WiFi认证平台对接华为ME60实现微信、短信、访客和MAC快速认证应用

2019-01-29-WiFi认证平台 / 网络运营融合平台阅(25761)

详细说明
相关推荐

配置三层IPoE接入(Portal推送)示例

介绍一个三层IPoE接入(Portal推送)的配置示例，结合配置组网图来理解业务的配置过程。配置示例包括组网需求、思路准备、操作步骤和配置文件。

组网需求

如图1所示，三层IPoE接入组网需求为：

用户归属于isp2域，经DHCP Relay设备ME60A，从ME60B的GE1/0/2接口下以三层IPoE方式接入。

用户采用Web认证，并采用RADIUS认证模式和RADIUS计费模式。

RADIUS服务器地址为192.168.8.249，认证和计费端口分别是1812和1813，采用标准RADIUS协议，密钥为hello。

DNS服务器地址为192.168.8.252。

Web服务器、Web认证服务器和Portal服务器集成到一台设备上，Portal服务器地址为192.168.8.251。

为了提升Portal推送的准确率，需要配置基于流的Portal推送。如果用户访问指定的网页（IP地址：4.4.4.4），要进行Portal推送。

图1 三层IPoE（Portal推送）配置举例组网图

配置思路

配置思路如下，以下除了DHCP中继功能外，其他功能都是在ME60B上配置的：

配置ME60A的DHCP中继功能

配置认证方案和计费方案

配置RADIUS服务器组

配置地址池

配置Web认证的认证前域和认证域

配置Web认证服务器

配置Portal服务器

配置Portal业务策略

配置UCL规则和流量管理策略

配置BAS接口和上行接口

数据准备

完成此配置举例，需要准备以下数据：

认证模板的名称和认证方式

计费模板的名称和计费方式

RADIUS服务器组名称，RADIUS认证服务器和RADIUS计费服务器的IP地址、端口号

地址池名称、网关地址、DNS服务器地址

域的名称

Portal业务策略

Portal服务器地址

UCL规则

流量管理策略

BAS接口参数

操作步骤

在ME60A和ME60B上分别配置接口IP地址。

配置ME60A

<me60a> system-view
[ME60A] interface GigabitEthernet1/0/2
[ME60A-GigabitEthernet1/0/2] ip address 11.11.11.1 255.255.255.0
[ME60A-GigabitEthernet1/0/2] quit
[ME60A] interface GigabitEthernet1/0/1.1
[ME60A-GigabitEthernet1/0/1.1] ip address 192.168.1.2 255.255.255.0
[ME60A-GigabitEthernet1/0/1.1] vlan-type dot1q 1
[ME60A-GigabitEthernet1/0/1.1] quit

配置ME60B

[ME60B] interface GigabitEthernet1/0/2.1
[ME60B-GigabitEthernet1/0/2.1] ip address 192.168.1.1 255.255.255.0
[ME60B-GigabitEthernet1/0/2.1] vlan-type dot1q 1
[ME60B-GigabitEthernet1/0/2.1] quit
在ME60A上配置Relay功能。
[ME60A] interface GigabitEthernet1/0/2
[ME60A-GigabitEthernet1/0/2] dhcp select relay
[ME60A-GigabitEthernet1/0/2] ip relay address 192.168.1.1
[ME60A-GigabitEthernet1/0/2] quit
在ME60B上配置网络侧地址池，网关与Relay (ME60A) 入接口的IP地址在同一个网段。
<me60b> system-view
[ME60B] ip pool huawei bas local
[ME60B-ip-pool-huawei] gateway 11.11.11.1 24
[ME60B-ip-pool-huawei] section 0 11.11.11.2 11.11.11.255
[ME60B-ip-pool-huawei] dns-server 192.168.8.252
[ME60B-ip-pool-huawei] quit

配置AAA方案

配置认证方案

[ME60B] aaa
[ME60B-aaa] authentication-scheme auth2
[ME60B-aaa-authen-auth2] authentication-mode radius
[ME60B-aaa-authen-auth2] quit

配置计费方案

[ME60B-aaa] accounting-scheme acct2
[ME60B-aaa-accounting-acct2] accounting-mode radius
[ME60B-aaa-accounting-acct2] quit
[ME60B-aaa] quit

配置RADIUS服务器组

[ME60B] radius-server group rd2
[ME60B-radius-rd2] radius-server authentication 192.168.8.249 1812
[ME60B-radius-rd2] radius-server accounting 192.168.8.249 1813
[ME60B-radius-rd2] radius-server type standard
[ME60B-radius-rd2] radius-server shared-key hello
[ME60B-radius-rd2] quit

配置域

配置default0域，作为Web认证的认证前域。

[ME60B] user-group huawei
[ME60B] aaa
[ME60B-aaa] domain default0
[ME60B-aaa-domain-default0] user-group huawei
[ME60B-aaa-domain-default0] web-server 192.168.8.251
[ME60B-aaa-domain-default0] web-server url http://192.168.8.251
[ME60B-aaa-domain-default0] ip-pool huawei
[ME60B-aaa-domain-default0] quit

配置Portal业务策略

[ME60B] service-group portal-group
[ME60B] service-policy name portal-policy portal
[ME60B-service-policy-pt] service-group portal-group
[ME60B-service-policy-pt] quit

配置认证域isp2，域下绑定Portal业务策略

[ME60B-aaa] domain isp2
[ME60B-aaa-domain-isp2] authentication-scheme auth2
[ME60B-aaa-domain-isp2] accounting-scheme acct2
[ME60B-aaa-domain-isp2] radius-server group rd2
[ME60B-aaa-domain-isp2] portal-server 192.168.8.251
[ME60B-aaa-domain-isp2] portal-server url http://192.168.8.251/portal/admin/
[ME60B-aaa-domain-isp2] service-policy portal-policy
[ME60B-aaa-domain-isp2] quit
[ME60B-aaa] quit

配置Web认证服务器

[ME60B] web-auth-server 192.168.8.251

配置UCL

配置用户在前域时，重定向到Web认证页面的UCL规则，其中UCL 6000里配置的是允许用户访问的网页的IP地址。

[ME60B] acl 6000
[ME60B-acl-ucl-6000] rule 10 permit ip source user-group huawei destination ip-address 127.0.0.1 0
[ME60B-acl-ucl-6000] rule 15 permit ip source ip-address 127.0.0.1 0  destination user-group huawei

说明：
配置针对127.0.0.1的UCL是为了让上送ME60B设备CPU的用户报文能顺利通过。如果是在BSUA/MSUA单板上配置BAS接口，则需要配置针对127.0.0.1的UCL；如果是在BSUF-21/BSUF-40单板上配置BAS接口，则此处的127.0.0.1也可以替换为地址池gateway地址11.11.11.1。

[ME60B-acl-ucl-6000] rule 20 permit ip source user-group huawei destination ip-address 192.168.8.252 0
[ME60B-acl-ucl-6000] rule 25 permit ip source ip-address 192.168.8.252 0  destination user-group huawei
[ME60B-acl-ucl-6000] rule 30 permit ip source user-group huawei destination ip-address 192.168.8.249 0
[ME60B-acl-ucl-6000] rule 35 permit ip source ip-address 192.168.8.249 0  destination user-group huawei
[ME60B-acl-ucl-6000] rule 40 permit ip source user-group huawei destination ip-address 192.168.8.251 0
[ME60B-acl-ucl-6000] rule 45 permit ip source ip-address 192.168.8.251 0  destination user-group huawei
[ME60B] acl 6001
[ME60B-acl-ucl-6001] rule 10 permit tcp source user-group huawei destination-port eq www
[ME60B-acl-ucl-6001] rule 15 permit tcp source user-group huawei destination-port eq 8080
[ME60B-acl-ucl-6001] rule 20 permit ip source user-group huawei

配置用户在认证域时，访问指定的网页会被重定向到Portal推送页面的UCL规则，其中4.4.4.4为指定的某个网页的IP地址，192.168.8.251为PORTAL服务器地址

ME60B] acl 7000
ME60B-acl-ucl-7000] rule 5 permit tcp source service-group portal-group destination ip-address 4.4.4.4 0 destination-port eq www
ME60B-acl-ucl-7000] rule 10 permit tcp source service-group portal-group destination ip-address 4.4.4.4 0 destination-port eq 8080
ME60B-acl-ucl-7000] rule 15 permit tcp source service-group portal-group destination ip-address 192.168.8.251 0 destination-port eq www
ME60B-acl-ucl-7000] rule 20 permit tcp source service-group portal-group destination ip-address 192.168.8.251 0 destination-port eq 8080
ME60B-acl-ucl-7000] quit

配置流量管理策略

[ME60B] traffic classifier web_permit
[ME60B-classifier-web_permit] if-match acl 6000
[ME60B-classifier-web_permit] quit
[ME60B] traffic behavior web_permit
[ME60B-behavior-web_permit] permit
[ME60B-behavior-web_permit] quit
[ME60B] traffic classifier web_deny
[ME60B-classifier-web_deny] if-match acl 6001
[ME60B-classifier-web_deny] quit

[ME60B] traffic behavior web_deny
[ME60B-behavior-web_deny] http-redirect
[ME60B-behavior-web_deny] quit
[ME60B] traffic behavior portal
[ME60B-behavior-portal] if-match acl 7000
[ME60B-behavior-portal] quit
[ME60B] traffic behavior portal
[ME60B-behavior-portal] redirect-cpu portal
[ME60B-behavior-portal] quit
[ME60B] traffic policy l3-ipoe
[ME60B-policy-l3-ipoe] classifier portal behavior portal
[ME60B-policy-l3-ipoe] classifier web_permit behavior web_permit
[ME60B-policy-l3-ipoe] classifier web_deny behavior web_deny
[ME60B-policy-l3-ipoe] quit

在全局下应用用户侧流量管理策略

[ME60B] traffic-policy l3-ipoe inbound
[ME60B] traffic-policy l3-ipoe outbound

配置接口

配置BAS接口

[ME60B] interface GigabitEthernet 1/0/2.1
[ME60B-GigabitEthernet1/0/2.1] vlan-type dot1q 1
[ME60B-GigabitEthernet1/0/2.1] ip address 192.168.1.1 255.255.255.0 
[ME60B-GigabitEthernet1/0/2.1] bas
[ME60B-GigabitEthernet1/0/2.1-bas] access-type layer3-subscriber default-domain pre-authentication default0 authentication isp2
[ME60B-GigabitEthernet1/0/2.1-bas] quit
[ME60B-GigabitEthernet1/0/2.1] quit

配置上行接口。

[ME60B] interface GigabitEthernet 1/0/1
[ME60B-GigabitEthernet1/0/1] ip address 192.168.8.1 255.255.255.0
[ME60B-GigabitEthernet1/0/1] quit

配置文件

ME60A的配置文件

#
 sysname ME60A
#
interface 1/0/2
 undo shutdown
 ip address 11.11.11.1 255.255.255.0
 ip relay address 192.168.1.1
 dhcp select relay
#
interface GigabitEthernet1/0/1.1
 vlan-type dot1q 1
 ip address 192.168.1.2 255.255.255.0
#
return

ME60B的配置文件

#
 sysname ME60B
#
user-group huawei
#
radius-server group rd2
 radius-server authentication 192.168.8.249 1812 weight 0
 radius-server accounting 192.168.8.249 1813 weight 0
 radius-server shared-key hello       
#
acl number 6000
rule 10 permit ip source user-group huawei destination ip-address 127.0.0.1 0 
rule 15 permit ip source ip-address 127.0.0.1 0  destination user-group huawei
rule 20 permit ip source user-group huawei destination ip-address 192.168.8.252 0
rule 25 permit ip source ip-address 192.168.8.252 0  destination user-group huawei
rule 30 permit ip source user-group huawei destination ip-address 192.168.8.249 0
rule 35 permit ip source ip-address 192.168.8.249 0  destination user-group huawei
rule 40 permit ip source user-group huawei destination ip-address 192.168.8.251 0
rule 45 permit ip source ip-address 192.168.8.251 0  destination user-group huawei
#
acl number 6001
rule 10 permit tcp source user-group huawei destination-port eq www
rule 15 permit tcp source user-group huawei destination-port eq 8080
rule 20 permit ip source user-group huawei
#
acl number 7000                                                               
rule 5 permit tcp source service-group portal-group destination ip-address 4.4.4.4 0 destination-port eq www
rule 10 permit tcp source service-group portal-group destination ip-address 4.4.4.4 0 destination-port eq 8080
rule 15 permit tcp source service-group portal-group destination ip-address 192.168.8.251 0 destination-port eq www
rule 20 permit tcp source service-group portal-group destination ip-address 192.168.8.251 0 destination-port eq 8080
#
traffic classifier web_permit operator or
if-match acl 6000
traffic classifier web_deny operator or
if-match acl 6001
traffic classifier portal operator or
if-match acl 7000

#
traffic behavior web_permit
traffic behavior web_deny
http-redirect
traffic behavior portal
redirect-cpu portal

#
traffic policy l3-ipoe
share-mode
classifier portal behavior portal
classifier web_permit behavior web_permit
classifier web_deny behavior web_deny
#
ip pool huawei bas local
 gateway 11.11.11.1 255.255.255.0
 section 0 11.11.11.2 11.11.11.255 
 dns-server 192.168.8.252
#
aaa  
 authentication-scheme auth2
 #
  accounting-scheme acct2 
 #  
 domain default0
  user-group huawei
  web-server 192.168.8.251
  web-server url http://192.168.8.251
  ip-pool huawei
 domain isp2
  authentication-scheme auth2
  accounting-scheme acct2
  radius-server group rd2
  portal-server 192.168.8.251
  portal-server url http://192.168.8.251/portal/admin/
  service-policy portal-policy
#
interface GigabitEthernet1/0/2
 undo shutdown
#
interface GigabitEthernet1/0/2.1
 vlan-type dot1q 1
 ip address 192.168.1.1 255.255.255.0
 bas
 #
  access-type layer3-subscriber default-domain pre-authentication default0 authentication isp2
#
 ip route-static 11.11.11.1 255.255.255.255 192.168.1.2

#
 traffic-policy l3-ipoe inbound
 traffic-policy l3-ipoe outbound
#
 web-auth-server 192.168.8.251
#
return</me60b></me60a>