R2511-HP MSR Router Series Security Configuration Guide(V5)

290
Authentication page customization support
The local portal server function allows you to customize authentication pages. You can customize
authentication pages by editing the corresponding HTML files and then compress and save the files to the
storage medium of the device. A set of customized authentication pages consists of six authentication
pages: the logon page, the logon success page, the online page, the logoff success page, the logon
failure page, and the system busy page. A local portal server pushes a corresponding authentication
page at each authentication phase. If you do not customize the authentication pages, the local portal
server pushes the default authentication pages. For information about authentication page customization
rules, see "Customizing authentication pages."
Portal authentication modes
Portal authentication can work at Layer 2 or Layer 3 of the OSI model.
The following matrix shows the feature and router compatibility:
Feature
MSR90
0
MSR93
X
MSR20-
1
X
MSR20 MSR30 MSR50
MSR10
00
Layer 2 portal
authentication
No No No No
Supported on MIM-FSW
modules, MSR30-11E,
and MSR30-11F
No No
Layer 2 portal authentication
You can enable Layer 2 portal authentication on an access device's Layer 2 port that connects
authentication clients, so that only clients whose MAC addresses pass authentication can access the
external network. Only the local portal server provided by the access device supports Layer 2 portal
authentication.
Layer 3 portal authentication
You can enable Layer 3 authentication on an access device's Layer 3 interfaces that connect
authentication clients. Portal authentication performed on a Layer 3 interface can be direct authentication,
re-DHCP authentication, or cross-subnet authentication. In direct authentication and re-DHCP
authentication, no Layer 3 forwarding devices exist between the authentication client and the access
device. In cross-subnet authentication, Layer 3 forwarding devices might exist between the authentication
client and the access device.
• Direct authentication
Before authentication, a user manually configures a public IP address or directly obtains a public
IP address through DHCP, and can access only the portal server and predefined free websites.
After passing authentication, the user can access the network resources. The process of direct
authentication is simpler than that of re-DHCP authentication.
• Re-DHCP authentication
Before authentication, a user gets a private IP address through DHCP and can access only the
portal server and predefined free websites. After passing authentication, the user is allocated a
public IP address and can access the network resources. No public IP address is allocated to those
who fail authentication. This solves the IP address planning and allocation problem. For example,
a service provider can allocate public IP addresses to broadband users only when they access
networks beyond the residential community network.
The local portal server does not support re-DHCP portal authentication.
• Cross-subnet authentication