host name of the Portal server. The domain name is recommended in the URL so that the Portal authentication page can be pushed to users faster and more securely. To use the domain name in the URL, you must configure the mapping between this domain name access.example.com and Portal server IP address on the DNS server in advance.
[SwitchC-web-auth-server-portal_huawei] quit
[SwitchC] web-auth-server listening-port 2000 //Configure the port number that the switch uses to process Portal protocol packets. The default port number is 2000. If the port number is changed on the server, change it accordingly on the switch.
[SwitchC] portal quiet-period //Enable the quiet function for Portal authentication users. If the number of times that a Portal authentication user fails to be authenticated within 60 seconds exceeds the specified value, the device discards the user's Portal authentication request packets for a period to prevent impact of frequent authentication failures on the system.
[SwitchC] portal quiet-times 5 //Configure the maximum number of authentication failures within 60 seconds before the device quiets a Portal authentication user.
[SwitchC] portal timer quiet-period 240 //Set the quiet period to 240 seconds.

Enable Portal authentication and configure network access rights for users in the pre-authentication domain and post-authentication domain.

# Set the NAC mode to unified.

[SwitchC] authentication unified-mode    //Set the NAC mode to unified. By default, the switch works in unified mode. After changing the NAC mode from common to unified, save the configuration and restart the switch to make the configuration take effect.

# Configure a Portal access profile.

[SwitchC] portal-access-profile name web1
[SwitchC-portal-acces-profile-web1] web-auth-server portal_huawei direct
[SwitchC-portal-acces-profile-web1] quit

# Configure an authentication-free rule profile and specify resources that users can access without authentication.

[SwitchC] free-rule-template name default_free_rule
[SwitchC-free-rule-default_free_rule] free-rule 1 destination ip 172.16.1.2 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the DNS server before the authentication.
[SwitchC-free-rule-default_free_rule] free-rule 2 destination ip 172.16.1.3 mask 255.255.255.255    //Configure authentication-free rules for Portal authentication users, so that these users can access the web server before the authentication.
[SwitchC-free-rule-default_free_rule] quit

# Configure an authentication profile.

[SwitchC] authentication-profile name p1
[SwitchC-authen-profile-p1] portal-access-profile web1    ///Bind the Portal access profile web1.
[SwitchC-authen-profile-p1] quit

# Enable Portal authentication.

[SwitchC] interface vlanif 101
[SwitchC-Vlanif101] authentication-profile p1   //Enable Portal authentication on the interface connecting to the R&D department.
[SwitchC-Vlanif101] quit
[SwitchC] interface vlanif 102
[SwitchC-Vlanif102] authentication-profile p1   //Enable Portal authentication on the interface connecting to the marketing department.
[SwitchC-Vlanif102] quit

# (Recommended) Configure the source IP address and source MAC address for offline detection packets in a specified VLAN. You are advised to set the user gateway IP address and its corresponding MAC address as the source IP address and source MAC address of offline detection packets. This function does not take effect for users who use Layer 3 Portal authentication.

[SwitchC] access-user arp-detect vlan 101 ip-address 192.168.0.1 mac-address 00e0-fc12-3456
[SwitchC] access-user arp-detect vlan 102 ip-address 192.168.1.1 mac-address 00e0-fc12-3456

Configure the Agile Controller-Campus.

Open the Internet Explorer, enter the Agile Controller-Campus address in the address box, and press Enter.

The following table provides two types of Agile Controller-Campus addresses.

Address Format	Description
https://Agile Controller-Campus-IP:8443	In the address, Agile Controller-Campus-IP indicates the Agile Controller-Campus IP address.
Agile Controller-Campus IP address	If port 80 is enabled during installation, you can access the Agile Controller-Campus by simply entering its IP address without the port number. The Agile Controller-Campus address will automatically change to https://Agile Controller-Campus-IP:8443.

Enter the administrator account and password.

Create departments and accounts. The following describes how to create the R&D department. Create the Marketing department similarly.
1. Choose Resource > User > User Management.
2. Click the Department tab in the operation area on the right. Then click Add under the Department tab, and add the department R&D.
3. Click the User tab in the operation area on the right. Then click Add under the User tab, and add the user A.
4. Click in the Operation column on the right of user A. The Account Management page is displayed. Click Add, and create a common account A-123 with the password YsHsjx_202207.
5. On the User tab page, select user A and click Transfer to add user A to the R&D department.

Add a switch to the Agile Controller-Campus and configure related parameters to ensure normal communication between the Agile Controller-Campus and switch.

Choose Resource > Device > Device Management.
Click Add.

Configure parameters for the switch.

Parameter	Value	Description
Name	SW	-
IP Address	172.16.1.254	The interface must be able to communicate with the SC.
Device series	Huawei Quidway Series	-
Authentication Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS authentication server configured on the switch.
Charging Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS accounting server configured on the switch.
Real-time charging interval (minute)	15	It must be the same as the real-time accounting interval configured on the switch.
Port	2000	This is the port that the switch uses to communicate with the Portal server. Retain the default value.
Portal Key	YsHsjx_202206	It must be the same as the Portal shared key configured on the switch.
Allowed IP Addresses	192.168.0.1/24; 192.168.1.1/24	-

Click OK.

Parameter	Value	Description
Name	R&D employee post-authentication domain	-
Service Type	Access Service	-
ACL Number/AAA User Group	3001	The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule, and specify the authorization conditions for R&D employees.
Parameter

Value

Description

Name

R&D employee authorization rule

-

Service Type

Access User

-

Department

R&D

-

Authorization Result

R&D employee post-authentication domain

-

Verify the configuration.
- Employees can access only the Agile Controller-Campus, DNS, and web servers before authentication.
- The Portal authentication page is pushed to an employee when the employee attempts to visit an Internet website. After the employee enters the correct account and password, the requested web page is displayed.
- R&D employee A can access the Internet, code library, and issue tracking system after authentication. Marketing employee B can access the Internet but not the code library and issue tracking system after authentication.
- After an employee is authenticated, run the display access-user command on the switch. The command output shows that the employee is online.

Parameter	Value	Description
Name	R&D employee authorization rule	-
Service Type	Access User	-
Department	R&D	-
Authorization Result	R&D employee post-authentication domain	-

Configuration Files

# Configuration file of the access switch for the R&D department

#
sysname SwitchA
#
vlan batch 101
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 101
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 101
#
return

# Configuration file of the access switch for the marketing department

#
sysname SwitchB
#
vlan batch 102
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 102
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 102
#
return

# Configuration file of the aggregation switch

#
sysname SwitchC
#
vlan batch 101 to 103
#
authentication-profile name p1
 portal-access-profile web1
#
domain portal
#
access-user arp-detect vlan 101 ip-address 192.168.0.1 mac-address 00e0-fc12-3456
access-user arp-detect vlan 102 ip-address 192.168.1.1 mac-address 00e0-fc12-3456
#
dhcp enable
#
radius-server template policy
 radius-server shared-key cipher %#%#lJIB8CQ<:A;x$h2V5+;+C>HwC+@XAL)ldpQI}:$X%#%#
 radius-server authentication 172.16.1.1 1812 source ip-address 172.16.1.254 weight 80
 radius-server accounting 172.16.1.1 1813 source ip-address 172.16.1.254 weight 80
#
acl number 3001
 rule 1 permit ip
acl number 3002
 rule 1 deny ip destination 172.16.1.4 0
 rule 2 deny ip destination 172.16.1.5 0
 rule 3 permit ip
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.2 mask 255.255.255.255
 free-rule 2 destination ip 172.16.1.3 mask 255.255.255.255
# 
web-auth-server portal_huawei
 server-ip 172.16.1.1
 port 50200
 shared-key cipher %#%#q9a^<=Ct5'=0n40/1g}/m6Mo,U9u5!s(GYM}Z{<~%#%#
 url http://access.***.com:8080/portal
 source-ip 172.16.1.254
#
portal-access-profile name web1 
 web-auth-server portal_huawei direct 
#
aaa
 authentication-scheme auth
  authentication-mode radius
 accounting-scheme acco
  accounting-mode radius
  accounting realtime 15
 domain portal
  authentication-scheme auth
  accounting-scheme acco
  radius-server policy
#
interface Vlanif101
 ip address 192.168.0.1 255.255.255.0
 authentication-profile p1 
 dhcp select interface
 dhcp server dns-list 172.16.1.2
#
interface Vlanif102
 ip address 192.168.1.1 255.255.255.0
 authentication-profile p1 
 dhcp select interface
 dhcp server dns-list 172.16.1.2
#
interface Vlanif103
 ip address 172.16.1.254 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk
 port trunk allow-pass vlan 101
#
interface GigabitEthernet1/0/2
 port link-type trunk
 port trunk allow-pass vlan 102
#
interface GigabitEthernet1/0/3
 port link-type access
 port default vlan 103
#
portal quiet-period
portal timer quiet-period 240
portal quiet-times 5
#
return

Configuring 802.1X and MAC Address Authentication for Access Users on Huawei Agile Controller-Campus

This section includes the following content:

Overview
Networking Requirements
Configuration Logic
Configuration Notes
Data Plan
Procedure
Configuration Files

Overview

On a NAC network, the 802.1X, MAC address, and Portal authentication modes are configured on the user access interfaces of a device to meet various authentication requirements. Users can access the network using any authentication mode.

If multiple authentication modes are enabled, the authentication modes take effect in the sequence they are configured. In addition, after multiple authentication modes are deployed, users can be authenticated in different modes by default and assigned different network rights accordingly by the device.

Networking Requirements

Enterprises have high requirements on network security. To prevent unauthorized access and protect information security, an enterprise requests users to pass identity authentication and security check before they access the enterprise network. Only authorized users are allowed to access the enterprise network.

In addition, dumb terminals, such as IP phones and printers, can access the enterprise network only after passing authentication.

The enterprise network has the following characteristics:

The access switches on the network do not support 802.1X authentication.
The enterprise network has a small size and does not have branch networks.
The enterprise has no more than 1000 employees. A maximum of 2000 users, including guests, access the network every day.
Dumb terminals, such as IP phones and printers, are connected to the enterprise network.

To reduce network reconstruction investment, you are advised to configure the 802.1X authentication function on the aggregation switch and connect a single centralized authentication server to the aggregation switch in bypass mode. MAC address authentication needs to be configured for dumb terminals.

Figure 3-209 Wired access networking diagram

Configuration Logic

Figure 3-210 Configuration logic of Huawei switch

Table 3-106 Configuration logic of Huawei Agile Controller-Campus

Item	Description
Creating a department and an account	-
Adding switches	Set parameters for switches connected to the Agile Controller-Campus.
Adding an authentication rule	Configure the conditions for users to pass the authentication.
Adding an authorization result	Create network access right profiles so that users granted with different profiles have different network access rights.
Adding an authorization rule	Select network access right profiles and users in an authorization rule so that specified network access rights are granted to specific users.

Configuration Notes

This configuration example applies to all switches running V200R009C00 or a later version, Huawei Agile Controller-Campus in V100R001 functions as the RADIUS server. For the Agile Controller-Campus, the version required is V100R001, V100R002, V100R003.

The RADIUS authentication and accounting shared keys and Portal shared key on the switch must be the same as those on the Agile Controller-Campus server.

By default, the switch allows the packets from RADIUS server to pass. You do not need to configure authentication-free rules for the server on the switch.

When you run the access-user arp-detect command to configure the IP address and MAC address of the user gateway as the source IP address and source MAC address of user offline detection packets, ensure that the MAC address of the gateway remains unchanged, especially in active/standby switchover scenarios. If the gateway MAC address is changed, ARP entries of terminals will be incorrect on the device, and the terminals cannot communicate with the device.

Data Plan

Table 3-107 Network data plan

Item	Data
Agile Controller-Campus	IP address: 192.168.100.100
Post-authentication domain server	IP address: 192.168.102.100
Aggregation switch (SwitchA)	VLAN to which 0/0/6 connected to the server belongs: VLAN 100 VLAN to which downstream interfaces GE0/0/1 and GE0/0/2 belong: VLAN 200
Access switch (SwitchC)	User VLAN ID: 200
Access switch (SwitchD)	User VLAN ID: 200

Table 3-108 Aggregation switch service data plan

Item	Data
RADIUS scheme	Authentication server IP address: 192.168.100.100 Authentication server port number: 1812 Accounting server IP address: 192.168.100.100 Accounting server port number: 1813 Shared key for the RADIUS server: YsHsjx_202206 Accounting interval: 15 minutes Authentication domain: isp
ACL number of the post-authentication domain	3002

Table 3-109 Agile Controller-Campus service data plan

Item	Data
Department	R&D department
Access user	User name: A Wired access account: A-123 Password: YsHsjx_202207
Device group	Wired device group: Switch
Switch IP address	SwitchA: 192.168.10.10
RADIUS authentication key	YsHsjx_202206
Charging Key	YsHsjx_202206

Procedure

Configure the access switches.

Create VLANs and configure the VLANs allowed by interfaces so that packets can be forwarded. This example uses SwitchC to describe the configuration. The configuration on SwitchD is the same as that on SwitchC.

# Create VLAN 200.

<HUAWEI> system-view
[HUAWEI] sysname SwitchC
[SwitchC] vlan batch 200

# Configure the interface connected to users as an access interface and add the interface to VLAN 200.

[SwitchC] interface gigabitethernet 0/0/1
[SwitchC-GigabitEthernet0/0/1] port link-type access
[SwitchC-GigabitEthernet0/0/1] port default vlan 200 
[SwitchC-GigabitEthernet0/0/1] quit
[SwitchC] interface gigabitethernet 0/0/2
[SwitchC-GigabitEthernet0/0/2] port link-type access
[SwitchC-GigabitEthernet0/0/2] port default vlan 200
[SwitchC-GigabitEthernet0/0/2] quit

# Configure the interface connected to the upstream network as a trunk interface and configure the interface to allow VLAN 200.

[SwitchC] interface gigabitethernet 0/0/3
[SwitchC-GigabitEthernet0/0/3] port link-type trunk
[SwitchC-GigabitEthernet0/0/3] port trunk allow-pass vlan 200
[SwitchC-GigabitEthernet0/0/3] quit

Configure the device to transparently transmit 802.1X packets. This example uses SwitchC to describe the configuration. The configuration on SwitchD is the same as that on SwitchC.

In this example, SwitchC and SwitchD are deployed between the authentication switch SwitchA and users. 802.1X packet transparent transmission needs to be configured on SwitchC and SwitchD so that SwitchA can perform 802.1X authentication for users.

Method 1:

[SwitchC] l2protocol-tunnel user-defined-protocol 802.1X protocol-mac 0180-c200-0003 group-mac 0100-0000-0002
[SwitchC] interface gigabitethernet 0/0/1
[SwitchC-GigabitEthernet0/0/1] l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/1] bpdu enable
[SwitchC-GigabitEthernet0/0/1] quit
[SwitchC] interface gigabitethernet 0/0/2
[SwitchC-GigabitEthernet0/0/2] l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/2] bpdu enable
[SwitchC-GigabitEthernet0/0/2] quit
[SwitchC] interface gigabitethernet 0/0/3
[SwitchC-GigabitEthernet0/0/3] l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/3] bpdu enable
[SwitchC-GigabitEthernet0/0/3] quit

Method 2: This method is recommended when a large number of users exist or high network performance is required. Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S6720-EI, S6720-HI, S6720S-EI, S5732-H, S6730-H, S6730S-H, S6730-S, and S6730S-S support this method.

[SwitchC] undo bpdu mac-address 0180-c200-0000 ffff-ffff-fff0
[SwitchC] bpdu mac-address 0180-c200-0000 FFFF-FFFF-FFFE
[SwitchC] bpdu mac-address 0180-c200-0002 FFFF-FFFF-FFFF
[SwitchC] bpdu mac-address 0180-c200-0004 FFFF-FFFF-FFFC
[SwitchC] bpdu mac-address 0180-c200-0008 FFFF-FFFF-FFF8

This following step is mandatory when you switch from method 1 to method 2.

[SwitchC] interface gigabitethernet 0/0/1
[SwitchC-GigabitEthernet0/0/1] undo l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/1] quit
[SwitchC] interface gigabitethernet 0/0/2
[SwitchC-GigabitEthernet0/0/2] undo l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/2] quit
[SwitchC] interface gigabitethernet 0/0/3
[SwitchC-GigabitEthernet0/0/3] undo l2protocol-tunnel user-defined-protocol 802.1X enable
[SwitchC-GigabitEthernet0/0/3] quit

Configure the aggregation switch.

Create VLANs and configure the VLANs allowed by interfaces so that packets can be forwarded.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 100 200
[SwitchA] interface gigabitethernet 0/0/1    //Configure the interface connected to SwitchC.
[SwitchA-GigabitEthernet0/0/1] port link-type trunk
[SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 200
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2    //Configure the interface connected to SwitchD.
[SwitchA-GigabitEthernet0/0/2] port link-type trunk
[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 200
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/6    //Configure the interface connected to the server.
[SwitchA-GigabitEthernet0/0/6] port link-type trunk
[SwitchA-GigabitEthernet0/0/6] port trunk allow-pass vlan 100
[SwitchA-GigabitEthernet0/0/6] quit
[SwitchA] interface vlanif 100
[SwitchA-Vlanif100] ip address 192.168.10.10 24    //Configure the management IP address for SwitchA. This IP address is used when SwitchA is added to Agile Controller-Campus.
[SwitchA-Vlanif100] quit
[SwitchA] interface vlanif 200
[SwitchA-Vlanif200] ip address 192.168.200.1 24    //Configure the gateway address for terminal users.
[SwitchA-Vlanif200] quit
[SwitchA] ip route-static 192.168.100.0 255.255.255.0 192.168.100.100    //Configure a route to the network segment where the pre-authentication domain resides.
[SwitchA] ip route-static 192.168.102.0 255.255.255.0 192.168.102.100    //Configure a route to the network segment where the post-authentication domain resides.

Configure network access rights for users after successful authentication.

[SwitchA] acl 3002
[SwitchA-acl-adv-3002] rule 1 permit ip destination 192.168.102.100 0
[SwitchA-acl-adv-3002] rule 2 deny ip destination any
[SwitchA-acl-adv-3002] quit

Create and configure a RADIUS server template, an AAA authentication scheme, and an authentication domain.

# Create and configure the RADIUS server template rd1.

[SwitchA] radius-server template rd1
[SwitchA-radius-rd1] radius-server authentication 192.168.100.100 1812
[SwitchA-radius-rd1] radius-server accounting 192.168.100.100 1813
[SwitchA-radius-rd1] radius-server shared-key cipher YsHsjx_202206
[SwitchA-radius-rd1] quit

# Create an AAA authentication scheme abc and set the authentication mode to RADIUS.

[SwitchA] aaa
[SwitchA-aaa] authentication-scheme abc
[SwitchA-aaa-authen-abc] authentication-mode radius
[SwitchA-aaa-authen-abc] quit

# Configure an accounting scheme acco1. Set the accounting mode to RADIUS so that the RADIUS server can maintain account status, such as login, log-off and forced log-off.

[SwitchA-aaa] accounting-scheme acco1
[SwitchA-aaa-accounting-acco1] accounting-mode radius
[SwitchA-aaa-accounting-acco1] accounting realtime 15    //Set the real-time accounting interval to 15 minutes.
[SwitchA-aaa-accounting-acco1] quit

# Create an authentication domain isp, and bind the AAA authentication scheme abc, accounting scheme acco1, and RADIUS server template rd1 to the domain.

[SwitchA-aaa] domain isp
[SwitchA-aaa-domain-isp] authentication-scheme abc
[SwitchA-aaa-domain-isp] accounting-scheme acco1
[SwitchA-aaa-domain-isp] radius-server rd1
[SwitchA-aaa-domain-isp] quit
[SwitchA-aaa] quit

# Configure the global default domain isp. During access authentication, enter a user name in the format user@isp to perform AAA authentication in the domain isp. If the user name does not contain a domain name or contains an invalid domain name, the user is authenticated in the default domain.

[SwitchA] domain isp

Enable 802.1X and MAC address authentication.

# Set the NAC mode to unified.

[SwitchA] authentication unified-mode

By default, the unified mode is enabled. After the NAC mode is changed, the device automatically restarts.

# Configure an 802.1X access profile.

By default, an 802.1X access profile uses the EAP authentication mode. Ensure that the RADIUS server supports EAP; otherwise, the server cannot process 802.1X authentication request packets.

[SwitchA] dot1x-access-profile name d1
[SwitchA-dot1x-access-profile-d1] dot1x authentication-method eap
[SwitchA-dot1x-access-profile-d1] dot1x timer client-timeout 30
[SwitchA-dot1x-access-profile-d1] quit

# Configure a MAC access profile.

[SwitchA] mac-access-profile name m1
[SwitchA-mac-access-profile-m1] mac-authen username fixed A-123 password cipher Huawei123    //Set the user name mode for MAC address authentication to fixed user name. Set the user name to A-123 and password to Huawei123.
[SwitchA-mac-access-profile-m1] quit

# Configure an authentication profile.

[SwitchA] authentication-profile name p1
[SwitchA-authen-profile-p1] mac-access-profile m1    //Bind the MAC access profile m1.
[SwitchA-authen-profile-p1] dot1x-access-profile d1    //Bind the 802.1X access profile d1.
[SwitchA-authen-profile-p1] quit

# Enable 802.1X authentication and MAC address authentication on GE0/0/1 and GE0/0/2.

[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-Gigabitethernet0/0/1] authentication-profile p1    //Bind the authentication profile p1 and enable 802.1X + MAC address combined authentication.
[SwitchA-Gigabitethernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-Gigabitethernet0/0/2] authentication-profile p1    //Bind the authentication profile p1 and enable 802.1X + MAC address combined authentication.
[SwitchA-Gigabitethernet0/0/2] quit

[SwitchA] access-user arp-detect vlan 200 ip-address 192.168.200.1 mac-address 00e0-fc12-3456

Configure the Agile Controller-Campus.

Open the Internet Explorer, enter the Agile Controller-Campus address in the address box, and press Enter.

The following table provides two types of Agile Controller-Campus addresses.

Address Format	Description
https://Agile Controller-Campus-IP:8443	In the address, Agile Controller-Campus-IP indicates the Agile Controller-Campus IP address.
Agile Controller-Campus IP address	If port 80 is enabled during installation, you can access the Agile Controller-Campus by simply entering its IP address without the port number. The Agile Controller-Campus address will automatically change to https://Agile Controller-Campus-IP:8443.

Enter the administrator account and password.

Create a department and an account.
1. Choose Resource > User > User Management.
2. Click the Department tab in the operation area on the right. Then click Add under the Department tab, and add the department R&D.
3. Click the User tab in the operation area on the right. Then click Add under the User tab, and add the user A.
4. Click in the Operation column on the right of user A. The Account Management page is displayed. Click Add, and create a common account A-123 with the password YsHsjx_202207.
5. On the User tab page, select user A and click Transfer to add user A to the R&D department.

Add switches to the Agile Controller-Campus so that the switches can communicate with the Agile Controller-Campus.

Choose Resource > Device > Device Management.
Click Permission Control Device Group in the navigation tree, and click and Add SubGroup to create a device group Switch.
Click the device group in the navigation tree and select ALL Device. Click Add to add network access devices.

Set connection parameters on the Add Device page.

Parameter	Value	Description
Name	SwitchA	-
IP Address	192.168.10.10	The interface on the switch must communicate with the Agile Controller-Campus.
Device Series	Huawei Quidway series switch	-
Authentication Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS authentication server configured on the switch.
Charging Key	YsHsjx_202206	It must be the same as the shared key of the RADIUS accounting server configured on the switch.
Real-time charging interval (minute)	15	It must be the same as the real-time accounting interval configured on the switch.

Click Permission Control Device Group in the navigation tree, select SwitchC, and click Move to move SwitchA to the Switch group. The configuration on SwitchD is the same as that on SwitchC.

Add an authentication rule.

Choose Policy > Permission Control > Authentication and Authorization > Authentication Rule and click Add to create an authentication rule.

Configure basic information for the authentication rule.

Parameter	Value	Description
Name	Access authentication rule	-
Service Type	Access service	-
Authentication Condition	Device group Switch	Customize authentication rules based on the requirements of your network.
Please select the allowed authentication protocol	PAP CHAP EAP-MD5 EAP-PEAP-MSCHAPv2 EAP-TLS EAP-PEAP-GTC EAP-TTLS-PAP	-

Add an authorization result.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Result and click Add to create an authorization result.

Configure basic information for the authorization result.

Parameter	Value	Description
Name	Post-authentication domain	-
Service Type	Access service	-
ACL Number/AAA User Group	3002	The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

Add an authorization rule.

After a user passes the authentication, authorization phase starts. The Agile Controller-Campus grants the user access rights based on the authorization rule.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule and click Add to create an authorization rule.

Configure basic information for the authorization rule.

Parameter	Value	Description
Name	Authorization rule for R&D employees	-
Service Type	Access service	-
Access Device Group	Switch	-
Authorization Result	Post-authentication domain	-

Verify the configuration.
- An employee can only access the Agile Controller-Campus server before passing the authentication.
- After passing the authentication, the employee can access resources in the post-authentication domain.
- After the employee passes the authentication, run the display access-user command on the switch. The command output shows information about the online employee.

Configuration Files

SwitchA configuration file

#
sysname SwitchA
#
vlan batch 100 200
#
authentication-profile name p1
 dot1x-access-profile d1
 mac-access-profile m1
#
domain isp
#
access-user arp-detect vlan 200 ip-address 192.168.200.1 mac-address 00e0-fc12-3456
#
radius-server template rd1
 radius-server shared-key cipher %#%#FP@&C(&{$F2HTlPxg^NLS~KqA/\^3Fex;T@Q9A](%#%#
 radius-server authentication 192.168.100.100 1812 weight 80
 radius-server accounting 192.168.100.100 1813 weight 80
#
dot1x-access-profile name d1
#
mac-access-profile name m1
 mac-authen username fixed A-123 password cipher %#%#'Fxw8E,G-81(A3U<^HH9Sj\:&hTdd>R>HILQYLtW%#%#
#
acl number 3002
 rule 1 permit ip destination 192.168.102.100 0
 rule 2 deny ip
#
aaa
 authentication-scheme abc
  authentication-mode radius
 accounting-scheme acco1
  accounting-mode radius
  accounting realtime 15
 domain isp
  authentication-scheme abc
  accounting-scheme acco1
  radius-server rd1
#
interface Vlanif100
 ip address 192.168.10.10 255.255.255.0
#
interface Vlanif200
 ip address 192.168.200.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 200
 authentication-profile p1
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 200
 authentication-profile p1
#
interface GigabitEthernet0/0/6
 port link-type trunk
 port trunk allow-pass vlan 100
#
ip route-static 192.168.100.0 255.255.255.0 192.168.10.10
ip route-static 192.168.102.0 255.255.255.0 192.168.10.10
#
return

SwitchC configuration file

#
sysname SwitchC
#
vlan batch 200
#
l2protocol-tunnel user-defined-protocol 802.1x protocol-mac 0180-c200-0003 group-mac 0100-0000-0002
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 200
 l2protocol-tunnel user-defined-protocol 802.1x enable
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 200
 l2protocol-tunnel user-defined-protocol 802.1x enable
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 200
 l2protocol-tunnel user-defined-protocol 802.1x enable
#
return

Delivering VLANs or ACLs to Successfully Authenticated Users on Huawei Agile Controller-Campus

This section includes the following content:

Overview
Networking Requirements
Configuration Logic
Configuration Notes
Data Plan
Procedure
Configuration File

Overview

After an 802.1X user is successfully authenticated on a RADIUS server, the server sends authorization information to the access device of the user. When the Agile Controller-Campus functions as the RADIUS server, it can deliver multiple authorization parameters.

ACL-based authorization is classified into:
- ACL description-based authorization: If ACL description-based authorization is configured on the server, authorization information includes the ACL description. The device matches ACL rules based on the ACL description authorized by the server to control user rights. The ACL number, corresponding description, and ACL rule must be configured on the device.
  
  The standard RADIUS attribute (011) Filter-Id is used.
- Dynamic ACL-based authorization: The server authorizes rules in an ACL to the device. Users can access network resources controlled using this ACL. The ACL and ACL rules must be configured on the server. The ACL does not need to be configured on the device.
  
  The Huawei proprietary RADIUS attribute (26-82) HW-Data-Filter is used.
Dynamic VLAN: If dynamic VLAN delivery is configured on the server, authorization information includes the delivered VLAN attribute. After the device receives the delivered VLAN attribute, it changes the VLAN of the user to the delivered VLAN.

The delivered VLAN does not change or affect the interface configuration. The delivered VLAN, however, takes precedence over the VLAN configured on the interface. That is, the delivered VLAN takes effect after the authentication succeeds, and the configured VLAN takes effect after the user goes offline.
The following standard RADIUS attributes are used for dynamic VLAN delivery:
- (064) Tunnel-Type (It must be set to VLAN or 13.)
- (065) Tunnel-Medium-Type (It must be set to 802 or 6.)
- (081) Tunnel-Private-Group-ID (For devices running versions earlier than V200R012C00, it can be the VLAN ID or VLAN description. For devices running V200R012C00 and later versions, it can be the VLAN ID, VLAN description, VLAN name, or VLAN pool.)
To ensure that the RADIUS server delivers VLAN information correctly, all the three RADIUS attributes must be used. In addition, the Tunnel-Type and Tunnel-Medium-Type attributes must be set to the specified values.

The following uses ACL number and dynamic VLAN delivery as an example. The configuration differences between ACL number delivery and dynamic ACL delivery are described in notes.

Networking Requirements

As shown in Figure 3-211, a large number of employees' terminals in a company connect to the intranet through GE0/0/1 on SwitchA. To ensure network security, the administrator needs to control network access rights of terminals. The requirements are as follows:

Before passing authentication, terminals can access the public server (with IP address 192.168.40.1), and download the 802.1X client or update the antivirus database.
After passing authentication, terminals can access the service server (with IP address 192.168.50.1) and devices in the laboratory (with VLAN ID 20 and IP address segment 192.168.20.10-192.168.20.100).

Figure 3-211 Wired access networking diagram

Configuration Logic

Figure 3-212 Configuration logic of Huawei switch

Table 3-110 Configuration logic of Huawei Agile Controller-Campus

Item	Description
Creating a department and an account	-
Adding switches	Set parameters for switches connected to the Agile Controller-Campus.
(Optional) adding an authentication rule	Configure the conditions for users to pass the authentication. If no authentication rule is created, the default authentication rule (that allows all users to pass the authentication) of the Agile Controller-Campus is used.
Adding an authorization result	Create network access right profiles so that users granted with different profiles have different network access rights.
Adding an authorization rule	Select network access right profiles and users in an authorization rule so that specified network access rights are granted to specific users.

Configuration Notes

When the device supports UCL groups, using UCL groups to configure authorization rules is recommended. For details, see section "AAA Configuration" > "Configuring Authorization Rules" in the Configuration Guide - User Access and Authentication.

Data Plan

Table 3-111 Service data plan for the access switch

Item	Data
RADIUS scheme	Authentication server IP address: 192.168.30.1 Authentication server port number: 1812 Accounting server IP address: 192.168.30.1 Accounting server port number: 1813 Shared key for the RADIUS server: YsHsjx_202206 Accounting interval: 15 minutes Authentication domain: huawei
Resources accessible to users before authentication	Access rights to the public server are configured using an authentication-free rule. The name of the authentication-free rule profile is default_free_rule.
Resources accessible to users after authentication	Access rights to the laboratory are granted using a dynamic VLAN. The VLAN ID is 20. Access rights to the service server are granted using an ACL number. The ACL number is 3002.

Item

Data

RADIUS scheme

Authentication server IP address: 192.168.30.1
Authentication server port number: 1812
Accounting server IP address: 192.168.30.1
Accounting server port number: 1813
Shared key for the RADIUS server: YsHsjx_202206
Accounting interval: 15 minutes
Authentication domain: huawei

Resources accessible to users before authentication

Access rights to the public server are configured using an authentication-free rule. The name of the authentication-free rule profile is default_free_rule.

Resources accessible to users after authentication

Access rights to the laboratory are granted using a dynamic VLAN. The VLAN ID is 20.

Access rights to the service server are granted using an ACL number. The ACL number is 3002.

Table 3-112 Service data plan for the Agile Controller-Campus

Item	Data
Department	R&D department
Access user	User name: A Wired access account: A-123 Password: YsHsjx_202207
Switch IP address	SwitchA: 10.10.10.1
RADIUS authentication key	YsHsjx_202206
RADIUS accounting key	YsHsjx_202206

Procedure

Configure access switch SwitchA.

Create VLANs and configure the allowed VLANs on interfaces to ensure network connectivity.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 10 20
[SwitchA] interface gigabitethernet 0/0/1    //Configure the interface connecting to employees' terminals.
[SwitchA-GigabitEthernet0/0/1] port link-type hybrid
[SwitchA-GigabitEthernet0/0/1] port hybrid pvid vlan 10
[SwitchA-GigabitEthernet0/0/1] port hybrid untagged vlan 10
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2    //Configure the interface connecting to the laboratory.
[SwitchA-GigabitEthernet0/0/2] port link-type hybrid
[SwitchA-GigabitEthernet0/0/2] port hybrid untagged vlan 20
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3    //Configure the interface connecting to SwitchB.
[SwitchA-GigabitEthernet0/0/3] port link-type trunk
[SwitchA-GigabitEthernet0/0/3] port trunk allow-pass vlan 10 20
[SwitchA-GigabitEthernet0/0/3] quit
[SwitchA] interface loopback 1
[SwitchA-LoopBack1] ip address 10.10.10.1 24    //Configure an IP address for communication with the Agile Controller-Campus.
[SwitchA-LoopBack1] quit
[SwitchA] interface vlanif 10
[SwitchA-Vlanif10] ip address 192.168.1.10 24
[SwitchA-Vlanif10] quit

Configure network access rights for users after successful authentication.

In dynamic ACL mode, this step does not need to be configured on the device.

[SwitchA] acl 3002
[SwitchA-acl-adv-3002] rule 1 permit ip destination 192.168.30.1 0
[SwitchA-acl-adv-3002] rule 2 permit ip destination 192.168.50.1 0
[SwitchA-acl-adv-3002] rule 3 deny ip destination any
[SwitchA-acl-adv-3002] quit

Create and configure a RADIUS server template, an AAA authentication scheme, and an authentication domain.

# Create and configure the RADIUS server template rd1.

[SwitchA] radius-server template rd1
[SwitchA-radius-rd1] radius-server authentication 192.168.30.1 1812
[SwitchA-radius-rd1] radius-server accounting 192.168.30.1 1813
[SwitchA-radius-rd1] radius-server shared-key cipher YsHsjx_202206
[SwitchA-radius-rd1] quit

# Create the AAA authentication scheme abc and set the authentication mode to RADIUS.

[SwitchA] aaa
[SwitchA-aaa] authentication-scheme abc
[SwitchA-aaa-authen-abc] authentication-mode radius
[SwitchA-aaa-authen-abc] quit

# Configure the accounting scheme acco1 and set the accounting mode to RADIUS.

[SwitchA-aaa] accounting-scheme acco1
[SwitchA-aaa-accounting-acco1] accounting-mode radius
[SwitchA-aaa-accounting-acco1] accounting realtime 15
[SwitchA-aaa-accounting-acco1] quit

# Create the authentication domain huawei, and bind the AAA authentication scheme abc, accounting scheme acco1, and RADIUS server template rd1 to the domain.

[SwitchA-aaa] domain huawei
[SwitchA-aaa-domain-huawei] authentication-scheme abc
[SwitchA-aaa-domain-huawei] accounting-scheme acco1
[SwitchA-aaa-domain-huawei] radius-server rd1
[SwitchA-aaa-domain-huawei] quit
[SwitchA-aaa] quit

Enable 802.1X authentication.
# Set the NAC mode to unified.
```
[SwitchA] authentication unified-mode
```
By default, the unified mode is enabled. Before changing the NAC mode, you must save the configuration. After the mode is changed and the device is restarted, functions of the newly configured mode take effect.
# Configure the 802.1X access profile d1.
```
[SwitchA] dot1x-access-profile name d1
[SwitchA-dot1x-access-profile-d1] dot1x timer client-timeout 30
[SwitchA-dot1x-access-profile-d1] quit
```
# Configure an authentication-free rule profile.
```
[SwitchA] free-rule-template name default_free_rule
[SwitchA-free-rule-default_free_rule] free-rule 10 destination ip 192.168.40.0 mask 24
[SwitchA-free-rule-default_free_rule] quit
```
# Configure the authentication profile p1, bind the 802.1X access profile d1 and authentication-free rule profile default_free_rule to the authentication profile, specify the domain huawei as the forcible authentication domain in the authentication profile, and set the user access mode to multi-authen.
```
[SwitchA] authentication-profile name p1
[SwitchA-authen-profile-p1] dot1x-access-profile d1
[SwitchA-authen-profile-p1] free-rule-template default_free_rule
[SwitchA-authen-profile-p1] access-domain huawei force
[SwitchA-authen-profile-p1] authentication mode multi-authen
[SwitchA-authen-profile-p1] quit
```
# Bind the authentication profile p1 to GE0/0/1 and enable 802.1X authentication on the interface.
```
[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] authentication-profile p1
[SwitchA-GigabitEthernet0/0/1] quit
```
# (Recommended) Configure the source IP address and source MAC address for offline detection packets in a specified VLAN. You are advised to set the user gateway IP address and its corresponding MAC address as the source IP address and source MAC address of offline detection packets.
```
[SwitchA] access-user arp-detect vlan 10 ip-address 192.168.1.10 mac-address 00e0-fc12-3456
```

Configure the Agile Controller-Campus.

Open the Internet Explorer, enter the Agile Controller-Campus access address in the address bar, and press Enter.

The following table describes addresses for accessing the Agile Controller-Campus.

Access Mode	Description
https://Agile Controller-Campus-IP:8443	Agile Controller-Campus-IP specifies the IP address of the Agile Controller-Campus.
IP address of the Agile Controller-Campus	If port 80 is enabled during installation, you can access the Agile Controller-Campus by entering its IP address without the port number. The Agile Controller-Campus URL will automatically change to https://Agile Controller-Campus-IP:8443.

Enter the administrator user name and password.

Create a department and an account.
1. Choose Resource > User > User Management.
2. Click the Department tab in the operation area on the right, and then click Add under the Department tab to add a department R&D.
3. Click the User tab in the operation area on the right, and then click Add under the User tab to add a user A.
4. Click next to user A in Operation to access Account Management. Click Add. Create a common account A-123 and set the password to YsHsjx_202207.
5. In the User tab, select user A. Click Transfer to add user A to the department R&D.
Add switches to the Agile Controller-Campus so that the switches can communicate with the Agile Controller-Campus.
Choose Resource > Device > Device Management. Click Add in the operation area on the right. Set connection parameters on the Add Device page.

Add an authorization result.

Perform this step for ACL number and VLAN delivery.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and click Add to create an authorization result.

Configure basic information for the authorization result.

Parameter	Value	Description
Name	Authorization info for authenticated users	-
Service type	Access service	-
VLAN	20	The VLAN must be the same as the VLAN configured for R&D employees on the switch.
ACL number/AAA user group	3002	The ACL number must be the same as the number of the ACL configured for R&D employees on the switch.

Add an authorization result.

Perform this step for dynamic ACL and VLAN delivery.

Add a dynamic ACL.
1. Choose Policy > Permission Control > Policy Element > Dynamic ACL.
2. Click Add.
3. Configure basic information for the dynamic ACL and click Add in Rule List.
4. Configure attributes contained in the dynamic ACL.
Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and click Add to create an authorization result.

Configure basic information for the authorization result.

Parameter	Value	Description
Name	Authorization information for users who pass authentication	-
Service type	Access service	-
VLAN	20	The VLAN ID must be the same as the VLAN ID configured for R&D employees on the switch.
Dynamic ACL	3002	-

Add an authorization rule.

After a user passes authentication, authorization phase starts. The Agile Controller-Campus grants the user access rights based on the authorization rule.

Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule and click Add to create an authorization rule.

Configure basic information for the authorization rule.

Parameter	Value	Description
Name	Authorization rule for authenticated users	-
Service type	Access service	-
Department	R&D department	-
Authorization result	Authorization info for authenticated users	-

Verify the configuration.
- An employee can only access the Agile Controller-Campus server and public server before passing authentication.
- An employee can access the Agile Controller-Campus server, public server, service server, and laboratory after passing authentication.
- After the employee passes authentication, run the display access-user command on the switch. The command output shows information about the online employee.

Configuration File

#
sysname SwitchA
#
vlan batch 10 20
#
authentication-profile name p1
 dot1x-access-profile d1
 free-rule-template default_free_rule
 access-domain huawei force
#
access-user arp-detect vlan 10 ip-address 192.168.1.10 mac-address 00e0-fc12-3456
#
radius-server template rd1
 radius-server shared-key cipher %^%#FP@&C(&{$F2HTlPxg^NLS~KqA/\^3Fex;T@Q9A](%^%#
 radius-server authentication 192.168.30.1 1812 weight 80
 radius-server accounting 192.168.30.1 1813 weight 80
#
acl number 3002
 rule 1 permit ip destination 192.168.30.1 0 
 rule 2 permit ip destination 192.168.50.1 0 
 rule 3 deny ip
#
free-rule-template name default_free_rule
 free-rule 10 destination ip 192.168.40.0 mask 255.255.255.0
# 
aaa
 authentication-scheme abc
  authentication-mode radius
 accounting-scheme acco1
  accounting-mode radius
  accounting realtime 15
 domain huawei
  authentication-scheme abc
  accounting-scheme acco1
  radius-server rd1
#
interface Vlanif10
 ip address 192.168.1.10 255.255.255.0
#
interface GigabitEthernet0/0/1
 port link-type hybrid
 port hybrid pvid vlan 10 
 port hybrid untagged vlan 10
 authentication-profile p1
#
interface GigabitEthernet0/0/2
 port link-type hybrid
 port hybrid untagged vlan 20
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface LoopBack1
 ip address 10.10.10.1 255.255.255.0
#  
dot1x-access-profile name d1
#
return

Identifying Types of Terminals Accessing the Network on Huawei Agile Controller-Campus

This section includes the following content:

Context
Networking Requirements
Configuration Logic
Configuration Notes
Data Plan
Procedure
Configuration Files

Context

As an increasing number of smart terminals are used, Bring Your Own Device (BYOD), a new working style for enterprises, has become a trend. When an enterprise uses the BYOD solution, the administrator must determine the users and terminals that can connect to the enterprise network, where users can connect to the enterprise network, and access rights of different terminals. All these require terminal type identification.

Two terminal type identification methods are available:

Local identification

A switch identifies terminal types by analyzing MAC addresses, DHCP option information, and user agent (UA) information of terminals and then controls terminal access and grants access rights to terminals accordingly. The switch can also send identified terminal type information to a server, which then controls terminal access and grants access rights to terminals accordingly.
Remote identification

A switch obtains MAC addresses, DHCP option information, and UA information of terminals and sends the information to a server, which then controls terminal access and grants access rights to terminals accordingly.

Networking Requirements

In Figure 3-213, to meet service requirements, an enterprise needs to deploy an identity authentication system to implement access control on users who attempt to access the enterprise network. Only authorized users can access the enterprise network.

The enterprise has the following requirements:

The authentication operations should be simple. The authentication system only performs access authorization and does not require any client software on user terminals.
To facilitate future network reconstruction and save investment, the authentication control point must be deployed on a core switch.
A unified identity authentication mechanism is used to authenticate all terminals accessing the campus network and deny accesses from unauthorized terminals. This mechanism identifies the terminals, records information about devices accessing the network, and automatically groups the devices by the device type to facilitate tracing of accidental information disclosure.
R&D employees can only access public servers (such as the public web and DNS servers) of the company before authentication, and can access both the intranet (code base and issue tracking system) and Internet after passing authentication.
Marketing employees can only access public servers (such as the public web and DNS servers) of the company before authentication, and can only access the Internet after passing authentication.

Figure 3-213 Configuring terminal type identification through a server

Configuration Logic

Perform Portal authentication configuration. For details, see Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch).
Configure the terminal type awareness function so that the switch can identify terminal types based on the packets sent by terminals.
Enable the UA function so that the switch can obtain UA information from the packets sent by terminals.

Configuration Notes

The authentication control point in this example must be deployed on the S5720-HI, S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S6720-HI, S5732-H, S6730-H, S6730S-H, S6730-S, or S6730S-S fixed switch or X series card of modular switch running V200R009C00 or a later version.

Huawei Agile Controller-Campus in V100R001 functions as the Portal server and RADIUS server in this example. For the Agile Controller-Campus, the version required is V100R001, V100R002, V100R003.

The RADIUS authentication and accounting shared keys and Portal shared key on the switch must be the same as those on the Agile Controller-Campus server.

By default, the switch allows the packets from RADIUS and Portal servers to pass. You do not need to configure authentication-free rules for the two servers on the switch.

Data Plan

This example provides only the configuration of terminal type identification. For details about VLAN planning, network data planning, and service data planning, see Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch).

In this example, the administrator user name and password are admin and Admin_123, and the user name and password of Portal users are Jason and Admin_1234.

Procedure

Configure the core switch.
# Configure the core switch to send DHCP option and UA information to the Agile Controller-Campus, which then uses the information as original information to identify terminals.
```
<HUAWEI> system-view
[HUAWEI] sysname SwitchD
[SwitchD] dhcp enable
[SwitchD] dhcp snooping enable
[SwitchD] device-sensor dhcp option 12 55 60
[SwitchD] http parse user-agent enable
```
For wireless users, you can configure attributes for APs when the switch works as an AC. In versions earlier than V200R011C10, the configurations are not delivered to APs in real time, and are delivered to APs only after you run the commit command in the WLAN view. In V200R011C10 and later versions, the commit command is deleted, the switch delivers the configurations to APs every 5 seconds.
Configure the Agile Controller-Campus.
1. Log in to the Agile Controller-Campus client, AnyOffice Agent, enter the administrator user name and password to open the system homepage.
2. Enable the terminal type identification function.
  1. Choose Resource > Terminal > Parameter Setting.
  2. In Terminal Identification, select Enable. The system automatically identifies terminals based on the probe messages. In Manual Terminal Registration, select Enable. The system allows manual registration of terminals. Retain default values for other parameters, and then click OK.
    
    Figure 3-214 Enabling the terminal type identification function
3. Identify terminals based on the DHCP option and UA information.
  The following uses a terminal, a local account, and Portal authentication as an example (based on UA information).
  1. Open a web browser to access a web server in the post-authentication domain.
  2. Enter the user name and password requested from the administrator.
    Figure 3-215 Entering the user name and password
Check the configuration.
Check terminal type identification results.
1. Choose Resource > Terminal > Registered Device List.
2. Check whether the terminal is in the device list.
  
  If the terminal is in the device list, its terminal type has been identified.

Configuration Files

# Core switch configuration file

#
sysname SwitchD
# 
device-sensor dhcp option 12 55 60 
#
dhcp enable 
# 
dhcp snooping enable
# 
http parse user-agent enable
#
return

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch)
Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Aggregation Switch)
Configuring 802.1X and MAC Address Authentication for Access Users on Huawei Agile Controller-Campus
Delivering VLANs or ACLs to Successfully Authenticated Users on Huawei Agile Controller-Campus
Identifying Types of Terminals Accessing the Network on Huawei Agile Controller-Campus

Translation

Español 日本語 Русский 简体中文

Download

Updated: 2023-07-29

Document ID: EDOC1000069520

Downloads: 41277

Average rating:

This Document Applies to these Products

Related Version

Digital Signature File

Digital Signature Authentication Mode

Enterprise

Huawei Cloud

Carrier

Consumer

Corporate

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Core Switch)

Introduction to Portal authentication

Networking Requirements

Configuration Logic

Configuration Notes

Data Plan

Procedure

Configuration Files

Configuring Portal Authentication for Access Users on Huawei Agile Controller-Campus (Authentication Point on Aggregation Switch)

Introduction to Portal authentication

Networking Requirements

Configuration Logic

Configuration Notes

Data Plan

Procedure

Configuration Files

Configuring 802.1X and MAC Address Authentication for Access Users on Huawei Agile Controller-Campus

Overview

Networking Requirements

Configuration Logic

Configuration Notes

Data Plan

Procedure

Configuration Files

Delivering VLANs or ACLs to Successfully Authenticated Users on Huawei Agile Controller-Campus

Overview

Networking Requirements

Configuration Logic

Configuration Notes

Data Plan

Procedure

Configuration File

Identifying Types of Terminals Accessing the Network on Huawei Agile Controller-Campus

Context

Networking Requirements

Configuration Logic

Configuration Notes

Data Plan

Procedure

Configuration Files

Related Version

Related Documents

Digital Signature File