ciscoAP配置
Cisco无线瘦AP配置
1.查看AP系统版本、Flash等信息
AP# show version
AP# dir
Directory of flash:/
2 -rwx 64 Jan 18 2016 08:34:20 +00:00 sensord_CSPRNG0
3 -rwx 58733 Jan 18 2016 08:34:25 +00:00 event.log
4 -rwx 378 Oct 8 2016 02:44:56 +00:00 env_vars
5 drwx 0 Mar 1 1993 00:01:05 +00:00 configs
6 -rwx 74 Oct 8 2016 02:44:56 +00:00 capwap-saved-config
7 drwx 2176 Jan 18 2016 08:23:01 +00:00 ap3g2-k9w8-mx.153-3.JA
75 -rwx 965 Aug 16 2016 08:16:47 +00:00 lwapp_mm_mwar_hash.cfg
76 -rwx 64 Sep 30 2016 10:51:40 +00:00 sensord_CSPRNG1
77 -rwx 7192 Oct 8 2016 02:44:57 +00:00 private-multiple-fs
78 -rwx 62 Jan 18 2016 08:27:02 +00:00 mesh_cfg.txt
79 -rwx 85 Jan 18 2016 08:27:02 +00:00 mesh_port_cfg.txt
40900608 bytes total (21235712 bytes free)
注：这个AP使用过，重新配置前最好清空以前配置。即删除除红色字体以外的全部文件，清空AP配置。
ap# delete flash:文件名 /删除文件，清空配置信息
如果需更换IOS，需查看flash剩余空间，如空间不足，需删除现有IOS再重新导入新IOS。
查看AP的证书
- MIC 厂商预安装
- SSC 自签名证书
show crypto pki certificates
2.配置瘦AP
ap# lwapp ap ip address 172.17.40.69 255.255.255.0 /配置AP的IP地址
ap# lwapp ap ip default-gateway 172.17.40.1 /配置网关
ap# lwapp ap controller ip address 172.17.3.33 /配置控制器IP地址
配置完成后将AP接入网络
3.检查配置
ap# show ip interface b /查看AP的IP地址
ap# show capwap ip config /查看AP的配置信息
ap# ping 172.17.3.33 ping控制器地址
ap# ping 172.17.40.1 ping网关
4.总结
总的来说，瘦AP配置相当简单，只要IP，Gateway，Controller IP配置OK，AP会自动注册到控制器，然后从控制器download最新配置文件到AP本地，AP自动重启后就可以正常使用了，后续其它管理操作全部在控制器上完成即可，控制器配置在这里就不说明了。
附：Cisco3702 AP相关命令输出
AP# show version
Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JA, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Fri 15-Aug-14 12:22 by prod_rel_team
ROM: Bootstrap program is C3700 boot loader
BOOTLDR: C3700 Boot Loader (AP3G2-BOOT-M), Version 15.2 [mpleso-v152_4_jb_throttle_31101 103]
AP uptime is 1 hour, 57 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g2-k9w8-mx.153-3.JA/ap3g2-k9w8-xx.153-3.JA"
Last reload reason:
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
If you require further assistance please contact us by sending email to
[email protected].
cisco AIR-CAP3702E-H-K9 (PowerPC) processor (revision A0) with 376810K/134656K bytes of memory.
Processor board ID FGL1941X3RQ
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.100.0
1 Gigabit Ethernet interface
2 802.11 Radios
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: E4:AA:5D:D9:5E:C4
Part Number : 73-15397-01
PCA Assembly Number : 000-00000-00
PCA Revision Number :
PCB Serial Number : FOC19376Y4C
Top Assembly Part Number : 068-05055-06
Top Assembly Serial Number : FGL1941X3RQ
Top Revision Number : A0
Product/Model Number : AIR-CAP3702E-H-K9
Configuration register is 0xF
AP# show ip interface brief
Interface IP-Address OK? Method Status Protocol
BVI1 172.17.40.69 YES TFTP up up
Dot11Radio0 unassigned NO unset up up
Dot11Radio1 unassigned NO unset administratively down down
GigabitEthernet0 unassigned NO unset up up
AP# show capwap ip config
LWAPP Static IP Configuration
IP Address 172.17.40.69
IP netmask 255.255.255.0
Default Gateway 172.17.40.1
Primary Controller 172.17.3.33
Cisco 胖AP桥接配置实例
桥接网络一般是解决光纤无法到达的无奈之举，Cisco的桥接链路技术比较成熟，稳定性实测还可以，用的也很普遍。
本文介绍Cisco FAT AP桥接配置实例，我使用的是3台Cisco 1532E 胖AP，软件版本是C1530 Software (ap1g3-K9W7-M), Version 15.2(4)JB3b，其它版本也应该通用。
配置实例
本文只列举了5.8G桥接的主要配置信息，2.4G桥接同理。
逻辑拓扑图
root AP配置
dot11 ssid TEST5G
authentication open
authentication key-management wpa version 2
wpa-psk ascii passwd5G
interface Dot11Radio1
no ip address
encryption mode ciphers aes-ccm
ssid TEST5G
antenna gain 0
peakdetect
dfs band 3 block
packet retries 64 drop-packet
channel 5765
station-role root bridge
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address 172.17.50.111 255.255.255.0
ip default-gateway 172.17.50.1
其它常规配置：略
以上配置的SSID，加密类型，channel，station-role 可根据需要自行修改。
station-role几种常用的选择如下：
station-role root bridge
station-role root bridge wireless-clients
station-role root access-point
station-role root ap-only
mesh1 AP配置
dot11 ssid TEST5G
authentication open
authentication key-management wpa version 2
wpa-psk ascii passwd5G
interface Dot11Radio1
no ip address
encryption mode ciphers aes-ccm
ssid TEST5G
antenna gain 0
peakdetect
packet retries 64 drop-packet
station-role non-root bridge
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address 172.17.50.222 255.255.255.0
ip default-gateway 172.17.50.1
其它常规配置：略
以上配置的SSID，加密类型，station-role 同样也可根据需要自行修改。
station-role几种常用的选择如下：
station-role non-root bridge
station-role non-root bridge wireless-clients
station-role non-root wireless-clients
station-role workgroup-bridge
mesh2 AP配置
同mesh1 AP配置，略
桥接链路检查
配置完成后，在root AP上查看，可以看到我的两台mesh AP都已桥接到root AP上。
Root-1532E#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID Local Intrfce Holdtme Capability Platform Port ID
Mesh1-1532E Vi-Dot11 1 147 T I AIR-SAP15 Vi-Dot11 0
Mesh2-1532E Vi-Dot11 0 167 T I AIR-SAP15 Vi-Dot11 0
测试桥接链路信号质量
Root-1532E#show dot11 associations
802.11 Client Stations on Dot11Radio1:
SSID [WPWGB5G] :
MAC Address IP address IPV6 address Device Name Parent State
bc16.f59e.xxx1 0.0.0.0 :: Br-client - bc16.f5a0.xxx1 Assoc
bc16.f5a0.xxx2 172.17.50.107 :: bridge Mesh1-1532E self Assoc
bc16.f5a1.xxx3 172.17.50.110 :: bridge Mesh2-1532E self Assoc
Root-1532E#dot11 dot11Radio 1 linktest target bc16.f5a0.xxx2
Root-1532E#terminal monitor
Root-1532E#dot11 dot11Radio 1 linktest
Start linktest to bc16.f5a0.xxx2, 100 512 byte packets
GOOD (2 % retries) Time Strength(dBm) SNR SNR Retries
msec In Out In Out In Out
Sent : 100, Avg 0 - 28 - 31 58 56 Tot: 0 4
Lost to Tgt: 0, Max 4 - 28 - 31 59 57 Max: 0 1
Lost to Src: 0, Min 0 - 29 - 33 58 55
Rates (Src/Tgt) mcs4 100/100
Linktest Done in 0.084 msec
通过以上测试，就可以知道Root AP和Mesh AP的信号强度，信噪比，重传率等信息。
Cisco瘦AP转胖AP
思科瘦AP转胖AP
准备工作
1.电脑安装tftp工具，如tftpd32，3CDaemon等。
2.将胖AP ios下载后放在tftp工具设置的文件目录下。ios需要根据要求改成****.default后缀的文件名，比如1532要改为：ap1g3-k9w7-tar.default
3.PC以太网口连接AP，PC配置10.0.0.x网段的IP地址，掩码255.255.255.0，因为AP初始IP为10.0.0.1
4.Console线连接AP，保证PC能通过console管理AP。
思科瘦AP转胖AP
1.准备工作做好后，断开AP电源。
2.按住AP上的mode键，不放，接上电源，通电。
3.按住约20s左右，直到出现button is pressed, wait for button to be released...提示，继续按住至少5秒。
4.松开mode键，等待新ios上传，上传时间根据ios大小的而不同，约10min左右。瘦转胖完成后，AP会自动重启。
5.登录新的ios系统，通过show version检查系统版本，show boot检查系统启动项。
6.对于思科1242等比较老旧的AP，瘦转胖的过程中按住mode键时，console窗口不会输出任何信息，因此只能通过AP的状态灯来判断松开mode键的时间，一般有橙色变紫红色时，松开mode键即可，整个按住的时间也差不多为20s。
7.附：升级过程
button pressed for 30 seconds
process_config_recovery: set IP address and config to default 10.0.0.1
process_config_recovery: image recovery
image_recovery: Download default IOS tar image tftp://255.255.255.255/ap1g3-k9w7-tar.default
examining image...
extracting info (285 bytes)
Image info:
Version Suffix: k9w7-.152-4.JB3b
Image Name: ap1g3-k9w7-mx.152-4.JB3b
Version Directory: ap1g3-k9w7-mx.152-4.JB3b
Ios Image Size: 12227072
Total Image Size: 13169152
Image Feature: WIRELESS LAN
Image Family: ap1g3
Wireless Switch Management Version: 7.6.9a5.12
Extracting files...
ap1g3-k9w7-mx.152-4.JB3b/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/level/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/level/1/ (directory) 0 (bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/appsui.js (563 bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/back.shtml (512 bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/cookies.js (5032 bytes)
....
New software image installed in flash:/ap1g3-k9w7-mx.152-4.JB3b
Configuring system to use new image...done.
Requested system reload in progress...download took about 449 seconds
Loading "flash:/ap1g3-k9w7-mx.152-4.JB3b/ap1g3-k9w7-mx.152-4.JB3b"...########################################################################################################################################################################################
ap#show version
Cisco胖AP转瘦AP
思科胖AP转瘦AP，Cisco1242胖AP转瘦AP，Cisco1532胖AP转瘦AP，Cisco3702胖AP转瘦AP，Cisco AP胖转瘦
准备工作
1.tftp工具，如tftpd32，3CDaemon等。
2.PC以太网口连接AP，PC配置10.0.0.x网段的IP地址，掩码255.255.255.0，因为AP初始IP为10.0.0.1。
3.Console线连接AP，保证PC能通过console管理AP。
思科胖AP转瘦AP
1.登录胖AP，进入特权模式，默认密码均为Cisco。
2.输入以下命令archive download-sw /overwrite /create-space tftp://10.0.0.2/ap3g2-k9w8-tar.153-3.JD.tar，上传ios。
ap#archive download-sw /overwrite /create-space tftp://10.0.0.2/ap3g2-k9w8-tar.153-3.JD.tar
examining image...
Loading ap3g2-k9w8-tar.153-3.JD.tar from 10.0.0.2 (via BVI1): !
extracting info (285 bytes)
Image info:
Version Suffix: k9w8-.153-3.JD
Image Name: ap3g2-k9w8-mx.153-3.JD
Version Directory: ap3g2-k9w8-mx.153-3.JD
Ios Image Size: 12861952
Total Image Size: 15022592
Image Feature: WIRELESS LAN|LWAPP
Image Family: AP3G2
Wireless Switch Management Version: 8.3.102.0
Extracting files...
ap3g2-k9w8-mx.153-3.JD/ (directory) 0 (bytes)O
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD (215867 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-tx.153-3.JD (73 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-bl-2600 (190140 bytes)!
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-bl-3600 (189183 bytes)!
ap3g2-k9w8-mx.153-3.JD/html/ (directory) 0 (bytes)
ap3g2-k9w8-mx.153-3.JD/html/level/ (directory) 0 (bytes)
ap3g2-k9w8-mx.153-3.JD/html/level/1/ (directory) 0 (bytes)
extracting ap3g2-k9w8-mx.153-3.JD/html/level/1/appsui.js (563 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/html/level/1/back.shtml (512 bytes)
.......
即可看到ios已经在上传中。
3.ios上传完成。
......
extracting ap3g2-k9w8-mx.153-3.JD/final_hash.sig (513 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/img_sign_rel.cert (1375 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/img_sign_rel_sha2.cert (1371 bytes)
extracting info.ver (285 bytes)
[OK - 15042560 bytes]
Deleting current version: flash:/ap3g2-k9w7-mx.152-4.JB6...
Set booting path to recovery image: ''...done.
New software image installed in flash:/ap3g2-k9w8-mx.153-3.JD
Configuring system to use new image...done.
archive download: takes 265 seconds
4.检查系统启动项，保存，重启。
ap#show boot
BOOT path-list: flash:/ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD
Config file: flash:/config.txt
Private Config file: flash:/private-config
Enable Break: yes
Manual Boot: no
Enable IOS Break: no
HELPER path-list:
NVRAM/Config file
buffer size: 32768
Mode Button: on
Radio Core TFTP:
5.重启完成，查看AP版本，已成功由胖AP转换为瘦AP。
AP843d.c618.aff0#show version
Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JD, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 29-Jul-16 04:06 by prod_rel_team
思科胖AP转瘦AP另一种方法
对于部分新的AP，默认自带了两种ios，胖瘦都有。如果初始是胖AP，需要转换成瘦AP，有简单方法。
1.进入配置模式
2.boot system flash:/******* 瘦ios路径
比如：
3702AP#configure terminal
3702AP(config)#boot system flash:/ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD
3.show boot检查一下。
4.保存，重启。转换完成。
Cisco胖AP配置
Cisco胖AP配置，思科胖AP配置，思科AP配置，思科AP常用配置，思科AP配置实例
主要配置命令
hostname ap /设置AP名
dot11 ssid AP-N2 /设置SSID（AP-N2为SSID号）
authentication open /认证开放
authentication key-management wpa version 2 /认证密钥版本为WPA版本2
guest-mode /显示SSID，no guest-mode表示隐藏SSID
wpa-psk ascii 123456789 /SSID登陆密钥设置（123456789为密钥）
exit
interface dot11radio0 /进入2.4G接口
encryption mode ciphers aes-ccm /加密密码AES CCM模式
ssid AP-N2 /加入SSID AP-N2
power local maximum /设置AP信号发射功率，默认可不配置
no shutdown /开启端口
exit
interface dot11radio1 /进入5.8G接口
encryption mode ciphers aes-ccm /加密密码AES CCM模式
ssid AP-N2 /加入SSID AP-N2
power local maximum /设置AP信号发射功率，默认可不配置
no shutdown /开启端口
exit
interface BVI1 进入管理接口
ip address 192.168.0.191 255.255.255.0 /配置接口IP地址
no shutdown /开启端口
ip default-gateway 192.168.0.1 /配置网关
配置范例
version 15.2
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname test-ap
!
logging rate-limit console 9
enable secret 5 $5$4fXI$i1Zl2wBy24uDQd2j2Tuf41
!
no aaa new-model
clock timezone BeiJing 8 0
no ip source-route
no ip cef
!
dot11 syslog
!
dot11 ssid testssid
authentication open
authentication key-management wpa version 2
guest-mode
wpa-psk ascii 7 1443130D010939102541
!
dot11 guest
!
username myname secret 5 $4$7p8Z$yjeef33iW422J3bDrdN8Q/
!
bridge irb
!
interface Dot11Radio0
no ip address
no shutdown
!
encryption mode ciphers aes-ccm
!
ssid testssid
!
antenna gain 0
power local maximum
packet retries 64 drop-packet
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
!
interface Dot11Radio1
no ip address
!
encryption mode ciphers aes-ccm
!
ssid testssid
!
no shutdown
!
antenna gain 0
power local maximum
peakdetect
dfs band 3 block
packet retries 64 drop-packet
bridge-group 1
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
!
interface GigabitEthernet1
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 192.168.0.16 255.255.255.0
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable
!
ip default-gateway 192.168.0.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
snmp-server community public RO
bridge 1 route ip
!
line con 0
line vty 0 4
login local
transport input all
!
sntp server 192.168.0.1
end