AC可靠性：双链路双机备份（AP指定配置方式）

实验背景

AC+FIT AP架构的WLAN，所有AP由AC通过CAPWAP隧道统一管理和下发配置。

一旦AC出现故障，AC和所有AP之间的CAPWAP隧道断开，AP掉线，用户搜索不到WLAN信号，该网络下所有WLAN用户无法上网。

解决方案：

1、AC的可靠性

2、业务的可靠性

实验案例

此实验中，做的是AC可靠性：双链路双机热备。

AC同时与主备AC之间分别建立CAPWAP隧道，AC间的业务信息通过HSB主备通道同步。

当AP与主AC间链路断开，AP会通知备AC切换成主AC（AP状态切换慢，需等待检测到capwap断链超时后才会切换）。

通过AC优先级确定主备AC。优先级相同的情况下，根据AC负载（AP和STA个数)确立主备。

配置双链路备份有两种方式：

AC全局配置：在AC的WLAN视图下配置双链路备份参数，下发给所有AP（指定配置的AP除外），适用于批量创建双链路备份。

AP指定配置：在AC的AP系统模板视图下配置双链路备份参数，适用于对所有引用了此AP系统模板的AP。

AP指定配置优先级高于AC全局配置。主备AC上WLAN相关的业务配置必须保持一致。

实验拓扑规划

部署无线局域网，为用户提供WLAN服务，如下图所示，AP设备通过接入层交换机LSW2接入，采用双AC旁挂式部署，采用双AC主备备份的方式提高无线用户的业务可靠性。

配置过程

基础配置

1、配置交换机和AC，使AP和AC互通

在交换机上创建VLAN100和VLAN101，其中VLAN100用于WLAN的管理VLAN，VLAN101用于WLAN的业务VLAN。在AC上创建管理vlan100。

# LSW1连接两台AC的接口GE0/0/2和GE0/0/3为trunk类型，并允许VLAN100的报文通过。 LSW1 system-view sysname LSW1 vlan batch 100 101 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 to 101 # interface GigabitEthernet0/0/2  port link-type trunk  port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/3  port link-type trunk  port trunk allow-pass vlan 100   # LSW2连接AP的接口GE0/0/2配置为trunk类型接口，PVID为100，允许VLAN100和VLAN101的报文通过。配置LSW1的接口GE0/0/1为trunk类型，允许VLAN100、101的报文通过。 LSW2 system-view sysname LSW2 vlan batch 100 101 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 to 101 # interface GigabitEthernet0/0/2  port link-type trunk  port trunk pvid vlan 100  port trunk allow-pass vlan 100 to 101  port-isolate enable group 1 # AC连接LSW1的接口GE0/0/1配置为trunk类型接口,允许VLAN100的报文通过。 AC1 system-view sysname AC1 vlan batch 100 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 interface vlan 100 ip address 172.16.100.2 24 quit # AC2 system-view sysname AC2 vlan batch 100 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 # interface vlan 100 ip address 172.16.100.3 24 quit

2、配置IP地址以及配置核心交换机LSW1的DHCP功能，为AP和STA分配IP地址

[LSW1]dhcp enable Info: The operation may take a few seconds. Please wait for a moment.done. [LSW1]interface vlan 100 [LSW1-Vlanif100]ip address 172.16.100.1 24  [LSW1-Vlanif100]dhcp select interface  [LSW1-Vlanif100]dhcp server excluded-ip-address  172.16.100.2 172.16.100.3 [LSW1-Vlanif100] quit [LSW1]interface vlan 101 [LSW1-Vlanif101]ip address 172.16.101.1 24 [LSW1-Vlanif101]dhcp select interface  [LSW1-Vlanif101]quit [LSW1] AC1 interface vlan 100 ip address 172.16.100.2 24 quit AC2 interface vlan 100 ip address 172.16.100.3 24 quit

配置AC的wlan基本业务

1、配置AP上线，创建AP，AP组名为”ap-group1“，用于将相同配置的AP都加入同一个AP组中。

[AC1]wlan [AC1-wlan-view]ap-group name ap-group1 Info: This operation may take a few seconds. Please wait for a moment.done. [AC1-wlan-ap-group-ap-group1]quit [AC1-wlan-view]

2、创建域管理模板，域管理模板名称为“domain1”，在域管理模板下配置AC的国家码，并在AP组"ap-group1"下引用名称为”domain1“的域管理模板。

[AC1-wlan-view]regulatory-domain-profile name domain1 [AC1-wlan-regulate-domain-domain1]country-code cn Info: The current country code is same with the input country code. [AC1-wlan-regulate-domain-domain1]quit [AC1-wlan-view]ap-group name ap-group1 [AC1-wlan-ap-group-ap-group1]regulatory-domain-profile domain1 Warning: Modifying the country code will clear channel, power and antenna gain c onfigurations of the radio and reset the AP. Continue?[Y/N]:y [AC1-wlan-ap-group-ap-group1]quit [AC1-wlan-view]quit 设置源接口 [AC1]capwap source interface vlan 100 [AC1]

3、在AC上离线导入AP，并将AP加入AP组ap-group1中，假设AP的MAC地址为 00e0-fcf8-14a0，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为 00e0-fcf8-14a0的AP部署在1号区域，命名此AP为“area1-ap1”。

[AC1]wlan  [AC1-wlan-view] ap-id 1 type-id 56 ap-mac 00e0-fcf8-14a0 [AC1-wlan-ap-1] ap-name area1-ap1 [AC1-wlan-ap-1] ap-group ap-group1 Warning: This operation may cause AP reset. If the country code changes, it will  clear channel, power and antenna gain configurations of the radio, Whether to c ontinue? [Y/N]:y Info: This operation may take a few seconds. Please wait for a moment.. done. [AC1-wlan-ap-1] quit #

验证配置结果

 使用命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线

 创建WLAN业务参数

1、创建名为security-porfile1的安全模板，并配置安全策略，实验中配置WPA2+PSK+AES的安全策略为例，密码为“admin123456”，实际配置中请根据实际情况，配置符合实际要求的安全策略。

[AC1-wlan-view] security-profile name security-profile1 [AC1-wlan-sec-prof-security-profile1] security wpa-wpa2 psk pass-phrase  admin123456 aes [AC1-wlan-sec-prof-security-profile1] quit [AC1-wlan-view]

2、配置名为ssid-profile1的SSID模板，并配置SSID名称为ssid1

[AC1-wlan-view] ssid-profile name ssid-profile1 [AC1-wlan-ssid-prof-ssid-rpofile1]ssid ssid1 Info: This operation may take a few seconds, please wait.done. [AC1-wlan-ssid-prof-ssid-rpofile1]quit [AC1-wlan-view]

3、创建名为vap-profile的VAP模板，配置业务数据转发模式为直接转发、业务vlan，并引用安全模板security-profile1和ssid模板ssid-profile1。

[AC1-wlan-view]vap-profile name vap-profile1 [AC1-wlan-vap-prof-vap-profile1]forward-mode direct-forward  [AC1-wlan-vap-prof-vap-profile1]service-vlan vlan-id 101 Info: This operation may take a few seconds, please wait.done. [AC1-wlan-vap-prof-vap-profile1]security-profile security-profile1 Info: This operation may take a few seconds, please wait.done. [AC1-wlan-vap-prof-vap-profile1]ssid-profile ssid-profile1 Info: This operation may take a few seconds, please wait.done. [AC1-wlan-vap-prof-vap-profile1]quit [AC1-wlan-view]

4、配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板vap-profile1的配置。

[AC1-wlan-view] ap-group name ap-group1 [AC1-wlan-ap-group-ap-group1] vap-profile vap-profile1 wlan 1 radio 0 Info: This operation may take a few seconds, please wait...done. [AC1-wlan-ap-group-ap-group1] vap-profile vap-profile1 wlan 1 radio 1 Info: This operation may take a few seconds, please wait...done. [AC1-wlan-ap-group-ap-group1]quit [AC1-wlan-view]

5、配置AC2的WLAN基础业务，AC2基本业务其他参数的配置请参考AC1的配置过程，除源接口地址外其他配置参数和AC1一样。

AC1的源接口IP地址为172.16.100.2/24，而AC2的源接口IP地址为172.16.100.3/24，前面配置IP地址的时候已经配置了。

配置主用AC1和备用AC2双链路备份功能

1、在AC1上，AP系统视图上配置备AC2的IP地址，AC1的优选级，用于双链路备份

通过配置AC的优选级来决定主备AC，优选级高的AC作为AC，优选级低的AC作为备AC。数字越小，优选级越高，优选级相同的情况下可接入AP数大的AC作为主AC；可接入AP数量相同情况下可接入用户数量大的AC作为主AC，以上都相同的情况下，IP地址小的AC为主AC。

本实验开始前面讲了，使用的是AP指定配置的方式配置双链路备份，#用户还可以在WLAN视图下使用AC全局配置的方式配置双链路备份。

[AC1]wlan [AC1-wlan-view] ap-system-profile name ap-system1 [AC1-wlan-ap-system-prof-ap-system1] priority 1 Warning: This action will take effect after resetting AP. [AC1-wlan-ap-system-prof-ap-system1] protect-ac ip-address 172.16.100.3 Warning: This action will take effect after resetting AP. [AC1-wlan-ap-system-prof-ap-system1] quit [AC1-wlan-view]

2、在AP组视图下绑定AP系统模板

[AC1-wlan-view] ap-group name ap-group1 [AC1-wlan-ap-group-ap-group1] ap-system-profile ap-system1  Warning: This action may cause service interruption. Continue?[Y/N]y [AC1-wlan-ap-group-ap-group1] quit [AC1-wlan-view]

3、在AC1上，全局使能双链路备份和回切功能，重启所有AP使双链路备份功能生效

注意：缺省情况下，双链路备份功能未使能，执行命令ac protect enable会提示重启所有AP。AP重启后，双链路备份功能开始生效。

如果双链路备份功能已enable，此处再执行命令ac protect enable不会重启AP，需要在主AC上继续执行命令ap-reset重启AP，AP重启后，双链路备份功能开始生效。

[AC1-wlan-view]undo ac protect restore disable  Info: Protect restore has already enabled. [AC1-wlan-view]ac protect enable Warning: This operation maybe cause AP reset, continue?[Y/N]:y Info: This operation may take a few seconds. Please wait for a moment.done. Info: Capwap echo interval has changed to default value 25, capwap echo times to 3. [AC1-wlan-view]

4、在AC2上，AP系统视图下配置主用AC1的IP地址，AC2的优选级，用于双链路备份

[AC2]wlan [AC2-wlan-view] ap-system-profile name ap-system1 [AC2-wlan-ap-system-prof-ap-system1]  priority 2 Warning: This action will take effect after resetting AP. [AC2-wlan-ap-system-prof-ap-system1]  protect-ac ip-address 172.16.100.2 Warning: This action will take effect after resetting AP. #在AP组视图下绑定AP系统模板 [AC2-wlan-ap-system-prof-ap-system1] ap-group name ap-group1 [AC2-wlan-ap-group-ap-group1] ap-system-profile ap-system1 [AC2-wlan-ap-group-ap-group1] #在AC2上，全局使能双链路备份和回切功能，重启所有AP使双链路备份功能生效。 [AC2-wlan-view]undo ac protect restore disable Info: Protect restore has already enabled. [AC2-wlan-view]ac protect enable Warning: This operation maybe cause AP reset, continue?[Y/N]:y Info: This operation may take a few seconds. Please wait for a moment.done. Info: Capwap echo interval has changed to default value 25, capwap echo times to 3. [AC2-wlan-view]

实验结果验证

在主备AC上分别执行命令display ac protect和display ap-system-profile，查看2台AC上双链路信息和优先级。

 

 STA用户获取

 STA连接成功。

 

 模拟链路故障

当将AC1的接口1shutdown之后，也就是当AP与AC1的链路中断后，AC2会切换为主AC，保证业务的稳定。操作如下：

 这时候分别查看AC1、AC2上AP的上线情况，可以看到AC1接口故障之后，APstate是fault（AP故障），备AC2切换成了主AC，AP上线状态正常，STA连接也正常。

 

 这时候，AC1的接口链路故障修复之后，过一段时间，再查看，AC1恢复主AC的状态，而AC2又变回备AC。这时候可以看到AC1恢复故障后恢复主AC，而STA断开了连接，得重新获取上线。

 实验命令

LSW1 system-view sysname LSW1 vlan batch 100 101 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 to 101 # interface GigabitEthernet0/0/2  port link-type trunk  port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/3  port link-type trunk  port trunk allow-pass vlan 100 # dhcp enable interface Vlanif100  ip address 172.16.100.1 255.255.255.0  dhcp select interface  dhcp server excluded-ip-address 172.16.100.2 172.16.100.3 # interface Vlanif101  ip address 172.16.101.1 255.255.255.0  dhcp select interface # LSW2 system-view sysname LSW2 vlan batch 100 101 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 to 101 # interface GigabitEthernet0/0/2  port link-type trunk  port trunk pvid vlan 100  port trunk allow-pass vlan 100 to 101  port-isolate enable group 1 AC1 system-view sysname AC1 vlan batch 100 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 # AC2 system-view sysname AC2 vlan batch 100 interface GigabitEthernet0/0/1  port link-type trunk  port trunk allow-pass vlan 100 # AC1、AC2 wlan ap-group name ap-group1   quit regulatory-domain-profile name domain1  country-code cn quit ap-group name ap1  regulatory-domain-profile domain1 y quit quit capwap source interface vlan 100   wlan ap auth-mode mac-auth ap-id 1 type-id 56 ap-mac  00e0-fcf8-14a0 ap-name area1-ap1 ap-group ap-group1 y dis ap all 查看AP是否正常上线 继续配置wlan参数 security-profile name security-profile1 security wpa-wpa2 psk pass-phrase  admin123456 aes quit ssid-profile name ssid-profile1 ssid ssid1 quit vap-profile name vap-profile1 forward-mode direct-forward    service-vlan vlan-id 101   ssid-profile ssid-profile1   security-profile security-profile1 # ap-group name ap-group1 vap-profile vap-profile1 wlan 1 radio 0 vap-profile vap-profile1 wlan 1 radio 1 AC1 ap-system-profile name ap-system1   priority 1   protect-ac ip-address 172.16.100.3 # ap-group name ap-group1 ap-system-profile ap-system1  quit undo ac protect restore disable ac protect enable AC2 ap-system-profile name ap-system1   priority 2   protect-ac ip-address 172.16.100.2 # ap-group name ap-group1 ap-system-profile ap-system1  quit undo ac protect restore disable ac protect enable