网络运维与网络安全 学习笔记2023.11.30
网络运维与网络安全 学习笔记 第三十一天
今日目标
实现AP自动注册、配置WLAN业务参数、无线终端通过wifi互访
实现AP自动注册
项目背景
企业内网的大量AP已经通过DHCP的方式获得IP地址
为了实现后期大量AP的统一管理，希望通过AC实现集中控制
在AC设备上，为了便于设备管理，按照统一的命名格式
项目分析
需要确保AP知道AC服务器的IP地址
需要确保AP可以与AC保持IP层面的连通性
需要确保在AC上提前添加了AP的相关信息，实现顺利注册
解决方案
需要确保AP知道AC服务器的IP地址
因为AP的地址信息全部来自于DHCP服务器，所以我们需要调整DHCP服务器的配置内容，在AP所在的VLAN的地址池中，指定AC服务器的IP地址
需要确保AP可以与AC保持IP层面的连通性
需要确保在AC上提前添加了AP的相关信息，实现顺利注册
配置思路
①修改DHCP服务器的地址池，添加AC服务器的IP地址
②配置AC接口地址和路由，实现AC与AP的网关设备之间的互通
③配置AC服务器，进行AP的自动注册
创建VLAN pool，用于无线终端用户使用的vlan
创建AP组，将需要使用相同配置的AP加入到同一个AP组，实现统一配置
配置AC的系统参数，包括国家代码、AC服务器与AP通信时使用的接口地址
配置AP的上线方式并离线导入AP，实现AP正常上线
配置命令
确保AP知道AC服务器的IP地址
[DHCP]ip pool VLAN100
[DHCP-ip-pool-VLAN100]option 43 sub-option 3 ascii 192.168.200.1
[DHCP-ip-pool-VLAN100]quit
确保AP与AC之间的互通
[SW2]vlan 200
[SW2-vlan200]quit
[SW2]interface GigabitEthernet0/0/10
[SW2-GigabitEthernet0/0/10]port link-type access
[SW2-GigabitEthernet0/0/10]port default vlan 200
[SW2-GigabitEthernet0/0/10]quit
[SW2]interface Vlanif 200
[SW2-Vlanif200]ip address 192.168.200.254 24
[SW2-Vlanif200]quit
确保AP与AC之间的互通
[AC6605]vlan 200
[AC6605-vlan200]quit
[AC6605]interface GigabitEthernet0/0/10
[AC6605-GigabitEthernet0/0/10]port link-type access
[AC6605-GigabitEthernet0/0/10]port default vlan 200
[AC6605-GigabitEthernet0/0/10]quit
[AC6605]interface Vlanif 200
[AC6605-Vlanif200]ip address 192.168.200.1 24
[AC6605-Vlanif200]quit
[AC6605]ip route-static 0.0.0.0 0 192.168.200.254
配置AC，创建VLAN pool ，为无线终端用户提供服务
[AC6605]vlan pool pool1
[AC6605-vlan-pool-pool1]vlan 101 102
[AC6605-vlan-pool-pool1]quit
[AC6605]vlan pool pool2
[AC6605-vlan-pool-pool2]vlan 103 104
[AC6605-vlan-pool-pool2]quit
[AC6605]
配置AC，创建AP组，以及国家代码和AC与AP的通信接口地址
[AC6605]wlan
[AC6605-wlan-view]ap-group name neibu
[AC6605-wlan-ap-group-neibu]quit
[AC6605-wlan-view]ap-group name wailai
[AC6605-wlan-ap-goup-wailai]quit
[AC6605-wlan-view]regulatory-domain-profile name domain1
[AC6605-wlan-regulate-domain-domian1]country-code cn
[AC6605-wlan-regulate-domain-domian1]quit
[AC6605-wlan-view]ap-group name neibu
[AC6605-wlan-ap-group-neibu]regulatory-domain-profile domain1
Warning:Modifying the country code will clear channel,power and antenna gain configurations of the radio and reset the AP.
Continue?[Y/N]:y
[AC6605-wlan-ap-group-group1]quit
[AC6605-wlan-view]ap-group name wailai
[AC6605-wlan-ap-group-wailai]regulatory-domian-profile domain1
Warning:Modifying the country code will clear channel,power and antenna gain configurations of the radio and reset the AP.
Continue?[Y/N]:y
[AC6605-wlan-ap-group-group2]quit
[AC6605]capwap source interface Vlanif 200
配置AC，离线导入AP
[AC6605]wlan
[AC6605-wlan-view]ap-id 1 ap-mac 00E0-FC9D-1580
[AC6605-wlan-ap-1]ap-name neibu-1
[AC6605-wlan-ap-1]ap-group neibu
Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y
[AC6605-wlan-ap-1]quit
[AC6605-wlan-view]ap-id 2 ap-mac 00e0-fc60-4c70
[AC6605-wlan-ap-2]ap-name neibu-2
[AC6605-wlan-ap-2]ap-group neibu
Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y
[AC6605-wlan-ap-2]quit
[AC6605-wlan-view]ap-id 3 ap-mac 00e0-fc56-6320
[AC6605-wlan-ap-3]ap-name wailai-1
[AC6605-wlan-ap-3]ap-group wailai
Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y
[AC6605-wlan-ap-3]quit
[AC6605-wlan-view]ap-id 4 ap-mac 00e0-fc4e-2fd0
[AC6605-wlan-ap-4]ap-name wailai-2
[AC6605-wlan-ap-4]ap-group wailai
Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y
[AC6605-wlan-ap-4]quit
在AC上查看AP的注册状态
[AC6605]display ap all
Info:This operation may take a few seconds.Please wait for a moment.done.
Total AP information:
idle : idle [0]
nor : normal [4]
ID MAC Name Group IP Type State STA Uptime
1 00e0-fc9d-1580 neibu group1 192.168.100.253 AP5030DN nor 0 9M:54S
2 00e0-fc60-4c70 neibu group1 192.168.100.251 AP5030DN nor 0 3M:45S
3 00e0-fc56-6320 wailai group2 192.168.100.250 AP5030DN nor 0 9M:44S
4 00e0-fc4e-2fd0 wailai group2 192.168.100.252 AP5030DN nor 0 9m:44S
项目总结
AP在进行自助注册时，必须通过DHCP获得AC服务器的IP地址
必须确保AP所在的VLAN与AC服务器之间的互通
必须在AC服务器上指定与AP通信时所使用的IP地址，与DHCP服务区中的AC服务器的IP地址相同
在AC上离线导入AP的时候，必须手动确认每个AP的MAC地址，确保输入正确，否则不能注册成功
配置WLAN业务参数
项目背景
企业内网的无线网络改造已经完成大部分工作，AP成功注册到AC
基于分配好的IP方案，为不同的无线终端，动态分配IP地址
配置AC，为不同的AP下发不同的位置，确保可以发射无线信号
实现不同的“无线终端”可以成功连接AP，并成功获得IP地址
实现不同的“无线终端”之间的互通
项目分析
首先需要确保AP能够发射出无线信号，确保无线终端能够搜索到
其次确保每个无线关联了特定的VLAN信息
再次确保无线终端输入正确的wifi密码，正确连接到wifi
然后再DHCP服务器上，为每个无线终端 的VLAN创建了DHCP地址池
最后测试多个无线终端之间的连通性
解决方案
确定AP已经成功注册到AC，通过配置AC，为AP开启无线功能
确定AP发射的无线信号已经与“无线终端”的VLAN相关联
为每个终端用户所属于的VLAN配置DHCP服务
无线终端设备之间彼此测试连通性
配置思路
①在AC上为AP配置WLAN业务参数
②为每个终端用户的VLAN配置DHCP服务
在DHCP服务器上配置每个VLAN的地址池
为每个VLAN配置DHCP中继
配置路由条目，确保DHCP服务器与每个VLAN的DHCP中继互通
③测试无线终端设备之间的连通性
配置命令
①在AC上为AP配置WLAN业务参数
[AC6605]wlan
[AC6605-wlan-view]security-profile name neibu
[AC6605-wlan-sec-prof-neibu]security wpa2 psk pass-phrase a1234567890 aes
[AC6605-wlan-sec-prof-neibu]quit
[AC6605-wlan-view]security-profile name wailai
[AC6605-wlan-sec-prof-wailai]security wpa2 psk pass-phrase b1234567890 aes
[AC6605-wlan-sec-prof-wailai]quit
[AC6605-wlan-view]ssid-profile name wailai
[AC6605-wlan-ssid-prof-wailai]ssid wailai
[AC6605-wlan-ssid-prof-wailai]quit
[AC6605-wlan-view]ssid-profile name neibu
[AC6605-wlan-ssid-prof-neibu]ssid name neibu
[AC6605-wlan-ssid-prof-neibu]quit
②在AC上为AP配置WLAN业务参数
[AC6605-wlan-view]vap-profile name neibu
[AC6605-wlan-vap-prof-neibu]security-profile neibu
[AC6605-wlan-vap-prof-neibu]ssid-profile neibu
[AC6605-wlan-vap-prof-neibu]service-vlan vlan-pool pool1
[AC6605-wlan-vap-prof-neibu]quit
[AC6605-wlan-view]vap-profile name wailai
[AC6605-wlan-vap-prof-wailai]security-profile wailai
[AC6605-wlan-vap-prof-wailai]ssid-profile wailai
[AC6605-wlan-vap-prof-wailai]service-vlan vlan-pool pool2
[AC6605-wlan-vap-prof-wailai]quit
[AC6605-wlan-view]ap-group name neibu
[AC6605-wlan-ap-group-neibu]vap-profile neibu wlan 1 radio 0
[AC6605-wlan-ap-group-neibu]vap-profile neibu wlan 1 radio 1
[AC6605-wlan-ap-group-neibu]quit
[AC6605-wlan-view]ap-group name wailai
[AC6605-wlan-ap-group-wailai]vap-profile wailaiwlan 1 radio 0
[AC6605-wlan-ap-group-wailai]vap-profile wailaiwlan 1 radio 1
[AC6605-wlan-ap-group-wailai]quit
③为终端用户配置DHCP地址池
[DHCP]ip pool VLAN101
[DHCP-ip-pool-VLAN101]network 192.168.101.0 mask 24
[DHCP-ip-pool-VLAN101]gateway-list 192.168.101.254
[DHCP-ip-pool-VLAN101]quit
[DHCP]ip pool VLAN102
[DHCP-ip-pool-VLAN102]network 192.168.102.0 mask 24
[DHCP-ip-pool-VLAN102]gateway-list 192.168.102.254
[DHCP-ip-pool-VLAN102]quit
[DHCP]ip pool VLAN103
[DHCP-ip-pool-VLAN103]network 192.168.103.0 mask 24
[DHCP-ip-pool-VLAN103]gateway-list 192.168.103.254
[DHCP-ip-pool-VLAN103]quit
[DHCP]ip pool VLAN104
[DHCP-ip-pool-VLAN104]network 192.168.104.0 mask 24
[DHCP-ip-pool-VLAN104]gateway-list 192.168.104.254
[DHCP-ip-pool-VLAN104]quit
[DHCP]ip route-static 0.0.0.0 0 192.168.210.254
④为终端用户配置DHCP中继
[SW1]vlan batch 101 102 103 104
[SW2]vlan batch 101 102 103 104
[SW2]dhcp enable
[SW2]interface Vlanif101
[SW2-Vlanif101]ip address 192.168.101.254 24
[SW2-Vlanif101]dhcp select relay
[SW2-Vlanif101]dhcp relay server-ip 192.168.210.1
[SW2-Vlanif101]quit
[SW2]interface Vlanif102
[SW2-Vlanif102]ip address 192.168.102.254 24
[SW2-Vlanif102]dhcp select relay
[SW2-Vlanif102]dhcp relay server-ip 192.168.210.1
[SW2-Vlanif102]quit
[SW2]interface Vlanif103
[SW2-Vlanif103]ip address 192.168.103.254 24
[SW2-Vlanif103]dhcp select relay
[SW2-Vlanif103]dhcp relay server-ip 192.168.210.1
[SW2-Vlanif103]quit
[SW2]interface Vlanif104
[SW2-Vlanif104]ip address 192.168.104.254 24
[SW2-Vlanif104]dhcp select relay
[SW2-Vlanif104]dhcp relay server-ip 192.168.210.1
[SW2-Vlanif104]quit
⑤无线终端连接到wifi信号，输入密码，获取IP地址
⑥在无线终端的命令行验证IP地址是否正确：ipconfig
⑦在无线终端的命令行验证设备之间的互通性：ping x.x.x.x
项目总结
为了实现AP的批量管理，需要将AP加入到ap-group
为了配置AP，需要为ap-group关联vap-profile
Vap-profile表示的是AP设备在AC上的配置文件
Vap-profile中包含了AP的无线名字、密码以及属于的VLAN
为确保无线终端可以顺利获得IP地址，需要提前配置DHCP服务器和DHCP中继，并确保两者之间的连通性