AC+AP(同广播域组网)
AP 是无线访问接入点(WirelessAccessPoint),作用是发射无线信号,也就相当于有线网络中的集线器,连接所有无线设备。
AC 是无线网络控制器(Wireless Access Point Controller)用来集中化控制无线ap,负责将来自不同AP的数据进行汇聚并接入互联网,同时完成AP设备的配置管理和无线用户的认证、管理,以及带宽、访问、切换、安全等控制功能。
同广播域组网思想
AC和AP之间连接
- AC实际是三层交换机
- AP信号发射器,负责一定的数据转发和转换,能够支持识别VLAN 能打TAG的设备
AC与AP之间,通关在一个vlan里使用PVID的方式进行通讯
如果SW1与AP直连的接口不打上一个与AC一个vlan PVID那么,DHCP就无法发送报文
配置trunk
//SW1 [SW1]vlan 100 [SW1]int g0/0/1 [SW1-GigabitEthernet0/0/1]port link-type trunk [SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all //与AP直连的接口必须打标签 [SW1]int g0/0/2 [SW1-GigabitEthernet0/0/2]port link-type trunk [SW1-GigabitEthernet0/0/2]port trunk pvid vlan 100 [SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 100
//AC [AC6005]int g0/0/01 [AC6005-GigabitEthernet0/0/1]port link-type trunk [AC6005-GigabitEthernet0/0/1]port trunk allow-pass vlan all
AC配置DHCP【AC或者交换机上配置都行】
DHCP开启中继器的问题,两个网段不在同一个vlan里就要开启中继器,在一个vlan里就不需要开启DHCP中继器
[AC6005]dhcp enable [AC6005]ip pool AC [AC6005-ip-pool-AC]network 192.168.10.0 mask 255.255.255.0 [AC6005-ip-pool-AC]gateway-list 192.168.10.254 [AC6005-ip-pool-AC]dns-list 114.114.114.114 //在vlan 100上开启DHCP [AC6005]vlan 100 [AC6005-Vlanif100]ip address 192.168.100.253 255.255.255.0 [AC6005-Vlanif100]dhcp select global
AP端进行验证DHCP分发的地址
[Huawei]dis ip int bri
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 0
Interface IP Address/Mask Physical Protocol
NULL0 unassigned up up(s)
Vlanif1 192.168.100.117/24 up up
配置AP上线
AC创建的设备管理组里是不是可以有多个虚拟AP模板,一个AP的虚拟模板对应一个服务VLAN组网
基于前面的基础,在加一个AP设备
SW1
[SW1-GigabitEthernet0/0/3]dis this
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100
#
return
1.AC创建AP设备管理组
[AC6005]wlan
[AC6005-wlan-view]ap-group name 68B
2.配置国家代码
//起 一个名字 [AC6005-wlan-ap-group-68B]regulatory-domain-profile name CHINA //选择中国为国家代码 [AC6005-wlan-regulate-domain-CHINA]country-code cn Info: The current country code is same with the input country code.
3.AP关联国家代码
[AC6005]wlan [AC6005-wlan-view]undo ap-group name 68B //关联国家代码的名称,前面创建的名称 [AC6005-wlan-ap-group-68B]regulatory-domain-profile CHINA Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
4.AC与AP建立capwap隧道的连接接口
//用于发送管理信息
[AC6005]capwap source interface Vlanif 100
5.AC配置认证
- MAC地址认证
//查看AP的MAC地址,要看与AP相连接的接口
[Huawei]dis int g0/0/0 GigabitEthernet0/0/0 current state : UP Line protocol current state : UP Description:HUAWEI, AP Series, GigabitEthernet0/0/0 Interface Switch Port, PVID : 1, TPID : 8100(Hex), The Maximum Frame Length is 1800 IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fc90-5b40
//添加AP设备MAC地址进行认证
[AC6005]wlan [AC6005-wlan-view]ap auth-mode ? mac-auth MAC authenticated mode, default authenticated mode no-auth No authenticated mode sn-auth SN authenticated mode //所有AP设备从0开始,进行管理AC设备 [AC6005-wlan-view]ap-id 0 ap-mac 00e0-fc90-5b40 [AC6005-wlan-view]ap-id 1 ap-mac 00e0-fc22-5780
- SN码认证
- 也可以不认证
两台配置完成的AP设备就会重启
[Huawei]
===== CAPWAP LINK IS UP!!! =====
6.查看上线的AP是否有问题
7.把AP设备关联到新的组下
由上图可以看到AP在一个默认的组下,我们需要把AP加入到前面创建的68B组内
[AC6005]wlan //ap0设备 [AC6005-wlan-view]ap-id 0 [AC6005-wlan-ap-0]ap-group 68B Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y Info: This operation may take a few seconds. Please wait for a moment.. done. //ap1设备 [AC6005-wlan-view]ap-id 1 [AC6005-wlan-ap-1]ap-group 68B Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y Info: This operation may take a few seconds. Please wait for a moment.. done.
查看AP状态,发现是Fault,这个是正常的,AP每次重新加入组都会重新启动AP设备
8.配置SSID和密码
//起策略组的名称叫什么 [AC6005]wlan [AC6005-wlan-view]ssid-profile name FUNNET //创建SSID名称 [AC6005-wlan-ssid-prof-FUNNET]ssid Kk Info: This operation may take a few seconds, please wait.done. //配置密码,创建安全模块的名称 [AC6005-wlan-ssid-prof-FUNNET]q [AC6005-wlan-view]security-profile name FUNNET-S [AC6005-wlan-sec-prof-FUNNET-S]security wpa-wpa2 ? dot1x 802.1x authentication //需要单独的服务器,有客户端登录的,就选这个 psk Pre-shared key //只做密码认证,需要网页认证的就选这个 // 8位以上密码,加密的方式是aes [AC6005-wlan-sec-prof-FUNNET-S]security wpa-wpa2 psk pass-phrase QWER1234 aes
9.把SSID和密码关联到虚拟IP模板
- SSID PROFILE 关联的名字
- SEURITY PROFILE 关联的密码
- 接入AP的用户使用哪个VLAN 比如使用VLAN 200
- 转发方式
- 集中转发
就是无线设备连接AP,通过AP设备把数据发给AC设备,AC设备在转发给SW,SW在把数据发给路由
- 直接转发【这种更加好,也是默认的】
就是不同过AC设备转发了,直接发
- 配置虚拟AP模板
[AC6005]wlan
[AC6005-wlan-view]vap-profile name 68B
- 名字
//SSID的名称 [AC6005-wlan-vap-prof-68B]ssid-profile FUNNET
- 密码组名称
//安全组的名称 [AC6005-wlan-vap-prof-68B]security-profile FUNNET-S
- 用户
//服务用户的VLAN分配给VLAN200,不要和AP的组网vlan100一样 [AC6005]vlan 200 [AC6005-wlan-vap-prof-68B]service-vlan vlan-id 200 //直接转发,也是默认的 [AC6005-wlan-vap-prof-68B]forward-mode direct-forward //SW1连接AP的接口需要使用Trunk并允许vlan200通过 [SW1-ip-pool-68b]int g0/0/2 [SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 100 200 [SW1-GigabitEthernet0/0/2]dis this # interface GigabitEthernet0/0/2 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 200 # return [SW1]int g0/0/3 [SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 100 200 [SW1-GigabitEthernet0/0/3]dis this # interface GigabitEthernet0/0/3 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 200 # return SW1
10.关联虚拟AP组到真实AP组
[AC6005]wlan
[AC6005-wlan-view]ap-group name 68B
[AC6005-wlan-ap-group-68B]vap-profile 68B wlan 1 radio all
11.创建 SVI三层口支持用户转发,同时分配IP地址
[SW1]dhcp enable [SW1]vlan 200 [SW1]int vlan 200 [SW1-Vlanif200]ip add 192.168.200.254 24 //开启地址池接口DHCP功能 [SW1]dhcp enable [SW1-Vlanif200]dhcp select interface [SW1-Vlanif200]dhcp server dns-list 114.114.114.114
无线设备连接AP
AC设备查看AP设备状态的命令
nor就是正常
[AC6005]dis ap all
Info: This operation may take a few seconds. Please wait for a moment.done.
Total AP information:
nor : normal [2]
-------------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime
-------------------------------------------------------------------------------------------------------
0 00e0-fc90-5b40 00e0-fc90-5b40 default 192.168.100.117 AP6050DN nor 0 16M:25S
1 00e0-fc22-5780 00e0-fc22-5780 default 192.168.100.83 AP6050DN nor 0 3M:27S
-------------------------------------------------------------------------------------------------------
Total: 2
也可以看到用户有几个,在哪个设备上

评论