WX2540E 旁路部署时开启 portal 认证后无效

参考官网上的配置指导

http://www.h3c.com/cn/d_201708/1021747_30005_0.htm  

贴上我的配置：

<H3C>dis cur
#
version 5.20, ESS 3703P68
#
sysname H3C
#
clock timezone Asia/Shanghai add 08:00:00
#
domain default enable system
#
telnet server enable
#
port-security enable
#
portal server 111 ip 10.1.48.224 key cipher $c$3$z0ufbNV7ux0I8KmKT3dzeETU73uAoMUH2g== url http://10.1.48.224:1816/wlan/index server-type cmcc
portal server tough ip 192.168.250.103 key cipher $c$3$MtWpbh+2VxkjJXrVCzHiDDyv3z6k2mpDyg== url http//192.168.250.103:1816/wlan/index server-type cmcc
portal free-rule 0 source ip any destination ip 192.168.250.0 mask 255.255.255.0
portal wlan ssid CengWang server tough domain portal
portal audit enable
#
wlan auto-ap enable
wlan auto-persistent enable
#
password-recovery enable
#
vlan 1
#
vlan 10
#
vlan 250
#
radius scheme portal
primary authentication 192.168.250.103 key cipher $c$3$gZU+hcUX3uGtrnU7kw041SEC0xl8vwdz2g==
user-name-format without-domain
nas-ip 192.168.250.100
#
domain portal
authentication default radius-scheme portal
authorization default radius-scheme portal
accounting default radius-scheme portal
access-limit disable
state active
idle-cut disable
self-service-url disable
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
user-group system
group-attribute allow-guest
#
local-user admin
password cipher $c$3$pDAHjktz0v9UQhj2KtcLaeCcnTPivP82
authorization-attribute level 3
service-type telnet
service-type web
#
wlan rrm
dot11a mandatory-rate 6 12 24
dot11a supported-rate 9 18 36 48 54
dot11b mandatory-rate 1 2
dot11b supported-rate 5.5 11
dot11g mandatory-rate 1 2 5.5 11
dot11g supported-rate 6 9 12 18 24 36 48 54
#
wlan service-template 1 clear
ssid CengWang
bind WLAN-ESS 1
client forwarding-mode local vlan 10
client dhcp-server centralized
service-template enable
#
wlan ap-group 1
ap 5866-baf7-0060
country-code CN
dot11a service-template 1
dot11bg service-template 1
dot11a radio enable
dot11bg radio enable
map-configuration apg1.cfg
undo bonjour-gateway enable
#
wlan ap-group default_group
#
interface Cellular1/0/1
async mode protocol
link-protocol ppp
#
interface NULL0
#
interface Vlan-interface1
shutdown
#
interface Vlan-interface10
ip address 192.168.10.2 255.255.255.0
portal server tough method direct
#
interface Vlan-interface250
ip address dhcp-alloc
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 250
#
interface GigabitEthernet1/0/2
port link-mode bridge
#
interface GigabitEthernet1/0/3
port link-mode bridge
port access vlan 250
#
interface GigabitEthernet1/0/4
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 10 250
port trunk pvid vlan 250
#
interface WLAN-ESS1
port link-type hybrid
undo port hybrid vlan 1
port hybrid vlan 10 untagged
port hybrid pvid vlan 10
mac-vlan enable
#
wlan ap 5866-baf7-0060 model WA2620 id 1
map-configuration apg1.cfg
serial-id 219801A0D1C125004249
undo bonjour-gateway enable
country-code CN
radio 1
service-template 1
radio enable
radio 2
service-template 1
radio enable
#
wlan ips
malformed-detect-policy default
signature deauth_flood signature-id 1
signature broadcast_deauth_flood signature-id 2
signature disassoc_flood signature-id 3
signature broadcast_disassoc_flood signature-id 4
signature eapol_logoff_flood signature-id 5
signature eap_success_flood signature-id 6
signature eap_failure_flood signature-id 7
signature pspoll_flood signature-id 8
signature cts_flood signature-id 9
signature rts_flood signature-id 10
signature addba_req_flood signature-id 11
signature-policy default
countermeasure-policy default
attack-detect-policy default
virtual-security-domain default
attack-detect-policy default
malformed-detect-policy default
signature-policy default
countermeasure-policy default
#
ip route-static 0.0.0.0 0.0.0.0 192.168.250.1
#
info-center format cmcc
#
ntp-service refclock-master 2
#
load xml-configuration
#
user-interface con 0
user-interface tty 4
user-interface vty 0 4
authentication-mode scheme
user privilege level 3
#
return
<H3C>

配置说明：

VLAN250 为 AP、AC 的设备管理 IP VLAN（192.168.250.0/24）

VLAN10 为用户获取的 IP 所属 VLAN（192.168.10.0/24）

有的地方说 portal 需要在有 IP 地址的三层接口上启用，但 AC 旁路部署时，除了与 AP 通信的 IP外，其他 IP 基本已无用。尽管我也在 interface vlan-interface 10 接口上配置了 IP，但并无效果，数据直接放行。