华为FIT痩AP旁挂式隧道组网实验(一)

拓扑图

华为FIT痩AP旁挂式隧道组网实验(一)_第1张图片

实验设备 型号
AC AC6005
S1 S5700
S2 S3700
AP AP2050DN
AP4 AP2050DN
AR1 AR200
没有配置好之前,是没有这个AP范围圈的

配置流程

接入交换机创建VLAN,配置对应端口的链路类型,放行vlan,开启端口隔离
# 与AP连接的接口(0/0/2)
[S2]vlan batch 100 101
[S2]int e0/0/2
[S2-Ethernet0/0/2]port link-type trunk
[S2-Ethernet0/0/2]port trunk pvid vlan 100
[S2-Ethernet0/0/2]port trunk allow-pass vlan 100 101
[S2-Ethernet0/0/2]port-isolate enable 
#   与上行汇聚层交换机连接的接口(0/0/1)
[S2]int e0/0/1
[S2-Ethernet0/0/1]port link-type trunk
[S2-Ethernet0/0/1]port trunk allow-pass vlan 100 101

命令:

  • port-isolate enable(开启端口隔离功能):主要是实现二层隔离,可以实现同一个vlan内端口隔离,如果不配置端口隔离,尤其是业务数据转发方式采用直接转发时,可能会在VLAN内形成大量不必要的广播报文,导致网络阻塞,影响用户体验。
  • port trunk pvid vlan 100 默认是vlan 1,就是相当于给AP打个vlan 100的标签,表示AP划在了vlan 100
汇聚交换机配置链路类型,与AC相连的放行vlan 100,与路由器相连的放行vlan 101
# 与AC相连的接口
[S1]vlan batch 100 101
[S1]int g0/0/1
[S1-GigabitEthernet0/0/1]port link-type trunk
[S1-GigabitEthernet0/0/1]port trunk allow-pass vlan 100
#与下行接入交换机相连的接口
[S1-GigabitEthernet0/0/1]int g0/0/2
[S1-GigabitEthernet0/0/2]port link-type trunk
[S1-GigabitEthernet0/0/2]port trunk allow-pass vlan 100 101
#与路由器相连接口
[S1-GigabitEthernet0/0/2]int g0/0/3
[S1-GigabitEthernet0/0/3]port link-type trunk 
[S1-GigabitEthernet0/0/3]port trunk allow-pass vlan 101
路由器配置,配置链路类型,放行vlan,设置vlan 101ip地址
#路由器接口
[AR1]int e0/0/0
[AR1-Ethernet0/0/0]port link-type trunk 	
[AR1-Ethernet0/0/0]port trunk allow-pass vlan 101
[AR1-Ethernet0/0/0]q
[AR1]int Vlanif 101
[AR1-Vlanif101]ip address 10.10.10.1 24
配置AC,配置管理VLAN为AP下发IP
[AC]vlan batch 100 101
[AC]int g0/0/1
[AC-GigabitEthernet0/0/1]port link-type trunk 
[AC-GigabitEthernet0/0/1]port trunk allow-pass vlan 100
[AC-GigabitEthernet0/0/1]q
[AC] dhcp enable
[AC]interface Vlanif 100
[AC-Vlanif100]ip address 10.10.100.1 24
[AC-Vlanif100]dhcp select interface 

命令:
dhcp enable开启DHCP功能
dhcp select interface开启接口采用接口地址池的DHCP Server功能

配置vlan 101为终端分配IP地址
[S1] dhcp enable
[S1]interface Vlanif 101
[S1-Vlanif101]ip address 10.10.10.2 24
[S1-Vlanif101]dhcp select interface
  • 这里可以应该加一条命令dhcp server gateway-list 10.10.10.1 24就是让路由器做他的网关,但是不知道为什么在实验里这个命令就配置不上去,就只能10.10.10.2做网关了
配置AP上线
#创建ap组 组名为lnj_group_1
[AC]wlan 
[AC-wlan-view]ap-group name lnj_group_1
[AC-wlan-ap-group-lnj_group_1]q
#创建域的管理模板,在域管理的模板下配置AC的国家码
[AC-wlan-view]regulatory-domain-profile name default
[AC-wlan-regulate-domain-default]country-code cn
[AC-wlan-regulate-domain-default]q
#在AP组下引用域管理模板。
[AC-wlan-view]ap-group name lnj_group_1
[AC-wlan-ap-group-lnj_group_1]regulatory-domain-profile default
onfigurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-lnj_group_1]q
[AC-wlan-view]q
#配置AC的源接口为vlan 100
[AC] capwap source interface vlanif 100
在AC上可以离线导入AP(00e0-fc13-10b0),并将AP加入AP组“lnj_group_1”
[AC]wlan 
[AC-wlan-view]ap auth-mode mac-auth 
#我的AP的MAC:00e0-fc13-10b0
[AC-wlan-view]ap-id 0 ap-mac 00e0-fc13-10b0
[AC-wlan-ap-0]ap-name area_1
[AC-wlan-ap-0]ap-group lnj_group_1
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-wlan-ap-0]q

上面这一步完成,给AP通电,查看配置结果,State的值为nor表示AP正常
[AC-wlan-view]display ap all
配置WLAN参数
#创建名为lnj的安全模板,配置WPA-WPA2+PSK+AES的安全策略
[AC-wlan-view]security-profile name lnj	
[AC-wlan-sec-prof-lnj]security wpa-wpa2 psk pass-phrase ax123456 aes
[AC-wlan-sec-prof-lnj]q
#配置wifi名称为lnj
[AC-wlan-view]ssid-profile name lnj
[AC-wlan-ssid-prof-lnj]ssid lnj
[AC-wlan-ssid-prof-lnj]q
创建名为“lnj”的VAP模板,配置业务数据转发模式为tunnel(隧道转发)
[AC-wlan-view]vap-profile name lnj
[AC-wlan-vap-prof-lnj]forward-mode tunnel
#业务vlan为101
[AC-wlan-vap-prof-lnj]service-vlan vlan-id 101
#引用安全模板和ssid模板
[AC-wlan-vap-prof-lnj]security-profile lnj
[AC-wlan-vap-prof-lnj]ssid-profile lnj
[AC-wlan-vap-prof-lnj]q
配置AP组引用VAP模板,指定射频为 0和1都使用lnj模板
[AC-wlan-view]ap-group name lnj_group_1	
[AC-wlan-ap-group-lnj_group_1]vap-profile lnj wlan 1 radio 0
[AC-wlan-ap-group-lnj_group_1]vap-profile lnj wlan 1 radio 1
[AC-wlan-ap-group-lnj_group_1]q
配置让射频的信道和功率自动调优功能
[AC-wlan-view]regulatory-domain-profile name default
[AC-wlan-regulate-domain-default]dca-channel 2.4g channel-set 1,6,11
[AC-wlan-regulate-domain-default]dca-channel 5g bandwidth 20mhz 
[AC-wlan-regulate-domain-default]dca-channel 5g channel-set 149,153,157,161
创建扫描模板“wlan-air”,指定空口扫描信道集合为调优信道集合,指定空口扫描持续时间为60毫秒,指定空口扫描间隔时间为60000毫秒,间隔应该设置高一点,低了会占用较多资源,影响业务
[AC-wlan-view]air-scan-profile name wlan-air
[AC-wlan-air-scan-prof-wlan-air]scan-channel-set dca-channel 
[AC-wlan-air-scan-prof-wlan-air]scan-period 60	
[AC-wlan-air-scan-prof-wlan-air]scan-interval 60000
创建2G射频模板lnj_radio2g,并引用刚刚配置的空口扫描模板wlan-air,5G射频模板lnj_radio5g,引用模板wlan-air
[AC-wlan-view]radio-2g-profile name lnj_radio2g
[AC-wlan-radio-2g-prof-lnj_radio2g]air-scan-profile wlan-air
[AC-wlan-view]radio-5g-profile name lnj_radio5g
[AC-wlan-radio-5g-prof-lnj_radio5g]air-scan-profile wlan-air

在名为AP组下引用5G射频模板lnj_radio5g 和2G射频模板lnj-radio2g
[AC-wlan-view]ap-group name lnj_group_1	
[AC-wlan-ap-group-lnj_group_1]radio-5g-profile lnj_radio5g radio 1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ap-group-lnj_group_1]radio-2g-profile lnj_radio2g radio 0
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ap-group-lnj_group_1]q
配置射频调优模式为手动调优,并手动触发射频调优
[AC-wlan-view]calibrate enable manual 
[AC-wlan-view]calibrate manual startup 
调优结束后。开始定时调优,并将调优时间定为用户业务空闲时段(如当地时间凌晨00:00-06:00时段)。
[AC-wlan-view]calibrate enable schedule time 02:30:00

没有提前做好规划表,配起来挺麻烦的

你可能感兴趣的:(HCIP之路,华为,网络)