CLI: Example for Configuring HTTPS Web Login (RADIUS Server Authentication+Administrator Account Not on the Local Device)

This section provides an example for configuring HTTPS web login using the CLI. The administrator account is stored on the RADIUS server, and the FW authenticates the administrator through the RADIUS server.

Networking Requirements

As shown in Figure 1, the FW connects to the RADIUS server to authenticate and authorize the administrator.

Figure 1 Networking diagram for configuring HTTPS web login

Data Planning

Item	Data	Description
Administrator	User name/Password: radiusadmin/Admin@123 Level: 3	The account name and password should be easy to remember.
RADIUS server	Name: myradius IP address: 10.2.0.155 Shared key: Admin@123 Port: 1812	Ensure that the configuration on the RADIUS server is consistent with that on the RADIUS server.
Port:	Interface: GigabitEthernet 0/0/2 IP address: 10.2.0.1/24 Security zone: DMZ	Interface for communicating with the RADIUS server
Port:	Interface: GigabitEthernet 0/0/3 IP address: 172.16.0.1/24 Security zone: Trust	Interface for communicating with the administrator's PC.

Configuration Roadmap

Configure FW interfaces and security policies.
Configure the web service on the device and enable the HTTPS service on interfaces so that the administrator can log in to the web UI through HTTPS.
Configure a RADIUS server template, authentication scheme, authorization scheme, and authentication domain.
Create an administrator on the RADIUS server and specify the administrator level.

Procedure

Configure the FW.

Set interface IP addresses and assign the interfaces to security zones.

# Set IP addresses of interfaces.

<FW> system-view
[FW] interface GigabitEthernet 0/0/2
[FW-GigabitEthernet 0/0/2] ip address 10.2.0.1 24
[FW-GigabitEthernet 0/0/2] quit
[FW] interface GigabitEthernet 0/0/3
[FW-GigabitEthernet 0/0/3] ip address 172.16.0.1 24
[FW-GigabitEthernet 0/0/3] service-manage enable
[FW-GigabitEthernet 0/0/3] service-manage https permit
[FW-GigabitEthernet 0/0/3] quit

# Assign interfaces to security zones.

[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet 0/0/3 
[FW-zone-trust] quit
[FW] firewall zone dmz
[FW-zone-dmz] add interface GigabitEthernet 0/0/2
[FW-zone-dmz] quit

Configure security policies for the FW.

# Configure a security policy from the Local zone to the DMZ so that the FW can proactively communicate with the RADIUS server.

[FW-policy-security] rule name policy02
[FW-policy-security-rule-policy02] source-zone local
[FW-policy-security-rule-policy02] destination-zone dmz
[FW-policy-security-rule-policy02] destination-address 10.2.0.155 24
[FW-policy-security-rule-policy02] action permit
[FW-policy-security-rule-policy02] quit

Enable the HTTPS service and set the service port and timeout period of the web service.

By default, the HTTPS service is enabled, and the default port number of the HTTPS service is 8443.
```
<FW> system-view
[FW] web-manager security enable port 8443
[FW] web-manager timeout 10
```

Configure a RADIUS server template.

[FW] radius-server template myradius
[FW-radius-myradius] radius-server authentication 10.2.0.155 1812
[FW-radius-myradius] radius-server shared-key cipher Admin@123
[FW-radius-myradius] test-aaa testname testpassword radius-template myradius
[FW-radius-myradius] quit

Configure authentication and authorization schemes.

# Configure an authentication scheme and set the authentication mode to RADIUS.

[FW] aaa
[FW-aaa] authentication-scheme radius   //Configure authentication scheme radius.
[FW-aaa-authen-radius] authentication-mode radius
[FW-aaa-authen-radius] quit

# Set the authorization mode to RADIUS.

[FW] aaa
[FW-aaa]  authorization-scheme radius   //Configure authorization scheme radius
[FW-aaa-author-radius] authorization-mode radius
[FW-aaa-author-radius] quit

Configure an authentication domain and references a RADIUS server template, authentication scheme, and authorization scheme.

[FW-aaa] domain radius
[FW-aaa-domain-radius] authentication-scheme radius   //Configure authentication scheme radius.
[FW-aaa-domain-radius] authorization-scheme radius   //Configure authorization scheme radius
[FW-aaa-domain-radius] radius-server myradius   //Configure RADIUS server myradius.
[FW-aaa-domain-radius] service-type administrator-access
[FW-aaa-domain-radius] quit
[FW-aaa] quit

Configure the RADIUS server. For the configuration methods of the RADIUS server you use, refer to related documents.

Verification

User administrator password/password radiusadmin@radius/Admin@123 to log in to the FW through HTTPS. The login succeeds.

Run the display manager-user online-user command on the FW. The command output shows the administrator information is correct.

<FW> display manager-user online-user
 ----------------------------------------------------------------------------
  UserID            : 26
  Username          : radiusadmin@radius
  IP address        : 172.16.0.100
  Access-type       : web
  User-level        : 3
  Authen method     : RADIUS
  Author method     : RADIUS
  Login time        : 2017/03/27 09:55
 ----------------------------------------------------------------------------

Configuration Scripts

Only the configuration scripts related to the FW are provided.

#                                                                         
 web-manager security version tlsv1 tlsv1.1 tlsv1.2                       
 web-manager enable                                                             
 web-manager security enable                                                    
 web-manager timeout 10                                                       
#                                                                               
radius-server template myradius                                                 
 radius-server shared-key cipher %@%@9hlwD}%l$-M+Dj/$IpO91e3I%@%@               
 radius-server authentication 10.2.0.155 1812 weight 80                         
 undo radius-server user-name domain-included                                   
 radius-server group-filter class                                               
#                                                                               
aaa                                                                             
 authentication-scheme radius                                                   
  authentication-mode radius                                                    
 authorization-scheme radius                                                    
  authorization-mode radius                                                     
 domain radius                                                                  
  authentication-scheme radius                                                  
  authorization-scheme radius                                                   
  radius-server myradius                                                        
  service-type administrator-access                                             
  internet-access mode password                                                 
  reference user current-domain                                                 
#                                                                               
interface GigabitEthernet0/0/2               
 ip address 10.2.0.1 255.255.255.0                                             
#                                                                               
interface GigabitEthernet 0/0/3            
 ip address 172.16.0.1 255.255.255.0                                             
 service-manage https permit                                                    
# 
firewall zone trust                                                             
 set priority 85                                                                
 add interface GigabitEthernet 0/0/3       
#                                                                               
firewall zone dmz                                                               
 set priority 50                                                                
 add interface GigabitEthernet0/0/2          
#                                                                               
security-policy                                                                  
  action permit 
 rule name policy02                                                      
  source-zone local                                                             
  destination-zone dmz                                                         
  destination-address 10.2.0.155 mask 255.255.255.0                            
  action permit 
#