User's Manual Part 2


61JadeOSUserManual
9.7WEBPortalAuthentication
Webauthentication isanauthentication scheme basedon browser.User that failed
authentication wi ll redirect to a  login page, and require to input user name and
password; user can access the network only after successfully authentication. WEB
redirectsupportsDNATredirectandHTTP302redirect.
9.7.1WebAuthenticationProcess
WebauthenticationisbasedonHTTPprotocol;authenticationwillnotpopupforci‐
blyunlessusersendHTTPrequest.
TheauthenticationprocessofWEBauthenticationisasfollows:
• AuserthatunauthenticatedbegintobrowsernetworkpageandsendHTTPre‐
quest
• HTTPrequestisredirecttoanexternalportalserver
• Portserversendanauthenticationpageforsecurelogin
• Userinputusernameandpassword;browserwilltransferittothewebportal
(authenticationmoduleinJadeOS),andthenwebportalsendauthentication
requesttotheradiusserver
• JadeOSwilldecidewhetherauthenticatesuccessfullythroughuserdatabasein
radiusserver;ifsuccessfullyauthenticate,radiusserverwillinformJadeOS,at
thesametime,JadeOSinformportalserver
• Portalserverpopsupwelc omepage;theuserauthenticationisover
9.7.2DNATRedirect
TheredirectoperationofJadeOSisbasedonDNATbydefault.
Beforeauthentication,sessionACLwillredirectHTTPrequesttoportalserver.
Theconfigurationcommandisasfollows:
(JadeOS) (config) #ip access-list session pre-auth-acl
(JadeOS) (config-sess-pre-auth-acl)#any any tcp 0 65535 dst-nat ip
10.0.0.2 443
(JadeOS) (config-sess-pre-auth-acl)#any any ucp 0 65535 dst-nat ip
10.0.0.2 443
9.7.3HTTP302Redirect
ToconfigureHTTP302redirect,usethefollowingsteps:
Step1ConfigureURLlistinconfigmode:
(JadeOS) (config)# aaa http-redirection-url 1 ip 10.0.0.1 url
http://10.0.0.1/wlan/index.php
Step2SpecifyURLID