一个无线网络项目的总结
一、无线网络整体架构
组网参数
1、AC型号（S5720HI-32C-LI-AC）
2、AC系统版本（V200R011C10）
3、核心交换机型号（华为7706）
4、核心版本（V200R010C00SPC600）
5、POE交换机型号（S5720-28X-PWR-LI-AC）
6、POE系统版本（V200R010C00SPC600）
数据规划
DHCP服务器 |
核心7706作为DHCP服务器，为STA分配ip地址。 |
网络设备地址池 |
172.18.208.2---172.18.208.64 |
AP的IP地址池 |
172.18.208.65---172.18.208.254 |
STA的IP地址池 |
Guest209 Teacher210 Student212 （172.18.208.209-210-212/24） |
AP组 |
名称 - ap-group 1 引用模板- VAP模板、域管理模板domain |
SSID模板 |
PDE_Teacher 、PDE_Student、PDE_Guest |
安全模板 |
名称 ：huawei 安全策略：radius、portal 认证 密码 ：radius服务器创建下发 |
VAP模板 |
名称：VAP -PDE_Teacher 、VAP-PDE_Student、VAP-PDE_Guest 转发模式：隧道转发 业务vlan：vlan2001、vlan2002、vlan2003 引用模板：SSID模板、安全模板 |
核心交换机做堆叠
配置逻辑堆叠端口并添加物理成员端口。
# 配置主核心的业务口GigabitEthernet0/0/27、GigabitEthernet0/0/28为物理成员端口，并加入到相应的逻辑堆叠端口。
主核心
system-view
sysname SwitchA
interface stack-port 0/1
port interface gigabitethernet 0/0/27 enable
quit
interface stack-port 0/2
port interface gigabitethernet 0/0/28 enable
quit
# 配置备核心的业务口GigabitEthernet0/0/27、GigabitEthernet0/0/28为物理成员端口，并加入到相应的逻辑堆叠端口。
system-view
sysname SwitchB
interface stack-port 0/1
port interface gigabitethernet 0/0/27 enable
quit
interface stack-port 0/2
port interface gigabitethernet 0/0/28 enable
quit
配置堆叠ID和堆叠优先级。堆叠ID缺省值为0，堆叠优先级缺省值为100。
[SwitchA] stack slot 0 priority 200 //修改主交换机的堆叠优先级为200，大于其他成员交换机。堆叠ID采用缺省值0。
[SwitchB] stack slot 0 renumber 1 //堆叠优先级采用缺省值100。修改堆叠ID为1。
通过关闭设备电源开关，将SwitchA、SwitchB、下电，使用SFP+电缆连接后再上电。
二、配置核心交换机7706
1、创建vlan、做链路聚合。
vlan batch 2000 to 2003
#
int eth-trunk 13
mode lacp
port link-type trunk
port trunk allow-pass vlan all
undo port trunk allow-pass vlan 1
trunkport XGigabitEthernet0/0/35
trunkport XGigabitEthernet1/0/35
int XGigabitEthernet0/0/35
description To_AC
int XGigabitEthernet0/0/35
description To_AC
quit
#
2、全局开启DHCP功能，并配置ip地址
#
dhcp enable
int vlan 2000
ip address 172.18.208.1 24
dhcp select global
#
int vlan 2001
ip address 172.18.209.1 24
dhcp select global
#
int vlan 2002
ip address 172.18.210.1 23
dhcp select global
#
int vlan 2003
ip address 172.18.212.1 23
dhcp select global
3、建立AP、业务vlan的地址池。
ip pool ap
gateway-list 172.18.208.1
network 172.18.208.0 mask 255.255.255.0
excluded-ip-address 172.18.208.2 172.18.208.64
option 43 sub-option 2 ip-address 172.18.208.33 10.71.12.1
#
ip pool guest
gateway-list 172.18.209.1
network 172.18.209.0 mask 255.255.255.0
lease day 0 hour 4 minute 0
dns-list 10.64.1.11 10.64.1.12
#
ip pool teacher
gateway-list 172.18.210.1
network 172.18.210.0 mask 255.255.254.0
lease day 0 hour 4 minute 0
dns-list 10.64.1.11 10.64.1.12
#
ip pool student
gateway-list 172.18.212.1
network 172.18.212.0 mask 255.255.254.0
lease day 0 hour 4 minute 0
dns-list 10.64.1.11 10.64.1.12
三、AC配置
1、为AC命名、配置远程登陆、开启stelnet、配置认证方式。
sysname JiaoFaYuanFuZhong_4#3F_AC-M
user-interface con 0
authentication-mode password
set authentication password cipher Huawei@2017!
quit
#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
quit
#
aaa
local-user admin password irreversible-cipher Huawei@2017!
local-user admin privilege level 15
local-user admin service-type ssh http
local-user hwadmin password irreversible-cipher Huawei@2017!
local-user hwadmin privilege level 15
local-user hwadmin service-type ssh http
quit
#
stelnet server enable
ssh user admin
ssh user hwadmin
ssh user admin authentication-type password
ssh user hwadmin authentication-type password
ssh user admin service-type stelnet
ssh user hwadmin service-type stelnet
ssh client first-time enable
#
rsa local-key-pair create
y
2、创建规划好的vlan、做链路聚合、写默认路由。
vlan batch 2000 to 2003
vlan 2000
description MGT
vlan 2001
description PDE_Guest
vlan 2002
description PDE_Teacher
vlan 2003
description PDE_Student
quit
#
int eth-trunk 1
description TO_HX
mode lacp
port link-type trunk
port trunk allow-pass vlan 2000 2001 2002 2003
undo port trunk allow-pass vlan 1
trunkport xg0/0/1
trunkport xg0/0/2
int xg0/0/1
description TO_HX
int xg0/0/2
description TO_HX
quit
#
int vlanif 2000
ip add 172.18.208.33 24
quit
ip route-static 0.0.0.0 0.0.0.0 172.18.208.33
#
3、建立capwap隧道传输业务和下发配置
capwap source interface vlanif 2000
portal https-redirect enable
portal captive-adaptive enable
device-sensor dhcp option 12 55 60
4、配置radius服务器认证模板。计费授权、portal认证
radius-server template huawei //创建名为huawei的radius服务器模板
radius-server shared-key cipher Admin@123 //配置radius服务器预共享密匙
radius-server authentication 10.71.12.37 1812 source ip-address 172.18.208.33 weight 80
//配置RADIUS主认证服务器10.71.12.37，认证端口1812，AC使用172.18.208.33和RADIUS主服务器10.71.12.37通信
radius-server authentication 10.71.12.38 1812 source ip-address 172.18.208.33 weight 40
//配置RADIUS主认证服务器10.71.12.38，证端口1812，AC使用172.18.208.33和RADIUS主服务器10.71.12.38通信
radius-server accounting 10.71.12.37 1813 source ip-address 172.18.208.33 weight 80
//配置RADIUS主计费服务器10.71.12.37，以便获取终端用户的上下线信息，计费端口1813，AC使用172.18.208.33和RADIUS主服务器10.71.12.37通信
radius-server accounting 10.71.12.38 1813 source ip-address 172.18.208.33 weight 40
//配置RADIUS主计费服务器10.71.12.38以便获取终端用户的上下线信息，计费端口1813，AC使用172.18.208.33和RADIUS主服务器10.71.12.38通信
radius-server user-name original
radius-server dead-time 15
quit
radius-server authorization 10.71.12.37 shared-key cipher Admin@123
radius-server authorization 10.71.12.38 shared-key cipher Admin@123
radius-server dead-interval 20
radius-server dead-count 3
#
配置portal服务器模板
url-template name huawei1
url http://10.71.12.37:8080/portal
url-parameter ssid ssid user-mac usermac redirect-url url ac-ip acip
quit
url-template name huawei2
url http://10.71.12.38:8080/portal
url-parameter ssid ssid user-mac usermac redirect-url url ac-ip acip
quit
#
mac-access-profile name huawei
quit
配置Portal认证
# 配置Portal服务的参数，端口号使用50200（缺省值，不需配置）。
web-auth-server huawei1 //创建名为huawei1的portal服务器模板
server-ip 10.71.12.37 //配置portal服务器ip地址
port 50200 //配置设备向Portal服务器主动发送报文时使用的目的端口号为50200
shared-key cipher Admin@123 //配置AC与Portal服务器信息交互的共享密钥
url-template huawei1 //配置指向Portal服务器的URL
source-ip 172.18.208.33 //指定主AC地址
server-detect
quit
web-auth-server huawei2
server-ip 10.71.12.38
port 50200
shared-key cipher Admin@123
url-template huawei2
source-ip 172.18.208.33
server-detect
quit
portal-access-profile name huawei
web-auth-server huawei1 huawei2 layer3
quit
#
5、与AAA认证模板和计费模板，并配置域信息。
aaa
authentication-scheme huawei //创建名为huawei的认证方案
authentication-mode radius //认证方式为radius
quit
accounting-scheme huawei
accounting-mode radius
accounting realtime 15
quit
domain portal //创建名为portal 的域
authentication-scheme huawei //绑定认证方案huawei
accounting-scheme huawei //绑定计费方案huawei
radius-server huawei
quit
quit
#
acl number 3000
description rzhy
rule 5 permit ip
quit
#
测试用户是否能够通过RADIUS模板的认证。
[AC] test-aaa [email protected] 123456 radius-template radius_huawei
Info: Account test succeed.
acl number 6000
description rzqy
rule 5 permit ip destination fqdn *.weixin.qq.com
rule 10 permit ip destination fqdn *.pdedu.sh.cn
rule 15 permit ip destination 10.64.1.11 0
rule 20 permit ip destination 10.64.1.12 0
rule 25 permit ip destination 10.71.12.0 0.0.0.63
rule 30 permit ip destination 172.19.0.33 0
quit
#
free-rule-template name default_free_rule
free-rule acl 6000
quit
#
6、配置认证模板，调用前面portal模板、调用mac优先模板。
authentication-profile name PDE_Teacher
portal-access-profile huawei
free-rule-template default_free_rule
access-domain portal force
mac-access-profile huawei
quit
#
authentication-profile name PDE_Student
portal-access-profile huawei
free-rule-template default_free_rule
access-domain portal force
mac-access-profile huawei
quit
#
authentication-profile name PDE_Guest
portal-access-profile huawei
free-rule-template default_free_rule
access-domain portal force
mac-access-profile huawei
quit
7、创建地址池关联业务vlan。
vlan pool guest
vlan 2001
quit
vlan pool teacher
vlan 2002
quit
vlan pool student
vlan 2003
quit
#
8、进入wlan
Wlan
regulatory-domain-profile name default
dca-channel 2.4g channel-set 1,5,9,13
quit
9、配置射频调优、配置干扰检测、调用rmm模板
rrm-profile name default //建立射频调优模板
undo calibrate auto-channel-select disable //开启信道自动选择功能
undo calibrate auto-txpower-select disable //开启发送功率选择功能
smart-roam enable
smart-roam roam-threshold check-snr
smart-roam quick-kickoff-threshold snr 20
quit
#
radio-2g-profile name default //配置干扰检测
rts-cts-mode rts-cts
y
rts-cts-threshold 1400
y
rrm-profile default
quit
#
radio-5g-profile name default
rts-cts-mode rts-cts
y
rts-cts-threshold 1400
y
rrm-profile default
quit
10、配置创建SSID模板、关联备AC，上线方式无认证上线。
ac protect protect-ac 10.71.12.1
ac protect priority 2
ap auth-mode no-auth
security-profile name huawei
quit
ssid-profile name PDE_Teacher
probe-response-retry 1
beacon-2g-rate 11
ssid PDE_Teacher
quit
#
ssid-profile name PDE_Student
probe-response-retry 1
beacon-2g-rate 11
ssid PDE_Student
ssid-hide enable
quit
#
ssid-profile name PDE_Guest
probe-response-retry 1
beacon-2g-rate 11
ssid PDE_Guest
quit
11、配置VAP模板、调用认证模板、SSID模板、地址池。
#
vap-profile name PDE_Guest
service-vlan vlan-pool guest
ssid-profile PDE_Guest
security-profile huawei
authentication-profile PDE_Guest
quit
#
vap-profile name PDE_Teacher
service-vlan vlan-pool teacher
ssid-profile PDE_Teacher
security-profile huawei
authentication-profile PDE_Teacher
quit
#
vap-profile name PDE_Student
service-vlan vlan-pool student
ssid-profile PDE_Student
security-profile huawei
authentication-profile PDE_Student
quit
#
serial-profile name JiaoFaYuanFuShuZX
speed 19200
parity odd
stopbits 2
frame-format frame-start-stop
frame-length 270
frame-start bb
frame-stop cc
quit
#
iot-profile name JiaoFaYuanFuShuZX
management-server server-ip 172.19.0.32 server-port 3000
config-agent permit ip-address 172.19.0.32 255.255.255.0
share-key Huawei@2017!
quit
12、使用默认的default去调用vap模板到射频卡里
ap-group name default
vap-profile PDE_Teacher wlan 1 radio 0
vap-profile PDE_Teacher wlan 1 radio 1
vap-profile PDE_Student wlan 2 radio 0
vap-profile PDE_Student wlan 2 radio 1
vap-profile PDE_Guest wlan 3 radio 0
vap-profile PDE_Guest wlan 3 radio 1
radio-2g-profile default radio 0
radio-5g-profile default radio 1
regulatory-domain-profile default
y
quit
#
commit all //下发所有配置
y
#
quit
13、配置SNMP使能被Esight网管服务器管理。
lldp enable 开启lldp
snmp-agent 开启snmp代理
snmp-agent sys-info version v2c v3 启动snmp版本
snmp-agent community complexity-check disable
snmp-agent community read cipher Huawei@2017! mib-view iso-view
snmp-agent community write cipher Huawei@2017! mib-view iso-view
snmp-agent mib-view included iso-view iso
snmp-agent target-host trap address udp-domain 172.19.0.32 params securityname cipher Huawei@2017! v2c
snmp-agent extend error-code enable
snmp-agent trap source vlanif2000
snmp-agent trap enable
四、poe交换机配置
1、命名交换机、配置远程登陆。
sysname XXXXXXXX_JR_POE_24_1
user-interface con 0
authentication-mode password
set authentication password cipher Huawei@2017!
quit
#
user-interface vty 0 4
authentication-mode aaa
user privilege level 15
protocol inbound ssh
quit
#
aaa
local-user admin password irreversible-cipher Huawei@2017!
local-user admin privilege level 15
local-user hwadmin password irreversible-cipher Huawei@2017!
local-user hwadmin privilege level 15
local-user admin service-type ssh
local-user hwadmin service-type ssh
quit
stelnet server enable
ssh user admin
ssh user hwadmin
ssh user admin authentication-type password
ssh user hwadmin authentication-type password
ssh user admin service-type stelnet
ssh user hwadmin service-type stelnet
ssh client first-time enable
rsa local-key-pair create
#
vlan batch 2000 to 2003
dhcp enable
dhcp snooping enable
stp bpdu-protection
#
2、创建所需要的vlan、做链路聚合。
vlan 2000
dhcp snooping enable
description MGT
vlan 2001
description PDE_Guest
vlan 2002
description PDE_Teacher
vlan 2003
description PDE_Student
quit
int eth-trunk 1
description to
port link-type trunk
mode lacp
port trunk allow-pass vlan 2000 2001 2002 2003
undo port trunk allow-pass vlan 1
trunkport xg0/0/1
trunkport xg0/0/2
dhcp snooping trusted
quit
int xg0/0/1
description to
int xg0/0/2
description to
quit
#
int eth-trunk 2
description to
port link-type trunk
mode lacp
port trunk allow-pass vlan 2000 2001 2002 2003
undo port trunk allow-pass vlan 1
trunkport xg0/0/3
trunkport xg0/0/4
dhcp snooping trusted
quit
#
int xg0/0/3
description to
int xg0/0/4
description to
quit
#
3、为每个接口写上配置。
int range g0/0/1 to g0/0/24
description TO_HWAP
port link-type trunk
port trunk pvid vlan 2000
port trunk allow-pass vlan 2000 2001 2002 2003
undo port trunk allow-pass vlan 1
stp edged-port enable
port-isolate enable
quit
#
4、配置管理IP地址、配置路由、配置SNMP。
int vlanif 2000
ip add 172.18.208.45 24
quit
ip route-static 0.0.0.0 0.0.0.0 172.18.208.1
lldp enable
snmp-agent
snmp-agent sys-info version v2c v3
snmp-agent community complexity-check disable
snmp-agent community read cipher Huawei@2017! mib-view iso-view
snmp-agent community write cipher Huawei@2017! mib-view iso-view
snmp-agent mib-view included iso-view iso
snmp-agent target-host trap address udp-domain 172.18.208.32 params securityname cipher Huawei@2017! v2c
snmp-agent extend error-code enable
snmp-agent trap source vlanif2000
snmp-agent trap enable
y
五、胖Ap配置
胖Ap配置脚本
参数 ssid===Huawei-Wifi
密码 cjy@58645679
============================================================================
0--将瘦AP转换成胖AP
ap-mode-switch fat
1--创建一个IP地址池
ip pool dhcp
network 172.17.1.0 mask 255.255.255.0
excluded-ip-address 172.17.1.1 172.17.1.20
dns-list 114.114.114.114 8.8.8.8
2--创建一个认证模板
[Huawei-wlan-view]security-profile name wlan-net
[Huawei-wlan-sec-prof-wlan-net]security wpa-wpa2 psk pass-phrase cjy@58645679 aes
3--创建一个SSID模板
[Huawei-wlan-view]ssid-profile name wlan-net
[Huawei-wlan-ssid-prof-wlan-net]ssid wlan-net
4--创建一个VAP模板调养前面的认证模板和SSID模板
[Huawei-wlan-view]vap-profile name wlan-net
[Huawei-wlan-vap-prof-wlan-net]service-vlan vlan-id 201
[Huawei-wlan-vap-prof-wlan-net]security-profile wlan-net
[Huawei-wlan-vap-prof-wlan-net]ssid-profile wlan-net
5--创建一个射频优化模板，并启动射频优化和功率优化
[Huawei-wlan-view]rrm-profile name default
[Huawei-wlan-rrm-prof-default]calibrate auto-channel-select disable
[Huawei-wlan-rrm-prof-default]calibrate auto-txpower-select disable
6--进入射频口引用vap模板
[Huawei]int Wlan-Radio 0/0/0
[Huawei-Wlan-Radio0/0/0]vap-profile wlan-net wlan 2
[Huawei-Wlan-Radio0/0/0]channel 20mhz 6
[Huawei-Wlan-Radio0/0/0]eirp 127
7--进入射频口引用vap模板
[Huawei]interface Wlan-Radio 0/0/1
[Huawei-Wlan-Radio0/0/1]vap-profile wlan-net wlan 2
[Huawei-Wlan-Radio0/0/1]channel 20mhz 149
[Huawei-Wlan-Radio0/0/1]eirp 127
8--创建一个acl
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 6 permit source 172.17.1.0 0.0.0.255
9--写一个默认路由
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
10--进入vlanif1中，进行nat转换
interface Vlanif1
nat outbound 2000
ip address dhcp-alloc unicast
dhcp select global
以上内容就完成了一个胖AP配置，即插即用。