Alcatel-Lucent IAP93 Betriebsanweisung PDF herunterladen (Seite 135)

135 | Authentication AOS-W Instant 6.3.1.1-4.0 | User Guide

successful, the mac-auth-only role is overwritten by the final role. The mac-auth-only role is primarily used

for wired clients.

n L2 authentication fall-through - Allows you to enable the l2-authentication-fallthrough mode. When this

option is enabled, the 802.1X authentication is allowed even if the MAC authentication fails. If this option is

disabled, 802.1X authentication is not allowed. The l2-authentication-fallthrough mode is disabled by

default.

For more information on configuring an OAW-IAP to use MAC + 802.1X Authentication, see Configuring MAC

Authentication with 802.1X Authentication on page 155.

l Captive Portal — Captive portal authentication is used for authenticating guest users. For more information on

Captive Portal authentication, see Captive Portal for Guest Access on page 110.

l MAC authentication with Captive Portal authentication—This authentication method has the following

features:

n If the captive portal splash page type is Internal-Authenticated or External-RADIUS Server, MAC

authentication reuses the server configurations.

n If the captive portal splash page type is Internal-Acknowledged or External-Authentication Text and MAC

authentication is enabled, a server configuration page is displayed.

n If the captive portal splash page type is none, MAC authentication is disabled.

n You can configure the mac-auth-only role when MAC authentication is enabled with captive portal

authentication.

For more information configuring an OAW-IAP to use MAC and Captive Portal authentication, see Configuring

MAC Authentication with Captive Portal Authentication on page 156.

l 802.1X authentication with Captive Portal authentication — This authentication mechanism allows you to

configure different Captive portal settings for clients on the same SSID. For example, you can configure an

802.1x SSID and create a role with for captive portal access, so that some of the clients using the SSID derive

the Captive portal role. You can configure rules to indicate access to external or internal Captive portal, or none.

For more information on configuring Captive portal roles for an SSID with 802.1x authentication, see Configuring

Captive Portal Roles for an SSID on page 123.

l WISPr authentication—Wireless Internet Service Provider roaming (WISPr) authentication allows a smart client

to authenticate on the network when they roam between wireless Internet service providers, even if the wireless

hotspot uses an Internet Service Provider (ISP) with whom the client may not have an account.

If a hotspot is configured to use WISPr authentication in a specific ISP and a client attempts to access the

Internet at that hotspot, the WISPr AAA server configured for the ISP authenticates the client directly and allows

the client to access the network. If the client only has an account with a

partner

ISP, the WISPr AAA server

forwards the client’s credentials to the partner ISP’s WISPr AAA server for authentication. When the client is

authenticated on the partner ISP, it is also authenticated on your hotspot’s own ISP as per their service

agreements. The OAW-IAP assigns the default WISPr user role to the client when your ISP sends an

authentication message to the OAW-IAP. For more information on WISPr authentication, see Configuring WISPr

Authentication on page 157.

Supported Authentication Servers

Based on the security requirements, you can configure internal or external RADIUSservers. This section describes

the following types of authentication servers and authentication termination, which can be configured for a network

profile:

l External RADIUS Server on page 136

l Internal RADIUS Server on page 136

l Authentication Termination on OAW-IAP on page 137

l Supported VSAs on page 137

1 2 ... 130 131 132 133 134 135 136 137 138 139 140 ... 334 335

Alcatel-Lucent IAP93 Betriebsanweisung Seite 135

Kommentare zu diesen Handbüchern