wlan配置

1. 项目拓扑与项目需求
   1. 

   项目需求

   图为某酒店的组网，AR1为酒店的出口设备，通过与运营PPPoE拨号实现访问外网。AC1通过配置实现对AP1-AP4的纳管以及无线配置的下发。现在要求实现如下需求：

   • AP1、AP2房间的面板ap，LSW1为楼层交换机，通过在AC配置实现楼层的wlan SSID为LC，密码为huawei123 ，楼层的STA上网使用vlan10。
   • AP3、AP4为大厅的AP设备，通过在AC配置实现楼层的wlan SSID为DT，密码为huawei123，大厅的STA上网使用vlan20。
   • AC和AP通信的控制vlan为vlan100，所有终端设备都通过AR1获取IP地址，所有的STA都能实现访问外部网络。
   1. 实验步骤

   步骤1：配置AC，实现AC纳管AP并下发配置

   1. 创建vlan，开启DHCP使AP获取IP地址

   AC的配置：

   Enter system view, return user view with Ctrl+Z.

   [AC6605]vlan batch 10 20 100

   Info: This operation may take a few seconds. Please wait for a moment...done. 

   [AC6605]dhcp enable

   [AC6605]interface Vlanif 100

   [AC6605-Vlanif100]ip address 10.0.100.254 24

   [AC6605-Vlanif100]dhcp  select  interface

   [AC6605]interface Vlanif 10

   [AC6605-Vlanif10]ip address 10.0.10.254 24

   [AC6605-Vlanif10]interface vlanif 20

   [AC6605-Vlanif20]ip address 10.0.20.254 24

   LSW1的配置：

   [LSW1]vlan batch 10 20 100

   [LSW1-GigabitEthernet0/0/1]port link-type trunk

   [LSW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 100

   [LSW1-GigabitEthernet0/0/2]port link-type trunk

   [LSW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 100

   [LSW1-GigabitEthernet0/0/2]port trunk pvid vlan 100

   [LSW1-GigabitEthernet0/0/3]port link-type trunk

   [LSW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 100

   [LSW1-GigabitEthernet0/0/3]port trunk pvid vlan 100

   LSW2的配置：

   [LSW2]vlan batch 10 20 100

   [LSW2-GigabitEthernet0/0/1]port link-type trunk

   [LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 100

   [LSW2-GigabitEthernet0/0/2]port link-type trunk

   [LSW2-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20 100

   [LSW2-GigabitEthernet0/0/2]port trunk pvid vlan 100

   [LSW2-GigabitEthernet0/0/3]port link-type trunk

   [LSW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20 100

   [LSW2-GigabitEthernet0/0/3]port trunk pvid vlan 100

   1. 下发WLAN配置
   1. 在AC上配置capwap隧道

   [AC6605]capwap source interface Vlanif 100

   1. AP上线

   创建AP组

   [AC6605-wlan-view]ap-group name lc

   Info: This operation may take a few seconds. Please wait for a moment.done.

   [AC6605-wlan-ap-group-lc]quit

   [AC6605-wlan-view]ap-group name dt

   Info: This operation may take a few seconds. Please wait for a moment.done.

   [AC6605-wlan-ap-group-dt]quit

   让AP加入对应的组

   [AC6605-wlan-view]ap-id 1 ap-mac 00e0-fcdb-1960  //MAC地址在AP上输入display

   Interface vlanif1查看  

   [AC6605-wlan-ap-1]ap-name ap1

   [AC6605-wlan-ap-1]ap-group lc

   Warning: This operation may cause AP reset. If the country code changes, it will

    clear channel, power and antenna gain configurations of the radio, Whether to

   continue? [Y/N]:y

   Info: This operation may take a few seconds. Please wait for a moment. done.

   [AC6605-wlan-ap-1]

   dis in vlanif 1

   Vlanif1 current state : UP

   Line protocol current state : UP

   Last line protocol up time : 2023-07-25 07:00:52 UTC-05:13

   Description: HUAWEI, AP Series, Vlanif1 Interface

   Route Port, The Maximum Transmit Unit is 1500

   Internet Address is a Located by DHCP, 10.0.100.90/24

   IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 00e0-fcdb-1960

   查看AP命令行界面：

   ===== CAPWAP LINK IS UP!!! =====

   说明AP１上线了！AP2、3、4同理

   1. 下发配置

   SSID模块：

   [AC6605-wlan-view]ssid-profile name lc//创建LC　SSID模板

   [AC6605-wlan-ssid-prof-lc]ssid lc　SSID叫LC

   Info: This operation may take a few seconds, please wait.done.

   [AC6605-wlan-view]ssid-profile name dt

   [AC6605-wlan-ssid-prof-dt]ssid dt//真正看到的名字

   Info: This operation may take a few seconds, please wait.done.

   安全模块：

   [AC6605-wlan-view]security-profile name huawei 

   [AC6605-wlan-sec-prof-huawei]security wpa-wpa2 psk（加密）     

   [AC6605-wlan-sec-prof-huawei]security wpa-wpa2 psk pass-phrase huawei@123 aes（对密码加密）

   调用模块：

   [AC6605-wlan-view]vap-profile name lc

   [AC6605-wlan-vap-prof-lc]service-vlan vlan-id 10//STA加入的vlan

   [AC6605-wlan-vap-prof-lc]ssid-profile lc

   [AC6605-wlan-vap-prof-lc]security-profile huawei//只写了一个安全模板，密码相同

   [AC6605-wlan-view]vap-profile name dt

   [AC6605-wlan-vap-prof-dt]service-vlan vlan-id 20

   [AC6605-wlan-vap-prof-dt]ssid-profile dt

   [AC6605-wlan-vap-prof-dt]security-profile huawei

在AP组里调用VAP 模块：

[AC6605-wlan-view]ap-group name lc

[AC6605-wlan-ap-group-lc]vap-profile lc wlan 1 radio 0（2.4G　1：5G）

Info: This operation may take a few seconds, please wait...done.

[AC6605-wlan-ap-group-lc]    

[AC6605-wlan-ap-group-dt]vap-profile dt wlan 2 radio 1

Info: This operation may take a few seconds, please wait...done.

[AC6605-wlan-ap-group-dt]

步骤２：配置DHCP中继

1. 配置DHCP服务器

AC的配置：

[AC6605]interface Vlanif 1

[AC6605-Vlanif1]ip address 10.0.11.2 24

[AC6605-Vlanif1]ping 10.0.11.1

AR1的配置：

[AR1] ip pool vlan10  //创建vlan10的服务器地址池

[AR1-ip-pool-vlan10]gateway-list 10.0.10.254

[AR1-ip-pool-vlan10]network 10.0.10.0 mask 255.255.255.0

[AR1-ip-pool-vlan10]dns-list 8.8.8.8

[AR1-GigabitEthernet0/0/1]dhcp select global  //接口选择基于全局

[AR1] ip pool vlan20  //创建vlan20的服务器地址池

[AR1-ip-pool-vlan20]gateway-list 10.0.20.254

[AR1-ip-pool-vlan20]network 10.0.20.0 mask 255.255.255.0

[AR1-ip-pool-vlan20]dns-list 8.8.8.8

[AR1-GigabitEthernet0/0/1]dhcp select global  //接口选择基于全局

1. 配置中继

[AC6605-Vlanif10]dhcp select relay

[AC6605-Vlanif10]dhcp relay server-ip 10.0.11.1

[AC6605-Vlanif20]dhcp select relay

[AC6605-Vlanif20]dhcp relay server-ip 10.0.11.1

1. 配置静态路由

[AR1]ip route-static 10.0.10.0 24 10.0.11.2

[AR1]ip route-static 10.0.20.0 24 10.0.11.2

步骤3：配置PPPoE拨号上网

1. 配置PPPoE sever的地址池

system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname PPPoE sever

[PPPoE sever]ip pool pool1

Info: It's successful to create an Ip address pool.    

[PPPoE sever-ip-pool-pool1]network 100.1.1.0 mask 24  //客户端通过拨号所获取的网段地址

[PPPoE sever-ip-pool-pool1]gateway-list 100.1.1.1  //配置分配的网关地址

[PPPoE sever-A]local-user huawei password cipher huawei  //创建用户名为huawei、密码为huawei的账号

Info: Add a new user.  

[PPPoE sever-A]local-user huawei service-type ppp //设置用户名为huawei的服务类型为ppp

1. 配置VT接口，用于PPPoE认证并且分配地址

[PPPoE sever]interface Virtual-Template 1   //创建vt接口

[PPPoE sever-Virtual-Template1]ip address  100.1.1.1 24  //将网关地址配置在VT接口

[PPPoE sever-Virtual-Template1]ppp authentication-mode chap  //配置ppp的认证类型为chap

[PPPoE sever-Virtual-Template1]remote address pool  pool1  //调用为客户端分配地址的地址池pool1

1. 在以太网接口使能PPPoE功能并绑定VT接口1

[PPPoE sever]interface  g0/0/0

[PPPoE sever-GigabitEthernet0/0/0]PPPoE-server bind virtual-template 1  //设置本设备为PPPoE的服务端，并且关联VT接口

1. 配置AR1的PPPoE client拨号功能

[Huawei]sysname PPPoE client

[PPPoE client]interface Dialer 0

[PPPoE client-Dialer0]dialer user useAR1  // 使能共享DDC功能

[PPPoE client-Dialer0]dialer bundle 1  //指定该dialer口的dialer bundle

[PPPoE client-Dialer0]ppp chap user huawei  //配置服务端分配的用户名

[PPPoE client-Dialer0]ppp chap password cipher huawei  //配置服务端分配的密码

[PPPoE client-Dialer0]ip address  ppp-negotiate  //使用ppp协商获取ip地址

1. 建立PPPoE会话

[PPPoE client]interface  g0/0/0

[PPPoE client-GigabitEthernet0/0/0]PPPoE-client dial-bundle-number 1 //绑定dialer口的dialer bundle

1. 查看客户端是否通过PPPoE获取到ip地址

[PPPoE client]display ip interface brief

*down: administratively down

^down: standby

(l): loopback

(s): spoofing

The number of interface that is UP in Physical is 4

The number of interface that is DOWN in Physical is 3

The number of interface that is UP in Protocol is 2

The number of interface that is DOWN in Protocol is 5

Interface                         Ip address/Mask      Physical   Protocol 

Dialer0                           100.1.1.254/32       up         up(s)    

GigabitEthernet0/0/0              unassigned           up         down     

GigabitEthernet0/0/1              unassigned           up         down     

GigabitEthernet0/0/2              unassigned           down       down     

NUL0                             unassigned           up         up(s)    

可以看到客户端通过PPPoE获取到了100.1.1.254的ip地址

1. 配置AR1的G0/0/1口的ip地址

[PPPoE client]interface g0/0/1

[PPPoE client-GigabitEthernet0/0/1]ip address  10.1.1.2 24

1. 配置nat，让私有网络的PC能够访问外部网络

配置acl定义需要地址转换的流量

[PPPoE client]acl 2000

[PPPoE client-acl-basic-2000]rule  permit  source  any //匹配需要访问外网的设备流量

在接口配置easy ip

[PPPoE client]interface Dialer 0

[PPPoE client-Dialer0]nat outbound 2000 //在dialer 0口调用acl 2000

配置默认路由访问外网

[PPPoE client]ip route-static 0.0.0.0 0 Dialer 0 //配置默认路由，下一跳出口为dialer 口

[AC6605]ip route-static 0.0.0.0 0 10.0.11.1

1. 在ISP上写环回模拟公网：200.1.1.1/32

STAping200.1.1.1