Example: Configuring different SSIDs for office use and guests

Introduction

The following information provides an example of configuring different SSIDs for office use and guests.

Network configuration

As shown in Figure 1, in centralized forwarding, the AC that is connected to Switch 1 through out-of-path deployment. The Ethernet interface of Switch 1 connects upstream to the gateway and downstream to the PoE switch, which supplies power to the APs. Configure wireless services as follows:

·     Create an AP management VLAN and a client service VLAN on Switch 1, and configure Switch 1 to act as the DHCP server to assign IP addresses to the APs and clients.

·     Configure Switch 1, the PoE switch, and the AC to reach each other, and configure the PoE switch and the APs to reach each other.

·     Configure two service templates on the AC, one for office use and the other for guests. Bind the service templates to all APs for them to provide two wireless services with different SSIDs.

Figure 1 Network diagram

 

Device	Interface	IP address
AC 1	Vlan-int 20 (management VLAN)	192.168.20.2/24
	Vlan-int 30 (business VLAN–office use only)	-
	Vlan-int 31 (business VLAN–guest use only)	-
Switch 1	Vlan-int 20 (management VLAN)	192.168.20.1/24
	Vlan-int 30 (business VLAN–office use only)	192.168.30.1/24
	Vlan-int 31 (business VLAN–guest use only)	192.168.31.1/24

 

Analysis

·     Configure Switch 1 to act as the DHCP server to assign IP addresses to the APs and clients.

·     Enable the PoE function on the PoE switch to supply power to the APs.

·     Create two service templates on the AC, one for office use and the other for guests.

Restrictions and guidelines

·     Use the actual serial ID of an AP to uniquely identify that AP.

·     Specify the interface connecting the PoE switch to the APs as an access port, and block VLAN 1 traffic on the interface to prevent excessive packets within VLAN 1.

Procedures

Configuring Switch 1

1.     Configure interfaces:

# Create VLAN 20 and assign an IP address to VLAN-interface 20. The AC will use this IP address to establish CAPWAP tunnels with APs.

<Switch1> system-view

[Switch1] vlan 20

[Switch1-vlan20] quit

[Switch1] interface vlan-interface 20

[Switch1-Vlan-interface20] ip address 192.168.20.1 255.255.255.0

[Switch1-Vlan-interface20] quit

# Create VLAN 30 and assign an IP address to VLAN-interface 30. The clients will use this VLAN to access the office wireless network.

[Switch1] vlan 30

[Switch1-vlan30] quit

[Switch1] interface vlan-interface 30

[Switch1-Vlan-interface30] ip address 192.168.30.1 255.255.255.0

[Switch1-Vlan-interface30] quit

# Create VLAN 31 and assign IP address to VLAN-interface 31. The clients will use this VLAN to access the guest wireless network.

[Switch1] vlan 31

[Switch1-vlan31] quit

[Switch1] interface vlan-interface 31

[Switch1-Vlan-interface31] ip address 192.168.31.1 255.255.255.0

[Switch1-Vlan-interface31] quit

# Specify GigabitEthernet 1/0/1 that connects Switch 1 to the AC as a trunk port and assign the port to VLANs 20, 30, and 31.

[Switch1] interface gigabitEthernet 1/0/1

[Switch1-GigabitEthernet1/0/1] port link-type trunk

[Switch1-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[Switch1-GigabitEthernet1/0/1] port trunk permit vlan 20 30 31

[Switch1-GigabitEthernet1/0/1] quit

# Specify GigabitEthernet 1/0/2 that connects Switch 1 to the PoE switch as a trunk port and assign the port to VLAN 20.

[Switch1] interfac gigabitEthernet 1/0/2

[Switch1-GigabitEthernet1/0/2] port link-type trunk

[Switch1-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[Switch1-GigabitEthernet1/0/2] port trunk permit vlan 20

[Switch1-GigabitEthernet1/0/2] quit

2.     Configure the DHCP server:

# Enable the DHCP server feature.

[Switch1] dhcp enable

# Create DHCP address pool 2 for dynamic IP allocation to the APs. Specify 192.168.20.0/24 as the subnet and exclude 192.168.20.2 from dynamic allocation. Specify the gateway address as 192.168.20.1.

[Switch1] dhcp server ip-pool 2

[Switch1-dhcp-pool-2] network 192.168.20.0 mask 255.255.255.0

[Switch1-dhcp-pool-2] gateway-list 192.168.20.1

[Switch1-dhcp-pool-2] forbidden-ip 192.168.20.2

[Switch1-dhcp-pool-2] quit

# Create DHCP address pool 3, specify subnet 192.168.30.0/24 for clients connecting to the office network. Specify the gateway address as 192.168.30.1 and specify the address of the DNS server. In this example, the gateway also acts as the DNS server.

[Switch1] dhcp server ip-pool 3

[Switch1-dhcp-pool-3] network 192.168.30.0 mask 255.255.255.0

[Switch1-dhcp-pool-3] gateway-list 192.168.30.1

[Switch1-dhcp-pool-3] dns-list 192.168.30.1

[Switch1-dhcp-pool-3] quit

# Create DHCP address pool 4, specify subnet 192.168.31.0/24 for clients connecting to the guest network. Specify the gateway address as 192.168.31.1 and specify the address of the DNS server. In this example, the gateway also acts as the DNS server.

[Switch1] dhcp server ip-pool 4

[Switch1-dhcp-pool-4] network 192.168.31.0 mask 255.255.255.0

[Switch1-dhcp-pool-4] gateway-list 192.168.31.1

[Switch1-dhcp-pool-4] dns-list 192.168.31.1

[Switch1-dhcp-pool-4] quit

Configuring AC

1.     Configure AC interfaces:

# Create VLAN 20 and VLAN-interface 20, and assign an IP address to the interface. The AC will use this IP address to establish CAPWAP tunnels with APs.

[AC] vlan 20

[AC-vlan20] quit

[AC] interface vlan-interface 20

[AC-Vlan-interface20] ip address 192.168.20.2 255.255.255.0

[AC-Vlan-interface20] quit

# Create VLAN 30. The clients use this VLAN to access the office wireless network.

[AC] vlan 30

[AC-vlan30] quit

# Create VLAN 31. The clients use this VLAN to access the guest wireless network.

[AC] vlan 31

[AC-vlan31] quit

# Specify GigabitEthernet 1/0/1 that connects the AC to Switch 1 as a trunk port. Prohibit VLAN 1 traffic and assign the port to VLANs 20, 30, and 31.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[AC-GigabitEthernet1/0/1] port trunk permit vlan 20 30 31

[AC-GigabitEthernet1/0/1] quit

2.     Configure wireless services:

# Create service template 1. Set the SSID to BanGong.

[AC] wlan service-template 1

[AC-wlan-st-1] ssid BanGong

# Specify PSK as the AKM mode and specify 12345678 as the plaintext key.

[AC-wlan-st-1] akm mode psk

[AC-wlan-st-1] preshared-key pass-phrase simple 12345678

# Specify CCMP as the cipher suite and specify RSN as the security IE.

[AC-wlan-st-1] cipher-suite ccmp

[AC-wlan-st-1] security-ie rsn

# Configure the AC to forward client data traffic. If the default client data traffic forwarder is AC, skip this step.

[AC-wlan-st-1] client forwarding-location ac

# Enable the service template.

[AC-wlan-st-1] service-template enable

[AC-wlan-st-1] quit

# Repeat the above steps to create service template 2, and set the SSID to FangKe.

[AC] wlan service-template 2

[AC-wlan-st-2] ssid FangKe

[AC-wlan-st-2] akm mode psk

[AC-wlan-st-2] preshared-key pass-phrase simple 87654321

[AC-wlan-st-2] cipher-suite ccmp

[AC-wlan-st-2] security-ie rsn

[AC-wlan-st-2] client forwarding-location ac

[AC-wlan-st-2] service-template enable

[AC-wlan-st-2] quit

3.     Configure AP settings:

 

NOTE: As a best practice, configure wireless settings based on AP groups for large-scale networks.

 

# Create AP ap1, and specify the AP model as WA6320 and serial ID as 219801A28N819CE0002T.

[AC] wlan ap ap1 model WA6320

[AC-wlan-ap-ap1] serial-id 219801A28N819CE0002T

[AC-wlan-ap-ap1] quit

# Create AP group group1 and configure an AP name-based grouping rule to add AP ap1 to the group.

[AC] wlan ap-group group1

[AC-wlan-ap-group-group1] ap ap1

# Bind service template 1 to radio 1 for AP group group1 and specify VLAN 30 as the VLAN for clients coming online through the radio.

[AC-wlan-ap-group-group1] ap-model WA6320

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 1

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] service-template 1 vlan 30

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] quit

# Bind service template 2 to radio 2 for AP group group1 and specify VLAN 31 as the VLAN for the client.

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template 2 vlan 31

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] quit

[AC-wlan-ap-group-group1-ap-model-WA6320] quit

[AC-wlan-ap-group-group1] quit

# Repeat the above steps to configure the other APs.

Configuring the PoE switch

# Create VLAN 20. The AC will use VLAN 20 to establish CAPWAP tunnels with the APs.

<PoE switch> system-view

[PoE switch] vlan 20

[PoE switch-vlan20] quit

# Specify GigabitEthernet 1/0/1 that connects PoE to Switch 1 as a trunk port. Prohibit VLAN 1 traffic and assign the port to VLAN 20.

[PoE switch] interface gigabitEthernet 1/0/1

[PoE switch-GigabitEthernet1/0/1] port link-type trunk

[PoE switch-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[PoE switch-GigabitEthernet1/0/1] port trunk permit vlan 20

[PoE switch-GigabitEthernet1/0/1] quit

# Configure the interfaces connecting the PoE switch to the APs. This section uses GigabitEthernet 1/0/2 as an example. Set the link type of GigabitEthernet 1/0/2 that connects PoE and the Switch 1 to access, assign the port to VLAN 20, and enable the PoE function.

[PoE switch] interfac gigabitEthernet 1/0/2

[PoE switch-GigabitEthernet1/0/2] port link-type access

[PoE switch-GigabitEthernet1/0/2] port access vlan 20

[PoE switch-GigabitEthernet1/0/2] poe enable

[PoE switch-GigabitEthernet1/0/2] quit

Verifying the configuration

# Use the display wlan client command to view the state of the AC. If the State field in the command output shows R/M, it indicates a successful connection.

<AC> display wlan ap all

Total number of APs: 1

Total number of connected APs: 1

Total number of connected manual APs: 1

Total number of connected auto APs: 0

Total number of connected common APs: 1

Total number of connected WTUs: 0

Total number of inside APs: 0

Maximum supported APs: 3072

Remaining APs: 3071

Total AP licenses: 128

Remaining AP licenses: 127

 

                                 AP information

 State : I = Idle,       J  = Join,       JA = JoinAck,    IL = ImageLoad

         C = Config,     DC = DataCheck,  R  = Run   M = Master,  B = Backup

 

AP name                AP ID   State   Model             Serial ID

ap1                    1       R/M     WA6320        219801A28N819CE0002T

Configuration files

·     AC:

#

vlan 20

#

vlan 30

#

vlan 31

#

interface vlan-interface 20

 ip address 192.168.20.2 255.255.255.0

#

interface gigabitethernet 1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30 31

#

wlan service-template 1

 ssid BanGong

 akm mode psk

 preshared-key pass-phrase simple $c$3$N//5BVbsOqdBTxi+7MJZKT6Zqh5MAmYs2ZzM

 cipher-suite ccmp

 security-ie rsn

 client forwarding-location ac

 service-template enable

#

wlan service-template 2

 ssid FangKe

 akm mode psk

 preshared-key pass-phrase simple $c$3$N//5BVbsOqdBTxi+7MJZKT6Zqh5MAmYs2ZzM

 cipher-suite ccmp

 security-ie rsn

 client forwarding-location ac

 service-template enable

#

wlan ap ap1 model WA6320

 serial-id 219801A28N819CE0002T

#

 wlan ap-group group1

 ap ap1

 ap-model WA6320

 radio 1

 service-template 1 vlan 30

 radio enable

 radio 2

 service-template 1 vlan 31

 radio enable

#

·     Switch 1:

#

dhcp enable

#

vlan 20

#

vlan 30

#

vlan 31

#

dhcp server ip-pool 2

 network 192.168.20.0 mask 255.255.255.0

 gateway-list 192.168.20.1

 forbidden-ip 192.168.20.2

#

dhcp server ip-pool 3

 network 192.168.30.0 mask 255.255.255.0

 gateway-list 192.168.30.1

 dns-list 192.168.30.1

#

dhcp server ip-pool 4

 network 192.168.31.0 mask 255.255.255.0

 gateway-list 192.168.31.1

 dns-list 192.168.31.1

#

interface vlan-interface 20

 ip address 192.168.20.1 255.255.255.0

#

interface vlan-interface 30

 ip address 192.168.30.1 255.255.255.0

#

interface vlan-interface 31

 ip address 192.168.31.1 255.255.255.0

#

interface gigabitEthernet 1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30 31

#

interfac gigabitEthernet 1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20

#

·     PoE switch:

#

vlan 20

#

interface gigabitethernet 1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20

#

interface gigabitethernet 1/0/2

 port link-type access

 port access vlan 20

 poe enable

#

Related documentation

·     WLAN Access Command Reference in H3C Access Controllers Command References

·     WLAN Access Configuration Guide in H3C Access Controllers Configuration Guides

·     AP and WT Management Command Reference in H3C Access Controllers Command References

·     AP and WT Management Configuration Guide in H3C Access Controllers Configuration Guides