网络

华为AC+AP实现WLAN

Posted by honeyshan on 2024年9月19日 0 Comments

Read Next →

AC组网方式：旁挂二层组网。业务数据转发方式：隧道转发。
DHCP部署方式：
AC作为DHCP服务器为AP分配IP地址。
汇聚交换机S2作为DHCP服务器为STA分配IP地址。

WLAN的配置比较复杂，各模版直接的套用关系可以参考一下图：

1、配置好交换机和AC的接口，让AP能与AC建立CAPWAP隧道。

2、AC上设置AP的认证模式为无认证模式： ap auth-mode no-auth

3、用dis ap all 查看AP是否连接AC

4、当AP与AC建立连接后就可以在AC上进行ap-id的设置

各设备的具体配置如下：

<AC>dis current-configuration 
#
 sysname AC
#
 set memory-usage threshold 0
#
ssl renegotiation-rate 1 
#
vlan batch 100 to 101
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile
#
dhcp enable
#
diffserv domain default
#
radius-server template default
#
pki realm default
 rsa local-key-pair default
 enrollment self-signed
#
ike proposal default
 encryption-algorithm aes-256 
 dh group14 
 authentication-algorithm sha2-256 
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256 
 prf hmac-sha2-256 
#
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
#
aaa
 authentication-scheme default
 authentication-scheme radius
  authentication-mode radius
 authorization-scheme default
 accounting-scheme default
 domain default
  authentication-scheme radius
  radius-server default
 domain default_admin
  authentication-scheme default
 local-user admin password irreversible-cipher $1a$-j(u"#;&G*$9!,Z0(_'ML81/~0U\h
.#d6[.QA(-#9V,L@!]fmdQ$
 local-user admin privilege level 15
 local-user admin service-type http
#
interface Vlanif100
 ip address 192.168.100.1 255.255.255.0
 dhcp select interface
#
interface MEth0/0/1
 undo negotiation auto
 duplex half
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#
interface NULL0
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1
#
capwap source interface vlanif100
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
 protocol inbound all
user-interface vty 16 20
 protocol inbound all
#
wlan
 traffic-profile name default
 security-profile name secp
  security wpa2 psk pass-phrase %^%#yl#t4a-(BQ^="(AwoLUAvbe@WIY<XRhozj)w{xuA%^%#
 aes
 security-profile name default
 security-profile name default-wds
 security-profile name default-mesh
 ssid-profile name ssidp
  ssid qingmeiT1
 ssid-profile name default
 vap-profile name vapp
  forward-mode tunnel
  service-vlan vlan-id 101
  ssid-profile ssidp
  security-profile secp
 vap-profile name default
 wds-profile name default
 mesh-handover-profile name default
 mesh-profile name default
 regulatory-domain-profile name rdp
 regulatory-domain-profile name default
 air-scan-profile name default
 rrm-profile name default
 radio-2g-profile name default
 radio-5g-profile name default
 wids-spoof-profile name default
 wids-profile name default
 wireless-access-specification
 ap-system-profile name default
 port-link-profile name default
 wired-port-profile name default
 serial-profile name preset-enjoyor-toeap 
 ap auth-mode no-auth
 ap-group name apg
  regulatory-domain-profile rdp
  radio 0
   vap-profile vapp wlan 1
  radio 1
   vap-profile vapp wlan 1
  radio 2
   vap-profile vapp wlan 1
 ap-group name default
 ap-id 0 type-id 69 ap-mac 00e0-fc6a-5d40 ap-sn 2102354483103A24C14B
  ap-group apg
 ap-id 1 type-id 69 ap-mac 00e0-fcb1-04e0 ap-sn 2102354483106C0D3447
  ap-group apg
 provision-ap
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
#
return
<AC>

核心交换机的配置：

<s2>dis cur
#
sysname s2
#
vlan batch 100 to 101
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
dhcp enable
#
diffserv domain default
#
drop-profile default
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password simple admin
 local-user admin service-type http
#
interface Vlanif1
#
interface Vlanif101
 ip address 192.168.101.1 255.255.255.0
 dhcp select interface
#
interface MEth0/0/1
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#

接入交换机的配置：

<s1>dis current-configuration 
#
sysname s1
#
vlan batch 100
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
diffserv domain default
#
drop-profile default
#
aaa
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default
 domain default_admin
 local-user admin password simple admin
 local-user admin service-type http
#
interface Vlanif1
#
interface MEth0/0/1
#
interface Ethernet0/0/1
 port link-type access
 port default vlan 100
#
interface Ethernet0/0/2
 port link-type access
 port default vlan 100
#
interface Ethernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#

5、AP无需任何配置，连接上开机即可使用。

6、STA在VAP列表中选择SSID并输入密码连接即可。

总结：

1、VAP中设置的service-vlan vlan-id 101 把业务数据封装到vlan 101中。

2、当AC为forward-mode tunnel 时vlan101在AC中产生，但AC为forward-mode direct-forward时，VLAN101在AP处产生，这时候要注意各交换机必须运行VLAN101通过。

honeyshan

Read Next →

Leave a Reply

分类

归档