1、交換機上結合IMC做802.1x+Portal 配置案例提示：建議將WORD顯示比例調整為150%查看1.配置要求：對交換機接入用戶做802.1x+Portal認證。2.網絡拓撲：3.設備端配置：portaldevicedis verH3C Comware Platform SoftwareComware Software, Version 5.20, Release 2202P19Copyright (c 2004-2010 Hangzhou H3C Tech. Co., Ltd. All rights reserved.H3C S5500-28C-EI uptime is 0 week,

2、0 day, 20 hours, 49 minutesportaldevice s5500-EIdis cu #version 5.20, Release 2202P19domain default enable ya /指定默認域名，并結合user-name-format without-domain這條命令，在802.1X時不用帶域名。dot1x /全局開啟dot1x功能portal server szhp ip 00 key szhp url 00:8080/portal（指定portal頁面）vlan 1vlan 10# vl

3、an 20#radius scheme szhprimary authentication 00primary accounting 00key authentication huakey accounting huauser-name-format without-domaindomain szh /portal配置，引用radius 方案szh.authentication portal radius-scheme szhauthorization portal radius-scheme szhaccounting portal radiu

4、s-scheme szhaccess-limit disablestate activeidle-cut disableself-service-url disabledomain ya /802.1X配置，引用radius 方案szh.authentication lan-access radius-scheme szhauthorization lan-access radius-scheme szhaccounting lan-access radius-scheme szhaccess-limit disablestate activeidle-cut disableself-serv

5、ice-url disable#user-group system#interface NULL0#interface Vlan-interface10ip address #interface Vlan-interface20 /portal認證VLANip address portal server szhp method direct#interface GigabitEthernet1/0/4port access vlan 20dot1x#snmp v3的配置snmp-agents

6、nmp-agent local-engineid 800063A203000FE2B23AD7snmp-agent community read publicsnmp-agent community write privatesnmp-agent sys-info version v3snmp-agent group v3 test_group privacy read-view test_view write-view test_view notify-view test_viewsnmp-agent mib-view included test_view isosnmp-agent usm

7、-user v3 test_user test_group authentication-mode md5 !QM%/G4DG2=O981L7YOQ! privacy-mode des56 !QM%/G4DG2=O981L7YOQ!#2.IMC上關于802.1X的配置：（1）創建用戶姓名：8021xuser(2給用戶姓名添加賬號：user802,密碼：*,并與之前創建的服務關聯。（3）用iNODE做客戶端驗證，先創建一個802.1x連接：圖（1）圖（2）圖（3）此處不帶域名需要在設備上指定默認域名（見配置）圖（4）802.1X驗證成功3.IMC關于Portal的配置:(1接入設備添加：共享密鑰

8、:hua ,為Portal設備和IMC最近的接口IP或者為nas-ip（2）創建服務(servicename（3）創建用戶姓名（4）給創建的用戶姓名添加賬號(account，密碼(123456，將用戶姓名和服務關聯起來。一個用戶姓名只能對應一個賬號.（5）創建一個服務，注意服務類型標識為domain名，為交換機portal認證的域名為szh，服務類型為描述的意思。在inode選擇服務類型即可，不用在用戶名輸入szh。（6）portal配置：添加啟用Portal設備名，IP地址一般為做Portal認證客戶端的網關IP.密鑰：szhp.(7添加IP地址組，地址為需要Port

9、al認證的地址段。（8）創建端口組，并將要認證的地址組關聯起來。9. 測試認證802.1x已認證成功。 認證之前Ping 不通網關地址（除了IMC服務器的地址外都不能訪問）如下圖：從該實驗中，可以看出802.1X驗證成功只相當于插上了網線，而ortal認證是基于三層的，在認證通過前只能與服務器通信。在瀏覽器中隨便輸入一個IP地址，會自動觸發Portal認證頁面如下圖：PORTAL認證頁面圖Portal認證成功后Ping測圖小結：結合IMC做Portal認證的基本流程：1. 添加接入設備。2. 創建服務。3. 創建用戶姓名，賬號，密碼，并將用戶與服務綁定4. 服務類型配置5. Portal的配置

10、:設備配置。6. IP地址組配置。7. 將IP地址組與設備綁定。注意1.portal認證時，如果用INODE認證，則必須將策略服務器關閉，否則認證后大概十秒鐘后下線，提示安全檢查沒通過。2.802.1X默認是CHAP認證方式，支持PAP,EAP，可用命令：dot1x authentication-method eap 修改。3在radius 認證時， V5產品必須在域中做授權配置authorization portal radius-scheme szh否則認證不成功，并且提示:Rejected by local server 錯誤。附帶：DO1X認證時的RADIUS報文:pr 27 09:1

11、3:34:679 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=EAP auth request Index = 164, ulParam3=112681088*Apr 27 09:13:34:831 2000 portaldevice RDS/7/DEBUG:Send attribute list:*Apr 27 09:13:34:923 2000 portaldevice RDS/7/DEBUG:1 User-name 41 b2Q4R0YDN3QtTho4dVF9fQbyrpM= user80212 Framed-MTU 6 145079

12、EAP-Message 46 0201002C01060762325134523059444E33517454686F34645646396651627972704D3D20207573657238303280 Message-Autheticator 18 000000000000000000000000000000004 NAS-IP-Address 6 32 NAS-Identifier 14 portaldevice*Apr 27 09:13:35:550 2000 portaldevice RDS/7/DEBUG:5 NAS-Port 6 1679362061

13、 NAS-Port-Type 6 156 Service-Type 6 27 Framed-Protocol 6 131 Caller-ID 16 313861392D303564652D30613733*Apr 27 09:13:35:934 2000 portaldevice RDS/7/DEBUG:Send: IP=00, UserIndex=164, ID=225, RetryTimes=0, Code=1, Length=191*Apr 27 09:13:36:116 2000 portaldevice RDS/7/DEBUG:Send Raw Packet

14、is:*Apr 27 09:13:36:208 2000 portaldevice RDS/7/DEBUG:01 e1 00 bf 00 00 16 4d 00 00 5f 3a 00 00 34 d4 00 00 25 93 01 29 06 07 62 32 51 34 52 30 59 44 4e 33 51 74 54 68 6f 34 64 56 46 39 66 51 62 79 72 70 4d 3d 20 20 75 73 65 72 38 30 32 0c 06 00 00 05 aa 4f 2e 02 01 00 2c 01 06 07 62 32 51 34 52 30

15、59 44 4e 33 51 74 54 68 6f 34 64 56 46 39 66 51 62 79 72 70 4d 3d 20 20 75 73 65 72 38 30 32 50 12 34 53 b5 20 dd 45 07 22 d0 77 af ee 48 34 c8 36 04 06 c0 a8 0a 01 20 0e 70 6f 72 74 61 6c 64 65 76 69 63 65 05 06 01 00 40 14 3d 06 00 00 00 0f 06 06 00 00 00 02 07 06 00 00 00 01 1f 10 31 38 61 39 2d

16、30 35 64 65 2d 30 61 37 33 *Apr 27 09:13:37:47 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=PKT response Index = 80, ulParam3=111623536*Apr 27 09:13:37:189 2000 portaldevice RDS/7/DEBUG:Receive Raw Packet is:*Apr 27 09:13:37:281 2000 portaldevice RDS/7/DEBUG:0b e1 00 50 4c ee 58 c7 62 2e a2 41 e3

17、84 5c 35 8f b1 f3 13 4f 18 01 02 00 16 04 10 37 63 35 47 67 4d 33 63 06 07 c8 64 10 ac 3b 23 18 12 37 62 31 39 64 32 34 37 54 f8 7d 7b 3e 8c c0 4c 50 12 89 c0 0f 2e 3c df c8 f6 dd 8c db 81 a7 48 a0 cc *Apr 27 09:13:37:686 2000 portaldevice RDS/7/DEBUG:No pick-up Notify from Receive Raw Packet!*Apr 2

18、7 09:13:37:808 2000 portaldevice RDS/7/DEBUG:Receive:IP=00,Code=11,Length=80*Apr 27 09:13:37:930 2000 portaldevice RDS/7/DEBUG:79 EAP-Message 24 01020016041037633547674D33630607C86410AC3B2324 State 18 376231396432343754F87D7B3E8CC04C80 Message-Autheticator 18 89C00F2E3CDFC8F6DD8CDB81A748

19、A0CC*Apr 27 09:13:38:294 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=EAP auth request Index = 164, ulParam3=112983184*Apr 27 09:13:38:446 2000 portaldevice RDS/7/DEBUG:Send attribute list:*Apr 27 09:13:38:538 2000 portaldevice RDS/7/DEBUG:1 User-name 41 b2Q4R0YDN3QtTho4dVF9fQbyrpM= user80212 Fram

20、ed-MTU 6 145079 EAP-Message 31 0202001D0410101DB07D72FEFD80B0D938EA1342C12D7573657238303280 Message-Autheticator 18 000000000000000000000000000000004 NAS-IP-Address 6 32 NAS-Identifier 14 portaldevice*Apr 27 09:13:39:124 2000 portaldevice RDS/7/DEBUG:5 NAS-Port 6 1679362061 NAS-Port-Type

21、 6 156 Service-Type 6 27 Framed-Protocol 6 131 Caller-ID 16 313861392D303564652D3061373324 State 18 376231396432343754F87D7B3E8CC04C*Apr 27 09:13:39:600 2000 portaldevice RDS/7/DEBUG:NULL*Apr 27 09:13:39:671 2000 portaldevice RDS/7/DEBUG:Send: IP=00, UserIndex=164, ID=226, RetryTimes=0,

22、Code=1, Length=194*Apr 27 09:13:39:853 2000 portaldevice RDS/7/DEBUG:Send Raw Packet is:*Apr 27 09:13:39:955 2000 portaldevice RDS/7/DEBUG:01 e2 00 c2 00 00 36 9f 00 00 71 d2 00 00 6c a4 00 00 50 9e 01 29 06 07 62 32 51 34 52 30 59 44 4e 33 51 74 54 68 6f 34 64 56 46 39 66 51 62 79 72 70 4d 3d 20 20

23、 75 73 65 72 38 30 32 0c 06 00 00 05 aa 4f 1f 02 02 00 1d 04 10 10 1d b0 7d 72 fe fd 80 b0 d9 38 ea 13 42 c1 2d 75 73 65 72 38 30 32 50 12 22 02 50 a9 32 9e 56 86 3d 14 c7 5f 22 dc 9b 70 04 06 c0 a8 0a 01 20 0e 70 6f 72 74 61 6c 64 65 76 69 63 65 05 06 01 00 40 14 3d 06 00 00 00 0f 06 06 00 00 00 02

24、 07 06 00 00 00 01 1f 10 31 38 61 39 2d 30 35 64 65 2d 30 61 37 33 18 12 37 62 31 39 64 32 34 37 54 f8 7d 7b 3e 8c c0 4c *Apr 27 09:13:40:804 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=PKT response Index = 143, ulParam3=111625904*Apr 27 09:13:40:955 2000 portaldevice RDS/7/DEBUG:Receive Raw Pack

25、et is:*Apr 27 09:13:41:46 2000 portaldevice RDS/7/DEBUG:02 e2 00 8f 22 99 b1 a6 ff 86 65 65 9c df 68 18 fb c6 29 c0 06 06 00 00 00 02 18 0a 37 63 35 47 67 4d 33 63 1d 06 00 00 00 00 1b 06 00 01 51 81 55 06 00 00 02 58 1a 41 00 00 63 a2 3d 3b 36 06 00 00 00 00 37 06 00 00 00 00 38 06 00 00 00 00 3a 0

26、6 00 00 00 00 42 06 00 00 00 00 43 11 31 20 20 20 52 30 30 36 42 30 33 44 30 30 33 3d 0a 37 63 35 47 67 4d 33 63 4f 06 03 02 00 04 50 12 1a 12 df 2f 39 35 05 98 d8 40 ab 7f 08 2b 1f 87 *Apr 27 09:13:41:683 2000 portaldevice RDS/7/DEBUG:Warning: VendorID=25506 is not recognized, 59 bytes is ignored *

27、Apr 27 09:13:41:825 2000 portaldevice RDS/7/DEBUG:No pick-up Notify from Receive Raw Packet!*Apr 27 09:13:41:947 2000 portaldevice RDS/7/DEBUG:Receive:IP=00,Code=2,Length=143*Apr 27 09:13:42:69 2000 portaldevice RDS/7/DEBUG:6 Service-Type 6 224 State 10 37633547674D336329 Termination-Act

28、ion 6 027 Session-TimeOut 6 8640185 Acct_Interim_Interval 6 60079 EAP-Message 6 03020004*Apr 27 09:13:42:504 2000 portaldevice RDS/7/DEBUG:80 Message-Autheticator 18 1A12DF2F39350598D840AB7F082B1F87*Apr 27 09:13:42:674 2000 portaldevice RDS/7/DEBUG:Recv MSG,MsgType=Account request Index = 164, ulPar

29、am3=0*Apr 27 09:13:42:816 2000 portaldevice RDS/7/DEBUG:Send attribute list:*Apr 27 09:13:42:907 2000 portaldevice RDS/7/DEBUG:1 User-name 41 b2Q4R0YDN3QtTho4dVF9fQbyrpM= user80232 NAS-Identifier 14 portaldevice5 NAS-Port 6 1679362061 NAS-Port-Type 6 1531 Caller-ID 16 313861392D303564652D3061373340

30、Acct-Status-Type 6 1*Apr 27 09:13:43:413 2000 portaldevice RDS/7/DEBUG:45 Acct-Authentic 6 144 Acct-Session-Id 17 1000327091333014 NAS-IP-Address 6 55 Event-Timestamp 6 956826814*Apr 27 09:13:43:737 2000 portaldevice RDS/7/DEBUG:Send: IP=00, UserIndex=164, ID=161, RetryTimes=0, Code=4, Length=144*Apr 27 09:13:43:919 2000 portaldevice RDS/7/DEBUG:Send Raw Packet is:*Apr 27 09:13:44:11 2000 portaldevice RDS/7/DEBUG:04 a1 00 90 7d eb f2 35 b3 43 81 2a 7f ec b2 ea 6b 77 a0 8b 01 29 06 07 62 3