3com WX1200 3CRWX120695A Manual De Usuario
548
C
HAPTER
24: C
ONFIGURING
SODA E
NDPOINT
S
ECURITY
FOR
A
WX S
WITCH
Note the following when creating the SODA agent in SODA Manager:
The failure.html and success.html pages, when specified as success or
failure URLs in SODA Manager, must be of the format:
failure URLs in SODA Manager, must be of the format:
https://hostname/soda/ssid/xxx.html
where xxx refers to the name of the HTML file being accessed.
The success and failure URLs configured in SODA Manager are
required to have two keywords in them: /soda/ and success.html or
failure.html. The /soda/ keyword must immediately follow the
hostname. The hostname must match the Common Name specified in
the WebAAA certificate.
required to have two keywords in them: /soda/ and success.html or
failure.html. The /soda/ keyword must immediately follow the
hostname. The hostname must match the Common Name specified in
the WebAAA certificate.
The logout page is required to have /logout.html in the URL.
The hostname of the logout page should be set to a name that
resolves to the WX switch’s IP address on the VLAN where the client
resides, or should be the IP address of the WX switch on the Web
Portal WebAAA VLAN; for example:
resolves to the WX switch’s IP address on the VLAN where the client
resides, or should be the IP address of the WX switch on the Web
Portal WebAAA VLAN; for example:
https://10.1.1.1/logout.html
The logout page should not point to a certificate hostname that is
unreachable from the client’s VLAN, nor should it point to an IP
address that is on a different VLAN, which causes the source MAC
address to be changed to the default router’s (gateway’s) MAC
address. The WX switch uses the client’s source MAC address and
source IP address combination to make sure the client is permitted to
log itself out.
unreachable from the client’s VLAN, nor should it point to an IP
address that is on a different VLAN, which causes the source MAC
address to be changed to the default router’s (gateway’s) MAC
address. The WX switch uses the client’s source MAC address and
source IP address combination to make sure the client is permitted to
log itself out.
If the source IP address is on a different VLAN, then the source MAC
address does not match with the session’s MAC address, and the
logout procedure fails.
address does not match with the session’s MAC address, and the
logout procedure fails.
Following the hostname, the URL of the logout page must exactly
match logout.html. You cannot specify any other subdirectories in the
URL.
match logout.html. You cannot specify any other subdirectories in the
URL.
Do not use the Partner Integration button in SODA Manager to
create agent files.
create agent files.