1.交换机的基础配置 配置vlan [SW]vlan batch 10 to 13 [SW-GigabitEthernet0/0/10]port link-type trunk [SW-GigabitEthernet0/0/10]port trunk allow-pass vlan 10 to 13 [SW-GigabitEthernet0/0/10]port trunk pvid vlan 10 [SW-GigabitEthernet0/0/11]port link-type trunk
[SW-GigabitEthernet0/0/11]port trunk pvid vlan 10 [SW-GigabitEthernet0/0/11]port trunk allow-pass vlan 10 to 13 [SW-GigabitEthernet0/0/1]port link-type trunk
[SW-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 to 13 [SW-LoopBack1]ip add 101.101.101.101 32 配置各vlan的网关 [SW-Vlanif10]ip add 10.1.10.1 24 [SW-Vlanif11]ip add 10.1.11.1 24 [SW-Vlanif12]ip add 10.1.12.1 24 [SW-Vlanif13]ip add 10.1.13.1 24 2.AC的基础配置 [AC]vlan batch 10 to 13 [AC-GigabitEthernet0/0/8]port link-type trunk [AC-GigabitEthernet0/0/8]port trunk allow-pass vlan 10 to 13 查看vlan的配置 配置三层接口ip地址 [AC-Vlanif10]ip add 10.1.10.100 24 [AC-Vlanif11]ip add 10.1.11.100 24 [AC-Vlanif12]ip add 10.1.12.100 24 [AC-Vlanif13]ip add 10.1.13.100 24 查看三层接口配置 [AC]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1 //配置默认路由指向交换机 检查AC和交换机上三层接口是否可达 3.配置AC远程登录 [AC]aaa [AC-aaa]local-user a1 password irreversible-cipher abc@123456 [AC-aaa]local-user a1 service-type telnet [AC-aaa]local-user a1 privilege level 3 [AC]user-interface vty 0 4 [AC-ui-vty0-4]authentication-mode aaa <AC>save //保存AC的配置 <SW>telnet 10.1.10.100 //在交换机上进行验证 4.创建AP组 [AC]wlan [AC-wlan-view]ap-group name ap-group 5.配置AP上线 开启DHCP服务，为STA和AP分配IP地址 [AC]dhcp enable [AC]ip pool ap [AC-ip-pool-ap]network 10.1.10.0 mask 24 [AC-ip-pool-ap]gateway-list 10.1.10.1 [AC-ip-pool-ap]option 43 sub-option 3 ascii 10.1.10.100 [AC]ip pool yw1 [AC-ip-pool-yw1]gateway-list 10.1.11.1
[AC-ip-pool-yw1]network 10.1.11.0 mask 24
[AC]ip pool yw2
[AC-ip-pool-yw2]network 10.1.12.0 mask 24 [AC-ip-pool-yw2]gateway-list 10.1.12.1
[AC-ip-pool-yw2]ip pool yw3
[AC-ip-pool-yw3]gateway-list 10.1.13.1 [AC-ip-pool-yw3]network 10.1.13.0 mask 24 在各vlanif接口下，使能DHCP [AC-Vlanif10]dhcp select global
[AC-Vlanif11]dhcp select global [AC-Vlanif12]dhcp select global [AC-Vlanif13]dhcp select global 配置域管理模板和AC的国家代码 [AC]wlan [AC-wlan-view]regulatory-domain-profile name domain [AC-wlan-regulate-domain-domain]country-code CN [AC]capwap source interface Vlanif 10 //配置AC源接口 [AC-wlan-view]ap auth-mode mac-auth //配置AP认证方式 查看AP的mac地址 在AC上离线导入AP [AC-wlan-view]ap-mac 00e0-fcb5-30f0 ap-id 0 [AC-wlan-ap-0]ap-group ap-group [AC-wlan-ap-0]ap-name ap1 [AC-wlan-view]ap-mac 00e0-fc68-7480 ap-id 1 [AC-wlan-ap-1]ap-group ap-group [AC-wlan-ap-1]ap-name ap2 检查AP状态 6.配置WLAN业务 配置SSID模板 [AC-wlan-view]ssid-profile name yw1 [AC-wlan-ssid-prof-yw1]ssid yw1 [AC-wlan-view]ssid-profile name yw2 [AC-wlan-ssid-prof-yw2]ssid yw2 [AC-wlan-ssid-prof-yw2]ssid-profile name yw3 [AC-wlan-ssid-prof-yw3]ssid yw3 配置VAP模板、业务数据转发模式、业务vlan、引用ssid模板 [AC-wlan-view]vap-profile name yw1 [AC-wlan-vap-prof-yw1]forward-mode direct-forward [AC-wlan-vap-prof-yw1]service-vlan vlan-id 11 [AC-wlan-vap-prof-yw1]ssid-profile yw1 [AC-wlan-view]vap-profile name yw2
[AC-wlan-vap-prof-yw2]forward-mode direct-forward [AC-wlan-vap-prof-yw2]service-vlan vlan-id 12
[AC-wlan-vap-prof-yw2]ssid-profile yw2
[AC-wlan-vap-prof-yw2]vap-profile name yw3 [AC-wlan-vap-prof-yw3]forward-mode tunnel [AC-wlan-vap-prof-yw3]service-vlan vlan-id 13 [AC-wlan-vap-prof-yw3]ssid-profile yw3
配置AP组引用域管理模板和VAP模板，AP上的射频0和1都使用VAP模板的配置 [AC-wlan-ap-group-ap-group]vap-profile yw1 wlan 1 radio all [AC-wlan-ap-group-ap-group]vap-profile yw2 wlan 2 radio all [AC-wlan-ap-group-ap-group]vap-profile yw3 wlan 3 radio all 查看vap状态 连接无线终端后 查看关联到的相关用户信息 在无线终端上ping loopback1口进行验证 7.配置WEP认证 AC支持的六种安全策略，每一个VAP模板可以调用一种 配置yw3认证方式和加密：认证方式为WEP share-key，加密采用WEP 40位 [AC-wlan-view]security-profile name yw3 [AC-wlan-sec-prof-yw3]security wep [AC-wlan-sec-prof-yw3]security wep share-key [AC-wlan-sec-prof-yw3]wep key 0 wep-40 pass-phrase abc123 [AC-wlan-view]vap-profile name yw3 [AC-wlan-vap-prof-yw3]security-profile yw3 查看安全模板配置 查看指定ssid下面关联用户汇总信息 查看终端关联详细信息 8.配置WPA PSK认证 华为AC支持WPA选项为 配置yw2的认证和加密：认证方式为WPA1-PSK，加密方式为TKIP [AC-wlan-view]security-profile name yw2 [AC-wlan-sec-prof-yw2]security wpa psk pass-phrase abc2abc2 tkip [AC-wlan-view]vap-profile name yw2 [AC-wlan-vap-prof-yw2]security-profile yw2 查看安全模板配置 查看关联用户汇总信息 查看终端关联信息 测试连通性 9.配置WPA EAP认证 WLAN的EAP认证架构需要客户端、认证者、认证服务器，认证功能服务器的配置略 在交换机上配置radius服务器网关地址 [SW]vlan 200 [SW-GigabitEthernet0/0/24]port link-type access [SW-GigabitEthernet0/0/24]port default vlan 200 [SW]interface Vlanif 200 [SW-Vlanif200]ip address 10.254.1.1 24 配置radius认证服务器和认证计费方案 [AC]radius-server template rs [AC-radius-rs]radius-server authentication 10.254.1.100 1812 source ip-address 10.1.10.100 [AC-radius-rs]radius-server accounting 10.254.1.100 1813 source ip-address 10.1.10.100 [AC-radius-rs]radius-server shared-key cipher rs001@123 [AC-radius-rs]undo radius-server user-name domain-included 配置aaa方案 [AC]aaa [AC-aaa]authentication-scheme radius [AC-aaa-authen-radius]authentication-mode radius [AC-aaa]accounting-scheme radius [AC-aaa-accounting-radius]accounting-mode radius [AC-aaa-accounting-radius]accounting realtime 15 [AC-aaa]domain default [AC-aaa-domain-default]authentication-scheme radius [AC-aaa-domain-default]radius-server rs 测试aaa的配置 [AC]test-aaa rs rs001@123 radius-template rs 配置接入模板 [AC]dot1x-access-profile name yw1 配置认证模板，并绑定认证模板、radius认证方案、计费方案和服务器模板指定使用的radius认证 [AC]authentication-profile name yw1 [AC-authentication-profile-yw1]dot1x-access-profile yw1 [AC-authentication-profile-yw1]authentication-scheme radius [AC-authentication-profile-yw1]radius-server rs 配置安全模板，定义加密方式为ccmp，认证方式为dot1x eap [AC]wlan [AC-wlan-view]security-profile name yw1 [AC-wlan-sec-prof-yw1]security wpa2 dot1x aes vap模板引用安全模板和认证模板 [AC-wlan-view]vap-profile name yw1 [AC-wlan-vap-prof-yw1]security-profile yw1 [AC-wlan-vap-prof-yw1]authentication-profile yw1 验证配置结果 [AC]display access-user ssid yw1 //查看ssid下面用户汇总信息 [AC]display station sta-mac 5489-98AF-2070 //查看终端关联的详细信息