一 无线控制器radius+portal认证配置
#
radius session-control enable
#
radius scheme hw-campus
primary authentication x.x.x.x //nce radius服务器配置
primary accounting x.x.x.x //nce radius服务器配置
key authentication simple root@123
key accounting simple root@123
user-name-format without-domain
nas-ip x.x.40.253 //无线控制器作为nas ip地址
#
radius dynamic-author server
client ip x.x.x.x key simple root@123
#
domain hw-campus
authentication lan-access radius-scheme hw-campus
authorization lan-access radius-scheme hw-campus
accounting lan-access radius-scheme hw-campus
authentication portal radius-scheme hw-campus
authorization portal radius-scheme hw-campus
accounting portal radius-scheme hw-campus
#
portal free-rule 0 source interface Ten-GigabitEthernet1/0/10
portal free-rule 2 source ip any destination ip 223.5.5.5 255.255.255.255
portal free-rule 3 source ip any destination ip 114.114.114.114 255.255.255.255
portal free-rule 200 source ip any destination ip x.x.x.x 255.255.255.255
#
portal web-server web-campus
url https://x.x.x.x:19008/portal
server-type cmcc
url-parameter ac-ip value x.x.40.253 //认证需要透传的参数，必须配置，否则认证会提出challenge认证报错
url-parameter attributes value challenge
url-parameter redirect-url original-url
url-parameter ssid ssid
url-parameter uaddress source-address
url-parameter umac source-mac
#
portal server web-campus
ip x.x.x.x key simple 123
server-type cmcc
#
wlan service-template kaiyuan-test
ssid test
vlan 50
client vlan-alloc static
client-security authentication-mode mac
client-security ignore-authentication
mac-authentication domain hw-campus
portal enable method direct
portal domain hw-campus
portal bas-ip x.x.40.253
portal apply web-server web-campus
portal fail-permit web-server
service-template enable
#
二 华为NCE认证服务器配置
1.下发acl配置
2.授权控制配置
3.认证与加密配置
三 终端认证测试
1.打开浏览器随便输入地址
2.会弹出认证页面
电脑端
手机端
3.认证服务器认证成功
四 无线控制器查看在线用户上线，并且下发了acl 3020
<AC>dis por us all
Total portal users: 1
Username: test
Portal server: web-campus
State: Online
VPN instance: N/A
MAC IP VLAN Interface
00e0-4c3d-5bb0 x.x.50.130 51 Vlan-interface51
Authorization information:
DHCP IP pool: N/A
User profile: N/A
Session group profile: N/A
ACL number: 3020 (active)
Inbound CAR: N/A
Outbound CAR: N/A
转载自 CSDN-专业IT技术社区
原文链接：https://blog.csdn.net/huainingning/article/details/166133175
