交换机上结合IMC做802.1xPortal配置案例重点

1、交换机上结合IMC做802.1x+Portal配置案例提示：建议将WORD显示比例调整为150%查看1. 配置要求：对交换机接入用户做 802.1x+Porta l认证 2网络拓扑:ClMfr3.设备端配置：portaldevicedis verH3C Comware Platform SoftwareComware Software, Versio n 5.20, Release 2202P19Copyright （c 2004-2010 Han gzhou H3C Tech. Co., Ltd. All rights reserved.H3C S5500-28C-EI uptime is

2、0 week, 0 day, 20 hours, 49 min utesportaldevice s5500-EIdis cu#version 5.20, Release 2202P19domain default enable ya/指定默认域名，并结合 user-name-format without-domain这条命令，在802.1X时不用带域名。dot1x 全局开启dot1x功能portal server szhp ip 00 key szhp url 00:8080/porta（指 定portal页面）vla n 1 vl

3、an 10#via n 20#radius scheme szhprimary authe ntication 00primary accou nting 00key authe nticati on huakey acco un ti ng huauser- name-format without-doma indomain szh /portal 配置，弓丨用 radius 方案 szh. authe nticati on portal radius-scheme szh authorizati on portal radius-scheme

4、 szh acco unting portal radius-scheme szh access-limit disable state active idle-cut disable self-service-url disabledomain ya /802.1X 配置，引用 radius 方案 szh. authe nticati on Ian-access radius-scheme szh authorizati on Ian-access radius-scheme szh acco un ti ng Ian-access radius-scheme szh access-limi

5、t disable state active idle-cut disable self-service-url disable#user-group system#in terface NULLO#in terface Vla n-i nterface10ip address #in terface Vla n-in terface20 /portal 认证 VLANip address portal server szhp method direct#in terface Gigabit

6、Ethernet1/0/4port access vla n 20dot1x#s nmp v3的配置sn mp-age ntsn mp-age nt local-e ngi neid 800063A203000FE2B23AD7sn mp-age nt com mun ity read publicsn mp-age nt com mun ity write privatesn mp-age nt sys-i nfo versi on v3sn mp-age nt group v3 test_group privacy read-view test_view write-view test_v

7、iew no tify-view test_view sn mp-age nt mib-view in cluded test_view isosn mp-age nt usm-user v3 test_user test_group authe nticati on-m ode md5 !QM%/G4DGv2=O98lL7YOQ! privacy-modedes56 !QM%/G4DG2=O981L7YOQ!2.IMC上关于802.1X的配置:(1)创建用户姓名：8021xuser(2给用户姓名添加账号：user802,密码：*,并与之前创建的服务关联。(3) 用iNODE做客户端验证，先创

8、建一个 802.1x连接:1-1-图(1)图（2）图（3）此处不带域名需要在设备上指定默认域名（见配置）m C * O * 13 6 D Qfi图（4） 802.1X验证成功3.IMC关于Portal的配置:（1接入设备添加：共享密钥:hua ,192.168.10伪Portal设备和IMC最近的接口 IP 或者为nas-ip(2)创建服务(servicename(3)创建用户姓名(4) 给创建的用户姓名添加账号(account,密码(123456,将用户姓名和服务关联 起来。一个用户姓名只能对应一个账号 I HM(5) 创建一个服务，注意服务类型标识为 domain名，为交换机portal认

9、证的域 名为szh,服务类型为描述的意思。在inode选择服务类型即可，不用在用户名输 入 szho(6) portal配置：添加启用Portal设备名，IP地址一般为做Portal认证客户端 的网关IP.密钥：szhp.(7添加IP地址组，地址为需要Portal认证的地址段(8)创建端口组，并将要认证的地址组关联起来9.测试认证/ V fiDita802.1x已认证成功。认证之前Ping不通网关地址（除了 IMC服务器的地址外都不能访问）如下图:从该实验中，可以看出802.1X验证成功只相当于插上了网线，而P ortal认证是基 于三层的，在认证通过前只能与服务器通信。在浏览器中随便输入一个

10、IP地址，会自动触发Portal认证页面如下图：PORTAL认证页面图Portal认证成功后Ping测图小结：结合IMC做Portal认证的基本流程:1. 添加接入设备。2. 创建服务。3. 创建用户姓名，账号，密码，并将用户与服务绑定4. 服务类型配置5. Portal的配置:设备配置。6. IP地址组配置。7. 将IP地址组与设备绑定。l.portal认证时，如果用INODE认证，则必须将策略服务器关闭，否则认证后大概 十秒钟后下线，提示安全检查没通过。2.802.1X默认是CHAP认证方式，支持 PAP,EAP,可用命令：dot1x authe nticati on-method eap

11、修 改。3.在radius认证时，V5产品必须在域中做授权配置 authorization portal radiusscheme szh否则认证不成功，并且提示：Rejected by local server错误。附带：DO1X认证时的RADIUS报文：pr 27 09:13:34:679 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=EAP auth request Index = 164, ulParam3=112681088*Apr 27 09:13:34:831 2000 portaldevice RDS/7/DEBUG:Se nd

12、attribute list:*Apr 27 09:13:34:923 2000 portaldevice RDS/7/DEBUG:1 User- name 41 b2Q4R0YDN3QtTho4dVF9fQbyrpM= user80212 Framed-MTU 6 145079 EAP-Message 46 0201002C01060762325134523059444E33517454686F34645646396651627972704D3 D2020757365723830324 NAS-IP-Address 6 32 NAS-Ide ntifier 14 po

13、rtaldevice*Apr 27 09:13:35:550 2000 portaldevice RDS/7/DEBUG:5 NAS-Port 6 1679362061 NAS-Port-Type 6 156 Service-Type 6 27 Framed-Protocol 6 131 Caller-ID 16 313861392D303564652D30613733*Apr 27 09:13:35:934 2000 portaldevice RDS/7/DEBUG:Send: IP=00,Userlndex=164, ID=225, RetryTimes=0, Co

14、de=1, Length=191*Apr 27 09:13:36:116 2000 portaldevice RDS/7/DEBUG:Se nd Raw Packet is:*Apr 27 09:13:36:208 2000 portaldevice RDS/7/DEBUG:01 e1 00 bf 00 00 16 4d 00 00 5f 3a 00 00 34 d400 00 25 93 01 29 06 07 62 32 51 34 52 30 59 444e 33 51 74 54 68 6f 34 64 56 46 39 66 51 62 7972 70 4d 3d 20 20 75

15、73 65 72 38 30 32 0c 06 0000 05 aa 4f 2e 02 01 00 2c 01 06 07 62 32 51 3452 30 59 44 4e 33 51 74 54 68 6f 34 64 56 46 3966 51 62 79 72 70 4d 3d 20 20 75 73 65 72 38 3032 50 12 34 53 b5 20 dd 45 07 22 d0 77 af ee 4834 c8 36 04 06 c0 a8 0a 01 20 0e 70 6f 72 74 616c 64 65 76 69 63 65 05 06 01 00 40 14

16、3d 06 0010 31 38 61 39 2d 30 35 64 65 2d 30 61 37 33*Apr 27 09:13:37:47 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=PKT response Index = 80, ulParam3=111623536*Apr 27 09:13:37:189 2000 portaldevice RDS/7/DEBUG:Receive Raw Packet is:*Apr 27 09:13:37:281 2000 portaldevice RDS/7/DEBUG:0b e1 00 50 4c

17、 ee 58 c7 62 2e a2 41 e3 84 5c 358f b1 f3 13 4f 18 01 02 00 16 04 10 37 63 35 4767 4d 33 63 06 07 c8 64 10 ac 3b 23 18 12 37 6231 39 64 32 34 37 54 f8 7d 7b 3e 8c c0 4c 50 1289 c0 0f 2e 3c df c8 f6 dd 8c db 81 a7 48 a0 cc*Apr 27 09:13:37:686 2000 portaldevice RDS/7/DEBUG:No pick-up Notify from Recei

18、ve Raw Packet!*Apr 27 09:13:37:808 2000 portaldevice RDS/7/DEBUG:Receive:IP=00,Code=11, Le ngth=80*Apr 27 09:13:37:930 2000 portaldevice RDS/7/DEBUG:79 EAP-Message 24 01020016041037633547674D33630607C86410AC3B2324 State 18 376231396432343754F87D7B3E8CC04C80 Message-Autheticator 18 89C00F

19、2E3CDFC8F6DD8CDB81A748A0CC*Apr 27 09:13:38:294 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=EAP auth request In dex = 164, ulParam3=112983184*Apr 27 09:13:38:446 2000 portaldevice RDS/7/DEBUG:Se nd attribute list:*Apr 27 09:13:38:538 2000 portaldevice RDS/7/DEBUG:1 User- name 41 b2Q4R0YDN3QtTho4dV

20、F9fQbyrpM= user80212 Framed-MTU 6 145079 EAP-Message 31 0202001D0410101DB07D72FEFD80B0D938EA1342C12D7573657238303280 Message-Autheticator 18 000000000000000000000000000000004 NAS-IP-Address 6 32 NAS-lde ntifie门14 portaldevice*Apr 27 09:13:39:124 2000 portaldevice RDS/7/DEBUG:5 NAS-Port 6

21、 1679362061 NAS-Port-Type 6 156 Service-Type 6 27 Framed-Protocol 6 131 Caller-ID 16 313861392D303564652D3061373324 State 18 376231396432343754F87D7B3E8CC04C*Apr 27 09:13:39:600 2000 portaldevice RDS/7/DEBUG:NULL*Apr 27 09:13:39:671 2000 portaldevice RDS/7/DEBUG:Send: IP=00, Userlndex=16

22、4, ID=226, RetryTimes=0, Code=1, Length=194*Apr 27 09:13:39:853 2000 portaldevice RDS/7/DEBUG:Se nd Raw Packet is:*Apr 27 09:13:39:955 2000 portaldevice RDS/7/DEBUG:01 e2 00 c2 00 00 36 9f 00 00 71 d2 00 00 6c a400 00 50 9e 01 29 06 07 62 32 51 34 52 30 59 444e 33 51 74 54 68 6f 34 64 56 46 39 66 51

23、 62 7972 70 4d 3d 20 20 75 73 65 72 38 30 32 0c 06 0000 05 aa 4f 1f 02 02 00 1d 04 10 10 1d b0 7d 72fe fd 80 b0 d9 38 ea 13 42 c1 2d 75 73 65 72 3830 32 50 12 22 02 50 a9 32 9e 56 86 3d 14 c7 5f22 dc 9b 70 04 06 c0 a8 0a 01 20 0e 70 6f 72 7461 6c 64 65 76 69 63 65 05 06 01 00 40 14 3d 0600 00 00 0f

24、06 06 00 00 00 02 07 06 00 00 00 011f 10 31 38 61 39 2d 30 35 64 65 2d 30 61 37 33 c0 4c18 12 37 62 31 39 64 32 34 37 54 f8 7d 7b 3e 8c*Apr 27 09:13:40:804 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=PKT response Index = 143, ulParam3=111625904*Apr 27 09:13:40:955 2000 portaldevice RDS/7/DEBUG:Re

25、ceive Raw Packet is:*Apr 27 09:13:41:46 2000 portaldevice RDS/7/DEBUG:02 e2 00 8f 22 99 b1 a6 ff 86 65 65 9c df 68 18fb c6 29 c0 06 06 00 00 00 02 18 0a 37 63 35 4767 4d 3363 1d 06 0000 00 00 1b06 00 01 518155 06 0000 02 58 1a41 00 00 63a2 3d 3b 360600 00 0000 37 06 0000 00 00 3806 00 00 00003a 06 0

26、000 00 00 4206 00 00 0000 43 11 312020 20 5230 30 36 4230 33 44 3030 33 3d 0a3763 35 47 67 4d 33 63 4f 06 03 02 00 04 50 12 1a12 df 2f 39 35 05 98 d8 40 ab 7f 08 2b 1f 87*Apr 27 09:13:41:683 2000 portaldevice RDS/7/DEBUG:Warni ng: Ven dorlD=25506 is not recog ni zed, 59 bytes is ignored*Apr 27 09:13

27、:41:825 2000 portaldevice RDS/7/DEBUG:No pick-up Notify from Receive Raw Packet!*Apr 27 09:13:41:947 2000 portaldevice RDS/7/DEBUG:Receive:IP=00,Code=2 ,L e ngth=143*Apr 27 09:13:42:69 2000 portaldevice RDS/7/DEBUG:6 Service-Type 6 224 State 10 37633547674D336329 Termi natio n-Actio n 6

28、027 Sessio n-TimeOut 6 8640185 Acct_I nterimn terval 6 60079 EAP-Message 6 03020004*Apr 27 09:13:42:504 2000 portaldevice RDS/7/DEBUG:*Apr 27 09:13:42:674 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=Accou nt request In dex = 164, ulParam3=0*Apr 27 09:13:42:816 2000 portaldevice RDS/7/DEBUG:Se nd

29、attribute list:*Apr 27 09:13:42:907 2000 portaldevice RDS/7/DEBUG:1 User- name 41 b2Q4R0YDN3QtTho4dVF9fQbyrpM= user80232 NAS-Ide ntifier 14 portaldevice5 NAS-Port 6 1679362061 NAS-Port-Type 6 1531 Caller-ID 16 313861392D303564652D3061373340 Acct-Status-Type 6 1*Apr 27 09:13:43:413 2000 portaldevice

30、RDS/7/DEBUG:45 Acct-Authe ntic 6 144 Acct-Sessio n-ld 17 1000327091333014 NAS-IP-Address 6 55 Eve nt-Timestamp 6 956826814*Apr 27 09:13:43:737 2000 portaldevice RDS/7/DEBUG:Send: IP=00, UserIndex=164, ID=161, RetryTimes=0, Code=4, Length=144*Apr 27 09:13:43:919 2000 portaldevice RDS/7/DEBUG:Se nd Raw Packet is:*Apr 27 09:13:44:11 2000 portaldevice RDS/7/DEBUG:04 a1 00 90 7d eb f2 35 b3 43