Example for Configuring Portal Authentication for Wireless Users in an AC Dual-Link Backup Environment

Procedure

1. [Device] Configure the access switch S2750EI to ensure network connectivity.

   <HUAWEI> system-view
   [HUAWEI] sysname S2700
   [S2700] vlan batch 100 101 102   //Create VLAN 100, VLAN 101 and VLAN 102 in a batch.
   [S2700] interface gigabitethernet 0/0/1  //Enter the view of the interface connected to the AP.
   [S2700-GigabitEthernet0/0/1] port link-type trunk  //Change the link type of gigabitethernet0/0/1 to trunk.
   [S2700-GigabitEthernet0/0/1] port trunk pvid vlan 100  //Set the default VLAN of gigabitethernet0/0/1 to VLAN 100.
   [S2700-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101 102  //Add gigabitethernet0/0/1 to VLAN 100, VLAN 101 and VLAN 102.
   [S2700-GigabitEthernet0/0/1] quit
   [S2700] interface gigabitethernet 0/0/2  //Enter the view of the interface connected to the aggregation switch.
   [S2700-GigabitEthernet0/0/2] port link-type trunk  //Change the link type of gigabitethernet0/0/2 to trunk.
   [S2700-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101 102  //Add gigabitethernet0/0/2 to VLAN 100, VLAN 101 and VLAN 102.
   [S2700-GigabitEthernet0/0/2] quit
   [S2700] interface gigabitethernet 0/0/3  //Connect to AP1's interface.
   [S2700-GigabitEthernet0/0/3] port link-type trunk  //Change the link type of gigabitethernet0/0/3 to trunk.
   [S2700-GigabitEthernet0/0/3] port trunk pvid vlan 100  //Set the default VLAN of gigabitethernet0/0/3 to VLAN 100
   [S2700-GigabitEthernet0/0/3] port trunk allow-pass vlan 100 101 102  //Add gigabitethernet0/0/3 to VLAN 100, VLAN 101 and VLAN 102.
   [S2700-GigabitEthernet0/0/3] quit
   [S2700] quit
   <S2700> save  //Save the configuration.

2. [Device] Configure the aggregation switch S5720HI to ensure network connectivity.

   <HUAWEI> system-view
   [HUAWEI] sysname S5700
   [S5700] vlan batch 100 101 102 105   //Create VLAN 100, VLAN 101, VLAN 102 and VLAN 105 in a batch.
   [S5700] interface vlanif 100  //Enter the view of VLANIF 100.
   [S5700-Vlanif100] ip address 172.18.10.3 16  //Configure an IP address for VLANIF 100 as the AP's gateway.
   [S5700-Vlanif100] dhcp select interface
   [S5700-Vlanif100] dhcp server excluded-ip-address 172.18.10.1 172.18.10.2  //Exclude IP addresses in use from the DHCP address pool.
   [S5700-Vlanif100] quit
   [S5700] interface vlanif 101  //Enter the view of VLANIF 101.
   [S5700-Vlanif101] ip address 172.19.10.1 16  //Configure an IP address for VLANIF 101 as the gateway for employees.
   [S5700-Vlanif101] dhcp select interface
   [S5700-Vlanif101] dhcp server dns-list 172.22.10.4  //Configure the DNS server address.
   [S5700-Vlanif101] quit
   [S5700] interface vlanif 102  //Enter the interface view of VLANIF 102.
   [S5700-Vlanif102] ip address 172.20.10.1 16  //Configure an IP address for VLANIF 102 to enable it to function as a guest gateway.
   [S5700-Vlanif102] dhcp select interface
   [S5700-Vlanif102] dhcp server dns-list 172.22.10.4  //Configure an IP address for the DNS server.
   [S5700-Vlanif102] quit
   [S5700] interface gigabitethernet 0/0/1  //Enter the view of the interface connected to the access switch.
   [S5700-GigabitEthernet0/0/1] port link-type trunk  //Change the link type of gigabitethernet0/0/1 to trunk.
   [S5700-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101 102  //Add gigabitethernet0/0/1 to VLAN 100, VLAN 101 and VLAN 102.
   [S5700-GigabitEthernet0/0/1] quit
   [S5700] interface gigabitethernet 0/0/2  //Enter the view of the interface connected to AC1.
   [S5700-GigabitEthernet0/0/2] port link-type trunk  //Change the link type of gigabitethernet0/0/2 to trunk.
   [S5700-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 105  //Add gigabitethernet0/0/2 to VLAN 100 and VLAN 105.
   [S5700-GigabitEthernet0/0/2] quit
   [S5700] interface gigabitethernet 0/0/3  //Enter the view of the interface connected to AC2.
   [S5700-GigabitEthernet0/0/3] port link-type trunk  //Change the link type of gigabitethernet0/0/3 to trunk.
   [S5700-GigabitEthernet0/0/3] port trunk allow-pass vlan 100 105  //Add gigabitethernet0/0/3 to VLAN 100 and VLAN 105.
   [S5700-GigabitEthernet0/0/3] quit
   [S5700] interface gigabitethernet 0/0/4  //Enter the view of the interface connected to core switch.
   [S5700-GigabitEthernet0/0/3] port link-type trunk  //Change the link type of gigabitethernet0/0/4 to trunk.
   [S5700-GigabitEthernet0/0/3] port trunk allow-pass vlan 103  //Add gigabitethernet0/0/4 to VLAN 103.
   [S5700-GigabitEthernet0/0/3] quit
   [S5700] ip route-static 172.22.10.0 255.255.255.0 172.21.10.2
   [S5700] quit
   <S5700> save  //Save the configuration.

3. [Device] Configure the core switch S7700 to ensure network connectivity.

   <HUAWEI> system-view
   [HUAWEI] sysname S7700
   [S7700] vlan batch 103 104   //Create VLANIF 103 and VLANIF 104 in batches.
   [S7700] interface gigabitethernet 1/0/1  //Connect to the interface of the aggregation switch.
   [S7700-GigabitEthernet1/0/1] port link-type trunk
   [S7700-GigabitEthernet1/0/1] port trunk allow-pass vlan 103
   [S7700-GigabitEthernet1/0/1] quit
   [S7700] interface vlanif 103
   [S7700-Vlanif103] ip address 172.21.10.2 255.255.255.0
   [S7700-Vlanif103] quit
   [S7700] interface gigabitethernet 1/0/2  //Connect to the interface of the server zone.
   [S7700-GigabitEthernet1/0/2] port link-type access
   [S7700-GigabitEthernet1/0/2] port default vlan 104  //Configure VLAN 104 as the default VLAN for the gigabitethernet1/0/2 interface.
   [S7700-GigabitEthernet1/0/2] quit
   [S7700] interface vlanif 104
   [S7700-Vlanif104] ip address 172.22.10.1 255.255.255.0  //Configure a gateway IP address for the server zone.
   [S7700-Vlanif104] quit
   [S7700] ip route-static 172.19.0.0 255.255.0.0 172.21.10.1  //Configure a static route to the employees' network segment.
   [S7700] ip route-static 172.20.0.0 255.255.0.0 172.21.10.1  //Configure a static route to the guests' network segment.
   [S7700] quit
   <S7700> save  //Save the configuration.

4. [Device] Configure the ACs to ensure network connectivity.

   # On AC1, ensure network connectivity, and add GE0/0/1 connecting to the S5720HI to VLAN 100 and VLAN 105.

   <AC6605> system-view
   [AC6605] sysname AC1
   [AC1] vlan batch 100 105
   [AC1] interface gigabitethernet 0/0/1
   [AC1-GigabitEthernet0/0/1] port link-type trunk
   [AC1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 105
   [AC1-GigabitEthernet0/0/1] quit

   # Configure an IP address for AC1 to communicate with other NEs.

   [AC1] interface vlanif 105
   [AC1-Vlanif105] ip address 10.10.11.1 24 //Configure an IP address for VLANIF 105 for communicating with AC2 and transmitting backup data.
   [AC1-Vlanif105] quit
   [AC1] interface vlanif 100
   [AC1-Vlanif100] ip address 172.18.10.1 24 //Configure an IP address for VLANIF 100 for communicating with servers and managing the AP.
   [AC1-Vlanif100] quit

   # Configure a default route for AC1 so that packets are forwarded to the routing gateway by default.

   [AC1] ip route-static 0.0.0.0 0 172.18.10.3

   # On AC2, ensure network connectivity, and add GE0/0/1 connecting to the S5720HI to VLAN 100 and VLAN 105.

   <AC6605> system-view
   [AC6605] sysname AC2
   [AC2] vlan batch 100 105
   [AC2] interface gigabitethernet 0/0/1
   [AC2-GigabitEthernet0/0/1] port link-type trunk
   [AC2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 105
   [AC2-GigabitEthernet0/0/1] quit

   # Configure an IP address for AC2 to communicate with other NEs.

   [AC2] interface vlanif 105
   [AC2-Vlanif105] ip address 10.10.11.2 24 //Configure an IP address for VLANIF 105 for communicating with AC1 and transmitting backup data.
   [AC2-Vlanif105] quit
   [AC2] interface vlanif 100
   [AC2-Vlanif100] ip address 172.18.10.2 24 //Configure an IP address for VLANIF 100 for communicating with servers and managing the AP.
   [AC2-Vlanif100] quit

   # Configure a default route for AC2 so that packets are forwarded to the routing gateway by default.

   [AC2] ip route-static 0.0.0.0 0 172.18.10.3

5. [Device] Configure the AP to go online.

   # Create an AP group to which APs with the same configuration can be added.

   [AC1] wlan
   [AC1-wlan-view] ap-group name ap_group
   [AC1-wlan-ap-group-ap_group] quit

   # Create a regulatory domain profile, configure the AC country code in the profile, and apply the profile to the AP group.

   [AC1-wlan-view] regulatory-domain-profile name domain1
   [AC1-wlan-regulatory-domain-prof-domain1] country-code cn
   [AC1-wlan-regulatory-domain-prof-domain1] quit
   [AC1-wlan-view] ap-group name ap_group
   [AC1-wlan-ap-group-ap_group] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
   e?[Y/N]:y 
   [AC1-wlan-ap-group-ap_group] quit
   [AC1-wlan-view] quit

   # Configure the AC's source interface.

   [AC1] capwap source interface vlanif 100

   # Import the AP offline on the AC and add the AP to the AP group. This example assumes that the AP type is AP6010DN-AGN, and the MAC addresses of AP_0 and AP_1 are 60de-4476-e360 and 60de-4476-e380 respectively.

   [AC1] wlan
   [AC1-wlan-view] ap auth-mode mac-auth
   [AC1-wlan-view] ap-id 0 ap-mac 60de-4476-e360
   [AC1-wlan-ap-0] ap-name ap_0
   [AC1-wlan-ap-0] ap-group ap_group
   Warning: This operation may cause AP reset. If the country code changes, it will, clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y 
   [AC1-wlan-ap-0] quit
   [AC1-wlan-view] ap-id 1 ap-mac 60de-4476-e380
   [AC1-wlan-ap-1] ap-name ap_1
   [AC1-wlan-ap-1] ap-group ap_group
   Warning: This operation may cause AP reset. If the country code changes, it will, clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y 
   [AC1-wlan-ap-1] quit
   [AC1-wlan-view] quit

   # After the AP is powered on, run the display ap all command to check the AP state. If the State field is displayed as nor, the AP has gone online properly.

   [AC1] display ap all
   Total AP information:
   nor  : normal          [2]
   -------------------------------------------------------------------------------------
   ID   MAC            Name   Group     IP            Type            State STA Uptime
   -------------------------------------------------------------------------------------
   0    60de-4476-e360 ap_0 ap_group  172.18.10.254 AP6010DN-AGN    nor   0   20S
   1    60de-4476-e380 ap_1 ap_group  172.18.10.253 AP6010DN-AGN    nor   0   10S
   -------------------------------------------------------------------------------------
   Total: 2

   The configuration of AC2 is the same as that of AC1 and is not provided here.

6. [Device] Configure interconnection parameters for the AC and RADIUS server as well as the AC and Portal server, so that the AC can associate with the RADIUS and Portal servers.

   # On AC1, configure a RADIUS server template, and configure authentication, accounting, and authorization schemes in the template.

   [AC1] radius-server template radius_template
   [AC1-radius-radius_template] radius-server authentication 172.22.10.2 1812 source ip-address 172.18.10.1 weight 80  //Configure a primary RADIUS authentication server with a higher weight than that of the secondary authentication server. 
   Set the authentication port to 1812 and the source IP address to communicate with the RADIUS server to 172.16.10.1.
   [AC1-radius-radius_template] radius-server authentication 172.22.10.3 1812 source ip-address 172.18.10.1 weight 40  //Configure a secondary RADIUS authentication server with a lower weight than that of the primary authentication server. 
   Set the authentication port to 1812 and the source IP address to communicate with the RADIUS server to 172.16.10.1.
   [AC1-radius-radius_template] radius-server accounting 172.22.10.2 1813 source ip-address 172.18.10.1 weight 80  //Configure a primary RADIUS accounting server with a higher weight than that of the secondary accounting server to obtain user login and logout information. 
   Set the accounting port to 1813 and the source IP address to communicate with the RADIUS server to 172.16.10.1.
   [AC1-radius-radius_template] radius-server accounting 172.22.10.3 1813 source ip-address 172.18.10.1 weight 40  //Configure a secondary RADIUS accounting server with a lower weight than that of the primary accounting server to obtain user login and logout information. 
   Set the accounting port to 1813 and the source IP address to communicate with the RADIUS server to 172.16.10.1.
   [AC1-radius-radius_template] radius-server shared-key cipher Admin@123  //Configure a shared key for the RADIUS server.
   [AC1-radius-radius_template] radius-server user-name original  //Configure the AC to send the user names entered by users to the RADIUS server.
   [AC1-radius-radius_template] quit
   [AC1] radius-server authorization 172.22.10.2 shared-key cipher Admin@123  //Configure a RADIUS authorization server so that the RADIUS server can deliver authorization rules to the AC. V200R021C00 and later versions, you must run the radius-server authorization server-source command to configures an IPv4 address for receiving and responding to request packets of a RADIUS authorization server so that the function of the RADIUS authorization server can take effect. 
   Set the shared key to Admin@123, which must be the same as that of the authentication and accounting server. 
   [AC1] radius-server authorization 172.22.10.3 shared-key cipher Admin@123  //Configure a RADIUS authorization server so that the RADIUS server can deliver authorization rules to the AC. V200R021C00 and later versions, you must run the radius-server authorization server-source command to configures an IPv4 address for receiving and responding to request packets of a RADIUS authorization server so that the function of the RADIUS authorization server can take effect. 
   //Set the shared key to Admin@123, which must be the same as that of the authentication and accounting server.
   //The access control device can process CoA/DM Request packets initiated by the Agile Controller-Campus only after the authorization servers are configured. 
   //Authentication servers and authorization servers must have a one-to-one mapping, that is, the number of authentication servers and authorization servers must be the same. 
   //If not, the Agile Controller-Campus will fail to kick some users offline.
   [AC1] aaa
   [AC1-aaa] authentication-scheme auth_scheme
   [AC1-aaa-authen-auth_scheme] authentication-mode radius  //Set the authentication scheme to RADIUS.
   [AC1-aaa-authen-auth_scheme] quit
   [AC1-aaa] accounting-scheme acco_scheme
   [AC1-aaa-accounting-acco_scheme] accounting-mode radius  //Set the accounting scheme to RADIUS. 
   //The RADIUS accounting scheme must be used so that the RADIUS server can maintain account state information such as login/logout information and force users to go offline.
   [AC1-aaa-accounting-acco_scheme] accounting realtime 15  //Set the real-time accounting interval to 15 minutes.
   [AC1-aaa-accounting-acco_scheme] quit
   [AC1-aaa] quit

   The accounting realtime command sets the real-time accounting interval. A short real-time accounting interval requires high performance of the device and RADIUS server. Set a real-time accounting interval based on the user quantity.

   Table 4-124 Accounting interval

   User Quantity	Real-Time Accounting Interval
   1 to 99	3 minutes
   100 to 499	6 minutes
   500 to 999	12 minutes
   ≥ 1000	≥ 15 minutes

   # Check whether a user can use a RADIUS template for authentication. (User name test and password Admin_123 have been configured on the RADIUS server.)

   [AC1] test-aaa test Admin_123 radius-template radius_template pap
   Info: Account test succeed.

   # On AC2, configure a RADIUS server template, and configure authentication, accounting, and authorization schemes in the template. The RADIUS authentication configuration of AC2 is the same as that of AC1 and is not provided here. However, when setting the source IP address for AC2 in the RADIUS server template, set the source IP address of AC2 to 172.18.10.2.

   # Configure Portal authentication for AC1.

   1. Configure the URL of the primary Portal authentication page. When a user attempts to access a website before authentication, the AC redirects the website to the primary Portal server.

      You are advised to configure the URL using a domain name to ensure secure and fast page pushing. Before configuring the URL using a domain name, you must first configure the mapping between the domain name and IP address of the Agile Controller-Campus server on the DNS server.

      [AC1] url-template name huawei1
      [AC1-url-template-huawei1] url http://access1.example.com:8080/portal  //access1.example.com is the host name of the primary Portal server.

   2. Configure parameters carried in the URL, which must be the same as those on the authentication server.

      [AC1-url-template-huawei1] url-parameter ssid ssid redirect-url url  //Specify the names of the parameters included in the URL. The parameter names must the same as those on the authentication server. 
      //This first ssid indicates that the URL contains the SSID field, and the second ssid indicates the parameter name. 
      //For example, after ssid ssid is configured, the URL redirected to the user contains sid=guest, where ssid indicates the parameter name, and guest indicates the SSID with which the user associates. 
      //The second SSID represents the transmitted parameter name only and cannot be replaced with the actual user SSID.
      //When the AC uses URL as the parameter name, the URL must be entered on the Portal server to specify to which URL users' access request will be redirected.
      [AC1-url-template-huawei1] quit

   3. Configure the URL of the secondary Portal authentication page. When the primary Portal server is unavailable, the AC redirects the website that a user attempts to access to the secondary Portal server.

      [AC1] url-template name huawei2
      [AC1-url-template-huawei2] url http://access2.example.com:8080/portal  //access2.example.com is the host name of the secondary Portal server.
      [AC1-url-template-huawei2] url-parameter ssid ssid redirect-url url
      [AC1-url-template-huawei2] quit

   4. Specify the port number used to process Portal protocol packets. The default port number is 2000. If you change the port number on the AC, set the same port number when you add this AC to the Agile Controller-Campus.

      [AC1] web-auth-server listening-port 2000

   5. Configure a primary Portal server template, including configuring the IP address and port number of the primary Portal server.

      Set the destination port number in the packets sent to the Portal server to 50200. The Portal server accepts packets with destination port 50200, but the AC uses port 50100 to send packets to the Portal server by default. Therefore, you must change the port number to 50200 on the AC so that the AC can communicate with the Portal server.

      [AC1] web-auth-server portal_huawei1  //In V200R021C00 and later versions, you must use the web-auth-server server-source or server-source command to configure the local gateway address used by the device to receive and respond to the packets sent by the Portal server. Otherwise, the Portal interconnection function cannot be used.
      [AC1-web-auth-server-portal_huawei1] server-ip 172.22.10.2  //Configure an IP address for the primary Portal server.
      [AC1-web-auth-server-portal_huawei1] source-ip 172.18.10.1  //Configure an IP address for the device to communicate with the Portal server.
      [AC1-web-auth-server-portal_huawei1] port 50200  //Set the destination port number in the packets sent to the Portal server to 50200.

   6. Configure the shared key used to communicate with the Portal server, which must be the same as that on the Portal server. In addition, enable the AC to transmit encrypted URL parameters to the Portal server.

      [AC1-web-auth-server-portal_huawei1] shared-key cipher Admin@123  //Configure the shared key used to communicate with the Portal server, which must be the same as that on the Portal server.
      [AC1-web-auth-server-portal_huawei1] url-template huawei1  //Bind the URL template to the Portal server profile.

   7. Enable the Portal server detection function.

      After the Portal server detection function is enabled in the Portal server template, the device detects all Portal servers configured in the Portal server template. If the number of times that the device fails to detect a Portal server exceeds the upper limit, the status of the Portal server is changed from Up to Down. If the number of Portal servers in Up state is less than or equal to the minimum number (specified by the critical-num parameter), the device performs the corresponding operation to allow the administrator to obtain the real-time Portal server status. The detection interval cannot be shorter than 15s, and the recommended value is 100s. The AC only supports Portal server detection but not Portal escape.

      [AC1-web-auth-server-portal_huawei1] server-detect interval 100 max-times 5 critical-num 0 action log

   8. Configure a secondary Portal server template, including configuring the IP address, port number, and shared key of the secondary Portal server.

      [AC1] web-auth-server portal_huawei2  //In V200R021C00 and later versions, you must use the web-auth-server server-source or server-source command to configure the local gateway address used by the device to receive and respond to the packets sent by the Portal server. Otherwise, the Portal interconnection function cannot be used.
      [AC1-web-auth-server-portal_huawei2] server-ip 172.22.10.3  //Configure an IP address for the secondary Portal server.
      [AC1-web-auth-server-portal_huawei2] source-ip 172.18.10.1
      [AC1-web-auth-server-portal_huawei2] port 50200
      [AC1-web-auth-server-portal_huawei2] shared-key cipher Admin@123
      [AC1-web-auth-server-portal_huawei2] url-template huawei2
      [AC1-web-auth-server-portal_huawei2] server-detect interval 100 max-times 5 critical-num 0 action log
      [AC1-web-auth-server-portal_huawei2] quit

   # Enable the Portal authentication quiet period function. With this function enabled, the AC drops packets of an authentication user during the quiet period if the user fails Portal authentication for the specified number of times in 60 seconds. This function protects the AC from overloading caused by frequent authentication.

   [AC1] portal quiet-period
   [AC1] portal quiet-times 5  //Set the maximum number of authentication failures in 60 seconds before a Portal authentication is set to quiet state.
   [AC1] portal timer quiet-period 240  //Set the quiet period to 240 seconds.

   # Create a Portal access profile, and bind the Portal server template to it.

   [AC1] portal-access-profile name acc_portal  //Create a Portal access profile.
   [AC1-portal-access-profile-acc_portal] web-auth-server portal_huawei1 portal_huawei2 direct  //Configure the primary and secondary Portal server templates used by the Portal access profile. If the network between end users and the AC is a Layer 2 network, configure the direct mode; if the network is a Layer 3 network, configure the layer3 mode.
   [AC1-portal-access-profile-acc_portal] quit

   # Configure pre-configuration and post-authentication access rules for users.

   [AC1] free-rule-template name default_free_rule 
   [AC1-free-rule-default_free_rule] free-rule 1 destination ip 172.22.10.4 mask 255.255.255.255  //Configure a Portal authentication-free rule to allow users to connect to the DNS server before authentication.
   [AC1-free-rule-default_free_rule] quit

   [AC1] acl 3001  //Configure the post-authentication domain for employees, including the intranet and Internet.
   [AC1-acl-adv-3001]  rule 5 permit ip
   [AC1-acl-adv-3001]  quit
   [AC1] acl 3002  //Configure the post-authentication domain for guests, including the Internet.
   [AC1-acl-adv-3002]  rule 5 deny ip destination 172.22.10.5 0  //172.22.10.5 is the company's server resource and cannot be accessed by guests.
   [AC1-acl-adv-3002]  rule 10 permit ip
   [AC1-acl-adv-3002]  quit

   # Configure an authentication profile.

   [AC1] authentication-profile name auth_portal
   [AC1-authentication-profile-auth_portal] portal-access-profile acc_portal
   [AC1-authentication-profile-auth_portal] authentication-scheme auth_scheme
   [AC1-authentication-profile-auth_portal] accounting-scheme acco_scheme
   [AC1-authentication-profile-auth_portal] radius-server radius_template
   [AC1-authentication-profile-auth_portal] free-rule-template default_free_rule
   [AC1-authentication-profile-auth_portal] quit

   # Enable terminal type awareness to allow the ACs to send the option fields containing the terminal type in DHCP packets to the authentication server. In this way, the authentication server can push the correct Portal authentication pages to users based on their terminal types.

   [AC1] dhcp snooping enable
   [AC1] device-sensor dhcp option 12 55 60

   # The Portal authentication configuration of AC2 is the same as that of AC1 and is not provided here. However, when setting the source IP address for AC2 in the Portal server template, set the source IP address of AC2 to 172.18.10.2.

7. [Device] Set WLAN service parameters on the ACs.

   # Create the security profile security_portal and set the security policy in the profile.

   [AC1] wlan
   [AC1-wlan-view] security-profile name security_portal
   [AC1-wlan-sec-prof-security_portal] quit

   # Create SSID profiles wlan-ssid-employee and wlan-ssid-guest, and set the SSID names to employee and guest respectively.

   [AC1-wlan-view] ssid-profile name wlan-ssid-employee
   [AC1-wlan-ssid-prof-wlan-ssid-employee] ssid employee
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [AC1-wlan-ssid-prof-wlan-ssid-employee] quit
   [AC1-wlan-view] ssid-profile name wlan-ssid-guest
   [AC1-wlan-ssid-prof-wlan-ssid-guest] ssid guest
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [AC1-wlan-ssid-prof-wlan-ssid-guest] quit

   # Create VAP profiles wlan-vap-employee and wlan-vap-guest, configure the service data forwarding mode and service VLANs, and apply the security, SSID, and authentication profiles to the VAP profiles.

   [AC1-wlan-view] vap-profile name wlan-vap-employee
   [AC1-wlan-vap-prof-wlan-vap-employee] forward-mode direct-forward  //Configure direct forwarding for employees.
   [AC1-wlan-vap-prof-wlan-vap-employee] service-vlan vlan-id 101
   [AC1-wlan-vap-prof-wlan-vap-employee] security-profile security_portal
   [AC1-wlan-vap-prof-wlan-vap-employee] ssid-profile wlan-ssid-employee
   [AC1-wlan-vap-prof-wlan-vap-employee] authentication-profile auth_portal  //Bind the authentication profile.
   [AC1-wlan-vap-prof-wlan-vap-employee] quit
   [AC1-wlan-view] vap-profile name wlan-vap-guest
   [AC1-wlan-vap-prof-wlan-vap-guest] forward-mode direct-forward  //Configure direct forwarding for guests.
   [AC1-wlan-vap-prof-wlan-vap-guest] service-vlan vlan-id 102
   [AC1-wlan-vap-prof-wlan-vap-guest] security-profile security_portal
   [AC1-wlan-vap-prof-wlan-vap-guest] ssid-profile wlan-ssid-guest
   [AC1-wlan-vap-prof-wlan-vap-guest] authentication-profile auth_portal
   [AC1-wlan-vap-prof-wlan-vap-guest] quit

   # Bind the VAP profile to the AP groups and apply the VAP profile to radio 0 and radio 1 of the AP.

   [AC1-wlan-view] ap-group name ap_group
   [AC1-wlan-ap-group-ap_group] vap-profile wlan-vap-employee wlan 1 radio 0  //Configure the 2.4 GHz frequency band of the AP to provide services for employees.
   [AC1-wlan-ap-group-ap_group] vap-profile wlan-vap-employee wlan 1 radio 1  //Configure the 5 GHz frequency band of the AP to provide services for employees.
   [AC1-wlan-ap-group-ap_group] vap-profile wlan-vap-guest wlan 2 radio 0  //Configure the 2.4 GHz frequency band of the AP to provide services for guests.
   [AC1-wlan-ap-group-ap_group] vap-profile wlan-vap-guest wlan 2 radio 1  //Configure the 5 GHz frequency band of the AP to provide services for guests.
   [AC1-wlan-ap-group-ap_group] quit

   # The WLAN service parameters configuration of AC2 is the same as that of AC1 and is not provided here.

8. [Device] Configure dual-link backup on AC1 to implement HSB.

   # Configure the IP address of AC2 and the AC1 priority to implement dual-link backup.

   [AC1] wlan
   [AC1-wlan-view] wlan ac protect enable
   Warning: This operation maybe cause ap reset or client down, continue?[Y/N]:y
   [AC1-wlan-view] wlan ac protect protect-ac 172.18.10.2 priority 2
   Warning: Operation successful. It will take effect after AP reset.
   

   # Restart the AP on AC1 and deliver the dual-link backup configuration to the AP.

   [AC1-wlan-view] ap-reset all
   Warning: Reset AP (s), continue?[Y/N]:y
   [AC1-wlan-view] quit

   # Create HSB service 0 on AC1. Configure the IP addresses and port numbers for the active and standby channels. Set the retransmission time and interval of HSB service 0.

   [AC1] hsb-service 0
   [AC1-hsb-service-0] service-ip-port local-ip 10.10.11.1 peer-ip 10.10.11.2 local-data-port 10241 peer-data-port 10241
   [AC1-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
   [AC1-hsb-service-0] quit

   # Bind the NAC service to the HSB service.

   [AC1] hsb-service-type access-user hsb-service 0

   # Bind the WLAN service to the HSB service.

   [AC1] hsb-service-type ap hsb-service 0

9. [Device] Configure dual-link backup on AC2 to implement HSB.

   # Configure the IP address of AC1 and the AC2 priority to implement dual-link backup.

   [AC2] wlan
   [AC2-wlan-view] wlan ac protect enable
   Warning: This operation maybe cause ap reset or client down, continue?[Y/N]:y
   [AC2-wlan-view] wlan ac protect protect-ac 172.18.10.1 priority 5
   Warning: Operation successful. It will take effect after AP reset.
   [AC2-wlan-view] quit

   # Create HSB service 0 on AC2 Configure the IP addresses and port numbers for the active and standby channels. Set the retransmission time and interval of HSB service 0.

   [AC2] hsb-service 0
   [AC2-hsb-service-0] service-ip-port local-ip 10.10.11.2 peer-ip 10.10.11.1 local-data-port 10241 peer-data-port 10241
   [AC2-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
   [AC2-hsb-service-0] quit

   # Bind the NAC service to the HSB service.

   [AC2] hsb-service-type access-user hsb-service 0

   # Bind the WLAN service to the HSB service.

   [AC2] hsb-service-type ap hsb-service 0

10. [Device] Verify the dual-link configuration.

    # After the configurations are complete, run the display ac protect command on AC1 and AC2 to view dual-link backup information.

    [AC1] display ac protect
      ------------------------------------------------------------
      Protect state             : enable
      Protect AC                : 172.18.10.2
      Priority                  : 2
      Protect restore           : enable
      Coldbackup kickoff station: disable
      ------------------------------------------------------------ 

    [AC2] display ac protect
      ------------------------------------------------------------
      Protect state             : enable
      Protect AC                : 172.18.10.1
      Priority                  : 5
      Protect restore           : enable
      Coldbackup kickoff station: disable
      ------------------------------------------------------------ 

    # Run the display hsb-service 0 command on AC1 and AC2 to check the HSB service status. The value of the Service State field is Connected, indicating that the active and standby HSB channels have been established.

    [AC1] display hsb-service 0
    Hot Standby Service Information:
    ----------------------------------------------------------
      Local IP Address       : 10.10.11.1
      Peer IP Address        : 10.10.11.2
      Source Port            : 10241
      Destination Port       : 10241
      Keep Alive Times       : 2
      Keep Alive Interval    : 1
      Service State          : Connected
      Service Batch Modules  : 
    ----------------------------------------------------------
    

    [AC2] display hsb-service 0
    Hot Standby Service Information:
    ----------------------------------------------------------
      Local IP Address       : 10.10.11.2
      Peer IP Address        : 10.10.11.1
      Source Port            : 10241
      Destination Port       : 10241
      Keep Alive Times       : 2
      Keep Alive Interval    : 1
      Service State          : Connected
      Service Batch Modules  : 
    ----------------------------------------------------------
    

11. [Agile Controller-Campus] Add the AC to the Service Manager to enable the Agile Controller-Campus to manage the AC.
    1. Choose Resource > Device > Device Management.
    2. Click Add.
    3. Configure parameters for the AC.

       Parameter	Value	Description
       Name	AC	-
       IP address	172.18.10.1	The AC1 interface with this IP address must be able to communicate with the Service Controller.
       Enable RADIUS	Select	-
       Standby device IP address	172.18.10.2	The AC2 interface with this IP address must be able to communicate with the Service Controller.
       Authentication/Accounting key	Admin@123	[AC1-radius-radius_template] radius-server shared-key cipher Admin@123
       Authorization key	Admin@123	[AC1] radius-server authorization 172.22.10.2 shared-key cipher Admin@123
       Real-time accounting interval (minute)	15	[AC1-aaa-accounting-acco_scheme] accounting realtime 15
       Enable Portal	Selected	-
       Port	2000	This is the port that the AC uses to communicate with the Portal server. Retain the default value.
       Portal key	Admin@123	[AC1-web-auth-server-portal_huawei1] shared-key cipher Admin@123
       Access terminal IP list	172.19.10.1/16;172.20.10.1/16	You need to add the IP addresses of all the terminals that go online through Portal authentication to the access terminal IP list. After the Portal server receives the account and password submitted by an end user, it searches for an access control device based on the terminal's IP address and allows the terminal to go online from the target access control device. If the IP address pool of the access control device does not include the terminal IP address, the Portal server cannot find an access control device to grant network access permission to the terminal, causing the terminal login failure.
       Enable heartbeat between access device and Portal server	Select	The Portal server can send heartbeat packets to the access device only when Enable heartbeat between access device and Portal server is selected and the Portal server's IP address has been added to Portal server IP list. The access device then periodically detects heartbeat packets of the Portal server to determine the Portal server status and synchronize user information from the Portal server. The server-detect and user-sync commands must have been configured in the Portal server view on the access device.
       Portal server IP list	172.22.10.2;172.22.10.3

    4. Click OK.
12. [Agile Controller-Campus] Add SSIDs on the Agile Controller-Campus, so that the Agile Controller-Campus can authorize users through the SSIDs.
    1. Choose Policy > Permission Control > Policy Element > SSID.
    2. Click Add and add SSIDs for employees and guests.

       The SSIDs must be the same as those configured on the AC.

13. [Agile Controller-Campus] Configure authorization results and rules to grant different access rights to employees and guests after they are successfully authenticated.
    1. Choose Policy > Permission Control > Authentication and Authorization > Authorization Result, and add authorization ACLs for employees and guests.

       The ACL numbers must be the same as those configured on the authentication control device.

    2. Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule, and bind the authorization result to specify resources accessible to employees and guests after successful authentication.

    3. Modify the default authorization rule by changing the authorization result to Deny Access.

       Choose Policy > Permission Control > Authentication and Authorization > Authorization Rule and click on the right of Default Authorization Rule. Change the value of Authorization Result to Deny Access.