Configuration procedure, Controlling access of portal users, Configuring a portal-free rule – H3C Technologies H3C SecPath F1000-E User Manual
Page 129
119
there are Layer 3 forwarding devices between the authentication client and the access device, you
must select the cross-subnet portal authentication mode.
•
In re-DHCP authentication mode, a client can use a public IP address to send packets before
passing portal authentication. However, responses to the packets are restricted.
Configuration procedure
To enable Layer 3 portal authentication:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface interface-type
interface-number
The interface must be a Layer 3
Ethernet interface.
3.
Enable Layer 3 portal
authentication on the
interface.
portal server server-name method
{ direct | layer3 | redhcp }
Not enabled by default.
Controlling access of portal users
Configuring a portal-free rule
A portal-free rule allows specified users to access specified external websites without portal
authentication.
The matching items for a portal-free rule include the source and destination IP address, source MAC
address, inbound interface, and VLAN. Packets matching a portal-free rule will not trigger portal
authentication, so that users sending the packets can directly access the specified external websites.
When you configure a portal-free rule, follow these guidelines:
•
If you specify both a VLAN and an interface in a portal-free rule, the interface must belong to the
VLAN. Otherwise, the rule does not take effect.
•
You cannot configure two or more portal-free rules with the same filtering criteria. Otherwise, the
system prompts that the rule already exists.
•
A Layer 2 interface in an aggregation group cannot be specified as the source interface of a
portal-free rule, and the source interface of a portal-free rule cannot be added to an aggregation
group.
To configure a portal-free rule:
Step Command
1.
Enter system view.
system-view
2.
Configure a portal-free rule.
portal free-rule rule-number { destination { any | ip { ip-address mask
{ mask-length | netmask } | any } } | source { any | [ interface
interface-type interface-number | ip { ip-address mask { mask-length |
mask } | any } | mac mac-address | vlan vlan-id ] * } } *