R3303-HP HSR6800 Routers Security Configuration Guide
45
Creating an ISP domain
In a networking scenario with multiple ISPs, the device can connect users of different ISPs. Different ISP
users can have different user attributes (such as username and password structures), different service
types, and different rights. To manage these ISP users, you need to create ISP domains and then
configure AAA methods and domain attributes for each ISP domain.
The device can accommodate up to 16 ISP domains, including the system predefined ISP domain system.
You can specify one ISP domain as the default domain.
On the device, each user belongs to an ISP domain. If a user provides no ISP domain name at login, the
device considers the user belongs to the default ISP domain.
The device chooses an authentication domain for each user in the following order:
• The authentication domain specified for the access module
• The ISP domain in the username
• The default ISP domain of the device
• The ISP domain specified for users with unknown domain names
If all the domains are unavailable, user authentication will fail.
NOTE:
Support for the authentication domain confi
g
uration depends on the access module. You can specify an
authentication domain for 802.1X, portal, or MAC address authentication.
To create an ISP domain:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Create an ISP domain and
enter ISP domain view.
domain isp-name N/A
3. Return to system view.
quit N/A
4. Specify the default ISP
domain.
domain default enable
isp-name
Optional.
By default, the default ISP domain is the
system predefined ISP domain system.
5. Specify an ISP domain for
users with unknown domain
names.
domain if-unknown
isp-name
Optional.
By default, no ISP domain is specified for
users with unknown domain names.
To delete the ISP domain that is functioning as the default ISP domain, you must change it to a non-default
ISP domain by using the undo domain default enable command.
Configuring ISP domain attributes
In an ISP domain, you can configure the following attributes:
• Domain status—By placing the ISP domain to the active or blocked state, you allow or deny
network service requests from users in the domain.