自学Aruba5.3.3-Aruba安全认证-有PEFNG 许可证环境的认证配置Captive-Portal

点击返回：自学Aruba之路

自学Aruba5.3.3-Aruba安全认证-有PEFNG 许可证环境的认证配置Captive-Portal

1. Captive-Portal认证配置前言

1.1 新建web认证服务器派生角色

在导入了PEFNG许可证后，系统不会对Web认证的aaa authentication captive-protal自动生成一个对应的role，因此需要为认证前的用户派生一个角色，并设置弹出认证界面。

1.2 新建web认证服务器派生角色

由于Policy“logon-control”中的允许ping的rule，使得web认证的用户接入SSID后，可以ping通其他地址，容易给客户造成误解。因此建议把配置web认证前，把策略“logon-control”中的允许ping关闭。 

1 (Aruba650) (config) #ip access-list session logon-control
2 (Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny    ## 关闭logon-control角色中ping功能
1 (Aruba650) (config) #user-role yk-web           */ 定义Captive-Portal的角色为yk-web
2 (Aruba650) (config-role) #session-acl logon-control
3 (Aruba650) (config-role) #session-acl captiveportal 
4 (Aruba650) (config-role) #session-acl vpnlogon 
5 (Aruba650) (config-role) #captive-portal web-auth
6 (Aruba650) (config-role) #exit

2.Captive-Portal认证配置命令

2.1 采用InterDB认证服务器完成Captive-Portal认证

 1 (Aruba650) (config) #aaa server-group web-server
 2 (Aruba650) (Server Group "web-server") #auth-server Internal
 3 (Aruba650) (Server Group "web-server") #set role condition role value-of
 4 (Aruba650) (Server Group "web-server") #exit
 5 
 6 (Aruba650) (config) #aaa authentication captive-portal web-auth
 7 (Aruba650) (Captive Portal Authentication Profile "web-auth") #server-group web-server
 8 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http    ##采用http进行认证
 9 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1 ##认证后自动跳转1s
10 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
11 (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit
12 
13 (Aruba650) (config) #ip access-list session logon-control
14 (Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny   ##关闭ping
15 
16 (Aruba650) (config) #user-role yk-web
17 (Aruba650) (config-role) #session-acl logon-control
18 (Aruba650) (config-role) #session-acl captiveportal 
19 (Aruba650) (config-role) #session-acl vpnlogon 
20 (Aruba650) (config-role) #captive-portal web-auth
21 (Aruba650) (config-role) #exit
22 
23 (Aruba650) (config) #aaa profile web-profile
24 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web          ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
25 (Aruba650) (AAA Profile "web-profile") #exit
26 
27 (Aruba650) (config) #wlan ssid-profile web-ssid
28 (Aruba650) (SSID Profile "web-ssid") #essid webyk
29 (Aruba650) (SSID Profile "web-ssid") #exit
30 
31 (Aruba650) (config) #wlan virtual-ap web-vap
32 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
33 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
34 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
35 (Aruba650) (Virtual AP profile "web-vap") #exit
36 
37 (Aruba650) (config) #ap-group webyk
38 (Aruba650) (AP group "webyk") #virtual-ap web-vap
39 (Aruba650) (AP group "webyk") #exit
1 (Aruba650) #local-userdb add username test1 password 123456 role web-1     ##建立两两个用户test1 test2 对应派生的角色web-1 web-2
2 (Aruba650) #local-userdb add username test2 password 123456 role web-2

2.2 采用LDAP认证服务器完成Captive-Portal认证

2.2.1 LDAP相关的配置

1 (Aruba650) #configure terminal 
2 (Aruba650) (config) #aaa authentication-server ldap ad
3 (Aruba650) (LDAP Server "ad") #host 172.18.50.30
4 (Aruba650) (LDAP Server "ad") #admin-dn cn=rui,cn=Users,dc=ruitest,dc=com
5 (Aruba650) (LDAP Server "ad") #admin-passwd 123456
6 (Aruba650) (LDAP Server "ad") #allow-cleartext 
7 (Aruba650) (LDAP Server "ad") #base-dn cn=Users,dc=ruitest,dc=com
8 (Aruba650) (LDAP Server "ad") #preferred-conn-type clear-text 
9 (Aruba650) (LDAP Server "ad") #exit
1 (Aruba650) #aaa test-server pap ad carlos 123456  ##测试是否和LDAP服务器建立连接
2 Authentication Successful                         ##认证成功
 1 (Aruba650) # aaa query-user ad carlos     ##  参看用户carlos，LADP返回的值
 2 
 3 objectClass: top 
 4 objectClass: person 
 5 objectClass: organizationalPerson 
 6 objectClass: user 
 7 cn: carlos
 8 sn: carlos
 9 distinguishedName: CN=carlos,CN=Users,DC=ruitest,DC=com ##返回值的用户组，AC可以根据返回值匹配来定义该用户所属的组
10 instanceType: 4 
11 whenCreated: 20180117082111.0Z 
12 whenChanged: 20180417082815.0Z 
13 displayName: carlos
14 uSNCreated: 368694 
15 memberOf: CN=tech1,CN=Users,DC=ruitest,DC=com 
16 uSNChanged: 368706 
17 name: wang1 
18 objectGUID: n\240\203\277T\345\002K\235\202y\351\372\240<\376 
19 userAccountControl: 66048 
20 badPwdCount: 0

2.2.2 无线相关的配置

 1 (Aruba650) #configure terminal 
 2 (Aruba650) (config) #aaa server-group web-server
 3 (Aruba650) (Server Group "web-server") #no auth-server Internal
 4 (Aruba650) (Server Group "web-server") #auth-server ad
 5 (Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech1,CN=Users,DC=ruitest,DC=com set-value web-1    ##返回组名为test1，匹配到role web-1
 6 (Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech2,CN=Users,DC=ruitest,DC=com set-value web-2
 7 (Aruba650) (Server Group "web-server") #exit
 8 
 9 (Aruba650) (config) #aaa authentication captive-portal web-auth
10 (Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
11 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http 
12 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1 
13 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
14  (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit
15 
16 (Aruba650) (config) #user-role yk-web
17 (Aruba650) (config-role) #session-acl logon-control
18 (Aruba650) (config-role) #session-acl captiveportal 
19 (Aruba650) (config-role) # session-acl vpnlogon 
20 (Aruba650) (config-role) #captive-portal web-auth
21 (Aruba650) (config-role) #exit
22 
23 (Aruba650) (config) #aaa profile web-profile
24 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web  ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
25 (Aruba650) (AAA Profile "web-profile") #exit
26 
27 (Aruba650) (config) #wlan ssid-profile web-ssid
28 (Aruba650) (SSID Profile "web-ssid") #essid web
29 (Aruba650) (SSID Profile "web-ssid") #exit
30 
31 (Aruba650) (config) #wlan virtual-ap web-vap
32 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
33 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
34 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
35 (Aruba650) (Virtual AP profile "web-vap") #exit
36 
37 (Aruba650) (config) #ap-group webyk
38 (Aruba650) (AP group "webyk") #virtual-ap web-vap
39 (Aruba650) (AP group "webyk") #exit

2.3 采用Radis认证服务器完成Captive-Portal认证

2.3.1 Radis相关的配置 

1 (Aruba650) #configure terminal 
2 (Aruba650) (config) #aaa authentication-server radius ias 
3 (Aruba650) (RADIUS Server "ias") #host 172.18.50.88
4 (Aruba650) (RADIUS Server "ias") #key 123456
5 (Aruba650) (RADIUS Server "ias") #exit
1 (Aruba650) #aaa test-server mschapv2 ias carlos 123456  ##测试是否和IAS服务器建立连接
2 Authentication Successful                               ##认证成功

   AS的远程访问策略中，需要注意的设置如下：

 

2.3.2 无线相关的配置 

 1 (Aruba650) #configure terminal 
 2 (Aruba650) (config) #aaa server-group web-server
 3 (Aruba650) (Server Group "web-server") #no auth-server Internal
 4 (Aruba650) (Server Group "web-server") #auth-server ad
 5 (Aruba650) (Server Group "web-server") #set role condition role value-of 
 6 (Aruba650) (Server Group "web-server") #exit
 7 
 8 (Aruba650) (config) #aaa authentication captive-portal web-auth
 9 (Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
10 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http 
11 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1 
12 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
13 (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit
14 
15 (Aruba650) (config) #user-role yk-web
16 (Aruba650) (config-role) #session-acl logon-control
17 (Aruba650) (config-role) #session-acl captiveportal 
18 (Aruba650) (config-role) # session-acl vpnlogon 
19 (Aruba650) (config-role) #captive-portal web-auth
20 (Aruba650) (config-role) #exit
21 
22 (Aruba650) (config) #aaa profile web-profile
23 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web  ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
24 (Aruba650) (AAA Profile "web-profile") #exit
25 
26 (Aruba650) (config) #wlan ssid-profile web-ssid
27 (Aruba650) (SSID Profile "web-ssid") #essid web
28 (Aruba650) (SSID Profile "web-ssid") #exit
29 
30 (Aruba650) (config) #wlan virtual-ap web-vap
31 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
32 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
33 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
34 (Aruba650) (Virtual AP profile "web-vap") #exit
35 
36 (Aruba650) (config) #ap-group webyk
37 (Aruba650) (AP group "webyk") #virtual-ap web-vap
38 (Aruba650) (AP group "webyk") #exit

posted on 2018-01-17 09:12  CARLOS_KONG  阅读(1615)  评论(0)  编辑  收藏  举报

导航