158
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter portal
authentication
server view.
portal server
server-name
N/A
3. Configure portal
user
synchronization.
user-sync timeout
timeout
By default, portal user
synchronization is disabled.
Configuring the portal fail-permit feature
Perform this task to configure the portal fail-permit feature on an interface. When the access device
detects that the portal authentication server or portal Web server is unreachable, it allows users on
the interface to have network access without portal authentication.
If you enable fail-permit for both a portal authentication server and a portal Web server on an
interface, the interface does the following:
• Disables portal authentication when either server is unreachable.
• Resumes portal authentication when both servers are reachable.
After portal authentication resumes, unauthenticated users must pass portal authentication to
access the network. Users who have passed portal authentication before the fail-permit event can
continue accessing the network.
To configure portal fail-permit:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
interface
interface-type
interface-number
N/A
3. Enable portal
fail-permit for a portal
authentication server.
portal
[
ipv6
]
fail-permit server
server-name
By default, portal fail-permit is
disabled for a portal
authentication server.
4. Enable portal
fail-permit for a portal
Web server.
portal
[
ipv6
]
apply web-server
server-name [
fail-permit
]
By default, portal fail-permit is
disabled for a portal Web server.
Configuring BAS-IP for portal packets sent to the
portal authentication server
If the device runs Portal 2.0, the unsolicited packets sent to the portal authentication server must
carry the BAS-IP attribute. If the device runs Portal 3.0, the unsolicited packets sent to the portal
authentication server must carry the BAS-IP or BAS-IPv6 attribute.
If IPv4 portal authentication is enabled on an interface, you can configure the BAS-IP attribute on the
interface. If IPv6 portal authentication is enabled on an interface, you can configure the BAS-IPv6
attribute on the interface.
After this attribute is configured, the source IP address for unsolicited notification portal packets the
device sends to the portal authentication server is the configured BAS-IP or BAS-IPv6 address. If the
attribute is not configured, the source IP address of the portal packets is the IP address of the packet
output interface.
To Next Page
Loading...
Need help?
General