自学Aruba5.3.3-Aruba安全认证-有PEFNG 许可证环境的认证配置Captive-Portal

点击返回：自学Aruba之路

自学Aruba5.3.3-Aruba安全认证-有PEFNG 许可证环境的认证配置Captive-Portal

1. Captive-Portal认证配置前言

1.1 新建web认证服务器派生角色

在导入了PEFNG许可证后，系统不会对Web认证的aaa authentication captive-protal自动生成一个对应的role，因此需要为认证前的用户派生一个角色，并设置弹出认证界面。

1.2 新建web认证服务器派生角色

由于Policy“logon-control”中的允许ping的rule，使得web认证的用户接入SSID后，可以ping通其他地址，容易给客户造成误解。因此建议把配置web认证前，把策略“logon-control”中的允许ping关闭。

 (Aruba650) (config) #ip access-list session logon-control
 (Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny    ## 关闭logon-control角色中ping功能

 (Aruba650) (config) #user-role yk-web           */ 定义Captive-Portal的角色为yk-web
 (Aruba650) (config-role) #session-acl logon-control
 (Aruba650) (config-role) #session-acl captiveportal
 (Aruba650) (config-role) #session-acl vpnlogon
 (Aruba650) (config-role) #captive-portal web-auth
 (Aruba650) (config-role) #exit

2.Captive-Portal认证配置命令

2.1 采用InterDB认证服务器完成Captive-Portal认证

 (Aruba650) (config) #aaa server-group web-server
 (Aruba650) (Server Group "web-server") #auth-server Internal
 (Aruba650) (Server Group "web-server") #set role condition role value-of
 (Aruba650) (Server Group "web-server") #exit

 (Aruba650) (config) #aaa authentication captive-portal web-auth
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #server-group web-server
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http    ##采用http进行认证
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1 ##认证后自动跳转1s
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit

 (Aruba650) (config) #ip access-list session logon-control
 (Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny   ##关闭ping

 (Aruba650) (config) #user-role yk-web
 (Aruba650) (config-role) #session-acl logon-control
 (Aruba650) (config-role) #session-acl captiveportal
 (Aruba650) (config-role) #session-acl vpnlogon
 (Aruba650) (config-role) #captive-portal web-auth
 (Aruba650) (config-role) #exit

 (Aruba650) (config) #aaa profile web-profile
 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web          ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
 (Aruba650) (AAA Profile "web-profile") #exit

 (Aruba650) (config) #wlan ssid-profile web-ssid
 (Aruba650) (SSID Profile "web-ssid") #essid webyk
 (Aruba650) (SSID Profile "web-ssid") #exit

 (Aruba650) (config) #wlan virtual-ap web-vap
 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
 (Aruba650) (Virtual AP profile "web-vap") #exit

 (Aruba650) (config) #ap-group webyk
 (Aruba650) (AP group "webyk") #virtual-ap web-vap
 (Aruba650) (AP group "webyk") #exit

 (Aruba650) #local-userdb add username test1 password 123456 role web-1     ##建立两两个用户test1 test2 对应派生的角色web-1 web-2
 (Aruba650) #local-userdb add username test2 password 123456 role web-2

2.2 采用LDAP认证服务器完成Captive-Portal认证

2.2.1 LDAP相关的配置

 (Aruba650) #configure terminal
 (Aruba650) (config) #aaa authentication-server ldap ad
 (Aruba650) (LDAP Server "ad") #host 172.18.50.30
 (Aruba650) (LDAP Server "ad") #admin-dn cn=rui,cn=Users,dc=ruitest,dc=com
 (Aruba650) (LDAP Server "ad") #admin-passwd 123456
 (Aruba650) (LDAP Server "ad") #allow-cleartext
 (Aruba650) (LDAP Server "ad") #base-dn cn=Users,dc=ruitest,dc=com
 (Aruba650) (LDAP Server "ad") #preferred-conn-type clear-text
 (Aruba650) (LDAP Server "ad") #exit

 (Aruba650) #aaa test-server pap ad carlos 123456  ##测试是否和LDAP服务器建立连接
 Authentication Successful                         ##认证成功

 (Aruba650) # aaa query-user ad carlos     ##  参看用户carlos，LADP返回的值

 objectClass: top
 objectClass: person
 objectClass: organizationalPerson
 objectClass: user
 cn: carlos
 sn: carlos
 distinguishedName: CN=carlos,CN=Users,DC=ruitest,DC=com ##返回值的用户组，AC可以根据返回值匹配来定义该用户所属的组
 instanceType: 4
 whenCreated: 20180117082111.0Z
 whenChanged: 20180417082815.0Z
 displayName: carlos
 uSNCreated: 368694
 memberOf: CN=tech1,CN=Users,DC=ruitest,DC=com
 uSNChanged: 368706
 name: wang1
 objectGUID: n\240\203\277T\345\002K\235\202y\351\372\240<\376
 userAccountControl: 66048
 badPwdCount: 0 

2.2.2 无线相关的配置

 (Aruba650) #configure terminal
 (Aruba650) (config) #aaa server-group web-server
 (Aruba650) (Server Group "web-server") #no auth-server Internal
 (Aruba650) (Server Group "web-server") #auth-server ad
 (Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech1,CN=Users,DC=ruitest,DC=com set-value web-1    ##返回组名为test1，匹配到role web-1
 (Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech2,CN=Users,DC=ruitest,DC=com set-value web-2
 (Aruba650) (Server Group "web-server") #exit

 (Aruba650) (config) #aaa authentication captive-portal web-auth
 (Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
  (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit

 (Aruba650) (config) #user-role yk-web
 (Aruba650) (config-role) #session-acl logon-control
 (Aruba650) (config-role) #session-acl captiveportal
 (Aruba650) (config-role) # session-acl vpnlogon
 (Aruba650) (config-role) #captive-portal web-auth
 (Aruba650) (config-role) #exit

 (Aruba650) (config) #aaa profile web-profile
 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web  ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
 (Aruba650) (AAA Profile "web-profile") #exit

 (Aruba650) (config) #wlan ssid-profile web-ssid
 (Aruba650) (SSID Profile "web-ssid") #essid web
 (Aruba650) (SSID Profile "web-ssid") #exit

 (Aruba650) (config) #wlan virtual-ap web-vap
 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
 (Aruba650) (Virtual AP profile "web-vap") #exit

 (Aruba650) (config) #ap-group webyk
 (Aruba650) (AP group "webyk") #virtual-ap web-vap
 (Aruba650) (AP group "webyk") #exit

2.3 采用Radis认证服务器完成Captive-Portal认证

2.3.1 Radis相关的配置

 (Aruba650) #configure terminal
 (Aruba650) (config) #aaa authentication-server radius ias
 (Aruba650) (RADIUS Server "ias") #host 172.18.50.88
 (Aruba650) (RADIUS Server "ias") #key 123456
 (Aruba650) (RADIUS Server "ias") #exit

 (Aruba650) #aaa test-server mschapv2 ias carlos 123456  ##测试是否和IAS服务器建立连接
 Authentication Successful                               ##认证成功

AS的远程访问策略中，需要注意的设置如下：

2.3.2 无线相关的配置

 (Aruba650) #configure terminal
 (Aruba650) (config) #aaa server-group web-server
 (Aruba650) (Server Group "web-server") #no auth-server Internal
 (Aruba650) (Server Group "web-server") #auth-server ad
 (Aruba650) (Server Group "web-server") #set role condition role value-of
 (Aruba650) (Server Group "web-server") #exit

 (Aruba650) (config) #aaa authentication captive-portal web-auth
 (Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated  ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
 (Aruba650) (Captive Portal Authentication Profile "web-auth") #exit

 (Aruba650) (config) #user-role yk-web
 (Aruba650) (config-role) #session-acl logon-control
 (Aruba650) (config-role) #session-acl captiveportal
 (Aruba650) (config-role) # session-acl vpnlogon
 (Aruba650) (config-role) #captive-portal web-auth
 (Aruba650) (config-role) #exit

 (Aruba650) (config) #aaa profile web-profile
 (Aruba650) (AAA Profile "web-profile") #initial-role yk-web  ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
 (Aruba650) (AAA Profile "web-profile") #exit

 (Aruba650) (config) #wlan ssid-profile web-ssid
 (Aruba650) (SSID Profile "web-ssid") #essid web
 (Aruba650) (SSID Profile "web-ssid") #exit

 (Aruba650) (config) #wlan virtual-ap web-vap
 (Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
 (Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
 (Aruba650) (Virtual AP profile "web-vap") #vlan 1
 (Aruba650) (Virtual AP profile "web-vap") #exit

 (Aruba650) (config) #ap-group webyk
 (Aruba650) (AP group "webyk") #virtual-ap web-vap
 (Aruba650) (AP group "webyk") #exit