H3C Technologies H3C S7500E Series Switches User Manual

Page 157

8-20

For re-DHCP authentication, you need to configure a public address pool (20.20.20.0/24, in

this example) and a private address pool (10.0.0.0/24, in this example) on the DHCP server.

The configuration steps are omitted. For DHCP configuration information, see DHCP

Server Configuration in the Layer 3 - IP Services Configuration Guide.

For re-DHCP authentication, the switch must be configured as a DHCP relay agent (instead

of a DHCP server) and the portal-enabled interface must be configured with a primary IP

address (a public IP address) and a secondary IP address (a private IP address).

Make sure that the IP address of the portal device added on the portal server is the private

IP address of the interface connecting users (10.0.0.1 in this example), and the IP address

group associated with the portal device is the private network segment where the users

reside (10.0.0.0/24 in this example).

You need to configure IP addresses for the devices as shown in

and ensure

that the devices can reach each other.

Perform configurations on the RADIUS server to ensure that the user authentication and

accounting functions can work normally.

Configure the switch:

1) Configure a RADIUS scheme

# Create a RADIUS scheme named rs1 and enter its view.

system-view

[Switch] radius scheme rs1

# Set the server type for the RADIUS scheme. When using the iMC server, you need set the
server type to extended.

[Switch-radius-rs1] server-type extended

# Specify the primary authentication server and primary accounting server, and configure the

keys for communication with the servers.

[Switch-radius-rs1] primary authentication 192.168.0.113

[Switch-radius-rs1] primary accounting 192.168.0.113

[Switch-radius-rs1] key authentication radius

[Switch-radius-rs1] key accounting radius

# Specify that the ISP domain name should not be included in the username sent to the

RADIUS server.

[Switch-radius-rs1] user-name-format without-domain

[Switch-radius-rs1] quit

2) Configure an authentication domain

# Create an ISP domain named dm1 and enter its view.

[Switch] domain dm1

# Configure the ISP domain to use RADIUS scheme rs1.

[Switch-isp-dm1] authentication portal radius-scheme rs1

[Switch-isp-dm1] authorization portal radius-scheme rs1

[Switch-isp-dm1] accounting portal radius-scheme rs1

[Switch-isp-dm1] quit

This manual is related to the following products: