H3CAC进行Portal认证

一、组网需求：在BYOD组网方案下，我们主要通过iNode客户端、HTTP网页、终端Mac地址以及DHCP的Option属性这四种方式获取终端的操作系统和厂商信息，实现终端识别以便完成相应的权限策略控制。其中DHCP的Option属性方式可普遍用户各种场景。由于部署DHCP服务器并安装Agent插件的方式比较繁琐，这里我们以普通Portal认证为例介绍一种通过无线控制器的DHCP-snooping功能获取记录终端的option55（终端操作系统）和option60（终端厂商）信息并通过Radius属性上报给iMC服务器的典型配置。WX系列AC、FitAP、交换机、便携机（安装有无线网卡）、iMC服务器及其他智能终端。二、组网图：三、配置步骤：1、AC版本要求WX系列AC从B109D012合入该特性，因此只有这个版本号及其以后的版本支持DHCP-snooping功能获取记录终端的option55（终端操作系统）和option60（终端厂商）信息并通过Radius属性上报给iMC服务器。WX系列AC可通过下面的命令查看内部版本号：WX5540E_displayversionH3CComwarePlatformSoftwareComwareSoftware,Version5.20,Release2607P18ComwarePlatformSoftwareVersionCOMWAREV500R002B109D022H3CWX5540ESoftwareVersionV200R006B09D022Copyright(c)2004-2014HangzhouH3CTech.Co.,Ltd.Allrightsreserved.CompiledFeb25201411:08:07,RELEASESOFTWAREH3CWX5540Euptimeis1week,4days,0hour,49minutes2、AC侧配置及说明#version5.20,Release3120P17#sysnameWX3024-AC#domaindefaultenablesystem#telnetserverenable#port-securityenable#//配置portalserver、ip、key、url以及server-type，注意这里server-type必须配置为imcportalserverimcip172.16.0.22keycipher$c$3$6uB5v4kaCg1aSOJkOqX+==url配置portalfree-rule放通AC内联口portalfree-rule0sourceinterfaceGigabitEthernet1/0/1destinationany#oapmanagement-ip192.168.0.101slot0#password-recoveryenable#vlan1#vlan24#//配置radius策略，注意server-type必须选择extended模式，注意user-name-format及nas-ip的配置必须与iMC接入策略和接入服务里配置保持一致。radiusschemeimcserver-typeextendedprimaryauthentication172.16.0.22primaryaccounting172.16.0.22keyauthenticationcipher$c$3$Myv0nhgPjC4vsMforZW3iCiW5KkP7Q==keyaccountingcipher$c$3$dCEXJGp71WPyrPK4hsPJd6sdTYf01A==user-name-formatwithout-domainnas-ip172.16.0.202#//配置domaindomainimcauthenticationportalradius-schemeimcauthorizationportalradius-schemeimcaccountingportalradius-schemeimcaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainsystemaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#//配置AP注册dhcppooldhcpserverip-pool1network192.168.0.0mask255.255.255.0#//配置终端业务dhcppooldhcpserverip-pooloption55network192.168.24.0mask255.255.255.0gateway-list192.168.24.254dns-list8.8.8.8#user-groupsystemgroup-attributeallow-guest#local-useradminpasswordcipher$c$3$iMGlwEx7o4TNbMqd7OaOAwB5SWSzOrKEauthorization-attributelevel3service-typetelnet#wlanrrmdot11amandatory-rate61224dot11asupported-rate918364854dot11bmandatory-rate12dot11bsupported-rate5.511dot11gmandatory-rate125.511dot11gsupported-rate69121824364854#//配置无线服务模板wlanservice-template10clearssidoption55bindWLAN-ESS10service-templateenable#wlanap-groupdefault_groupapap1apap2#interfaceNULL0#//与iMC互联ip及vlan接口interfaceVlan-interface1ipaddress172.16.0.202255.255.255.0#//终端业务互联ip及vlan接口，接口下开启portal，注意portaldomain及portalnas-ip配置需要与iMC服务器portal设备保持一致interfaceVlan-interface24ipaddress192.168.24.1255.255.255.0portalserverimcmethoddirectportaldomainimcportalnas-ip172.16.0.202#interfaceGigabitEthernet1/0/1portlink-typetrunkporttrunkpermitvlanall#//配置wlan-ess接口interfaceWLAN-ESS10portaccessvlan24#wlanapap2modelWA2610H-GNid2serial-id219801A0FH9136Q00287radio1service-template10radioenable#//开启dhcp-snooping，使能dhcp-snooping记录用户的option55和option60信息功能dhcp-snoopingdhcp-snoopingbindingrecorduser-identity#//配置默认路由iproute-static0.0.0.00.0.0.0192.168.24.254#snmp-agentsnmp-agentlocal-engineid800063A203000FE2873066snmp-agentcommunityreadpublicsnmp-agentcommunitywriteprivatesnmp-agentsys-infoversionall#//使能dhcpdhcpenable#user-interfacecon0user-interfacevty04authentication-modeschemeuserprivilegelevel3#return3、iMC侧配置请参考KMS-21434《WX系列AC与iMC配合实现无线Portal认证典型配置》，这里不再赘述。4、结果验证及抓包1）AC上查看在线的客户端和portal在线用户信息：WX3024-ACdiswlanclientTotalNumberofClients:2ClientInformationSSID:option55-------------------------------------------------------------------------------------------------MACAddressUserNameAPID/RIDIPAddressVLAN-------------------------------------------------------------------------------------------------2477-0391-7720-NA-2/1192.168.24.22428e1-4cb5-8249-NA-2/1192.168.24.324-------------------------------------------------------------------------------------------------WX3024-ACdisportaluserallIndex:12State:ONLINESubState:NONEACL:NONEWork-mode:stand-aloneMACIPVlanInterface----------------------------------------------------------------------------------------------2477-0391-7720192.168.24.224Vlan-interface24Index:13State:ONLINESubState:NONEACL:NONEWork-mode:stand-aloneMACIPVlanInterface----------------------------------------------------------------------------------------------28e1-4cb5-8249192.168.24.324Vlan-interface24Total2user(s)matched,2listed.2）iMC上通过终端设备管理查看终端的厂商、类型以及操作系统等信息：3）查看AC的debugging信息，可以清楚看到Radius的code=[1]报文里携带了option55和option60的属性字段：*Apr2616:37:06:9362000WX3024-ACRDS/7/DEBUG:Sendattributelist:*Apr2616:37:06:9462000WX3024-ACRDS/7/DEBUG:[1User-name][8][c09467][60CHAP_Challenge][18][6EFCA7E2624584E38EA53882A4A12C90][4NAS-IP-Address][6][172.16.0.202][32NAS-Identifier][11][WX3024-AC][5NAS-Port][6][16818200][87NAS_Port_Id][18][0100010000000024]*Apr2616:37:06:9862000WX3024-ACRDS/7/DEBUG:[61NAS-Port-Type][6][19][H3C-26Con