中大型企业有线无线用户统一接入(实施笔记)

组网图形

有线无线用户统一接入简介

在实际的使用场景中，有线网络和无线网络环境通常是共同存在的。例如在办公区内PC电脑、打印机等设备通常通过有线方式接入网络，而笔记本、手机终端等移动设备通常是通过无线方式接入网络。通过部署有线无线用户统一接入的网络环境，可以同时为有线用户和无线用户提供网络接入的服务，实现对有线用户和无线用户的统一管理。

配置注意事项

本举例使用Portal认证，为保证实际网络的安全性，请根据实际的需求配置合适的安全策略。
隧道转发模式下，管理VLAN和业务VLAN不能配置为同一VLAN。直接转发模式下，管理VLAN和业务VLAN建议也不要配置为同一VLAN。
数据转发方式为直接转发时，建议在直接连接AP的设备接口上配置端口隔离，如果不配置端口隔离，可能会在VLAN内存在不必要的广播报文，或者导致不同AP间的WLAN用户二层互通的问题。

　　配置管理VLAN和业务VLAN：

隧道转发模式下，业务报文会封装在CAPWAP数据隧道中进行传输，发送给AC，然后由AC再转发到上层网络或AP，所以只要配置AC与AP间的网络加入管理VLAN，AC与上层网络间的网络加入业务VLAN，就能正常传输业务报文和管理报文。
直接转发模式下，业务报文不会进行CAPWAP封装，而是直接转发给上层网络或AP，所以需要配置AC与AP间的网络加入管理VLAN，AP与上层网络间的网络加入业务VLAN，才能正常传输业务报文和管理报文。

组网需求

企业由于业务要求，需要在其企业大楼内同时部署有线和无线网络。为方便管理维护，管理员希望能够在AC上集中管理有线用户和无线用户，有线用户采取免认证方式，无线用户采用Portal认证方式，并且无线用户能够在AC内漫游。
如图所示，AC上行连接出口网关Router；下行通过接入交换机S5700-1和S5700-2连接和管理AP，其中，S5700-1部署在一楼，S5700-2部署在二楼。在每个房间内部署AP2010DN为房间内用户同时提供有线接入和无线接入，在楼道中部署AP5030DN提供无线网络覆盖。S5700-1和S5700-2均为PoE交换机，为连接的AP供电；为使整体网络规划简洁，便于管理，接入交换机只做二层透传，所有网关配置在AC上；AC作为DHCP服务器为AP、STA和PC分配IP地址。

配置思路

1.配置各网络设备，使AP、接入交换机S5700-1、S5700-2、AC和上层网络设备之间实现网络互通。
2.配置AC作为DHCP服务器，为AP、有线用户和无线用户分配IP地址。
3.配置RADIUS服务器认证、计费和授权模板和Portal认证。
4.配置WLAN基本业务，包括AC系统参数、AC上管理AP和WLAN业务参数。
5.配置VAP并下发配置。
6.验证配置结果，有线用户和无线用户都能够接入Internet。

操作步骤

1.配置各网络设备互通

　　# 配置交换机S5700-1和S5700-2的接口GE0/0/1～GE0/0/4都加入VLAN100（管理VLAN），S5700-1的接口GE0/0/1～GE0/0/4加入VLAN201（有线业务报文所属VLAN），S5700-2的接口GE0/0/1～GE0/0/4加入VLAN202（有线业务报文所属VLAN），其中直连AP的接口需要配置PVID，并建议直连AP的接口配置端口隔离以减少广播报文。以配置S5700-1为例，S5700-2的配置与S5700-1类似，不再赘述。

[HUAWEI] sysname S5700-1
[S5700-1] vlan batch 100 201
[S5700-1] interface gigabitethernet 0/0/1
[S5700-1-GigabitEthernet0/0/1] port link-type trunk
[S5700-1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 201
[S5700-1-GigabitEthernet0/0/1] quit
[S5700-1] interface gigabitethernet 0/0/2
[S5700-1-GigabitEthernet0/0/2] port link-type trunk
[S5700-1-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 201
[S5700-1-GigabitEthernet0/0/2] port trunk pvid vlan 100   //直连AP的接口需要配置PVID
[S5700-1-GigabitEthernet0/0/2] port-isolate enable   //配置端口隔离以减少广播报文
[S5700-1-GigabitEthernet0/0/2] quit
[S5700-1] interface gigabitethernet 0/0/3
[S5700-1-GigabitEthernet0/0/3] port link-type trunk
[S5700-1-GigabitEthernet0/0/3] port trunk allow-pass vlan 100 201
[S5700-1-GigabitEthernet0/0/3] port trunk pvid vlan 100
[S5700-1-GigabitEthernet0/0/3] port-isolate enable
[S5700-1-GigabitEthernet0/0/3] quit
[S5700-1] interface gigabitethernet 0/0/4
[S5700-1-GigabitEthernet0/0/4] port link-type trunk
[S5700-1-GigabitEthernet0/0/4] port trunk allow-pass vlan 100 201
[S5700-1-GigabitEthernet0/0/4] port trunk pvid vlan 100
[S5700-1-GigabitEthernet0/0/4] port-isolate enable
[S5700-1-GigabitEthernet0/0/4] quit

　　# 配置AC连接接入交换机S5700-1的接口GE1/0/1加入VLAN100和VLAN201，连接接入交换机S5700-2的接口GE1/0/2加入VLAN100和VLAN202，连接上层网络的接口GE1/0/4加入VLAN300，连接Agile Controller的接口GE1/0/3加入VLAN200。

[HUAWEI] sysname AC
[AC] vlan batch 100 200 201 202 300
[AC] interface gigabitethernet 1/0/1
[AC-GigabitEthernet1/0/1] port link-type trunk
[AC-GigabitEthernet1/0/1] port trunk allow-pass vlan 100 201
[AC-GigabitEthernet1/0/1] quit
[AC] interface gigabitethernet 1/0/2
[AC-GigabitEthernet1/0/2] port link-type trunk
[AC-GigabitEthernet1/0/2] port trunk allow-pass vlan 100 202
[AC-GigabitEthernet1/0/2] quit
[AC] interface gigabitethernet 1/0/3
[AC-GigabitEthernet1/0/3] port link-type trunk
[AC-GigabitEthernet1/0/3] port trunk allow-pass vlan 200
[AC-GigabitEthernet1/0/3] quit
[AC] interface gigabitethernet 1/0/4
[AC-GigabitEthernet1/0/4] port link-type trunk
[AC-GigabitEthernet1/0/4] port trunk allow-pass vlan 300
[AC-GigabitEthernet1/0/4] quit

　　# 配置VLANIF200，用于AC和Agile Controller通信。

[AC] interface vlanif200
[AC-Vlanif200] ip address 10.23.200.2 24  //配置IP地址用于AC和Agile Controller通信
[AC-Vlanif200] quit

2.配置AC为DHCP Server，分别为PC、AP、STA分配IP地址

　　# 配置AC通过接口地址池为PC、AP、STA分配IP地址。

[AC] dhcp enable
[AC] vlan batch 101 102
[AC] interface vlanif 100  //配置接口地址池为AP分配IP地址
[AC-Vlanif100] description manage_ap
[AC-Vlanif100] ip address 10.23.100.1 24
[AC-Vlanif100] dhcp select interface
[AC-Vlanif100] quit
[AC] interface vlanif 101  //配置接口地址池为一楼无线用户STA分配IP地址
[AC-Vlanif101] description manage_floor1_sta
[AC-Vlanif101] ip address 10.23.101.1 24
[AC-Vlanif101] dhcp select interface
[AC-Vlanif101] quit
[AC] interface vlanif 102  //配置接口地址池为二楼无线用户STA分配IP地址
[AC-Vlanif102] description manage_floor2_sta
[AC-Vlanif102] ip address 10.23.102.1 24
[AC-Vlanif102] dhcp select interface
[AC-Vlanif102] quit
[AC] interface vlanif 201  //配置接口地址池为一楼有线用户PC分配IP地址
[AC-Vlanif201] description manage_floor1_pc
[AC-Vlanif201] ip address 10.23.201.1 24
[AC-Vlanif201] dhcp select interface
[AC-Vlanif201] quit
[AC] interface vlanif 202  //配置接口地址池为二楼有线用户PC分配IP地址
[AC-Vlanif202] description manage_floor2_pc
[AC-Vlanif202] ip address 10.23.202.1 24
[AC-Vlanif202] dhcp select interface
[AC-Vlanif202] quit

3.配置RADIUS服务器认证、计费和授权模板和Portal认证

　　# 配置AC的RADIUS服务器认证、计费和授权模板。

[AC] radius-server template radius1  //创建名为radius1的RADIUS服务器模板
[AC-radius-radius1] radius-server authentication 10.23.200.1 1812 source ip-address 10.23.200.2 weight 80   //配置RADIUS认证服务器，认证端口1812，AC使用10.23.200.2和RADIUS服务器通信
[AC-radius-radius1] radius-server accounting 10.23.200.1 1813 source ip-address 10.23.200.2 weight 80   //配置RADIUS计费服务器，以便获取终端用户的上下线信息，计费端口1813，AC使用10.23.200.2和RADIUS服务器通信
[AC-radius-radius1] radius-server shared-key cipher Admin@123   //配置RADIUS服务器预共享密钥
[AC-radius-radius1] undo radius-server user-name domain-included   //设备向RADIUS服务器发送的用户名不包含域名，当RADIUS服务器不接受带域名的用户时需要配置
[AC-radius-radius1] quit
[AC] radius-server authorization 10.23.200.1 shared-key cipher Admin@123   //配置RADIUS授权服务器的地址，共享密钥为Admin@123，必须与认证密钥和计费密钥一致。配置授权服务器以便RADIUS服务器向AC下发授权规则
[AC] aaa
[AC-aaa] authentication-scheme radius1  //创建名为radius1的认证方案
[AC-aaa-authen-radius1] authentication-mode radius   //Agile Controller作为RADIUS服务器，认证方案必须配置为RADIUS
[AC-aaa-authen-radius1] quit
[AC-aaa] accounting-scheme radius1  //创建名为radius1的计费方案
[AC-aaa-accounting-radius1] accounting-mode radius   //配置计费方案为RADIUS方式。为了方便RADIUS服务器维护账号的状态信息，例如上下线信息，强制帐号下线，计费模式必须配置为radius
[AC-aaa-accounting-radius1] quit
[AC-aaa] domain portal1   //创建名为portal1的域
[AC-aaa-domain-portal1] authentication-scheme radius1  //绑定认证方案radius1
[AC-aaa-domain-portal1] accounting-scheme radius1  //绑定计费方案radius1
[AC-aaa-domain-portal1] radius-server radius1  //绑定RADIUS服务器模板radius1
[AC-aaa-domain-portal1] quit
[AC-aaa] quit

　　# 配置Portal服务器。

[AC] web-auth-server portal1  //创建名为portal1的Portal服务器模板
[AC-web-auth-server-portal1] server-ip 10.23.200.1  //配置Portal服务器的IP地址
[AC-web-auth-server-portal1] port 50200  //配置设备向Portal服务器主动发送报文时使用的目的端口号为50200，缺省为50200
[AC-web-auth-server-portal1] shared-key cipher Admin@123  //配置AC与Portal服务器信息交互的共享密钥
[AC-web-auth-server-portal1] url http://10.23.200.1:8080/portal  //配置指向Portal服务器的URL
[AC-web-auth-server-portal1] quit

　　# 在WLAN-ESS接口下绑定Portal服务器模板，使能Portal认证的功能，对无线用户进行Portal认证，有线用户进行免认证。

[AC] interface wlan-ess 1
[AC-Wlan-Ess1] domain name portal1 force  //配置用户强制域为portal1
[AC-Wlan-Ess1] domain name portal1  //配置用户默认域为portal1
[AC-Wlan-Ess1] authentication portal  //配置认证功能为Portal认证
[AC-Wlan-Ess1] web-auth-server portal1 direct  //绑定名为portal1的Portal服务器模板并指定Portal认证方式为二层认证方式
[AC-Wlan-Ess1] quit
[AC] interface wlan-ess 2
[AC-Wlan-Ess2] domain name portal1 force  //配置用户强制域为portal1
[AC-Wlan-Ess2] domain name portal1  //配置用户默认域为portal1
[AC-Wlan-Ess2] authentication portal  //配置认证功能为Portal认证
[AC-Wlan-Ess2] web-auth-server portal1 direct  //绑定名为portal1的Portal服务器模板并指定Portal认证方式为二层认证方式
[AC-Wlan-Ess2] quit

4.配置AP上线

　　# 创建AP组，用于将相同配置的AP都加入同一AP组中。

[AC] wlan
[AC-wlan-view] ap-group name ap-group1
[AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] ap-group name ap-group2
[AC-wlan-ap-group-ap-group2] quit

　　# 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。

[AC-wlan-view] regulatory-domain-profile name domain1
[AC-wlan-regulate-domain-domain1] country-code cn  //配置AC的国家码，使AC管理的AP的射频特性符合不同国家或区域的法律法规要求，国家码缺省值为CN
[AC-wlan-regulate-domain-domain1] quit
[AC-wlan-view] ap-group name ap-group1
[AC-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
e?[Y/N]:y 
[AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] ap-group name ap-group2
[AC-wlan-ap-group-ap-group2] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
e?[Y/N]:y 
[AC-wlan-ap-group-ap-group2] quit
[AC-wlan-view] quit

　　# 配置AC的源接口。

[AC] capwap source interface vlanif 100

　　# 在AC上离线导入AP。

[AC] wlan
[AC-wlan-view] ap auth-mode mac-auth
[AC-wlan-view] ap-id 101 ap-mac 60de-4476-e320
[AC-wlan-ap-101] ap-name ap-101
[AC-wlan-ap-101] ap-group ap-group1  //部署在一楼的AP都加入到AP组ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-101] quit
[AC-wlan-view] ap-id 102 ap-mac 60de-4476-e340
[AC-wlan-ap-102] ap-name ap-102
[AC-wlan-ap-102] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-102] quit
[AC-wlan-view] ap-id 103 ap-mac dcd2-fc04-b520
[AC-wlan-ap-103] ap-name ap-103
[AC-wlan-ap-103] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-103] quit
[AC-wlan-view] ap-id 201 ap-mac 60de-4476-e360
[AC-wlan-ap-201] ap-name ap-201
[AC-wlan-ap-201] ap-group ap-group2  //部署在二楼的AP都加入到AP组ap-group2
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-201] quit
[AC-wlan-view] ap-id 202 ap-mac 60de-4476-e380
[AC-wlan-ap-202] ap-name ap-202
[AC-wlan-ap-202] ap-group ap-group2
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-202] quit
[AC-wlan-view] ap-id 203 ap-mac dcd2-fc04-b540
[AC-wlan-ap-203] ap-name ap-203
[AC-wlan-ap-203] ap-group ap-group2
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
s of the radio, Whether to continue? [Y/N]:y 
[AC-wlan-ap-203] quit

　　# 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。

[AC-wlan-view] display ap all
Total AP information:
nor  : normal          [6]
-------------------------------------------------------------------------------------------------
ID   MAC            Name   Group     IP            Type            State STA Uptime
-------------------------------------------------------------------------------------------------
101  60de-4476-e320 ap-101 ap-group1 10.23.101.254 AP6010DN-AGN    nor   0   10S
102  60de-4476-e340 ap-102 ap-group1 10.23.101.253 AP6010DN-AGN    nor   0   15S
103  dcd2-fc04-b520 ap-103 ap-group1 10.23.101.252 AP6010DN-AGN    nor   0   23S
201  60de-4476-e360 ap-201 ap-group2 10.23.102.254 AP6010DN-AGN    nor   0   45S
202  60de-4476-e380 ap-202 ap-group2 10.23.102.253 AP6010DN-AGN    nor   0   49S
203  dcd2-fc04-b540 ap-203 ap-group2 10.23.102.252 AP6010DN-AGN    nor   0   55S
-------------------------------------------------------------------------------------------------
Total: 6

　　# 配置AP2010DN的上行有线口GE0/0/0和下行接口Eth0/0/0、Eth0/0/1允许有线业务报文通过。

[AC-wlan-view] wired-port-profile name wired1
[AC-wlan-wired-port-wired1] vlan pvid 201  //AP2010DN下行接口用于连接PC等有线用户终端，需要配置PVID，VLAN201用于传输一楼的有线业务报文
[AC-wlan-wired-port-wired1] vlan untagged 201  //AP2010DN下行接口用于连接PC等有线用户终端，需要配置untagged
[AC-wlan-wired-port-wired1] quit
[AC-wlan-view] wired-port-profile name wired2
[AC-wlan-wired-port-wired2] vlan tagged 201  //AP2010DN上行接口用于连接上行网络设备，需要配置tagged
[AC-wlan-wired-port-wired2] quit
[AC-wlan-view] wired-port-profile name wired3
[AC-wlan-wired-port-wired3] vlan pvid 202  //AP2010DN下行接口用于连接PC等有线用户终端，需要配置PVID，VLAN202用于传输二楼的有线业务报文
[AC-wlan-wired-port-wired3] vlan untagged 202
[AC-wlan-wired-port-wired3] quit
[AC-wlan-view] wired-port-profile name wired4
[AC-wlan-wired-port-wired4] vlan tagged 202
[AC-wlan-wired-port-wired4] quit
[AC-wlan-view] ap-id 101
[AC-wlan-ap-101] wired-port-profile wired1 ethernet 0
[AC-wlan-ap-101] wired-port-profile wired1 ethernet 1
[AC-wlan-ap-101] wired-port-profile wired2 gigabitethernet 0
[AC-wlan-ap-101] quit
[AC-wlan-view] ap-id 102
[AC-wlan-ap-102] wired-port-profile wired1 ethernet 0
[AC-wlan-ap-102] wired-port-profile wired1 ethernet 1
[AC-wlan-ap-102] wired-port-profile wired2 gigabitethernet 0
[AC-wlan-ap-102] quit
[AC-wlan-view] ap-id 201
[AC-wlan-ap-201] wired-port-profile wired3 ethernet 0
[AC-wlan-ap-201] wired-port-profile wired3 ethernet 1
[AC-wlan-ap-201] wired-port-profile wired4 gigabitethernet 0
[AC-wlan-ap-201] quit
[AC-wlan-view] ap-id 202
[AC-wlan-ap-202] wired-port-profile wired3 ethernet 0
[AC-wlan-ap-202] wired-port-profile wired3 ethernet 1
[AC-wlan-ap-202] wired-port-profile wired4 gigabitethernet 0
[AC-wlan-ap-202] quit

5.配置WLAN业务参数

　　# 创建名为“rrm1”的RRM模板。

[AC-wlan-view] rrm-profile name rrm1
[AC-wlan-rrm-prof-rrm1] calibrate auto-channel-select disable  //配置射频的信道选择模式为固定模式
[AC-wlan-rrm-prof-rrm1] calibrate auto-txpower-select disable  //配置射频的功率模式为固定模式
[AC-wlan-rrm-prof-rrm1] quit

　　# 创建名为“radio-2g”和“radio-5g”的射频模板，绑定RRM模板“rrm1”。

[AC-wlan-view] radio-2g-profile name radio-2g
[AC-wlan-radio-2g-prof-radio-2g] rrm-profile rrm1
[AC-wlan-radio-2g-prof-radio-2g] quit
[AC-wlan-view] radio-5g-profile name radio-5g
[AC-wlan-radio-5g-prof-radio-5g] rrm-profile rrm1
[AC-wlan-radio-5g-prof-radio-5g] quit

　　# 创建名为“wlan-security”的安全模板，并配置安全策略。

[AC-wlan-view] security-profile name wlan-security  //接口下已经使能了Portal认证，所以安全策略使用缺省的OPEN方式，不认证，不加密
[AC-wlan-sec-prof-wlan-security] quit

　　# 创建名为“wlan-ssid”的SSID模板，并配置SSID名称为“hospital-wlan”。

[AC-wlan-view] ssid-profile name wlan-ssid
[AC-wlan-ssid-prof-wlan-ssid] ssid hospital-wlan  //配置SSID名称为hospital-wlan
[AC-wlan-ssid-prof-wlan-ssid] quit

　　# 配置名为“traffic1”的流量模板，并配置无线用户二层隔离。

[AC-wlan-view] traffic-profile name traffic1
[AC-wlan-traffic-prof-traffic1] user-isolate l2
Warning: This action may cause service interruption. Continue?[Y/N]y

　　# 创建名为“wlan-vap1”和“wlan-vap2”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、SSID模板、认证模板和流量模板。

[AC-wlan-view] vap-profile name wlan-vap1
[AC-wlan-vap-prof-wlan-vap1] forward-mode tunnel  //配置业务转发模式为隧道转发
[AC-wlan-vap-prof-wlan-vap1] service-vlan vlan-id 101  //缺省情况下VLAN ID为1，修改VLAN ID为101
[AC-wlan-vap-prof-wlan-vap1] security-profile wlan-security 
[AC-wlan-vap-prof-wlan-vap1] ssid-profile wlan-ssid
[AC-wlan-vap-prof-wlan-vap1] authentication-profile portal1
[AC-wlan-vap-prof-wlan-vap1] traffic-profile traffic1
[AC-wlan-vap-prof-wlan-vap1] quit
[AC-wlan-view] vap-profile name wlan-vap2
[AC-wlan-vap-prof-wlan-vap2] forward-mode tunnel  //配置业务转发模式为隧道转发
[AC-wlan-vap-prof-wlan-vap2] service-vlan vlan-id 102  //缺省情况下VLAN ID为1，修改VLAN ID为102
[AC-wlan-vap-prof-wlan-vap2] security-profile wlan-security 
[AC-wlan-vap-prof-wlan-vap2] ssid-profile wlan-ssid 
[AC-wlan-vap-prof-wlan-vap2] authentication-profile portal1
[AC-wlan-vap-prof-wlan-vap2] traffic-profile traffic1
[AC-wlan-vap-prof-wlan-vap2] quit

　　# 配置AP组引用VAP模板和射频模板。

[AC-wlan-view] ap-group name ap-group1
[AC-wlan-ap-group-ap-group1] vap-profile wlan-vap1 wlan 1 radio 0
[AC-wlan-ap-group-ap-group1] vap-profile wlan-vap1 wlan 1 radio 1
[AC-wlan-ap-group-ap-group1] radio-2g-profile radio-2g
[AC-wlan-ap-group-ap-group1] radio-5g-profile radio-5g
[AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] ap-group name ap-group2
[AC-wlan-ap-group-ap-group2] vap-profile wlan-vap2 wlan 1 radio 0
[AC-wlan-ap-group-ap-group2] vap-profile wlan-vap2 wlan 1 radio 1
[AC-wlan-ap-group-ap-group2] radio-2g-profile radio-2g
[AC-wlan-ap-group-ap-group2] radio-5g-profile radio-5g
[AC-wlan-ap-group-ap-group2] quit

6.配置VAP并下发

　　# 配置VAP。

[AC-wlan-view] ap-id 101
[AC-wlan-ap-101] radio 0
[AC-wlan-radio-101/0] channel 20mhz 1  //根据WLAN planner网规工具规划的结果配置信道
[AC-wlan-radio-101/0] eirp 10  //根据WLAN planner网规工具规划的结果配置功率
[AC-wlan-radio-101/0] quit
[AC-wlan-ap-101] quit
[AC-wlan-view] ap-id 102
[AC-wlan-ap-102] radio 0
[AC-wlan-radio-102/0] channel 20mhz 6
[AC-wlan-radio-102/0] eirp 10
[AC-wlan-radio-102/0] quit
[AC-wlan-ap-102] quit
[AC-wlan-view] ap-id 103
[AC-wlan-ap-103] radio 0
[AC-wlan-radio-103/0] channel 20mhz 11
[AC-wlan-radio-103/0] eirp 10
[AC-wlan-radio-103/0] quit
[AC-wlan-ap-103] quit
[AC-wlan-view] ap-id 103
[AC-wlan-ap-103] radio 1  //AP5030支持两个射频，此步配置射频1
[AC-wlan-radio-103/1] channel 20mhz 153
[AC-wlan-radio-103/1] eirp 10
[AC-wlan-radio-103/1] quit
[AC-wlan-ap-103] quit
[AC-wlan-view] ap-id 201
[AC-wlan-ap-201] radio 0
[AC-wlan-radio-201/0] channel 20mhz 1 
[AC-wlan-radio-201/0] eirp 10 
[AC-wlan-radio-201/0] quit
[AC-wlan-ap-201] quit
[AC-wlan-view] ap-id 202
[AC-wlan-ap-202] radio 0
[AC-wlan-radio-202/0] channel 20mhz 6
[AC-wlan-radio-202/0] eirp 10
[AC-wlan-radio-202/0] quit
[AC-wlan-ap-202] quit
[AC-wlan-view] ap-id 203
[AC-wlan-ap-203] radio 0
[AC-wlan-radio-203/0] channel 20mhz 11
[AC-wlan-radio-203/0] eirp 10
[AC-wlan-radio-203/0] quit
[AC-wlan-ap-203] quit
[AC-wlan-view] ap-id 203
[AC-wlan-ap-203] radio 1 
[AC-wlan-radio-203/1] channel 20mhz 157
[AC-wlan-radio-203/1] eirp 10
[AC-wlan-radio-203/1] quit
[AC-wlan-ap-203] quit

　　# 下发配置。

[AC-wlan-view] commit all  //在AC上配置关于AP的WLAN业务配置后，需要下发配置到AP上才能最终生效
Warning: Committing configuration may cause service interruption, continue?[Y/N]:y

7.验证配置结果

　　# 配置完成后，通过display vap all命令，可以查看到VAP已创建成功。

[AC-wlan-view] display vap all
WID : WLAN ID
----------------------------------------------------------------------------------
AP ID AP name    RfID WID   BSSID          Status  Auth type  STA  SSID
----------------------------------------------------------------------------------
101   ap-101     0    1     60DE-4476-E320 ON      OPEN       0    hospital-wlan
102   ap-102     0    1     60DE-4476-E340 ON      OPEN       0    hospital-wlan
103   ap-103     0    1     DCD2-FC04-B520 ON      OPEN       0    hospital-wlan
103   ap-103     1    1     DCD2-FC04-B530 ON      OPEN       0    hospital-wlan
201   ap-201     0    1     60DE-4476-E360 ON      OPEN       0    hospital-wlan
202   ap-202     0    1     60DE-4476-E380 ON      OPEN       0    hospital-wlan
203   ap-203     0    1     DCD2-FC04-B540 ON      OPEN       0    hospital-wlan
203   ap-203     1    1     DCD2-FC04-B550 ON      OPEN       0    hospital-wlan
---------------------------------------------------------------------------------
Total: 8

　　# STA搜索到名为“hospital-wlan”的无线网络并正常关联后，STA能够被分配相应的IP地址，用户输入密钥可以访问无线网络，在AC上执行display station all命令，可以查看到用户已经接入到无线网络“hospital-wlan”中。

[AC-wlan-view] display station all
Rf/WLAN: Radio ID/WLAN ID
Rx/Tx: link receive rate/link transmit rate(Mbps)
----------------------------------------------------------------------------------------------------------
STA MAC          AP ID Ap name       Rf/WLAN  Band  Type  Rx/Tx    RSSI  VLAN  IP address    SSID
----------------------------------------------------------------------------------------------------------
14cf-9208-9abf   0     ap-101        0/1      2.4G  11n   3/8      -70   10    10.23.101.254 hospital-wlan
----------------------------------------------------------------------------------------------------------
Total: 1 2.4G: 1 5G: 0

　　# 无线用户STA和有线用户PC能够分配到IP地址，正常连接网络。

posted @ 2021-02-02 09:08 讲文张字阅读(1538) 评论(5) 编辑收藏举报

刷新页面返回顶部

中大型企业有线无线用户统一接入(实施笔记)

公告