User manual ALCATEL-LUCENT OMNISWITCH 9000

[. . . ] Any other trademarks appearing in this manual are the property of their respective companies. Legal Notice The use of Alcatel Internetworking Inc. switching platforms and software, by all individuals or corporations, to terminate Cisco or Nortel VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Alcatel Internetworking Inc. from any and all legal actions that might be taken against it with respect to infringement of copyright on behalf of Cisco Systems or Nortel Networks. ii Part 031650-00 May 2005 Contents Preface Document Organization Related Documents . . xi xii xii xiii Chapter 1 Deploying Access Points . [. . . ] Captive portal can also be configured to allow users to download the Alcatel VPN dialer for the Microsoft VPN client if the VPN is going to be terminated on the Alcatel Mobility Controller. Alcatel Mobility Controller also allows the customization of the logon page. Captive Portal customization will talk about customizing the captive portal page. Configuring Captive Portals for Guest Logon Configuring captive portal for guest logon does not require an authentication server. A user trying to access the network will be assigned a logon role. The user will then have to pull up a browser. The user will be re-directed to a logon page, where the user will need to enter the credentials (an email ID in this case). The user is then granted a default role with limited access to browse the internet. Navigate to the Configuration > Security > Authentication Methods > Captive Portal Authentication page. Configuring the Captive Portal 99 OmniAccess RN: User Guide 2 3 Configure the role that the guest logon users will take. (See "Configuring Firewall Roles and Policies" for information on configuring a role). Determine the protocol captive portal will use. Modify the captiveportal policy to support the selected protocol. Navigate to the Configuration> Security > Authentication Methods > Captive Portal Authentication page. 104 Part 031650-00 May 2005 Chapter 10 2 Configure the role that a user authenticated using captive portal will take. ("Configuring Firewall Roles and Policies" on page 65 for information on configuring a role). Determine the protocol captive portal will use. Modify the captiveportal policy to support the selected protocol. HTTP: If the protocol selected is http, ensure that the following rules are included in the captive portal policy 3 user alias mswitch svc-https permit user any svc-http dst-nat 8080 user any svc-https dst-nat 8081 Configuring the Captive Portal 105 OmniAccess RN: User Guide HTTPs: If the protocol is https, ensure that the captiveportal policy has the following rules user alias mswitch svc-https permit user any svc-http dst-nat 8080 user any svc-https dst-nat 8081 4 In the default role for unauthenticated users (logon role by default), ensure that the captiveportal policy has been added. The user traffic needs to hit the rules in this policy for captive portal to work. 5 Configure the captive portal parameters. 106 Part 031650-00 May 2005 Chapter 10 Parameter Default role Description The role assigned to the guest user on logon. Default: guest Enable Guest Logon This field needs to be checked to only if guest logon needs to be enabled in addition to user logon. Default: Unchecked Enable User Logon This field needs to be checked to enable user logon authentication using an authentication server. Default: Checked Enable Logout Popup Window When this is enabled, a pop up window will appear with the Logout link for the user to logout after the user logs in. If this is disabled, the user remains logged in till the user timeout period or till station reloads as the user does not have a logout mechanism. Default: Checked Protocol type The protocol used on re-direction to captive portal page. [. . . ] The master switch also has a separate VRRP instance for each of the local switches corresponding to the local switch's VLAN and subnet. The VRRP instances on the master have a lower priority since the master is a backup and needs to take over the Home agent functionality only if the local switch goes down. The preemption on all the master switch's VRRP instances is disabled. Requirements on the Local Switch The local switch shares a VRRP instance with the master. The address of the VRRP instance, VLAN ID on the local switch and the corresponding instance on the master must be the same. [. . . ]