AC+AP（同广播域组网）

同广播域组网思想

AC和AP之间连接

• AC实际是三层交换机
• AP信号发射器，负责一定的数据转发和转换，能够支持识别VLAN 能打TAG的设备

AC与AP之间，通关在一个vlan里使用PVID的方式进行通讯

如果SW1与AP直连的接口不打上一个与AC一个vlan PVID那么，DHCP就无法发送报文

配置trunk

//SW1
[SW1]vlan 100
[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all

//与AP直连的接口必须打标签
[SW1]int g0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk 
[SW1-GigabitEthernet0/0/2]port trunk pvid vlan 100
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 100

//AC
[AC6005]int g0/0/01
[AC6005-GigabitEthernet0/0/1]port link-type trunk 
[AC6005-GigabitEthernet0/0/1]port trunk allow-pass vlan all

AC配置DHCP【AC或者交换机上配置都行】

DHCP开启中继器的问题，两个网段不在同一个vlan里就要开启中继器，在一个vlan里就不需要开启DHCP中继器

[AC6005]dhcp enable 
[AC6005]ip pool AC
[AC6005-ip-pool-AC]network 192.168.10.0 mask 255.255.255.0
[AC6005-ip-pool-AC]gateway-list 192.168.10.254
[AC6005-ip-pool-AC]dns-list 114.114.114.114

//在vlan 100上开启DHCP
[AC6005]vlan 100
[AC6005-Vlanif100]ip address 192.168.100.253 255.255.255.0
[AC6005-Vlanif100]dhcp select global

AP端进行验证DHCP分发的地址

[Huawei]dis ip int bri
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 0

Interface                         IP Address/Mask      Physical   Protocol  
NULL0                             unassigned           up         up(s)     
Vlanif1                           192.168.100.117/24   up         up

配置AP上线

AC创建的设备管理组里是不是可以有多个虚拟AP模板，一个AP的虚拟模板对应一个服务VLAN组网

基于前面的基础，在加一个AP设备

SW1

[SW1-GigabitEthernet0/0/3]dis this
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100
#
return

1.AC创建AP设备管理组

[AC6005]wlan
[AC6005-wlan-view]ap-group name 68B

2.配置国家代码

//起 一个名字
[AC6005-wlan-ap-group-68B]regulatory-domain-profile name CHINA

//选择中国为国家代码
[AC6005-wlan-regulate-domain-CHINA]country-code cn
Info: The current country code is same with the input country code.

3.AP关联国家代码

[AC6005]wlan 
[AC6005-wlan-view]undo ap-group name 68B

//关联国家代码的名称，前面创建的名称
[AC6005-wlan-ap-group-68B]regulatory-domain-profile CHINA
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y

4.AC与AP建立capwap隧道的连接接口

//用于发送管理信息
[AC6005]capwap source interface Vlanif 100

5.AC配置认证

• MAC地址认证

//查看AP的MAC地址，要看与AP相连接的接口

[Huawei]dis int g0/0/0
GigabitEthernet0/0/0 current state : UP
Line protocol current state : UP
Description:HUAWEI, AP Series, GigabitEthernet0/0/0 Interface
Switch Port, PVID :    1, TPID : 8100(Hex), The Maximum Frame Length is 1800
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc90-5b40

//添加AP设备MAC地址进行认证

[AC6005]wlan 
[AC6005-wlan-view]ap auth-mode ?
  mac-auth  MAC authenticated mode, default authenticated mode
  no-auth   No authenticated mode 
  sn-auth   SN authenticated mode 

//所有AP设备从0开始，进行管理AC设备
[AC6005-wlan-view]ap-id 0 ap-mac  00e0-fc90-5b40
[AC6005-wlan-view]ap-id 1 ap-mac  00e0-fc22-5780

• SN码认证
• 也可以不认证

两台配置完成的AP设备就会重启

[Huawei]
===== CAPWAP LINK IS UP!!! =====

6.查看上线的AP是否有问题

7.把AP设备关联到新的组下

由上图可以看到AP在一个默认的组下，我们需要把AP加入到前面创建的68B组内

[AC6005]wlan
//ap0设备
[AC6005-wlan-view]ap-id 0
[AC6005-wlan-ap-0]ap-group 68B
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.

//ap1设备
[AC6005-wlan-view]ap-id 1
[AC6005-wlan-ap-1]ap-group 68B
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.

查看AP状态，发现是Fault，这个是正常的，AP每次重新加入组都会重新启动AP设备

8.配置SSID和密码

//起策略组的名称叫什么
[AC6005]wlan
[AC6005-wlan-view]ssid-profile name FUNNET

//创建SSID名称
[AC6005-wlan-ssid-prof-FUNNET]ssid Kk
Info: This operation may take a few seconds, please wait.done.

//配置密码，创建安全模块的名称
[AC6005-wlan-ssid-prof-FUNNET]q
[AC6005-wlan-view]security-profile name FUNNET-S
[AC6005-wlan-sec-prof-FUNNET-S]security wpa-wpa2 ?
  dot1x  802.1x authentication    //需要单独的服务器，有客户端登录的，就选这个
  psk    Pre-shared key           //只做密码认证，需要网页认证的就选这个
// 8位以上密码，加密的方式是aes
[AC6005-wlan-sec-prof-FUNNET-S]security wpa-wpa2 psk pass-phrase QWER1234 aes

9.把SSID和密码关联到虚拟IP模板

• SSID PROFILE   关联的名字
• SEURITY PROFILE  关联的密码
• 接入AP的用户使用哪个VLAN 比如使用VLAN 200
• 转发方式
  • 集中转发

就是无线设备连接AP，通过AP设备把数据发给AC设备，AC设备在转发给SW，SW在把数据发给路由

• • 直接转发【这种更加好，也是默认的】

就是不同过AC设备转发了，直接发

• 配置虚拟AP模板

[AC6005]wlan
[AC6005-wlan-view]vap-profile name 68B

• 名字

//SSID的名称
[AC6005-wlan-vap-prof-68B]ssid-profile FUNNET

• 密码组名称

//安全组的名称
[AC6005-wlan-vap-prof-68B]security-profile FUNNET-S

• 用户

//服务用户的VLAN分配给VLAN200，不要和AP的组网vlan100一样
[AC6005]vlan 200
[AC6005-wlan-vap-prof-68B]service-vlan vlan-id 200

//直接转发，也是默认的
[AC6005-wlan-vap-prof-68B]forward-mode direct-forward
//SW1连接AP的接口需要使用Trunk并允许vlan200通过
[SW1-ip-pool-68b]int g0/0/2
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 100 200
[SW1-GigabitEthernet0/0/2]dis this
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 200
#
return
[SW1]int g0/0/3
[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 100 200
[SW1-GigabitEthernet0/0/3]dis this
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100 200
#
return

SW1

10.关联虚拟AP组到真实AP组

[AC6005]wlan
[AC6005-wlan-view]ap-group name 68B
[AC6005-wlan-ap-group-68B]vap-profile 68B wlan 1 radio all

11.创建 SVI三层口支持用户转发，同时分配IP地址

[SW1]dhcp enable 
[SW1]vlan 200
[SW1]int vlan 200
[SW1-Vlanif200]ip add 192.168.200.254 24

//开启地址池接口DHCP功能
[SW1]dhcp enable 
[SW1-Vlanif200]dhcp select interface 
[SW1-Vlanif200]dhcp server dns-list 114.114.114.114

无线设备连接AP

AC设备查看AP设备状态的命令

nor就是正常

[AC6005]dis ap all
Info: This operation may take a few seconds. Please wait for a moment.done.
Total AP information:
nor  : normal          [2]
-------------------------------------------------------------------------------------------------------
ID   MAC            Name           Group   IP              Type            State STA Uptime
-------------------------------------------------------------------------------------------------------
0    00e0-fc90-5b40 00e0-fc90-5b40 default 192.168.100.117 AP6050DN        nor   0   16M:25S
1    00e0-fc22-5780 00e0-fc22-5780 default 192.168.100.83  AP6050DN        nor   0   3M:27S
-------------------------------------------------------------------------------------------------------
Total: 2

也可以看到用户有几个，在哪个设备上