< Home

Web: Example for Configuring WeChat Authentication on Internet Access Users

Networking Requirements

A shopping mall has a FW deployed as the egress gateway at the network border to connect the intranet to the Internet, as shown in Figure 1. To attract customers, the mall has Wi-Fi deployed so that the customers can enjoy free Internet access after they enable the Wi-Fi function and pass the one-click authentication.

Free Internet access through one-click authentication is implemented by combining the one-click authentication function for Wi-Fi access through WeChat provided by the Agile Controller with the user-defined portal authentication function of the FW and by integrating with the WeChat platform.

Figure 1 WeChat authentication on Internet access users

Configuration Roadmap

To implement the function of free Internet access through one-click authentication, you need to perform configurations on the WeChat platform, Agile Controller, and FW. The configuration procedure is as follows:

  1. Configure relevant services on the WeChat platform.
    1. Use the applied WeChat official account to log in to the WeChat platform and add the plug-ins for Wi-Fi access through WeChat and for shop management.

      Only an enterprise but not individual can apply for shop management.

    2. Add a shop and set its location and name.

      Ensure the accuracy of the shop location so that users can properly obtain Wi-Fi information.

    3. Add a device and bind a WeChat account as the administrator for the function of Wi-Fi access through WeChat in this shop.

      The device refers to the AP device corresponding to the SSID associated with this function. This step associates the shop name, Wi-Fi SSID, and Wi-Fi password. Configure the device as one authenticated through password.

    4. Activate the function of Wi-Fi access through the WeChat official account.
    5. View the AppID and AppSecret of the WeChat official account.

    The preceding descriptions cover basic steps of configurations on the WeChat platform. For operation details, contact WeChat technical support.

  2. Configure the Agile Controller.
    1. Configure a third-party application and specify the parameters for interconnecting the Agile Controller with the WeChat platform.
    2. Configure the authentication page pushed by the Agile Controller to users.
    3. Configure the policy for pushing the portal authentication page to users.
    4. Configure the portal server and RADIUS server for them to properly interwork with the FW.

  3. Configure the FW.

    1. Configure interfaces and assign them to security zones.
    2. Configure a NAT policy.
    3. Configure the DHCP function.
    4. Configure security policies.
    5. Configure authentication, accounting, and authorization information of the RADIUS server.
    6. Configure an authentication domain.
    7. Configure Portal2.0 authentication.
    8. Configure a domain name group.
    9. Configure authentication policies.

Data Planning

Item Data Description

Agile Controller

The parameters for interconnecting with the WeChat platform include the Token, AppID, and AppSecret.

The values shall be consistent with those on the WeChat platform.

When the Agile Controller communicates with the WeChat platform, the WeChat platform needs to verify these values.

Device IP address range of users: 10.3.0.0/24

If the device IP address of a user falls in the range of 10.3.0.0/24, the Agile Controller pushes the customized portal authentication page to the user.
RADIUS parameters:
  • Authentication and accounting key: Admin@123
  • Authorization key: Admin@123

RADIUS parameters set on the Agile Controller shall be consistent with those on the FW.
Portal parameters:
  • Portal key: Admin@123
  • Access device IP address list: 10.3.0.0/24
  • Portal protocol type: Huawei Portal protocol
  • Enabling heartbeat between the access device and portal server
  • Portal server IP address: 10.2.0.50
  • Port: 2000

Portal authentication parameters set on the Agile Controller shall be consistent with those on the FW.
FW
RADIUS server:
  • IP address of the authentication/accounting/authorization server: 10.2.0.50
  • Authentication port: 1812
  • Accounting port: 1813
  • Authentication and accounting key: Admin@123
  • Authorization key: Admin@123

RADIUS server parameters set on the FW shall be consistent with those on the Agile Controller.
Portal server:
  • IP address: 10.2.0.50
  • Port: 50100
  • Portal key: Admin@123
  • Probe cycle: 100 seconds; probe retry count: 5 times
  • User synchronization cycle: 300 seconds; user synchronization count: 5 times
  • Portal authentication page: http://10.2.0.50:8080/portal

Portal server parameters set on the FW shall be consistent with those on the Agile Controller.

FW listening port: 2000

This port is used by the FW to listen to portal server messages. You need also to configure this port on the Agile Controller.

Procedure

  1. Configure relevant information on the Agile Controller.
    1. Choose System > External Authentication > Third-Party Applications, set the parameters for interconnecting the Agile Controller with the WeChat platform, and keep default values for other parameters.

      Ensure that the Agile Controller can communicate with the WeChat platform. In this step, the Agile Controller connects to the WeChat platform for verification. The configuration completes only after the verification succeeds.

    2. Choose Policy > Permission Control > Page Customization > Page Customization, select a WeChat authentication template, and click the button below to start customizing the authentication page.

    3. Set parameters of the WeChat authentication page template as follows and then click OK.

    4. Edit the authentication page as required. After that, click Release in the lower-left corner.

      As shown in the following figure, click the red box on the left for the content and style editing page to be displayed on the right. Click the button in the line of Shop Info and select the shop bound to this authentication page. Edit other information as required or keep the default configurations.

      Ensure that the Agile Controller can communicate with the WeChat platform. In this step, the Agile Controller connects to the WeChat platform and reads information about the added shop from the platform. The read shop information is shown in the following figure.

      Till now, you have completed customizing the authentication page.

    5. Choose Policy > Permission Control > Page Customization > Portal Page Push Rule and perform configurations as shown in the following figure. Keep default values for other information.

      If the device IP address of a user falls in the range of 10.3.0.0/24, the Agile Controller pushes the customized portal authentication page to the user.

    6. Choose Resource > Device > Device Management, add a device, and configure the portal and RADIUS servers.

      Parameter

      Description

      IP address

      The Agile Controller and this interface address on the FW must be reachable to each other.

      RADIUS parameters

      Authentication and accounting key

      Must be consistent with the shared key for the FW to interact with the authentication and accounting server set on the 6.

      Authorization key

      Must be consistent with the shared key for the FW to interact with the authorization server set on the 6.

      Realtime account period

      Optional.

      Device series

      Keep the default value.

      Portal parameters

      Portal key

      Must be consistent with the shared key set on the 8.

      Port

      Must be consistent with the listening port set on the 8.


  2. Choose Network > Interface, configure an IP address for the interface, and assign the interface to a security zone.

    After completing the preceding configurations on the Agile Controller, perform the following configurations on the FW.

    The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

    Zone

    trust

    IP Address

    10.3.0.1/24

  3. Choose Policy > NAT Policy > NAT Policy and click Add to configure a NAT policy.

    Configure the NAT policy so that the FW can replace the source IP address for accessing extranet packets with the public address of the extranet interface.

    Name

    policy_nat1

    NAT Type

    NAT

    NAT Mode

    Source address translation

    Source Zone

    trust, dmz

    Destination Type

    Outbound Interface GigabitEthernet 0/0/1

    Source Address Translated To

    Outbound Interface

  4. Choose Network > DHCP Server > Service and click Add to configure the DHCP function.

    After that, the FW can allocate IP addresses to users after their devices connect to the SSID.

    Interface Name

    GigabitEthernet 0/0/3

    Type

    IPv4

    Service Type

    Server

    IP Addresses Range

    10.3.0.2 to 10.3.0.254

    Subnet Mask

    255.255.255.0

    DNS Server

    9.9.9.9

  5. Choose Policy > Security Policy > Security Policy and click Add to configure a security policy.
    1. Configure a security policy for the Trust (where users reside) -> DMZ (where the portal server resides) interzone for users to access the portal authentication page of the portal server.

      Name

      sec_policy_tsm

      Source Zone

      trust

      Destination Zone

      dmz

      Source Address

      10.3.0.0/24

      Destination Address

      10.2.0.0/24

      Action

      Permit

      If the URL of the authentication page is a domain name and a DNS server for resolving the domain name is deployed in the DMZ, you need to enable the DNS server from the Trust zone to the DMZ.

    2. Configure a security policy for the DMZ (where the portal and RADIUS servers reside) -> Local interzone to allow the portal and RADIUS servers communicate with the FW.

      Name

      local_policy_01

      Source Zone

      local

      Destination Zone

      dmz

      Action

      Permit

      Name

      local_policy_02

      Source Zone

      dmz

      Destination Zone

      local

      Action

      Permit

    3. Configure a security policy for the DMZ (where the Agile Controller resides) -> extranet interzone to allow the Agile Controller to access the WeChat platform.

      Name

      policy_02

      Source Zone

      dmz

      Destination Zone

      untrust

      Source Address

      10.2.0.0/24

      Action

      Permit

    4. Configure a security policy for the WeChat platform -> DMZ (where the Agile Controller resides) interzone to allow the WeChat platform to access the Agile Controller.

      Name

      policy_04

      Source Zone

      untrust

      Destination Zone

      dmz

      Destination Address

      10.2.0.0/24

      Action

      Permit

    5. Configure a security policy for the Trust (where users reside) -> extranet interzone to allow users to access extranet resources.

      Name

      policy_03

      Source Zone

      trust

      Destination Zone

      untrust

      Source Address

      10.3.0.0/24

      Action

      Permit

  6. Configure authentication, accounting, and authorization information of the RADIUS server.
    1. Choose Object > Authentication Server > RADIUS and click Add to configure the RADIUS server.

      Configure the IP address and port of the RADIUS authentication and accounting server and the shared key for the FW to interact with the authentication and accounting server. The parameters must be consistent with those on the RADIUS server.

    2. Click Detect and then OK in the dialog box displayed. Enter the account name and password obtained from the RADIUS server. Then click Start Checking to check the connectivity to the RADIUS server. If the connectivity check succeeds, click Cancel.
    3. Click OK.
    4. Configure the IP address of the RADIUS authorization server and the shared key for the FW to interact with the authorization server. 

      [FW] radius-server authorization 10.2.0.50 shared-key cipher Admin@123

  7. Configure an authentication domain.
    1. Choose Object > User > default.
    2. Set the parameters as follows.

  8. Configure Portal2.0 authentication.
    1. Choose Object > User > Authentication Options > User-Defined Portal.
    2. Set the parameters as follows.

    3. Enable the function of redirecting HTTPS service requests through the portal authentication template. 

      [FW] user-manage portal-template portal
[FW-portal-template-portal] https enable
[FW-portal-template-portal] quit

  9. Choose Object > Address > Domain Group and click Add to create a domain name group.

    Add wifi.weixin.qq.com to the created domain name group for it to be used by the authentication policy.

    Name

    weixin

    Domain

    wifi.weixin.qq.com

  10. Choose Object > User > Authentication Policy and click Add to configure an authentication policy.
    1. Configure the action of the authentication policy for users to access the portal server to No authentication so that the users' authentication packets can go through the FW to the portal server.

      Name

      auth_policy_tsm

      Source Zone

      trust

      Destination Zone

      dmz

      Source Address

      10.3.0.0/24

      Destination Address

      10.2.0.50/32

      Action

      No authentication

    2. Set the action of the authentication policy for the Agile Controller to access the extranet to No authentication.

      Name

      auth_policy_01

      Source Zone

      dmz

      Destination Zone

      untrust

      Source Address

      10.2.0.0/24

      Action

      No authentication

    3. Set the action of the authentication policy for users to access the WeChat platform to No authentication.

      Name

      auth_policy_02

      Source Zone

      trust

      Destination Zone

      untrust

      Source Address

      10.3.0.0/24

      Destination Address

      Domain name group weixin

      Action

      No authentication

    4. Set the action of the authentication policy for the WeChat platform to access the Agile Controller to No authentication.

      Name

      auth_policy_03

      Source Zone

      untrust

      Destination Zone

      dmz

      Destination Address

      10.2.0.0/24

      Action

      No authentication

    5. Set the action of the authentication policy for users to access other extranet resources to Portal authentication.

      Name

      auth_policy_service

      Source Zone

      trust

      Destination Zone

      untrust

      Source Address

      10.3.0.0/24

      Action

      Portal authentication

      Portal authentication template name

      portal

Verification

  1. Enable Wi-Fi on a mobile phone and connect to the SSID of the shop.
  2. Use a browser to access extranet resources through HTTP.
  3. The user request is redirected to the customized authentication page.
  4. Operate as prompted on the authentication page.
  5. The mobile phone automatically opens the local WeChat App.
  6. The mobile phone displays the page for Wi-Fi access through WeChat.
  7. Operate as prompted on the page for Wi-Fi access through WeChat and click Finish. The user can access the Internet through Wi-Fi.

Configuration Scripts

sysname FW
#
authentication-profile name portal_authen_default
 portal-access-profile default               
#                                            
 user-manage portal-template portal
 https enable
 portal-url push information
 portal-url parameter user-ip userip user-mac usermac
 portal-url parameter mac-address format delimiter - normal
 portal-url http://10.2.0.50:8080/portal
 server-detect web-auth-server default
#
security-policy
 rule name sec_policy_tsm  
  source-zone trust 
  destination-zone dmz
  source-address 10.3.0.0 24
  destination-address 10.2.0.0 24
  action permit
 rule name local_policy_01  
  source-zone local 
  destination-zone dmz
  action permit
 rule name local_policy_02
  source-zone dmz
  destination-zone local
  action permit
 rule name policy_02  
  source-zone dmz
  destination-zone untrust
  source-address 10.2.0.0 24
  action permit
 rule name policy_03  
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 24
  action permit
rule name policy_04  
  source-zone untrust
  destination-zone dmz
  destination-address 10.2.0.0 24
  action permit
#
nat-policy  
  rule name policy_nat1
  source-zone trust                                                             
  source-zone dmz                                                               
  egress-interface GigabitEthernet0/0/1
  action source-nat easy-ip
#                                                                               
radius-server template auth_server_radius                                       
 radius-server shared-key cipher %^%#H**3(i3_k%ugc;,fvZG!,-:|*=(A5(y4Q_2t'3P%^%
#                                                                               
 radius-server authentication 10.2.0.50 1812 weight 80                          
 radius-server accounting 10.2.0.50 1813 weight 80                              
 radius-server group-filter class                                               
radius-server authorization 10.2.0.50 shared-key cipher %^%#K}(^&0opP~Q%fMUr3k*(
59%N:,+H$*!(Vs%%^%#                                                          
#                                                                               
web-auth-server default                                                         
 server-ip 10.2.0.50                                                            
 port 50100                                                                     
 shared-key cipher %^%#/.6y+B[H{Q'wPG"lpVK,bx*Yg9C*5VEC;'-K7~Z%^%#             
 server-detect interval 100 max-times 5 action log                              
 user-sync max-times 5                                                          
#                                                                               
portal-access-profile name default                                              
 web-auth-server default                                                        
#                                                                               
aaa                                                                             
 authentication-scheme radius                                                   
  authentication-mode radius                                                    
 authorization-scheme radius                                                    
  authorization-mode radius                                                     
 accounting-scheme radius                                                       
  accounting-mode radius                                                        
 domain default                                                                 
  authentication-scheme radius                                                  
  accounting-scheme radius                                                      
  authorization-scheme radius                                                   
  radius-server auth_server_radius                                              
  service-type internetaccess                                                   
  internet-access mode password                                                 
#
domain-set name weixin
add domain wifi.weixin.qq.com
#
dhcp enable
#                                                                               
interface GigabitEthernet0/0/3           
 undo shutdown                                                                  
 ip address 10.3.0.1 255.255.255.0
 dhcp select interface                                                          
 dhcp server ip-range 10.3.0.2 10.3.0.254
 dhcp server dns-list 9.9.9.9                                               
#
interface LoopBack0                                                             
 authentication-profile portal_authen_default                                   
#                                                                               
firewall zone trust                                                             
 set priority 85                                                                
 add interface GigabitEthernet0/0/3      
#                                                                               
firewall zone untrust                                                           
 set priority 5                                                                 
 add interface GigabitEthernet0/0/1      
#                                                                               
firewall zone dmz                                                               
 set priority 50 
 add interface GigabitEthernet0/0/2   
#                                                                               
auth-policy                                                                     
 rule name auth_policy_tsm                                                      
  source-zone trust                                                             
  destination-zone dmz                                                          
  source-address 10.3.0.0 mask 255.255.255.0                                    
  destination-address 10.2.0.50 mask 255.255.255.255                            
  action none
  rule name auth_policy_01                                                      
  source-zone dmz                                                             
  destination-zone untrust                                                          
  source-address 10.2.0.0 mask 255.255.255.0                                   
  action none
 rule name auth_policy_02                                                      
  source-zone trust                                                             
  destination-zone untrust                                                          
  source-address 10.3.0.0 mask 255.255.255.0                                    
  destination-address domain-set weixin                            
  action none
rule name auth_policy_03                                                      
  source-zone untrust                                                             
  destination-zone dmz                                                          
  destination-address 10.2.0.0 mask 255.255.255.0                            
  action none                                                                   
 rule name auth_policy_service                                                  
  source-zone trust                                                             
  destination-zone untrust                                                      
  source-address 10.3.0.0 mask 255.255.255.0                                    
  action auth portal-template portal                                            
#                                                                                                                                                      
return
Parent Topic: User Authentication
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >