自学Aruba5.3.3-Aruba安全认证-有PEFNG 许可证环境的认证配置Captive-Portal
1. Captive-Portal认证配置前言
1.1 新建web认证服务器派生角色
在导入了PEFNG许可证后，系统不会对Web认证的aaa authentication captive-protal自动生成一个对应的role，因此需要为认证前的用户派生一个角色，并设置弹出认证界面。
1.2 新建web认证服务器派生角色
由于Policy“logon-control”中的允许ping的rule，使得web认证的用户接入SSID后，可以ping通其他地址，容易给客户造成误解。因此建议把配置web认证前，把策略“logon-control”中的允许ping关闭。
(Aruba650) (config) #ip access-list session logon-control
(Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny ## 关闭logon-control角色中ping功能
(Aruba650) (config) #user-role yk-web */ 定义Captive-Portal的角色为yk-web
(Aruba650) (config-role) #session-acl logon-control
(Aruba650) (config-role) #session-acl captiveportal
(Aruba650) (config-role) #session-acl vpnlogon
(Aruba650) (config-role) #captive-portal web-auth
(Aruba650) (config-role) #exit
2.Captive-Portal认证配置命令
2.1 采用InterDB认证服务器完成Captive-Portal认证
(Aruba650) (config) #aaa server-group web-server
(Aruba650) (Server Group "web-server") #auth-server Internal
(Aruba650) (Server Group "web-server") #set role condition role value-of
(Aruba650) (Server Group "web-server") #exit (Aruba650) (config) #aaa authentication captive-portal web-auth
(Aruba650) (Captive Portal Authentication Profile "web-auth") #server-group web-server
(Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http ##采用http进行认证
(Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1 ##认证后自动跳转1s
(Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
(Aruba650) (Captive Portal Authentication Profile "web-auth") #exit (Aruba650) (config) #ip access-list session logon-control
(Aruba650) (config-sess-logon-control)# no any any "svc-icmp" deny ##关闭ping (Aruba650) (config) #user-role yk-web
(Aruba650) (config-role) #session-acl logon-control
(Aruba650) (config-role) #session-acl captiveportal
(Aruba650) (config-role) #session-acl vpnlogon
(Aruba650) (config-role) #captive-portal web-auth
(Aruba650) (config-role) #exit (Aruba650) (config) #aaa profile web-profile
(Aruba650) (AAA Profile "web-profile") #initial-role yk-web ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
(Aruba650) (AAA Profile "web-profile") #exit (Aruba650) (config) #wlan ssid-profile web-ssid
(Aruba650) (SSID Profile "web-ssid") #essid webyk
(Aruba650) (SSID Profile "web-ssid") #exit (Aruba650) (config) #wlan virtual-ap web-vap
(Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
(Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
(Aruba650) (Virtual AP profile "web-vap") #vlan 1
(Aruba650) (Virtual AP profile "web-vap") #exit (Aruba650) (config) #ap-group webyk
(Aruba650) (AP group "webyk") #virtual-ap web-vap
(Aruba650) (AP group "webyk") #exit
(Aruba650) #local-userdb add username test1 password 123456 role web-1 ##建立两两个用户test1 test2 对应派生的角色web-1 web-2
(Aruba650) #local-userdb add username test2 password 123456 role web-2
2.2 采用LDAP认证服务器完成Captive-Portal认证
2.2.1 LDAP相关的配置
(Aruba650) #configure terminal
(Aruba650) (config) #aaa authentication-server ldap ad
(Aruba650) (LDAP Server "ad") #host 172.18.50.30
(Aruba650) (LDAP Server "ad") #admin-dn cn=rui,cn=Users,dc=ruitest,dc=com
(Aruba650) (LDAP Server "ad") #admin-passwd 123456
(Aruba650) (LDAP Server "ad") #allow-cleartext
(Aruba650) (LDAP Server "ad") #base-dn cn=Users,dc=ruitest,dc=com
(Aruba650) (LDAP Server "ad") #preferred-conn-type clear-text
(Aruba650) (LDAP Server "ad") #exit
(Aruba650) #aaa test-server pap ad carlos 123456 ##测试是否和LDAP服务器建立连接
Authentication Successful ##认证成功
(Aruba650) # aaa query-user ad carlos ## 参看用户carlos，LADP返回的值 objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: carlos
sn: carlos
distinguishedName: CN=carlos,CN=Users,DC=ruitest,DC=com ##返回值的用户组，AC可以根据返回值匹配来定义该用户所属的组
instanceType: 4
whenCreated: 20180117082111.0Z
whenChanged: 20180417082815.0Z
displayName: carlos
uSNCreated: 368694
memberOf: CN=tech1,CN=Users,DC=ruitest,DC=com
uSNChanged: 368706
name: wang1
objectGUID: n\240\203\277T\345\002K\235\202y\351\372\240<\376
userAccountControl: 66048
badPwdCount: 0
2.2.2 无线相关的配置
(Aruba650) #configure terminal
(Aruba650) (config) #aaa server-group web-server
(Aruba650) (Server Group "web-server") #no auth-server Internal
(Aruba650) (Server Group "web-server") #auth-server ad
(Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech1,CN=Users,DC=ruitest,DC=com set-value web-1 ##返回组名为test1，匹配到role web-1
(Aruba650) (Server Group "web-server") #set role condition memberOf equals CN=tech2,CN=Users,DC=ruitest,DC=com set-value web-2
(Aruba650) (Server Group "web-server") #exit (Aruba650) (config) #aaa authentication captive-portal web-auth
(Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
(Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http
(Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1
(Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
(Aruba650) (Captive Portal Authentication Profile "web-auth") #exit (Aruba650) (config) #user-role yk-web
(Aruba650) (config-role) #session-acl logon-control
(Aruba650) (config-role) #session-acl captiveportal
(Aruba650) (config-role) # session-acl vpnlogon
(Aruba650) (config-role) #captive-portal web-auth
(Aruba650) (config-role) #exit (Aruba650) (config) #aaa profile web-profile
(Aruba650) (AAA Profile "web-profile") #initial-role yk-web ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
(Aruba650) (AAA Profile "web-profile") #exit (Aruba650) (config) #wlan ssid-profile web-ssid
(Aruba650) (SSID Profile "web-ssid") #essid web
(Aruba650) (SSID Profile "web-ssid") #exit (Aruba650) (config) #wlan virtual-ap web-vap
(Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
(Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
(Aruba650) (Virtual AP profile "web-vap") #vlan 1
(Aruba650) (Virtual AP profile "web-vap") #exit (Aruba650) (config) #ap-group webyk
(Aruba650) (AP group "webyk") #virtual-ap web-vap
(Aruba650) (AP group "webyk") #exit
2.3 采用Radis认证服务器完成Captive-Portal认证
2.3.1 Radis相关的配置
(Aruba650) #configure terminal
(Aruba650) (config) #aaa authentication-server radius ias
(Aruba650) (RADIUS Server "ias") #host 172.18.50.88
(Aruba650) (RADIUS Server "ias") #key 123456
(Aruba650) (RADIUS Server "ias") #exit
(Aruba650) #aaa test-server mschapv2 ias carlos 123456 ##测试是否和IAS服务器建立连接
Authentication Successful ##认证成功
AS的远程访问策略中，需要注意的设置如下：
2.3.2 无线相关的配置
(Aruba650) #configure terminal
(Aruba650) (config) #aaa server-group web-server
(Aruba650) (Server Group "web-server") #no auth-server Internal
(Aruba650) (Server Group "web-server") #auth-server ad
(Aruba650) (Server Group "web-server") #set role condition role value-of
(Aruba650) (Server Group "web-server") #exit (Aruba650) (config) #aaa authentication captive-portal web-auth
(Aruba650) (Captive Portal Authentication Profile "web-auth") # server-group web-server
(Aruba650) (Captive Portal Authentication Profile "web-auth") #protocol-http
(Aruba650) (Captive Portal Authentication Profile "web-auth") #redirect-pause 1
(Aruba650) (Captive Portal Authentication Profile "web-auth") #default-role authenticated ##定义认证后的默认角色，如果没有服务器派生角色产生，用户将得到该角色
(Aruba650) (Captive Portal Authentication Profile "web-auth") #exit (Aruba650) (config) #user-role yk-web
(Aruba650) (config-role) #session-acl logon-control
(Aruba650) (config-role) #session-acl captiveportal
(Aruba650) (config-role) # session-acl vpnlogon
(Aruba650) (config-role) #captive-portal web-auth
(Aruba650) (config-role) #exit (Aruba650) (config) #aaa profile web-profile
(Aruba650) (AAA Profile "web-profile") #initial-role yk-web ##认证前的初始化派生角色，跳转到Captive-Portal认证页面
(Aruba650) (AAA Profile "web-profile") #exit (Aruba650) (config) #wlan ssid-profile web-ssid
(Aruba650) (SSID Profile "web-ssid") #essid web
(Aruba650) (SSID Profile "web-ssid") #exit (Aruba650) (config) #wlan virtual-ap web-vap
(Aruba650) (Virtual AP profile "web-vap") #aaa-profile web-profile
(Aruba650) (Virtual AP profile "web-vap") #ssid-profile web-ssid
(Aruba650) (Virtual AP profile "web-vap") #vlan 1
(Aruba650) (Virtual AP profile "web-vap") #exit (Aruba650) (config) #ap-group webyk
(Aruba650) (AP group "webyk") #virtual-ap web-vap
(Aruba650) (AP group "webyk") #exit