364unreachable log "Portal server newpt turns down from up." and disables portal authentication on theaccess interface, so the host can access the external network without authentication.Example: Configuring cross-subnet portal authentication forMPLS L3VPNsNetwork configurationAs shown in Figure 126, the PE device Router A provides portal authentication for the host in VPN 1.A portal server in VPN 3 acts as the portal authentication server, portal Web server, and RADIUSserver.Configure cross-subnet portal authentication on Router A, so the host can access network resourcesafter passing identity authentication.Figure 126 Network diagramConfiguration prerequisites• Before enabling portal authentication, configure MPLS L3VPN and specify VPN targets for VPN1 and VPN 3 so that VPN 1 and VPN 3 can communicate with each other. This exampledescribes only the access authentication configuration on the user-side PE. For informationabout MPLS L3VPN configurations, see MPLS Configuration Guide.• Configure the RADIUS server correctly to provide authentication and accounting functions.ProcedurePerform the following tasks on Router A.1. Configure a RADIUS scheme:# Create a RADIUS scheme named rs1 and enter its view. system-view[RouterA] radius scheme rs1# For the RADIUS scheme, specify the VPN instance that is bound to the interface connected tothe portal/RADIUS server. This example uses VPN instance vpn3. (For information about theVPN instance, see the MPLS L3VPN configuration on Router A.)[RouterA-radius-rs1] vpn-instance vpn3# Specify the primary authentication server and primary accounting server, and configure thekeys for communication with the servers.[RouterA-radius-rs1] primary authentication 192.168.0.111[RouterA-radius-rs1] primary accounting 192.168.0.111[RouterA-radius-rs1] key accounting simple radius[RouterA-radius-rs1] key authentication simple radius# Exclude the ISP domain name from the username sent to the RADIUS server.[RouterA-radius-rs1] user-name-format without-domain
