Nortel Networks 2300 manual How Portal Web-based AAA Works

Configuring AAA for Network Users 429

How Portal Web-based AAA Works

1A Web-based AAA user attempts to access the network. For a wireless user, this begins when the user’s network interface card (NIC) associates with an SSID on a Nortel radio. For a wired authentication user, this begins when the user’s NIC sends data on the wired authentication port.

2The user opens a web browser. The web browser sends a DNS request for the IP address of the home page or a URL requested by the user.

3If user web-portal-ssidhas been configured for the SSID (or web-portal-wired, if the user is on a wired authentication port), WSS Software does the following:

●Intercepts the DNS request, uses the WSS Software DNS proxy to obtain the URL’s IP address from the network DNS server, and sends the address to the user’s browser.

●Serves a login page to the Web-based AAA user.

The web-portal-ssidand web-portal-wiredusers allow temporary access to limited network resources (by default, DHCP only) while WSS Software authenticates and authorizes the Web-based AAA user. The access to DHCP allows the user to obtain an IP configuration while WSS Software is authenticating and authorizing the user.

4The user enters their username and password in the Web-based AAA login page.

5WSS Software starts a portal session for the user and places the user in the VLAN associated with the web-portal-ssidor web-portal-wireduser. A portal session allows the user to obtain an IP configuration while WSS Software authenticates and authorizes the user. WSS Software authenticates the user by checking RADIUS or the switch’s local database for the username and password entered by the user. If the user information is present, WSS Software authorizes the user based on the authorization attributes set for the user.

Note. WSS Software ignores the VLAN-Name or Tunnel-Private-Group-ID attribute associated with the user, and leaves the user in the VLAN associated with the web-portal-ssidor web-portal-wireduser. When you configure web-portal-ssidor web-portal-wiredusers, make sure you associate them with the VLAN in which you want to place authorized Web-based AAA users.

6After authentication and authorization are complete, WSS Software changes the user’s session from a portal session with the name web-portal-ssidor web-portal-wiredto a Web-based AAA session with the user’s name. The session remains connected, but is now an identity-based session for the user instead of a portal session.

7WSS Software redirects the browser to the URL initially requested by the user or, if the URL VSA is configured for the user, redirects the user to the URL specified by the VSA.

8The web page for the URL to which the user is redirected appears in the user’s browser window.

Nortel WLAN Security Switch 2300 Series Configuration Guide