OpenPortalServer开源Portal协议WEB认证服务器支持华为H3C锐捷---说明

('OpenPortalServer开源Portal协议WEB认证服务器作者：LeeSonQQ:25901875E-Mail:LeeSon@vip.qq.comOpenPortal官方交流群119688084该软件是基于华为AC/BASPORTA协议的服务端程序，Java编写，开源。最新源代码下载地址：https://github.com/lishuocoolhttps://git.oschina.net/SoftLeeSon/支持HuaweiH3CPortalV1V2协议PAPCHAP认证方式的Portal服务器新手安装配置说明:windows环境下：1.首先保证已有JDK1.7环境，MySQL环境，tomcat72.解压路径无中文及空格3.配置文件说明\\webapps\\ROOT\\WEB-INF\\classes\\jdbc.properties首先修改该数据库配置文件创建openportalserver数据库UTF-8字符集导入数据库文件OpenPortalServer.sql后台账号：admin密码:admin4.配置AC设备安装和配置Radius服务如果使用AC模拟器进行模拟测试则可忽略这步如果使用页面展示、本地接入用户认证方式不用配置radius5.运行bin/startup.bat快捷方式6.浏览器http://服务器IP7.如果使用AC模拟器测试用户名密码随意如果真实环境（不用我废话了）Linux环境：安装jdk1.7mysqltomcat7将解压目录下的webapps目录替换对接配置说明:超时设置3-5秒日志记录是否输出详细日志到文件验证码设置是否开启用户登陆的验证码用户心跳是否进行用户离线检测超时重复次数一次检查周期内用户在线检测超时几次算已经下线计费检测周期间隔多长时间检测一次用户是否在线，余额是否够认证方式页面展示，本地接入用户，外接radius自助注册开关是否允许自助注册接入用户，默认每个新用户给10分钟的时长设备账号对应设备的local-user用户账号密码，在本地接入用户和页面展示认证方式时必须配置，而且设备用默认domain设备密码对应设备的local-user用户账号密码，在本地接入用户和页面展示认证方式时必须配置，而且设备用默认domain1■•色的■srflM■rrnwR■卡：・a卓定■为帚麻Mhf»JMErAAnol-v(BASUPW101BAi-«DOG=M・SUMC19216・2ioo，u・・SuKf川nd・2hrw・・・OpenPortalServer网络接入认证系统OpenPortalServer网络接入认证系统(!)■±MWAaUM0O»MPortalRMIAVUMKW・肿lo<).r面交换机不用设置[SWITCH]domainleeson.org设备账号密码以华为S5700交换机为例，配置信息详细说明：交换机配置如下配置步骤步骤1创建VLAN并配置接口允许通过的VLAN,保证网络通畅。#创建VLAN10和VLAN20。[SWITCH]vlanbatch1020#配置交换机连接上行网络的接口E0/0/1为Access类型接口,并将GE0/0/1加入VLAN20。[SWITCH]interfaceEthernet0/0/1[SWITCH-Ethernet0/0/2]portlink-typeaccess[SWITCH-Ethernet0/0/2]portdefaultvlan20[SWITCH-Ethernet0/0/2]quit#配置交换机连接RADIUS和portalServer的接口E0/0/2为Access类型接口，并将GE0/0/2加入VLAN20。[SWITCH]interfaceEthernet0/0/2[SWITCH-Ethernet0/0/2]portlink-typeaccess[SWITCH-Ethernet0/0/2]portdefaultvlan20[SWITCH-Ethernet0/0/2]quit#创建VLANIF10和VLANIF20,并配置VLANIF的IP地址，以使用户终端、Switch、企业内网资源之间能够建立起路由。此处假设VLANIF10的IP地址为192.168.10.20/24；VLANIF20的IP地址为192.168.20.29/24。[SWITCH]interfacevlanif10[SWITCH-Vlanif10]ipaddress192.168.10.2024//10.1[SWITCH]interfacevlanif20[SWITCH-Vlanif20]ipaddress192.168.0.124//0.1[SWITCH-Vlanif20]quit步骤2创建并配置RADIUS服务器模板、AAA方案以及认证域。#创建并配置RADIUS服务器模板“rd1”。[SWITCH]radius-servertemplaterd1[SWITCH-radius-rd1]radius-serverauthentication192.168.0.21812[SWITCH-radius-rd1]radius-serveraccounting192.168.0.21813[SWITCH-radius-rd1]radius-servershared-keysimpleleeson[SWITCH-radius-rd1]radius-serverretransmit2[SWITCH-radius-rd1]quit本地用户认证模式则就是交换机的账号密码#创建AAA方案“abc”并配置认证方式为RADIUS。[SWITCH]aaa[SWITCH-aaa]authentication-schemeabc[SWITCH-aaa-authen-abc]authentication-moderadius[SWITCH-aaa-authen-abc]quit[SWITCH-aaa]accounting-schemeacc[SWITCH-aaa-acc-abc]accounting-moderadius[SWITCH-aaa-acc-abc]quit#创建认证域“leeson.org”，并在其上绑定AAA方案“abc”与RADIUS服务器模板"rd1”。[SWITCH-aaa]domainleeson.org[SWITCH-aaa-domain-isp1]authentication-schemeabc[SWITCH-aaa-domain-isp1]accounting-schemeacc[SWITCH-aaa-domain-isp1]radius-serverrd1[SWITCH-aaa-domain-isp1]quit[SWITCH-aaa]quit#配置全局默认域为"leeson.org”。用户进行接入认证时，以格式"user@xxx.xxx”输入用户名即可在xxx.xxx域下进行aaa认证。如果用户名中不携带域名或携带的域名不存在，用户将会在默认域中进行认证。[SWITCH]domainleeson.org步骤3配置外部Portal认证#创建并配置名称为“abc”的Portal服务器模板。[SWITCH]web-auth-serverabc[SWITCH-web-auth-server-abc]server-ip192.168.0.2[SWITCH-web-auth-server-abc]port50100[SWITCH-web-auth-server-abc]shared-keysimpleleeson[SWITCH-web-auth-server-abc]urlhttp://192.168.0.2[SWITCH-web-auth-server-abc]quit#使能Portal认证功能。[SWITCH]interfacevlanif10[SWITCH-Vlanif10]web-auth-serverabcdirect[SWITCH-Vlanif10]quit步骤4查看配置的Portal服务器的参数信息。#执行命令displayweb-auth-serverconfiguration查看Portal服务器相关的配置信息。displayweb-auth-serverconfigurationListeningport:2000Portal:version1,version2Includereplymessage:enabledWeb-auth-serverName:abc:192.168.20.30:%$%$]$c{$)Bp!XFdN>G2DBG(T#wn%$%$:http://192.168.0.2:101Webauthenticationserver(s)intotal步骤5在交换机上添加默认路由：iproute-static0.0.0.00.0.0.0192.168.0.1其中192.168.0.1为交换机上行端口的网关地址步骤6配置portal白名单portalfree-rule0destinationip192.168.0.1mask255.255.255.255portalfree-rule1destinationip192.168.0.2mask255.255.255.255portalfree-rule2destinationipxxx.xxx.xxx.xxxmask255.255.255.255其中的xxx.xxx.xxx.xxx为用户认证之后上网所需的DNS地址，实际以真实网络环境中的DNS为准//排除网关PORTALB务器Radius服务器DNS可选配置：接口视图下(vlan-if，ge)：dhcpselectrelay#使能接口VLANIF100的DHCPRelay功能。[HUAWEI]dhcpenable[HUAWEI]interfacevlanif100[HUAWEI-Vlanif100]dhcpselectrelay#Portal用户下线探测portaltimeroffline-detect命令用来配置Portal认证用户下线探测周期。undoportaltimeroffline-detect命令用来恢复下线探测周期的缺省值。缺省情况下，下线探测周期为300秒。注意：portaltimeroffline-detect命令功能仅适用于二层Portal认证方式。OpenPortalServer对接华为S5700配置[Quidway]discur#!SoftwareVersionV200R001C00SPC300sysnameQuidway#vlanbatch10100#web-auth-serverversionv2portalfree-rule2sourceip10.0.0.100mask255.255.255.255IP-addressShared-keyPort/PortFlagURLBoundedVlanif:50100/NOportalfree-rule3destinationip10.0.0.100mask255.255.255.255portalfree-rule4destinationip10.0.0.1mask255.255.255.255portalfree-rule5sourceip10.0.0.1mask255.255.255.255portalfree-rule6sourceip192.168.100.1mask255.255.255.255portalfree-rule7destinationip192.168.100.1mask255.255.255.255#domainleeson.com#httpserverloads5700si-v200r001c00.001.web.zip#undonapslaveenable#dhcpenable#radius-servertemplateleesonradius-servershared-keysimpleleesonradius-serverauthentication10.0.0.1001812radius-serveraccounting10.0.0.1001813radius-serverretransmit2#web-auth-serverleesonserver-ip10.0.0.100port50100shared-keysimpleleesonurlhttp://10.0.0.100/OpenPortalServersource-ip10.0.0.1#aaaauthentication-schemedefaultauthentication-schemeleesonauthentication-moderadiusauthorization-schemedefaultaccounting-schemedefaultaccounting-schemeleesonaccounting-moderadiusdomaindefaultdomaindefault_admindomainleeson.comauthentication-schemeleesonaccounting-schemeleesonradius-serverleesonlocal-useradminpasswordcipher%$%$03~N$}rD0X}s=D%#SD-/ybYP%$%$local-useradminprivilegelevel15local-useradminservice-typehttplocal-userleesonpasswordcipher%$%$3"M/J1RB:MO{"\\t&bDye\\S%$%$local-userleesonprivilegelevel15#interfaceVlanif1#interfaceVlanif10ipaddress10.0.0.1255.255.255.0web-auth-serverleesondirect#interfaceVlanif100ipaddress192.168.100.1255.255.255.0web-auth-serverleesondirectdhcpselectinterfaceH3C-MSR830-10对接OpenPortal配置portalservercbqt_wifi_ptsip192.168.1.250key$c$3$WcdcTvygU/tgJgwXYIR72l92h8HoFlyWoCFi8RS2Cj1goAg=http://192.168.1.250:8081/portalserver-typeimcportalfree-rule0sourceipanydestinationip114.114.114.114mask255.255.255.255portalfree-rule1sourceipanydestinationip192.168.1.254mask255.255.255.255portalfree-rule2sourceipanydestinationip192.168.70.254mask255.255.255.255portalfree-rule3sourceipanydestinationip192.168.1.250mask255.255.255.255portalservercbqt_wifi_ptsserver-detectmethodhttpactionpermit-allinterval600retry5interfaceVlan-interface70ipaddress192.168.70.254255.255.255.0dhcpselectrelaydhcprelayserver-select1portalservercbqt_wifi_ptsmethoddirectippolicy-based-routeWAN-TAIQIUradiusschemecbqt_wifi_rsserver-typeextendedprimaryauthentication192.168.1.250primaryaccounting192.168.1.250keyauthenticationcipher$c$3$Jb32HhDG0KQEFUJK/ie49Sc5ARR1gBavK0rY+MOwlhSU=keyaccountingcipher$c$3$nG1DwgslbalnXYZul3aAOdVU8ro2+/cWK4Oi6adZw/Rv5ZM=user-name-formatwithout-domain#domaincbqt_wifi_dmauthenticationportalradius-schemecbqt_wifi_rsauthorizationportalradius-schemecbqt_wifi_rsaccountingportalradius-schemecbqt_wifi_rsaccess-limitdisablecipherurlstateactiveidle-cutdisableself-service-urldisableH3C-MSR对接配置[BEGIN]2015/8/1213:13:39disdisplaycudisplaycurrent-configuration#version5.20,Release2311#sysnameH3C-MSR#ftpserverenable#l2tpenable#firewallenable#nataddress-group1nataging-timeudp180#domaindefaultenablesystem#darp2psignature-fileflash:/p2p_default.mtd#lldpenableqoscarl1destination-ip-addressrange192.169.0.31to192.169.0.254per-addressshared-bandwidthqoscarl10source-ip-addressrange192.169.0.31to192.169.0.254per-addressshared-bandwidth#portalserverportalip192.169.0.20keycipher$c$3$tmKimwpWYurgJSFeXElUKoFApV9rMZ6xfw==urlhttp://192.169.0.20:8080portalfree-rule0sourceipanydestinationip218.201.4.3mask255.255.255.255portalfree-rule1sourceipanydestinationip192.169.0.20mask255.255.255.255portalserverportalserver-detectmethodhttpactionpermit-allinterval60retry5#iphttpport9000#blacklistenable#aclnumber3000rule0permitipsource192.169.0.00.0.15.255rule1permitipsource192.169.101.00.0.0.255rule100denyipaclnumber3002nameLAN-Defendrule0denytcpdestination-porteq135rule1denyudpdestination-porteq135rule2denytcpdestination-porteq139rule3denyudpdestination-porteqnetbios-dgmrule4denyudpdestination-porteqnetbios-nsrule5denyudpdestination-porteqnetbios-ssnrule6denytcpdestination-porteq137rule7denytcpdestination-porteq138rule8denyudpdestination-porteq136rule200permiticmprule300permitipsource192.169.0.00.0.15.255rule301permitipsource192.169.101.00.0.0.255rule302permitipsource192.169.99.00.0.0.7rule303permitudpdestination-porteqbootpsrule400denyipaclnumber3003nameWAN-Defendrule0denytcpdestination-porteq135rule1denyudpdestination-porteq135rule2denyudpdestination-porteqnetbios-dgmrule3denyudpdestination-porteqnetbios-nsrule4denyudpdestination-porteqnetbios-ssnrule5denytcpdestination-porteq139rule6denytcpdestination-porteq137rule7denytcpdestination-porteq138rule8denyudpdestination-porteq136rule300permitudpsource-porteqdnsrule400permitipdestination192.169.0.00.0.15.255rule401permitipdestination192.169.101.00.0.0.255rule402permitipdestination192.169.99.00.0.0.7rule403permittcpdestination-porteq22rule404permittcpdestination-porteqwwwrule405permittcpdestination-porteq443rule406permitudpdestination-porteq1701rule407denyipaclnumber3100descriptioninsideaccessdomain-serverrule10denyipsource192.169.10.00.0.0.255rule11denyipsource192.169.11.00.0.0.255rule12denyipsource192.169.12.00.0.0.255rule13denyipsource192.169.13.00.0.0.255rule14denyipsource192.169.14.00.0.0.255rule15denyipsource192.169.15.00.0.0.255rule100permitipsource192.169.0.00.0.15.255destination192.169.0.200rule1000denyip##vlan1#radiusschemeradiusprimaryauthentication192.169.0.201645keycipher$c$3$pBtH9ea/vw5AfpLwHPg20KlJE1fGRKNHJw==primaryaccounting192.169.0.201646keycipher$c$3$iZTSbzm+q0xelQbsrxER90iYAQKV6aORPAtimerrealtime-accounting3#domainportalauthenticationportalradius-schemeradiuslocalauthorizationportalradius-schemeradiuslocalaccountingportalradius-schemeradiuslocalaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainpppoeaccountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool3192.169.101.2192.169.101.254domainpppoe-server-10accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool10192.169.10.2192.169.10.254domainpppoe-server-11accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool11192.169.11.2192.169.11.254domainpppoe-server-12accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool12192.169.12.2192.169.12.254domainpppoe-server-13accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool13192.169.13.2192.169.13.254domainpppoe-server-14accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool14192.169.14.2192.169.14.254domainpppoe-server-15accountinglan-accessradius-schemeradiusauthenticationpppradius-schemeradiuslocalauthorizationpppradius-schemeradiuslocalaccountingpppradius-schemeradiusaccess-limitdisablestateactiveidle-cutenable1010240self-service-urldisableippool15192.169.15.2192.169.15.254domainsystemauthenticationppplocalaccess-limitdisablestateactiveidle-cutdisableself-service-urldisableippool2192.169.99.2192.169.99.10#pkientitysslcommon-namesslorganization-unitxxzxorganizationgxgslocalitychongqingstatechongqingcountrycn#pkidomainsslcaidentifiersslcertificaterequestfromracertificaterequestentitysslcrlcheckdisable#dhcpserverip-pool1network192.169.0.0mask255.255.255.0gateway-list192.169.0.1dns-list218.201.4.3218.201.17.2expiredday5#dhcpserverip-poolvlan-10network192.169.10.0mask255.255.255.0gateway-list192.169.10.1dns-list218.201.4.3218.201.21.132#dhcpserverip-poolvlan-11network192.169.11.0mask255.255.255.0gateway-list192.169.11.1dns-list218.201.4.3218.201.21.132#dhcpserverip-poolvlan-12network192.169.12.0mask255.255.255.0gateway-list192.169.12.1dns-list218.201.4.3218.201.21.132#dhcpserverip-poolvlan-13network192.169.13.0mask255.255.255.0gateway-list192.169.13.1dns-list218.201.4.3218.201.21.132#dhcpserverip-poolvlan-14network192.169.14.0mask255.255.255.0gateway-list192.169.14.1dns-list218.201.4.3218.201.21.132#dhcpserverip-poolvlan-15network192.169.15.0mask255.255.255.0gateway-list192.169.15.1dns-list218.201.4.3218.201.21.132#user-groupsystemgroup-attributeallow-guest#local-useradminpasswordcipher$c$3$OPmwVHESNbfHNXczEeMcdq2DmRDCR7kmS/E=authorization-attributelevel3service-typesshterminalservice-typeftpservice-typeweblocal-userdot1xpasswordcipher$c$3$nWqagHMVZB63q5qHyLqXBdUlHB39vQ2RPnE=service-typelan-accesslocal-userh3cpasswordcipher$c$3$ZHwyfLAqYN93aNiWN5J8OHGVh3EAgA==service-typepppservice-typeportal#sslserver-policysslvpnpki-domainssl#cwmpundocwmpenable#l2tp-group1allowl2tpvirtual-template1tunnelnameLNS#interfaceAux0asyncmodeflowlink-protocolppp#interfaceCellular0/0asyncmodeprotocollink-protocolppp#interfaceEthernet0/0portlink-moderoutepppoe-serverbindVirtual-Template2#interfaceEthernet0/1portlink-moderoutefirewallpacket-filter3003inboundnatoutbound3000address-group1ipaddressdarenableqoscarinboundcarl1cir1600cbs100000ebs0greenpassreddiscardqoscaroutboundcarl10cir400cbs25000ebs0greenpassreddiscardinterfaceEthernet0/2portlink-moderoutespeed100#interfaceEthernet0/2.10vlan-typedot1qvid10natoutbound3100ipaddress192.169.10.1255.255.255.0#interfaceEthernet0/2.11vlan-typedot1qvid11natoutbound3100ipaddress192.169.11.1255.255.255.0#interfaceEthernet0/2.12vlan-typedot1qvid12natoutbound3100ipaddress192.169.12.1255.255.255.0#interfaceEthernet0/2.13vlan-typedot1qvid13natoutbound3100ipaddress192.169.13.1255.255.255.0#interfaceEthernet0/2.14vlan-typedot1qvid14ipaddress192.169.14.1255.255.255.0#interfaceEthernet0/2.15vlan-typedot1qvid15natoutbound3100ipaddress192.169.15.1255.255.255.0#interfaceEthernet0/2.20vlan-typedot1qvid20natoutbound3100ipaddress192.169.20.1255.255.255.0portalserverportalmethoddirect#interfaceSerial1/0link-protocolppp#interfaceSerial1/1link-protocolppp#interfaceVirtual-Template1pppauthentication-modechapdomainsystemremoteaddresspool2ipaddress192.169.99.1255.255.255.0#interfaceVirtual-Template2pppauthentication-modechapdomainpppoepppaccount-statisticsenablepppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.21.132remoteaddresspool3ipaddress192.169.101.1255.255.255.0#interfaceVirtual-Template10pppauthentication-modechapdomainpppoe-server-10pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool10#interfaceVirtual-Template11pppauthentication-modechapdomainpppoe-server-11pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool11#interfaceVirtual-Template12pppauthentication-modechapdomainpppoe-server-12pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool12#interfaceVirtual-Template13pppauthentication-modechapdomainpppoe-server-13pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool13#interfaceVirtual-Template14pppauthentication-modechapdomainpppoe-server-14pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool14interfaceVirtual-Template15pppauthentication-modechapdomainpppoe-server-15pppipcpremote-addressforcedpppipcpdns218.201.4.3218.201.17.2remoteaddresspool15#interfaceNULL0#interfaceVlan-interface1ipaddress192.169.0.1255.255.255.0undoipfast-forwardingnatoutbound3100firewallpacket-filter3002inboundfirewallpacket-filter4000inbound#interfaceEthernet0/3portlink-modebridge#interfaceEthernet0/4portlink-modebridge#dhcp-snooping#ssl-vpnserver-policysslvpnssl-vpnenable##info-centerloghost192.169.0.6facilitylocal6#dhcpserverforbidden-ip192.169.10.1192.169.10.10dhcpserverforbidden-ip192.169.11.1192.169.11.10dhcpserverforbidden-ip192.169.12.1192.169.12.10dhcpserverforbidden-ip192.169.13.1192.169.13.10dhcpserverforbidden-ip192.169.14.1192.169.14.10dhcpserverforbidden-ip192.169.15.1192.169.15.10dhcpserverforbidden-ip192.169.0.1192.169.0.30dhcpserverdetect#dhcpenable#ntp-serviceunicast-server202.112.10.60sshserverenablesshuseradminservice-typestelnetauthentication-typepassword#arptimeraging10#loadxml-configuration#loadtr069-configuration#user-interfacetty12user-interfaceaux0authentication-modeschemeuser-interfacevty04authentication-modescheme#return[END]2015/8/1213:16:01',)