AC+AP三层组网

实验拓扑规划

 

AC与AP间处于三层组网,AC与交换机LSW1之间通过Eth-trunk接口连接,增加网络带宽,提高网络可靠性;核心交换机LSW1为AP和STA的网关,并且作为DHCP服务器为STA和AP分配IP地址;接入层交换机LSW2、LSW3只做二层透传;底层路由采用OSPF协议通信,AC配置默认路由。

AC+AP三层组网_第1张图片

内网设备数据规划

AC+AP三层组网_第2张图片

配置步骤

根据拓扑规划,各设备基础配置,包括设备命名、创建vlan、接口所属vlan、IP地址、配置路由,实现底层路由通信等等配置

配置核心层交换机LSW1作为DHCP服务器,分别为AP与STA分配IP地址

配置WLAN基本业务

配置VAP并下发配置

验证配置结果,无线用户能接入Internet

 基础配置

配置交换机LSW2的接口G0/0/1、Ethernet0/0/1、0/0/2接口加入vlan100(管理vlan)和vlan101(业务vlan),Ethernet0/0/1、0/0/2接口直连AP需要配置PVID,并配置端口隔离以减少广播报文

LSW2

system-view

sysname LSW2

vlan batch 100 101

#
interface GigabitEthernet0/0/1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 100 to 101

#
port-group group-member Ethernet 0/0/1 Ethernet 0/0/2
 port link-type trunk
 port trunk pvid vlan 100                          #直连AP的接口需要配置PIVD
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 100 to 101
 stp edged-port enable
 port-isolate enable group 1          #配置端口隔离以减少广播报文

quit

#

配置交换机LSW3的接口G0/0/1、Ethernet0/0/1接口加入vlan200(管理vlan)和vlan201(业务vlan),Ethernet0/0/1接口直连AP需要配置PVID,并配置端口隔离以减少广播报文

LSW3

system-view

sysname LSW3

vlan batch 200 201

#
interface GigabitEthernet0/0/1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 200 to 201
#

interface Ethernet0/0/1
 port link-type trunk
 port trunk pvid vlan 200
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 200 to 201
 stp edged-port enable
 port-isolate enable group 1
#

配置交换机LSW1的接口G0/0/1加入vlan100(管理vlan)和vlan101(业务vlan),接口G0/0/2加入vlan200(管理vlan)和vlan201(业务vlan),连接外部网络的接口G0/0/3划为access属于vlan10,G0/0/23和G0/0/24接口加入Eth-trunk10,Eth-trunk10加入vlan300。

LSW1

system-view

sysname LSW1

vlan batch  10 100 101 200 201 300

interface GigabitEthernet0/0/1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/2
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 200 to 201
#

interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 10
#

interface Eth-Trunk10
 port link-type trunk
 port trunk allow-pass vlan 300

undo port trunk allow-pass vlan 1

trunkport GigabitEthernet 0/0/23 0/0/24
 

AC

system-view

sysname AC

vlan 300

quit

#

interface Eth-Trunk10
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 300

trunkport GigabitEthernet 0/0/23 0/0/24
#

配置IP地址

配置vlan10用于与外网通信,配置vlan300,用于交换机LSW1与AC通信,配置vlan100、101、200、201作为管理vlan和业务vlan的网关

LSW1

#

interface Vlanif10
 ip address 200.10.10.1 30

#

interface Vlanif100
 ip address 172.16.100.1 24
#

interface Vlanif101
 ip address 172.16.101.1 24
#

interface Vlanif200
 ip address 172.16.200.1 24

#
interface Vlanif201
 ip address 172.16.201.1 24
#

interface Vlanif300
 ip address 172.16.30.1 24
#

配置vlan300与交换机LSW1通信

AC
interface Vlanif300
ip address 172.16.30.2 255.255.255.0
#

AR1

interface GigabitEthernet0/0/0

ip address 200.10.10.2 30

quit

配置LSW1为DHCP服务器

通过全局地址池分别为AP和ST分配IP地址

#option 43 sub-option 1 ip-address 172.16.30.2  //AC和AP处于三层组网,需要配置option43向AP通告AC的IP地址

LSW1

dhcp enable

#配置全局地址池为AP1和AP2分配IP地址
ip pool visit-ap1
gateway-list 172.16.100.1
network 172.16.100.0 mask 24
option 43 sub-option 1 ip-address 172.16.30.2
#

interface Vlanif100         
 dhcp select global

#配置全局地址池为AP3分配IP地址

ip pool visit-ap2
 gateway-list 172.16.200.1
 network 172.16.200.0 mask 24
 option 43 sub-option 1 ip-address 172.16.30.2
#

interface Vlanif200
 dhcp select global
 

#配置全局地址池为AP1、AP2下接入的STA分配IP地址

ip pool area1-sta
 gateway-list 172.16.101.1
 network 172.16.101.0 mask 24
#

interface Vlanif101
 dhcp select global
 

#配置全局地址池为AP3下接入的STA分配IP地址
ip pool area2-sta
 gateway-list 172.16.201.1
 network 172.16.201.0 mask 24

#
interface Vlanif201
 dhcp select global
#

配置路由

配置AC的默认路由指向LSW1 

ip route-static 0.0.0.0 0.0.0.0 172.16.30.1

配置动态路由协议ospf

[LSW1-ospf-1]dis this
#

router id 11.1.1.1 
ospf 1
 area 0.0.0.0
  network 172.16.101.0 0.0.0.255
  network 172.16.201.0 0.0.0.255
  network 200.10.10.1 0.0.0.0

AR1

router id 1.1.1.1 

ospf 1 
 area 0.0.0.0 
  network 200.10.10.2 0.0.0.0 
#
 

 配置验证

ospf邻居建立成功,如下图所示:

AC+AP三层组网_第3张图片

配置AP上线

创建AP组,用于将相同配置的AP都加入同一个AP组中

创建名为ap-group1、ap-group2的AP组

[AC]wlan
[AC-wlan-view] ap-group name ap-group1
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] ap-group name ap-group2
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC-wlan-ap-group-ap-group2] quit
[AC-wlan-view]

创建域管理模板(名称为domain1),在域管理模板下配置AC的国家码并在AP组(ap-group1、ap-group2)下引用域管理模板(domain1)

[AC-wlan-view] regulatory-domain-profile name domain1  
[AC-wlan-regulate-domain-domain1] country-code cn
Info: The current country code is same with the input country code.
[AC-wlan-regulate-domain-domain1] quit
[AC-wlan-view] ap-group name ap-group1  
[AC-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] ap-group name ap-group2
[AC-wlan-ap-group-ap-group2] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-ap-group2] quit
[AC-wlan-view] quit

 配置AC的源接口

[AC]capwap source interface vlan 300

在AC上离线导入AP,通过该命令查看AP接口的MAC地址display interface GigabitEthernet 0/0/0

将部署的AP1、AP2都加入AP组ap-group1

AP1的ap-id设置为101,ap-name为ap-101、AP2的ap-id设置为102,ap-name为ap-102

[AC]wlan

[AC-wlan-view] ap auth-mode mac-auth 


[AC-wlan-view] ap-id 101 ap-mac 00e0-fc9b-1120
[AC-wlan-ap-101] ap-name ap-101
[AC-wlan-ap-101] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-wlan-ap-101] quit
[AC-wlan-view]

[AC-wlan-view] ap-id 102 ap-mac 00e0-fcfa-2810 2102354483102A24022C
[AC-wlan-ap-102] ap-name ap-102
[AC-wlan-ap-102] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-wlan-ap-102] quit
[AC-wlan-view]

将部署的AP3都加入AP组ap-group2,AP3的ap-id设置为103,ap-name为ap-103

[AC-wlan-view] ap-id 103 ap-mac 00e0-fcef-4a80
[AC-wlan-ap-103] ap-name ap-103
[AC-wlan-ap-103] ap-group ap-group2
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-wlan-ap-103] quit
[AC-wlan-view]

验证配置

查看所有已添加的AP信息,AP在AC上成功上线。

AC+AP三层组网_第4张图片

 配置WLAN业务参数

创建RRM模板

创建名为rrm-profile1的RRM模板

信道的选择模式有自动模式和固定模式、这里采用固定模式。为用户提供一种更灵活的选择;

功率的模式也有自动模式和固定模式,这里关闭自动模式,采用固定模式,发射功率由用户指定。

[AC-wlan-view] rrm-profile name rrm-profile1 创建名为rrm-profile1的RRM模板
[AC-wlan-rrm-prof-rrm-profile1] calibrate auto-channel-select disable  配置射频的功率模式为固定模式
[AC-wlan-rrm-prof-rrm-profile1] calibrate  auto-txpower-select disable  关闭发送功率自动选择功能
[AC-wlan-rrm-prof-rrm-profile1]quit

创建射频模板

创建名为radio-2g和radio-5g的射频模板,绑定RRM模板rrm-profile1。

[AC-wlan-view]radio-2g-profile name radio-2g
[AC-wlan-radio-2g-prof-radio-2g]rrm-profile rrm-profile1
[AC-wlan-radio-2g-prof-radio-2g]quit

[AC-wlan-view]radio-5g-profile name radio-5g             
[AC-wlan-radio-5g-prof-radio-5g]rrm-profile rrm-profile1
[AC-wlan-radio-5g-prof-radio-5g]quit
[AC-wlan-view]

创建安全模板

创建名为security-profile1的安全模板,并配置安全策略,配置WAP-WAP2+PSK+AES的安全策略,密码是“admin123456”。

[AC-wlan-view]security-profile name security-profile1
[AC-wlan-sec-prof-security-profile1]security wpa-wpa2 psk pass-phrase admin123456 aes
[AC-wlan-sec-prof-security-profile1]quit
[AC-wlan-view]

创建SSID模板 

创建名为ssid-profile1的SSID模板,并配置SSID名称为ssid1

[AC-wlan-view]ssid-profile name ssid-profile1
[AC-wlan-ssid-prof-ssid-rpofile1]ssid ssid1
Info: This operation may take a few seconds, please wait.done.
[AC-wlan-ssid-prof-ssid-rpofile1]quit
[AC-wlan-view]

创建流量模板

配置名为“traffic-profile1”的流量模板,并配置无线用户二层隔离 

[AC-wlan-view]traffic-profile  name traffic-profile1
[AC-wlan-traffic-prof-traffic-profile1]user-isolate ? 
  all  All
  l2   Layer 2 users isolated
[AC-wlan-traffic-prof-traffic-profile1]user-isolate l2
Warning: This action may cause service interruption. Continue?[Y/N]y
Info: This operation may take a few seconds, please wait.done.
[AC-wlan-traffic-prof-traffic-profile1]quit
[AC-wlan-view]

创建VAP模板

配置名为vap-profile1、vap-profile2的VAP模板,配置业务数据转发模式为直接转发、业务vlan。并引用安全模板、SSID模板、流量模板。

配置名为vap-profile1的VAP模板

[AC-wlan-view] vap-profile name vap-profile1
[AC-wlan-vap-prof-vap-profile1] forward-mode direct-forward   

[AC-wlan-vap-prof-vap-profile1]service-vlan vlan-id 101   
Info: This operation may take a few seconds, please wait.done.


[AC-wlan-vap-prof-vap-profile1] security-profile security-profile1
Info: This operation may take a few seconds, please wait.done.

[AC-wlan-vap-prof-vap-profile1]ssid-profile  ssid-profile1
Info: This operation may take a few seconds, please wait.done.

[AC-wlan-vap-prof-vap-profile1]traffic-profile traffic-profile1
Info: This operation may take a few seconds, please wait.done.
[AC-wlan-vap-prof-vap-profile1]quit
[AC-wlan-view]

配置名为vap-profile2的VAP模板

[AC-wlan-view]vap-profile name vap-profile2

[AC-wlan-vap-prof-vap-profile2]forward-mode direct-forward 

[AC-wlan-vap-prof-vap-profile2]service-vlan vlan-id 201
Info: This operation may take a few seconds, please wait.done.

[AC-wlan-vap-prof-vap-profile2]  security-profile security-profile1
Info: This operation may take a few seconds, please wait.done.


[AC-wlan-vap-prof-vap-profile2]  ssid-profile ssid-profile1
Info: This operation may take a few seconds, please wait.done.


[AC-wlan-vap-prof-vap-profile2]  traffic-profile traffic-profile1
Info: This operation may take a few seconds, please wait.done.
[AC-wlan-vap-prof-vap-profile2] quit
#

配置AP组引用VAP模板和射频模板

[AC-wlan-view]ap-group name ap-group1

[AC-wlan-ap-group-ap-group1]vap-profile vap-profile1 wlan 1 radio 0
Info: This operation may take a few seconds, please wait...done.


[AC-wlan-ap-group-ap-group1]vap-profile vap-profile1 wlan 1 radio 1
Info: This operation may take a few seconds, please wait...done.

[AC-wlan-ap-group-ap-group1]radio-2g-profile radio-2g radio 0
Warning: This action may cause service interruption. Continue?[Y/N]y

[AC-wlan-ap-group-ap-group1]radio-5g-profile radio-5g radio 1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ap-group-ap-group1] quit

[AC-wlan-view]ap-group name ap-group2
[AC-wlan-ap-group-ap-group2]vap-profile vap-profile2 wlan 1 radio 0
Info: This operation may take a few seconds, please wait...done.


[AC-wlan-ap-group-ap-group2]vap-profile vap-profile2 wlan 1 radio 1
Info: This operation may take a few seconds, please wait...done.

[AC-wlan-ap-group-ap-group2]radio-2g-profile radio-2g radio 0
Warning: This action may cause service interruption. Continue?[Y/N]y


[AC-wlan-ap-group-ap-group2]radio-5g-profile radio-5g radio 1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ap-group-ap-group2] quit

配置VAP并下发

channel 20mhz 1  //根据WLAN planner网规工具规划的结果配置信道
eirp 10  //根据WLAN planner网规工具规划的结果配置功率

[AC-wlan-view]ap-id 101
[AC-wlan-ap-101]radio
[AC-wlan-radio-101/0]channel 20mhz 1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-101/0]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-101/0]quit


[AC-wlan-ap-101]radio 1 
[AC-wlan-radio-101/1]channel 20mhz 153
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-101/1]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-101/1]quit
[AC-wlan-ap-101] quit


[AC-wlan-view] ap-id 102
[AC-wlan-radio-102/0]channel 20mhz 6
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-102/0]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-102/0]quit


[AC-wlan-ap-102]radio 1
[AC-wlan-radio-102/1]channel 20mhz 161
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-102/1]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-102/1]quit
[AC-wlan-ap-102]quit
[AC-wlan-view]

[AC-wlan-view]ap-id 103
[AC-wlan-ap-103]radio 0
[AC-wlan-radio-103/0]channel 20mhz 1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-103/0]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-103/0]quit


[AC-wlan-ap-103]radio 1
[AC-wlan-radio-103/1]channel 20mhz 153
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-103/1]eirp 10
Info: The EIRP value takes effect only when automatic transmit power selection is disabled, and the value depends on the AP specifications and local laws and regulations.
[AC-wlan-radio-103/1]quit
[AC-wlan-ap-103]quit
[AC-wlan-view]

实验结果验证

STA输入密码,点击确定。

AC+AP三层组网_第5张图片

 STA使用ipconfig命令查看获取的IP地址,使用ping命令测试与外网的连通,如下图所示:

 AC+AP三层组网_第6张图片

 AC+AP三层组网_第7张图片

 AC+AP三层组网_第8张图片

 AC+AP三层组网_第9张图片

 AC+AP三层组网_第10张图片

 无线用户STA能够分配到IP地址,且正常连接网络,能访问外网。

 AC+AP三层组网_第11张图片

​​AC+AP三层组网_第12张图片

你可能感兴趣的:(WLAN(华为),网络)