No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

S600-E V200R010C00 Configuration Guide - User Access and Authentication

This document describes the working mechanisms, configuration procedures, and configuration examples of User Access and Authentication features, such as AAA, NAC, and Policy Association.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring Policy Association

Example for Configuring Policy Association

Networking Requirements

Large campus networks have many access devices, so user access policy deployment is time consuming and the policies are difficult to modify. The customer requires that NAC authentication and user access policies be configured on the authentication gateway and the access policies be implemented on access devices to simplify device deployment at the access layer. As shown in Figure 4-4, the gateway device Switch functions as the control device and Switch_1-Switch_N are access devices. Users are authenticated on the control device and their access policies are implemented on the access devices. In this example, VLAN 10 is the user VLAN, VLAN 20 is the management VLAN of the CAPWAP tunnel, and 802.1X authentication is used as the access authentication mode.

Figure 4-4  Network diagram of configuring policy association

Configuration Roadmap

The configuration roadmap is as follows:

  1. Establish CAPWAP tunnels between the control device and access devices.
  2. Create and configure a RADIUS server template, an AAA scheme, and an authentication domain on the control device so that the RADIUS server can authenticate access users.
  3. Configure policy association on the control device and all access devices.
  4. Configure 802.1X authentication on the control device and all access devices, so that the employees' network access rights are controlled and only authenticated users can access the network.
NOTE:
  • Before configuring this example, ensure that devices can communicate with each other in the network.

  • This example only provides the configurations on the control device and access devices. The configurations on the RADIUS server are not provided here.

  • This example only provides the configurations on Switch_1. The configurations on other access devices are the same and not provided here.

Procedure

  1. Switch the NAC mode to unified mode.

    # Switch the NAC mode to unified mode on Switch_1.
    <HUAWEI> system-view
    [HUAWEI] sysname Switch_1
    [Switch_1] authentication unified-mode
    # Switch the NAC mode to unified mode on Switch.
    <HUAWEI> system-view
    [HUAWEI] sysname Switch
    [Switch] authentication unified-mode
    NOTE:

    By default, the unified mode is used. After changing the NAC mode from common to unified, you must enter y as prompted to restart the switch immediately to make the configuration take effect.

  2. Create VLANs and configure the allowed VLANs on interfaces.

    # Create VLAN 10 and VLAN 20 on Switch_1.

    [Switch_1] vlan batch 10 20
    

    # Specify GE0/0/2 connecting Switch_1 to users as an access interface and add the interface to VLAN 10.

    [Switch_1] interface gigabitethernet 0/0/2
    [Switch_1-GigabitEthernet0/0/2] port link-type access
    [Switch_1-GigabitEthernet0/0/2] port default vlan 10 
    [Switch_1-GigabitEthernet0/0/2] quit

    # On Switch_1, specify GE0/0/1 connecting to Switch as a trunk interface and configure the interface to permit packets from VLAN 10 and VLAN 20 to pass through.

    [Switch_1] interface gigabitethernet 0/0/1
    [Switch_1-GigabitEthernet0/0/1] port link-type trunk
    [Switch_1-GigabitEthernet0/0/1] port trunk allow-pass vlan 10 20
    [Switch_1-GigabitEthernet0/0/1] quit

    # Create VLAN 10, VLAN 20, and VLAN 30 on Switch.

    [Switch] vlan batch 10 20 30

    # On Switch, specify GE0/0/1 connecting to Switch_1 as a trunk interface and configure the interface to permit packets from VLAN 10 and VLAN 20 to pass through.

    [Switch] interface gigabitethernet 0/0/1
    [Switch-GigabitEthernet0/0/1] port link-type trunk
    [Switch-GigabitEthernet0/0/1] port trunk allow-pass vlan 10 20
    [Switch-GigabitEthernet0/0/1] quit

    # On Switch, specify GE0/0/2 connecting to the RADIUS server as an access interface and add the interface to VLAN 30.

    [Switch] interface gigabitethernet 0/0/2
    [Switch-GigabitEthernet0/0/2] port link-type access
    [Switch-GigabitEthernet0/0/2] port default vlan 30
    [Switch-GigabitEthernet0/0/2] quit
    [Switch] interface vlanif 30
    [Switch-Vlanif30] ip address 192.168.4.1 255.255.255.0
    [Switch-Vlanif30] quit
    

  3. On the control device, configure the interface address pool VLANIF10 to assign IP addresses to users.

    [Switch] dhcp enable
    [Switch] interface vlanif 10
    [Switch-Vlanif10] ip address 192.168.2.1 255.255.255.0
    [Switch-Vlanif10] dhcp select interface
    [Switch-Vlanif10] quit
    

  4. Establish CAPWAP tunnels between the control device and access devices.

    # Create VLANIF 20 on Switch_1, obtain the IP address of VLANIF 20 using DHCP, and specify VLANIF 20 as the access interface of the CAPWAP tunnel.

    [Switch_1] interface vlanif 20
    [Switch_1-Vlanif20] ip address dhcp-alloc
    [Switch_1-Vlanif20] quit
    [Switch_1] as access interface vlanif 20

    # Create VLANIF 20 on Switch and specify VLANIF 20 as the source interface of the interface address pool and CAPWAP tunnel.

    [Switch] interface vlanif 20
    [Switch-Vlanif20] ip address 192.168.3.1 255.255.255.0
    [Switch-Vlanif20] dhcp select interface
    [Switch-Vlanif20] dhcp server option 43 ip-address 192.168.3.1
    [Switch-Vlanif20] quit
    [Switch] capwap source interface vlanif 20
    [Switch] as-auth
    [Switch-as-auth] auth-mode none
    [Switch-as-auth] quit

  5. On Switch, create and configure a RADIUS server template, an AAA authentication scheme, and an authentication domain.

    # Create and configure a RADIUS server template rd1.

    [Switch] radius-server template rd1
    [Switch-radius-rd1] radius-server authentication 192.168.4.30 1812
    [Switch-radius-rd1] radius-server shared-key cipher Huawei@2012
    [Switch-radius-rd1] radius-server retransmit 2
    [Switch-radius-rd1] quit

    # Create an AAA authentication scheme abc and configure the authentication mode to RADIUS.

    [Switch] aaa
    [Switch-aaa] authentication-scheme abc
    [Switch-aaa-authen-abc] authentication-mode radius
    [Switch-aaa-authen-abc] quit

    # Create an authentication domain isp1, and bind the AAA scheme abc and RADIUS server template rd1 to the domain isp1.

    [Switch-aaa] domain isp1
    [Switch-aaa-domain-isp1] authentication-scheme abc
    [Switch-aaa-domain-isp1] radius-server rd1
    [Switch-aaa-domain-isp1] quit
    [Switch-aaa] quit

    # Configure the global default domain isp1.

    [Switch] domain isp1
    NOTE:

    During access authentication, enter a user name in the format user@isp1 to perform AAA authentication in the domain isp1. If the user name does not contain a domain name or contains an invalid domain name, the user is authenticated in the default domain.

  6. Configure policy association on the control device and access devices.

    # Specify GE0/0/2 on Switch_1 as the access point.

    [Switch_1] interface gigabitethernet 0/0/2
    [Switch_1-GigabitEthernet0/0/2] authentication access-point
    [Switch_1-GigabitEthernet0/0/2] quit

    # Specify GE0/0/1 on Switch as the control point.

    [Switch] interface gigabitethernet 0/0/1
    [Switch-GigabitEthernet0/0/1] authentication control-point
    [Switch-GigabitEthernet0/0/1] quit

    # Configure Switch to deliver the ACL authorization information to Switch_1, and bind the AAA service scheme asd to the authentication domain isp1.

    [Switch] aaa
    [Switch-aaa] service-scheme asd
    [Switch-aaa-service-asd] remote-authorize acl
    [Switch-aaa-service-asd] quit
    [Switch-aaa] domain isp1
    [Switch-aaa-domain-isp1] service-scheme asd
    [Switch-aaa-domain-isp1] quit
    [Switch-aaa] quit

    # Configure the ACL and rule for authorization on Switch_1.

    [Switch_1] acl 3001
    [Switch_1-acl-adv-3001] rule deny ip destination 192.168.5.0 0.0.0.255
    [Switch_1-acl-adv-3001] quit

    # Configure the ACL and rule for authorization on Switch.

    [Switch] acl 3001
    [Switch-acl-adv-3001] rule deny ip destination 192.168.6.0 0.0.0.255
    [Switch-acl-adv-3001] quit
    NOTE:

    The number of the ACL configured for authorization on Switch_1 and Switch must be the same as that the RADIUS server delivers to users.

  7. Configure 802.1X authentication on the control device and access devices.

    # Enable 802.1X authentication on GE0/0/2 of Switch_1.

    [Switch_1] dot1x-access-profile name d1
    [Switch_1-dot1x-access-profile-d1] quit
    [Switch_1] authentication-profile name p1
    [Switch_1-authen-profile-p1] dot1x-access-profile d1
    [Switch_1-authen-profile-p1] quit
    [Switch_1] interface gigabitethernet 0/0/2
    [Switch_1-GigabitEthernet0/0/2] authentication-profile p1
    [Switch_1-GigabitEthernet0/0/2] quit
    

    # Enable 802.1X authentication on GE0/0/1 of Switch and configure an authentication-free rule to allow packets from the management VLAN of the CAPWAP tunnel to pass through.

    [Switch] dot1x-access-profile name d1
    [Switch-dot1x-access-profile-d1] quit
    [Switch] free-rule-template name default_free_rule
    [Switch-free-rule-default_free_rule] free-rule 1 source vlan 20
    [Switch-free-rule-default_free_rule] quit
    [Switch] authentication-profile name p1
    [Switch-authen-profile-p1] dot1x-access-profile d1
    [Switch-authen-profile-p1] quit
    [Switch] interface gigabitethernet 0/0/1
    [Switch-GigabitEthernet0/0/1] authentication-profile p1
    [Switch-GigabitEthernet0/0/1] quit
    

  8. Verify the configuration.

    1. Run the display dot1x command on the control device and access devices to check the 802.1X authentication configuration. The command output shows that 802.1X authentication has been enabled on GE0/0/2 of Switch_1 and GE0/0/1 of Switch (802.1x protocol is Enabled). Run the display as all command on Switch to check the connection between the control device and access devices.
    2. A user starts the 802.1X client on a terminal, and enters the user name and password for authentication. If the user name and password are correct, an authentication success message is displayed on the client page. The user then can access the network.

Configuration Files

  • Switch_1 configuration file

    #
    sysname Switch_1
    #
    vlan batch 10 20
    #
    authentication-profile name p1
     dot1x-access-profile d1
    #
    as access interface vlanif 20
    #
    acl number 3001                                                                                                                     
     rule 5 deny ip destination 192.168.5.0 0.0.0.255                                                                                 
    #
    interface Vlanif20
     ip address dhcp-alloc
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk allow-pass vlan 10 20
    #
    interface GigabitEthernet0/0/2
     port link-type access
     port default vlan 10
     authentication-profile p1
     authentication access-point
    #
    dot1x-access-profile name d1                                                                                                        
    # 
    return  
  • Switch configuration file

    #
    sysname Switch
    #
    vlan batch 10 20 30
    #
    authentication-profile name p1
     dot1x-access-profile d1
    #
    domain isp1
    #
    dhcp enable
    #
    radius-server template rd1
     radius-server shared-key cipher %^%#4*SO-2u,Q.\1C~%[eiB77N/^2wME;6t%6U@qAJ9:%^%#
     radius-server authentication 192.168.4.30 1812 weight 80
     radius-server retransmit 2
    #
    acl number 3001                                                                                                                     
     rule 5 deny ip destination 192.168.6.0 0.0.0.255                                                                                   
    # 
    free-rule-template name default_free_rule                                                                                           
     free-rule 1 source vlan 20                                                                          
    # 
    aaa
     authentication-scheme abc
      authentication-mode radius
     service-scheme asd
      remote-authorize acl
     domain isp1
      authentication-scheme abc
      service-scheme asd
      radius-server rd1
    #
    interface Vlanif10
     ip address 192.168.2.1 255.255.255.0
     dhcp select interface
    #
    interface Vlanif20
     ip address 192.168.3.1 255.255.255.0
     dhcp select interface
     dhcp server option 43 ip-address 192.168.3.1
    #
    interface Vlanif30
     ip address 192.168.4.1 255.255.255.0
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk allow-pass vlan 10 20
     authentication-profile p1
     authentication control-point
    #
    interface GigabitEthernet0/0/2
     port link-type access
     port default vlan 30
    #
    capwap source interface vlanif20
    #                                                                                
    as-auth
     auth-mode none
    #                                                                                                                                   
    dot1x-access-profile name d1
    #  
    return  
Translation
Download
Updated: 2019-08-21

Document ID: EDOC1000141885

Views: 54998

Downloads: 10

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next