配置AC外接DHCP服务器业务示例
适用的AC:AC6605、AC6005
适用的AP:所有形态的AP
组网需求
如图1所示,现有网络中AC连接上层网络,并通过汇聚交换机和接入交换机连接管理AP1和AP2,AC外接DHCP服务器分配IP地址。AC和AP之间网络属于二层组网,可对小范围内进行组网且简化网络结构,主要应用于个人用户且AC不作为DHCP服务器分配IP地址。
由于有线网络需要进行大量的网线布放,耗费大量成本和人力,且用户使用网络不具备灵活性。用户希望通过WLAN部署,减少网线布放的成本和人力,提高用户使用网络的灵活性以及网络的可维护性。
图1 组网配置图
数据规划
规划内容 | 规划数据 |
WLAN安全 | WEP Open-system认证,不加密 |
WLAN服务集 | Name:huawei-1 SSID:huawei-1 WLAN 虚接口:WLAN-ESS0 数据转发模式:直接转发 Name:huawei-2 SSID:huawei-2 WLAN 虚接口:WLAN-ESS1 数据转发模式:直接转发 |
AP管理VLAN | VLAN 100 |
AP业务VLAN | AP1:VLAN 101 AP2:VLAN 102 |
AP域 | AP1:101 AP2:102 |
AC Carrier ID/AC ID | other/1 |
AP管理IP地址池 | 192.168.10.2~192.168.10.254/24 |
AP管理网关 | 192.168.10.1/24(AC上) |
AP1用户上网公网地址池 | 172.16.1.2~172.16.1.254/24 |
AP1用户上网公网网关 | 172.16.1.1/24(DHCP服务器上) |
AP2用户上网公网地址池 | 172.17.1.2~172.17.1.254/24 |
AP2用户上网公网网关 | 172.17.1.1/24(DHCP服务器上) |
配置流程
配置网络中各网元设备间互通。
在AC上配置WLAN相关业务。
业务下发至AP,用户完成业务验证。
配置注意事项
接入交换机或AC上直接接AP的端口,需要添加管理VLAN tag。AP上为零配置。
业务IP地址池给STA分配IP地址,管理IP地址池给AP分配IP地址,两种地址池需要分开配置。
需要将所有二层交换机在AP管理VLAN和业务VLAN内的下行口上配置端口隔离,如果不配置端口隔离,可能会在VLAN内存在不必要的广播报文,或者导致不同AP间的WLAN用户二层互通的问题。端口隔离功能未开启时,建议从接入交换机到AC之间的所有网络设备的接口都配置undo port trunk allow-pass vlan 1,防止引起报文冲突,占用端口资源。
操作步骤
1、配置接入交换机
# 使接入交换机透传所有的业务VLAN,由接入交换机给AP管理报文添加VLAN 100 tag,配置AP到AC之间VLAN 100互通。直接转发模式下还需要配置AP到AC之间业务VLAN 101内互通和业务VLAN 102内互通
<Quidway> system-view [Quidway] vlan batch 101 102 100 [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port link-type trunk [Quidway-Ethernet0/0/1] port trunk pvid vlan 100 [Quidway-Ethernet0/0/1] port trunk allow-pass vlan 101 100 [Quidway-Ethernet0/0/1] port-isolate enable [Quidway-Ethernet0/0/1] quit [Quidway] interface ethernet 0/0/2 [Quidway-Ethernet0/0/2] port link-type trunk [Quidway-Ethernet0/0/2] port trunk pvid vlan 100 [Quidway-Ethernet0/0/2] port trunk allow-pass vlan 102 100 [Quidway-Ethernet0/0/2] port-isolate enable [Quidway-Ethernet0/0/2] quit [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port link-type trunk [Quidway-GigabitEthernet0/0/1] port trunk allow-pass vlan 101 102 100 [Quidway-GigabitEthernet0/0/1] quit
2、配置汇聚交换机
# 使汇聚交换机透传所有的业务VLAN和管理VLAN
<Quidway> system-view [Quidway] vlan batch 101 102 100 [Quidway] interface GigabitEthernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port link-type trunk [Quidway-GigabitEthernet0/0/1] port trunk allow-pass vlan 101 102 100 [Quidway-GigabitEthernet0/0/1] port-isolate enable [Quidway-GigabitEthernet0/0/1] quit [Quidway] interface GigabitEthernet 0/0/2 [Quidway-GigabitEthernet0/0/2] port link-type trunk [Quidway-GigabitEthernet0/0/2] port trunk allow-pass vlan 101 102 100 [Quidway-GigabitEthernet0/0/2] quit
3、配置AC
a、配置AC,使AP与AC之间能够传输管理报文和业务报文
# 配置AC,将接口GE0/0/1加入VLAN100、VLAN101、VLAN102
<AC6605> system-view[AC6605] sysname AC[AC] vlan batch 100 101 102[AC] interface gigabitethernet 0/0/1[AC-GigabitEthernet0/0/1] port link-type trunk[AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 to 102[AC-GigabitEthernet0/0/1] quit
b、配置AC和DHCP服务器连接的接口GE0/0/2,使其可以透传业务VLAN 101、VLAN 102。
[AC] interface GigabitEthernet 0/0/2 [AC-GigabitEthernet0/0/2] port link-type trunk [AC-GigabitEthernet0/0/2] port trunk allow-pass vlan 101 102 [AC-GigabitEthernet0/0/2] quit
c、配置AC作为AP的DHCP服务器
[AC] dhcp enable [AC] interface Vlanif 100 [AC-Vlanif100] ip address 192.168.10.1 24 [AC-Vlanif100] dhcp select interface [AC-Vlanif100] quit
d、配置AC的全局参数
# 配置AC的国家码、AC ID、运营商标识和AC的源接口
[AC] wlan ac-global country-code cn Warning: Modify the country code may delete configuration on those AP which use the global country code and reset them, are you sure to continue?[Y/N]:y [AC] wlan ac-global ac id 1 carrier id other [AC] wlan[AC-wlan-view] wlan ac source interface vlanif 100
e、配置AP并上线
# 配置AP的认证方式为MAC认证[AC-wlan-view] ap-auth-mode mac-auth
# 查询AP的设备类型
[AC-wlan-view] display ap-type all All AP types information:
# 根据查询到的AP设备类型ID(AP6010DN-AGN type-id为19),离线添加AP
[AC-wlan-view] ap id 1 type-id 19 mac 60de-4476-e360 [AC-wlan-ap-1] quit[AC-wlan-view] ap id 2 type-id 19 mac dcd2-fc04-b500 [AC-wlan-ap-2] quit
# 将AP加入指定域
[AC-wlan-view] ap-region id 101 [AC-wlan-ap-region-101] quit [AC-wlan-view] ap-region id 102 [AC-wlan-ap-region-102] quit [AC-wlan-view] ap id 1 [AC-wlan-ap-1] region-id 101 [AC-wlan-ap-1] quit [AC-wlan-view] ap id 2 [AC-wlan-ap-2] region-id 102 [AC-wlan-ap-2] quit
# 查看AP的上线状态
[AC-wlan-view] display ap all
f、配置WLAN-ESS虚接口
[AC] interface wlan-ess 0 [AC-Wlan-Ess0] port hybrid pvid vlan 101 [AC-Wlan-Ess0] port hybrid untagged vlan 101 [AC-Wlan-Ess0] quit [AC] interface wlan-ess 1 [AC-Wlan-Ess1] port hybrid pvid vlan 102 [AC-Wlan-Ess1] port hybrid untagged vlan 102 [AC-Wlan-Ess1] quit
g、配置WLAN业务参数
# 配置WMM模板和射频模板,参数采用默认配置,将WMM模板绑定到射频模板
[AC] wlan [AC-wlan-view] wmm-profile name huawei-ap1 [AC-wlan-wmm-prof-huawei-ap1] quit [AC-wlan-view] wmm-profile name huawei-ap2 [AC-wlan-wmm-prof-huawei-ap2] quit [AC-wlan-view] radio-profile name huawei-ap1 [AC-wlan-radio-prof-huawei-ap1] wmm-profile name huawei-ap1 [AC-wlan-radio-prof-huawei-ap1] quit [AC-wlan-view] radio-profile name huawei-ap2 [AC-wlan-radio-prof-huawei-ap2] wmm-profile name huawei-ap2 [AC-wlan-radio-prof-huawei-ap2] quit
# 配置安全模板,参数采用默认配置,即开放认证、不加密
[AC-wlan-view] security-profile name huawei-ap [AC-wlan-sec-prof-huawei-ap] quit
# 配置流量模板,参数采用默认配置
[AC-wlan-view] traffic-profile name huawei-ap [AC-wlan-traffic-prof-huawei-ap] quit
# 配置AP1和AP2的服务集,设置数据转发模式为直接转发。默认转发模式为直接转发
[AC-wlan-view] service-set name huawei-1 [AC-wlan-service-set-huawei-1] ssid huawei-1 [AC-wlan-service-set-huawei-1] wlan-ess 0 [AC-wlan-service-set-huawei-1] service-vlan 101 [AC-wlan-service-set-huawei-1] security-profile name huawei-ap [AC-wlan-service-set-huawei-1] traffic-profile name huawei-ap [AC-wlan-service-set-huawei-1] forward-mode direct-forward [AC-wlan-service-set-huawei-1] quit [AC-wlan-view] service-set name huawei-2 [AC-wlan-service-set-huawei-2] ssid huawei-2 [AC-wlan-service-set-huawei-2] wlan-ess 1 [AC-wlan-service-set-huawei-2] service-vlan 102 [AC-wlan-service-set-huawei-2] security-profile name huawei-ap [AC-wlan-service-set-huawei-2] traffic-profile name huawei-ap [AC-wlan-service-set-huawei-2] forward-mode direct-forward [AC-wlan-service-set-huawei-2] quit
h、配置AP对应的VAP并下发配置
[AC-wlan-view] ap 1 radio 0 [AC-wlan-radio-1/0] radio-profile name huawei-ap1 [AC-wlan-radio-1/0] service-set name huawei-1 [AC-wlan-radio-1/0] quit [AC-wlan-view] commit ap 1 Warning: Committing configuration may cause service interruption,continue?[Y/N] y [AC-wlan-view] ap 2 radio 0 [AC-wlan-radio-2/0] radio-profile name huawei-ap2 [AC-wlan-radio-2/0] service-set name huawei-2 [AC-wlan-radio-2/0] quit [AC-wlan-view] commit ap 2 Warning: Committing configuration may cause service interruption,continue?[Y/N] y
i、配置DHCP服务器,DHCP服务器以华为交换机为例
[DHCP] vlan batch 101 102 [DHCP] interface GigabitEthernet 3/0/1 [DHCP-GigabitEthernet3/0/1] port link-type trunk [DHCP-GigabitEthernet3/0/1] port trunk allow-pass vlan 101 102 [DHCP-GigabitEthernet3/0/1] quit [DHCP] dhcp enable[DHCP] interface Vlanif 101 [DHCP-Vlanif101] ip address 172.16.1.1 24 [DHCP-Vlanif101] dhcp select interface [DHCP-Vlanif101] quit [DHCP] interface Vlanif 102 [DHCP-Vlanif102] ip address 172.17.1.1 24 [DHCP-Vlanif102] dhcp select interface [DHCP-Vlanif102] quit
j、验证配置结果
完成配置后,用户可通过无线PC搜索到huawei-1或huawei-2的无线网络。
用户关联到无线网络上后,无线PC能够被分配相应的IP地址。