Example: Configuring IPv6 WLAN access

Introduction

The following information provides an IPv6 access configuration example.

Network configuration

As shown in Figure 1, the Layer 3 switch acts as a DHCP server to assign IPv6 addresses to the AP and Client 1 and assign an IPv6 prefix to Client 2. Configure wireless services to ensure that the WLAN uses IPv6 addresses and Client 1 and Client 2 can access the WLAN. Assume that centralized forwarding is used in this example.

Figure 1 Network diagram

 

Restrictions and guidelines

When you configure IPv6 access, follow these restrictions and guidelines:

·     Use the actual serial ID of an AP to uniquely identify that AP.

·     To prevent too many packets from entering VLAN 1, configure the switch's interface that connects the switch to the AP to deny packets from VLAN 1.

Procedures

Configuring the AC

1.     Configure the interfaces of the AC:

# Create VLAN 100 and VLAN-interface 100, and assign the interface an IPv6 address. The AC will use this IPv6 address to establish a CAPWAP tunnel with the AP.

<AC> system-view

[AC] vlan 100

[AC-vlan100] quit

[AC] interface vlan-interface 100

[AC-Vlan-interface100] ipv6 address 2001::1 64

[AC-Vlan-interface100] quit

# Create VLAN 200 and VLAN 400. The AC uses the VLANs to forward client traffic.

[AC] vlan 200

[AC-vlan200] quit

[AC] vlan 400

[AC-vlan400] quit

# Configure GigabitEthernet 1/0/1 that connects the AC to the switch as a trunk port, remove the port from VLAN 1, and assign the port to VLANs 100, 200, and 400.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[AC-GigabitEthernet1/0/1] port trunk permit vlan 100 200 400

[AC-GigabitEthernet1/0/1] quit

2.     Configure IPv6 static routes.

[AC] ipv6 route-static 3001::0 64 2001::2

[AC] ipv6 route-static 4001::0 64 2001::2

3.     Configure wireless services:

# Create service template 1 and enter its view.

[AC] wlan service-template 1

# Set the SSID to service1.

[AC-wlan-st-1] ssid service1

# Specify PSK as the AKM mode and specify 12345678 as the plaintext key.

[AC-wlan-st-1] akm mode psk

[AC-wlan-st-1] preshared-key pass-phrase simple 12345678

# Specify CCMP as the cipher suite and specify RSN as the security IE.

[AC-wlan-st-1] cipher-suite ccmp

[AC-wlan-st-1] security-ie rsn

# Configure the AC to forward client data traffic. If the default client data traffic forwarder is AC, skip this step.

[AC-wlan-st-1] client forwarding-location ac

# Enable service template 1.

[AC-wlan-st-1] service-template enable

# Enable snooping DHCPv6 and ND packets.

[AC-wlan-st-2] client ipv6-snooping dhcpv6-learning enable

[AC-wlan-st-2] client ipv6-snooping nd-learning enable

[AC-wlan-st-2] quit

# Create service template 2 and enter its view.

[AC] wlan service-template 2

# Set the SSID to service2.

[AC-wlan-st-2] ssid service2

# Specify PSK as the AKM mode and specify 12345678 as the plaintext key.

[AC-wlan-st-2] akm mode psk

[AC-wlan-st-2] preshared-key pass-phrase simple 12345678

# Specify CCMP as the cipher suite and specify RSN as the security IE.

[AC-wlan-st-2] cipher-suite ccmp

[AC-wlan-st-2] security-ie rsn

# Configure the AC to forward client data traffic. If the default client data traffic forwarder is AC, skip this step.

[AC-wlan-st-2] client forwarding-location ac

# Enable service template 2.

[AC-wlan-st-2] service-template enable

# Enable snooping DHCPv6 and ND packets.

[AC-wlan-st-2] client ipv6-snooping dhcpv6-learning enable

[AC-wlan-st-2] client ipv6-snooping nd-learning enable

[AC-wlan-st-2] quit

4.     Configure AP settings:

 

NOTE: To simply AP configuration on a large-scale network, configure AP settings on a per AP group basis as a best practice.

 

# Create manual AP officeap, and specify the AP model and serial ID.

[AC] wlan ap officeap model WA6320

[AC-wlan-ap-officeap] serial-id 219801A28N819CE0002T

# Create AP group group1 and configure officeap as the AP grouping rule.

[AC] wlan ap-group group1

[AC-wlan-ap-group-group1] ap officeap

# Bind service template 1 and VLAN 200 to radio 1 for AP group group1.

[AC-wlan-ap-group-group1] ap-model WA6320

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 1

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] service-template 1 vlan 200

# Enable radio 1.

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] quit

# Bind service template 2 and VLAN 400 to radio 2 for AP group group1.

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template 2 vlan 400

# Enable radio 2.

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] return

Configuring the switch

1.     Configure switch interfaces:

# Create VLAN 100, VLAN 300, VLAN-interface 100, and VLAN-interface 300, and assign IPv6 addresses to the VLAN interfaces. The switch will use VLAN 100 and VLAN 300 to forward packets between AC and AP.

<L3 switch> system-view

[L3 switch] vlan 100

[L3 switch-vlan100] quit

[L3 switch] interface vlan-interface 100

[L3 switch-Vlan-interface100] ipv6 address 2001::2/64

[L3 switch-Vlan-interface100] quit

[L3 switch] vlan 300

[L3 switch-vlan300] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] ipv6 address 3001::1/64

[L3 switch-Vlan-interface300] quit

# Create VLAN 200 and VLAN-interface 200 and assign an IPv6 address to the VLAN interface. Client 1 will use this VLAN to access the WLAN.

[L3 switch] vlan 200

[L3 switch-vlan200] quit

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] ipv6 address 3000::1/64

[L3 switch-Vlan-interface200] quit

# Create VLAN 400 and VLAN-interface 400 and assign an IPv6 address to the VLAN interface. Client 2 will use this VLAN to access the WLAN.

[L3 switch] vlan 400

[L3 switch-vlan400] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] ipv6 address 4000::1/64

[L3 switch-Vlan-interface400] quit

# Configure GigabitEthernet 1/0/1 that connects the switch to the AC as a trunk port, remove the port from VLAN 1, and assign the port to VLANs 100, 200, and 400.

[L3 Switch] interface gigabitethernet 1/0/1

[L3 Switch-GigabitEthernet1/0/1] port link-type trunk

[L3 switch-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[L3 Switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200 400

[L3 Switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 that connects the switch to the AP as a trunk port, remove the port from VLAN 1, configure the PVID as VLAN 300, and assign the port to VLANs 300.

[L3 switch] interface gigabitEthernet 1/0/2

[L3 switch-GigabitEthernet1/0/2] port link-type trunk

[L3 switch-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[L3 switch-GigabitEthernet1/0/2] port trunk permit vlan 300

[L3 switch-GigabitEthernet1/0/2] port trunk pvid vlan 300

[L3 switch-GigabitEthernet1/0/2] quit

2.     Configure DHCPv6:

# Enable the DHCPv6 server on VLAN-interface 200, VLAN-interface 300, and VLAN-interface 400, respectively.

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] ipv6 dhcp select server

[L3 switch-Vlan-interface200] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] ipv6 dhcp select server

[L3 switch-Vlan-interface300] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] ipv6 dhcp select server

[L3 switch-Vlan-interface400] quit

# Disable RA message suppression, set both the managed address configuration flag (M) and the other stateful configuration flag (O) to 1 in RA advertisements to be sent for the created VLAN interfaces.

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] undo ipv6 nd ra halt

[L3 switch-Vlan-interface200] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface200] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface200] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] undo ipv6 nd ra halt

[L3 switch-Vlan-interface300] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface300] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface300] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] undo ipv6 nd ra halt

[L3 switch-Vlan-interface400] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface400] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface400] quit

# Create DHCPv6 address pool 1 to assign an IPv6 address to Client 1, and specify subnet 3000::0/64 in the DHCP address pool.

[L3 switch] ipv6 dhcp pool 1

[L3 switch-dhcp6-pool-1] network 3000::0/64

[L3 switch-dhcp6-pool-1] gateway-list 3000::1

[L3 switch-dhcp6-pool-1] quit

# Create DHCPv6 address pool 2 to assign an IPv6 address to the AP, specify subnet 3001::0/64 in the DHCP address pool, and configure Option 52 that specifies AC IPv6 address 2001:1 in the address pool.

[L3 switch] ipv6 dhcp pool 2

[L3 switch-dhcp6-pool-2] network 3001::0/64

[L3 switch-dhcp6-pool-2] gateway-list 3001::1

[L3 switch-dhcp6-pool-2] option 52 hex 20010000000000000001000000000001

[L3 switch-dhcp6-pool-2] quit

# Create a prefix pool and specify the prefix and the assigned prefix length for the pool.

[L3 switch] ipv6 dhcp prefix-pool 1 prefix 4001::/64 assign-len 64

# Create DHCPv6 address pool 3 to assign an IPv6 address to Client 2, and specify subnet 4001::0/64 in the DHCP address pool.

[L3 switch] ipv6 dhcp pool 3

[L3 switch-dhcp6-pool-3] network 4001::0/64

[L3 switch-dhcp6-pool-3] gateway-list 4001::1

# Apply prefix pool 1 to DHCPv6 address pool 3, so the DHCPv6 server can dynamically select a prefix from the prefix pool for a client.

[L3 switch-dhcp6-pool-3] prefix-pool 1

[L3 switch-dhcp6-pool-3] quit

Verifying the configuration

# Verify that Client 1 and Client 2 have connected to the network successfully.

[AC] display wlan client ipv6

MAC address     AP name              IPv6 address                            VLAN

0000-000f-1211  officeap             3000::2                                 200

0000-000f-1212  officeap             4001::3                                 400

Configuration files

·     AC:

#

vlan 100

#

vlan 200

#

vlan 400

#

interface Vlan-interface100

 ipv6 address  2001::1/64

#

wlan service-template 1

 ssid service

 client forwarding-location ac

 client ipv6-snooping dhcpv6-learning enable

 client ipv6-snooping nd-learning enable

 akm mode psk

 preshared-key pass-phrase cipher $c$3$N//5BVbsOqdBTxi+7MJZKT6Zqh5MAmYs2ZzM

 cipher-suite ccmp

 security-ie rsn

 service-template enable

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 100 200 400

#

ipv6 route-static 3001::0 64 2001::2

ipv6 route-static 4001::0 64 2001::2

#

wlan ap-group group1

 ap officeap

 ap-model WA6320

  radio 1

   radio enable

   service-template 1 vlan 200

  radio 2

   radio enable

   service-template 2 vlan 400

#

wlan ap officeap model WA6320

 serial-id 219801A28N819CE0002T

#

·     Layer 3 switch:

#

 ipv6 dhcp prefix-pool 1 prefix 4001::/64 assign-len 64

# #

vlan 100

#

vlan 200

#

vlan 300

#

vlan 400

#

ipv6 dhcp pool 1

 network 3000::0/64

 gateway-list 3000::1

#

ipv6 dhcp pool 2

 network 3001::0/64

 gateway-list 3001::1

 option 52 hex 00010000000000000001000000000001

#

#

ipv6 dhcp pool 3

 network 4001::0/64

 prefix-pool 1

 gateway-list 4001::1

#

interface Vlan-interface100

 ipv6 address 2001::2/64

#

interface Vlan-interface200

 ipv6 dhcp select server

 ipv6 address 3000::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface Vlan-interface300

 ipv6 dhcp select server

 ipv6 address 3001::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface Vlan-interface400

 ipv6 dhcp select server

 ipv6 address 4001::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 100 200 400

#

interface GigabitEthernet1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 300

 port trunk pvid vlan 300

#

Related documentation

·     AP and WT Management Command Reference in H3C Access Controllers Command References

·     AP and WT Management Configuration Guide in H3C Access Controllers Configuration Guides

·     Network Connectivity Command Reference in H3C Access Controllers Command References

·     Network Connectivity Configuration Guide in H3C Access Controllers Configuration Guides