Network Topology
Traditional cloud AP networking
Problem Description
The portal web page cannot pop up normally after the mobile terminal is connected to Wi-Fi, and some websites such as YouTube can still be accessed without passing the portal authentication.
Process Analysis
1. The user logs in to the portal using the account or password. The authentication template is the initial configuration.
2. If an AP is switched to cloud mode, free-rule is automatically delivered and temp-pass is enabled for the AP. If temp-pass is enabled for the AP, traffic is temporarily allowed within 30 seconds without authentication.
3. Undo part of the free-rule and turn off the temp-pass function, the terminal can still access some websites.
4. Check the terminal IP address and find that there is an IPv6 address, and capture packets on the terminal side and find that the customer accesses some websites using the ipv6 address.
5. Because Couldnet only performs portal authentication for ipv4, v6 does not enable authentication, so v6 traffic is allowed to pass.
Solution
Undo DHCPv6 ip-pool on the DHCP Server