Interaction Between Portal System Components; Portal Authentication Modes - HP FlexNetwork 10500 Series Security Configuration Manual

Interaction between portal system components

The components of a portal system interact as follows:
1. An unauthenticated user initiates authentication by accessing an Internet website through a
Web browser. When receiving the HTTP request, the access device redirects it to the Web
authentication page provided by the portal Web server. The user can also visit the
authentication website to log in. The user must log in through the HPE iNode client for extended
portal functions.
2. The user enters the authentication information on the authentication page/dialog box and
submits the information. The portal Web server forwards the information to the portal
authentication server. Then the portal authentication server processes the information and
forwards it to the access device.
3. The access device interacts with the AAA server to implement authentication, authorization,
accounting for the user.
4. If security policies are not imposed on the user, the access device allows the authenticated user
to access the Internet. If security policies are imposed on the user, the portal client, the access
device, and the security policy server interact to check the user host. If the user passes the
security check, the security policy server authorizes the user to access resources based on the
check result. Portal authentication through Web does not support security check for users. To
implement security check, the client must be the HPE iNode client.
NOTE:
Portal authentication supports NAT traversal whether it is initiated by a Web client or an HPE iNode
client. NAT traversal must be configured on the device when the portal client is on a private network
and the portal server is on a public network. As a best practice in NAT traversal scenarios, use an
interface's public IP address as the source address of outgoing portal packets.

Portal authentication modes

Portal authentication has three modes: direct authentication, re-DHCP authentication, and
cross-subnet authentication. In direct authentication and re-DHCP authentication, no Layer 3
forwarding devices exist between the authentication client and the access device. In cross-subnet
authentication, Layer 3 forwarding devices can exist between the authentication client and the
access device.
Direct authentication
A user manually configures a public IP address or obtains a public IP address through DHCP. Before
authentication, the user can access only the portal Web server and predefined authentication-free
websites. After passing authentication, the user can access other network resources. The process of
direct authentication is simpler than that of re-DHCP authentication.
Re-DHCP authentication
Before a user passes authentication, DHCP allocates an IP address (a private IP address) to the
user. The user can access only the portal Web server and predefined authentication-free websites.
After the user passes authentication, DHCP reallocates an IP address (a public IP address) to the
user. The user then can access other network resources. No public IP address is allocated to users
who fail authentication. Re-DHCP authentication saves public IP addresses. For example, an ISP
can allocate public IP addresses to broadband users only when they access networks beyond the
residential community network.
Only the HPE iNode client supports re-DHCP authentication. IPv6 portal authentication does not
support the re-DHCP authentication mode.
136