Secure Access Service Edge:Network access best practices

Step 1: Configure the authentication server (RADIUS)

RADIUS is a network protocol that provides centralized authentication, authorization, and accounting (AAA) services. SASE provides a Cloud Authentication Server, and you can also configure your own authentication server.

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Basic Configurations.

3. On the Authentication Server tab, view the Cloud Authentication Server information, or click Add Authentication Server. Complete one of the following options:

   • View the cloud authentication server

     1. In the upper-right corner of the page, click Cloud Authentication Server.

     2. In the Cloud Authentication Server pane, view the details of the cloud authentication server that SASE provides.

   • Add an authentication server

     1. Click Add Authentication Server.

     2. In the Add Authentication Server pane, configure the Authentication Server Name and the IP Address of the server, and then click Save.

        Note

        The default authentication port, shown as User Wi-Fi Authentication Interface, is 1812. The default accounting port, shown as User Wi-Fi Billing Interface, is 1813.

     3. On the Deployment and Installation tab, view the Recommended Server Specifications and the Server Deployment Commands required to deploy RADIUS.

     4. Copy the Server Deployment Commands and deploy RADIUS on your own server.

     5. After the deployment finishes, check the deployment status in the list.

        An authentication server that is deployed successfully shows the status Online.

Step 2: Configure network device information

A wireless controller centrally manages and controls wireless access points (APs), and lets you configure, monitor, and optimize the wireless network from one place. Register your on-premises wireless controller in the SASE console.

1. On the Network Device tab, click Add Network Device.

2. In the Add Network Device dialog box, configure the following parameters and click OK.

Step 3: Configure Wi-Fi management

Create a network instance for the wireless network that employees connect to.

1. On the Wi-Fi Management tab, click Create Network Instance.

2. In the Enterprise Wireless Network Configuration dialog box, configure the Network SSID and the Authentication Mode that employees use to access the network. Only EAP-TLS is supported. Then click OK.

Step 4: Configure certificate management

After a device connects to the enterprise office network through SASE, the system automatically issues the SASE CA certificate and a network access certificate to the SASE client. Only devices with these certificates installed can access internal enterprise applications over the enterprise wireless network. If the certificates that are issued automatically do not fit your business scenario, you can change the installation scope or the validity period, or customize the certificate organization name.

1. Click the Certificate Management tab.

2. On the Certificate Management tab, complete the Network Access Certificate Configuration, the CA Certificate Configuration, and the Global Settings.

Step 5: Configure the on-premises wireless controller (H3C example)

Configure the RADIUS scheme, the ISP domain, and wireless 802.1X authentication in the console of your on-premises wireless controller.

Step 6: Enable dynamic authorization (CoA)

CoA is usually implemented on the RADIUS protocol, and sends a RADIUS CoA-Request message to trigger an authorization change. After the wireless controller receives such a request, it updates the session parameters of the user based on the request content, and returns a CoA-ACK (acknowledgment) or CoA-NAK (rejection) message to the RADIUS server.

1. Connect to the wireless controller (AC) with a console cable.

2. Run the following commands to enable CoA.

[AC] radius dynamic-author server
[ac-radius-da-server] client ip <Radius server IP> key simple <Sharesecret>

Replace <Radius server IP> with the IP address of the RADIUS server, and replace <Sharesecret> with the shared key of that server.

Step 7: Configure a network access policy

When employees access the enterprise office network through SASE, a network access policy gives you fine-grained isolation and control over the access permissions of employees and devices, which improves network security and management efficiency.

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Office Network.

3. On the Network Access Permissions tab, click Create Policy.

4. In the Create Policy pane, configure the following parameters and click OK.

Step 8: Install and log on to the SASE client

Install and log on to the SASE client on an endpoint that is connected to the Internet. What you do after you log on to the client is described in Install and log on to SASE client.

Step 9: View authentication and network access records

After you complete the preceding steps, you can view network access records or employee authentication logs in the SASE console.

• View employee authentication logs

  1. In the navigation pane on the left of the SASE console, choose Log Analysis > Log Audit.

  2. On the Access Logs > User Authentication Logs tab, view the network access authentication status of employees.

• View network access records

  1. Log on to the Secure Access Service Edge console.

  2. In the navigation pane on the left, choose Network Access Control > Office Network.

  3. On the Network Access History tab, view the network access status of employees. You can also perform the Disable and Enable operations.

Step 1: Configure the authentication server (RADIUS)

RADIUS is a network protocol that provides centralized authentication, authorization, and accounting (AAA) services. SASE provides a Cloud Authentication Server, and you can also configure your own authentication server.

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Basic Configurations.

3. On the Authentication Server tab, view the Cloud Authentication Server information, or click Add Authentication Server. Complete one of the following options:

   • View the cloud authentication server

     1. In the upper-right corner of the page, click Cloud Authentication Server.

     2. In the Cloud Authentication Server pane, view the details of the cloud authentication server that SASE provides.

   • Add an authentication server

     1. Click Add Authentication Server.

     2. In the Add Authentication Server pane, configure the Authentication Server Name and the IP Address of the server, and then click Save.

        Note

        The default authentication port, shown as User Wi-Fi Authentication Interface, is 1812. The default accounting port, shown as User Wi-Fi Billing Interface, is 1813.

     3. On the Deployment and Installation tab, view the Recommended Server Specifications and the Server Deployment Commands required to deploy RADIUS.

     4. Copy the Server Deployment Commands and deploy RADIUS on your own server.

     5. After the deployment finishes, check the deployment status in the list.

        An authentication server that is deployed successfully shows the status Online.

Step 2: Configure network device information

A switch connects network devices of different types, such as computers, servers, printers, and routers, so that these devices can communicate and exchange data. Register your on-premises switch in the SASE console.

1. On the Network Device tab, click Add Network Device.

2. In the Add Network Device dialog box, configure the following parameters and click OK.

Step 3: Configure certificate management

After a device connects to the enterprise office network through SASE, the system automatically issues the SASE CA certificate and a network access certificate to the SASE client. Only devices with these certificates installed can access internal enterprise applications over the enterprise wired network. If the certificates that are issued automatically do not fit your business scenario, you can change the installation scope or the validity period, or customize the certificate organization name.

1. Click the Certificate Management tab.

2. On the Certificate Management tab, complete the Network Access Certificate Configuration, the CA Certificate Configuration, and the Global Settings.

Step 4: Configure the on-premises switch (H3C example)

Configure the RADIUS scheme, the ISP domain, and wired 802.1X authentication in the console of your on-premises switch.

Step 5: Enable dynamic authorization (CoA)

CoA is usually implemented on the RADIUS protocol, and sends a RADIUS CoA-Request message to trigger an authorization change. After the network device receives such a request, it updates the session parameters of the user based on the request content, and returns a CoA-ACK (acknowledgment) or CoA-NAK (rejection) message to the RADIUS server.

1. Connect to the access controller (AC) with a console cable.

2. Run the following commands to enable CoA.

[AC] radius dynamic-author server
[ac-radius-da-server] client ip <Radius server IP> key simple <Sharesecret>

Replace <Radius server IP> with the IP address of the RADIUS server, and replace <Sharesecret> with the shared key of that server.

Step 6: Configure a network access policy

When employees access the enterprise office network through SASE, a network access policy gives you fine-grained isolation and control over the access permissions of employees and devices, which improves network security and management efficiency.

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Office Network.

3. On the Network Access Permissions tab, click Create Policy.

4. In the Create Policy pane, configure the following parameters and click OK.

Step 7: Install and log on to the SASE client

Install and log on to the SASE client on an endpoint that is connected to the Internet. What you do after you log on to the client is described in Install and log on to SASE client.

Step 8: View authentication and network access records

After you complete the preceding steps, you can view network access records or employee authentication logs in the SASE console.

• View employee authentication logs

  1. In the navigation pane on the left of the SASE console, choose Log Analysis > Log Audit.

  2. On the Access Logs > User Authentication Logs tab, view the network access authentication status of employees.

• View network access records

  1. Log on to the Secure Access Service Edge console.

  2. In the navigation pane on the left, choose Network Access Control > Office Network.

  3. On the Network Access History tab, view the network access status of employees. You can also perform the Disable and Enable operations.

Step 1: Configure portal authentication

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Guest Network.

3. In the upper-right corner of the page, click Authentication Configuration.

4. On the Authentication Configuration page, complete the Authentication Portal Settings and the Custom Settings on Authentication Page. The detailed procedure is described in .

Step 2: Configure the authentication server (RADIUS)

RADIUS is a network protocol that provides centralized authentication, authorization, and accounting (AAA) services. For the guest network, SASE lets you configure your own authentication server.

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Network Access Control > Basic Configurations.

3. On the Authentication Server tab, click Add Authentication Server.

4. In the Add Authentication Server pane, configure the Authentication Server Name and the IP Address of the server, and then click Save.

   Note

   The default authentication port, shown as User Wi-Fi Authentication Interface, is 1812. The default accounting port, shown as User Wi-Fi Billing Interface, is 1813.

5. On the Deployment and Installation tab, view the Recommended Server Specifications and the Server Deployment Commands required to deploy RADIUS.

6. Copy the Server Deployment Commands and deploy RADIUS on your own server.

7. After the deployment finishes, check the deployment status in the list.

   An authentication server that is deployed successfully shows the status Online.

Step 3: Configure Wi-Fi management

Create a network instance for the wireless network that guests connect to.

1. On the Wi-Fi Management tab, click Create Network Instance.

2. In the Enterprise Wireless Network Configuration dialog box, configure the Network SSID and the Authentication Mode that guests use to access the network. Only EAP-TLS is supported. Then click OK.

Step 4: Configure the on-premises wireless controller (H3C example)

Configure portal authentication for the guest network in the console of your on-premises wireless controller.

# Enable wireless portal roaming.
[AC] portal roaming enable
# Disable ARP entry pinning for wireless portal clients.
[AC] undo portal refresh arp enable
# Enable the validity check for wireless portal clients.
[AC] portal host-check enable
# Set the portal authentication server type to CMCC
[AC] portal server sase-newptv4
[AC-portal-server-newpt] server-type cmcc
[AC-portal-server-newpt] quit
# Configure the portal web server
[AC] portal web-server sase-newptv4
[AC-portal-websvr-newpt] url http://192.168.XX.XX:8080/portal
# Include the ssid and wlan parameters in the portal web server URL that the device redirects users to. The values are the SSID and VLAN of the AP.
[AC-portal-websvr-newpt] url-parameter ssid ssid
[AC-portal-websvr-newpt] url-parameter vlan vlan
[AC-portal-websvr-newpt]  url-parameter acip value  <Actual IP address of the AC> 
# Set the portal web server type to CMCC.
[AC-portal-websvr-newpt] server-type cmcc
# Configure iOS captive-bypass adaptation
[AC-portal-websvr-newpt] captive-bypass ios optimize enable
[AC-portal-websvr-newpt] quit
# Enable the RADIUS session control feature.
[AC] radius session-control enable
# Configure the RADIUS CoA feature
[AC] radius dynamic-author server
[AC-radius-da-server] client ip <Radius server IP> key simple <SharedSecret>

Step 5: Log on as a guest

After a device connects to the guest Wi-Fi, the portal authentication page opens automatically. Enter your mobile number, get the SMS verification code and enter it, and then click Log On. You can access internal enterprise applications only after the authentication succeeds.

Step 6: View guest logs

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Log Analysis > Log Audit.

3. On the Access Logs > Guest Authentication Logs tab, view the network access authentication status of guests.

Step 1: Add dumb terminals

1. Log on to the Secure Access Service Edge console.

2. In the navigation pane on the left, choose Endpoint Management > Terminals.

3. In the list on the left, select Dumb Terminal. Based on your business requirements, click Add Terminal or Import Devices. Complete one of the following options:

   • Add Terminal — In the Add Terminal pane, enter the MAC Address, MAC Address Mask, Device Vendor, Device Name, and Device Type of the terminal, and then click OK.

   • Import Devices — In the Import Devices dialog box, click Download Import Template. After you fill in the device information, click Upload Local File. After the upload finishes, click OK.

Step 2: Configure network access

The network access configuration of a dumb terminal depends on the device type: wireless terminals and wired terminals use different methods.

• Wireless terminals — Follow the configuration procedure in Use case 1: Configure wireless network access for employees.

• Wired terminals — Follow the configuration procedure in Use case 2: Configure wired network access for employees.

Step 3: View dumb terminal authentication logs

1. In the navigation pane on the left of the SASE console, choose Log Analysis > Log Audit.

2. On the Access Logs > Dumb Terminal Authentication Logs tab, view the network access authentication status of the dumb terminals.