R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

133

• The host is directly connected to the Firewall and the Firewall is configured for re-DHCP portal

authentication. The host is assigned with an IP address through the DHCP server. Before passing

portal authentication, the host uses an assigned private IP address. After passing portal

authentication, it can get a public IP address and then the user can access Internet resources.

• A RADIUS server serves as the authentication/accounting server.

Figure 118 Network diagram

Configuration procedure

NOTE:

• For re-DHCP authentication, configure a public address pool (20.20.20.0/24, in this example) and a

private address pool (10.0.0.0/24, in this example) on the DHCP server. (Details not shown.)

• For re-DHCP authentication, the Firewall must be configured as a DHCP relay agent (instead of a DHCP

server) and the portal-enabled interface must be configured with a primary IP address (a public IP

address) and a secondary IP address (a private IP address). For information about DHCP relay a

ent

configuration, see

Network Management Configuration Guide

• Make sure that the IP address of the portal device added on the portal server is the public IP address of

the interface connecting users (20.20.20.1 in this example), the private IP address range for the IP

address group associated with the portal device is the private network segment where the users reside

(10.0.0.0/24 in this example), and the public IP address range for the IP address group is the public

network segment 20.20.20.0/24.

• Configure IP addresses for the Firewall and servers as shown in Figure 118 an

d make sure that the host,

Firewall, and servers can reach each other.

• Configure the RADIUS server properly to provide authentication/accounting functions for users.

1. Configure a RADIUS scheme on the Firewall.

# Create a RADIUS scheme named rs1, and enter its view.

<Firewall> system-view

[Firewall] radius scheme rs1

# Set the server type for the RADIUS scheme. When using the IMC server, set the server type to

extended.

[Firewall-radius-rs1] server-type extended