• 产品与解决方案
  • 行业解决方案
  • 服务
  • 支持
  • 合作伙伴
  • 新华三人才研学中心
  • 关于我们

H3C无线控制器典型配置案例集(V5)-6W114

目录

34-远程IPv6 Portal认证热备典型配置举例(V5)

本章节下载 34-远程IPv6 Portal认证热备典型配置举例(V5)  (795.05 KB)

34-远程IPv6 Portal认证热备典型配置举例(V5)

远程IPv6 Portal认证热备典型配置举例(V5)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

资料版本:6W114-20210416

 

Copyright © 2008-2021 新华三技术有限公司 版权所有,保留一切权利。

非经本公司书面许可,任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部,并不得以任何形式传播。

除新华三技术有限公司的商标外,本手册中出现的其它公司的商标、产品标识及商品名称,由各自权利人拥有。

本文档中的信息可能变动,恕不另行通知。



1  简介

本文档介绍了远程Portal认证热备典型配置举例。

2  配置前提

本文档不严格与具体软、硬件版本对应,如果使用过程中与产品实际情况有差异,请参考相关产品手册,或以设备实际情况为准。

本文档中的配置均是在实验室环境下进行的配置和验证,配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置,为了保证配置效果,请确认现有配置和以下举例中的配置不冲突。

本文档假设您已了解远程Portal认证、双机热备、VRRP和双AC备份等特性。

3  配置举例

3.1  组网需求

图1所示,AC 1和AC 2之间通过VRRP协议实现双机热备的流量切换,且两台设备均支持Portal认证功能。现要求AC 1和AC 2通过双机热备对Portal用户的业务信息进行备份。具体需求如下:

·     AC 1正常工作的情况下,Client通过AC 1进行Portal认证接入。认证成功后在AC 2上能同时备份Client的Portal相关认证信息。

·     当AC 1发生故障时,Client切换至AC 2上,保证业务流量切换不被中断。

·     Portal/RADIUS服务器作为认证/计费服务器,对Client进行远程Portal认证。

·     AC1和AC2通过VLAN 10传输双机热备报文。

图1 远程Portal认证热备组网图

 

3.2  配置思路

·     为了避免两台AC和上下行设备产生环路,并在主备切换时,尽快完成收敛,需要在AC 1和AC 2上使能MSTP功能,并设置AC 1为根桥。

·     为了实现Portal用户数据备份功能,需要分别在AC 1 和AC 2上配置双AC备份功能,使AC 1和AC 2的用户数据同步。

·     为了实现互为备份的两台AC可以同时处理用户数据热备功能,需要分别在AC 1和AC 2上配置VRRP备份组,使AC 1和AC 2在同一VRRP组里。

3.3  配置注意事项

·     配置AP的序列号时请确保该序列号与AP唯一对应,AP的序列号可以通过AP设备背面的标签获取。

·     互为双机热备的两台AC对于Portal服务器和AAA服务器需要呈现同一个客户端IP地址,所以AC 1与AC 2配置的Portal NAS-IP必须为VRRP备份组1的虚拟IP地址。

·     AC 1与AC 2上Portal和WLAN的相关配置必须一致。

·     AC 1与AC 2上所使用版本必须一致。

·     AC 1与AC 2配置Nas Device-id不能一致。

3.4  配置步骤

3.4.1  AC 1的配置

(1)     配置AC 1的接口

# 全局使能IPv6功能。

<AC1> system-view

[AC1] ipv6

# 创建VLAN 10作为双机热备的VLAN。

[AC1] vlan 10

[AC1-vlan10] quit

# 创建VLAN 100及其对应的VLAN接口,并为该接口配置IPv4和IPv6地址。AP将通过该VLAN与AC建立LWAPP隧道。

[AC1] vlan 100

[AC1-vlan100] quit

[AC1] interface vlan-interface 100

[AC1-Vlan-interface100] ip address 192.168.1.1 24

[AC1-Vlan-interface100] ipv6 address 3001::1 96

[AC1-Vlan-interface100] quit

# 创建VLAN 200作为WLAN-ESS接口的缺省VLAN。

[AC1] vlan 200

[AC1-vlan200] quit

# 创建VLAN 300作为Client接入的业务VLAN,并为该接口配置IPv4和IPv6地址。

[AC1] vlan 300

[AC1-vlan300] quit

[AC1] interface vlan-interface 300

[AC1-Vlan-interface300] ip address 192.168.3.1 24

[AC1-Vlan-interface300] ipv6 address fe80::1 link-local

[AC1-Vlan-interface300] ipv6 address 3003::1 96

[AC1-Vlan-interface300] quit

# 创建VLAN 1作为与RADIUS server通信的VLAN,并为该接口配置IPv4和IPv6地址。

[AC1] vlan 1

[AC1-vlan1] quit

[AC1] interface vlan-interface 1

[AC1-Vlan-interface1] ip address 192.168.100.147 24

[AC1-Vlan-interface1] ipv6 address fe80::2 link-local

[AC1-Vlan-interface1] ipv6 address 2003::1 64

[AC1-Vlan-interface1] quit

# 配置AC 1与AC 2相连的GigabitEthernet1/0/2接口的链路类型为Access,当前Access口允许VLAN 10通过。

[AC1] interface gigabitethernet 1/0/2

[AC1-GigabitEthernet1/0/2] port link-type access

[AC1-GigabitEthernet1/0/2] port access vlan 10

[AC1-GigabitEthernet1/0/2] quit

# 配置AC1的下行链路GigabitEthernet1/0/3接口的链路类型为Trunk,当前Trunk口的PVID100,并允许VLAN 100和VLAN 300的报文通过。

[AC1] interface gigabitethernet 1/0/3

[AC1-GigabitEthernet1/0/3] port link-type trunk

[AC1-GigabitEthernet1/0/3] port trunk permit vlan 100 300

[AC1-GigabitEthernet1/0/3] port trunk pvid vlan 100

[AC1-GigabitEthernet1/0/3] quit

(2)     配置MSTP

# 配置生成树的工作模式为MSTP。

[AC1] stp mode mstp

# 激活MST域。

[AC1] stp region-configuration

[AC1-mst-region] active region-configuration

[AC1-mst-region] quit

# 配置AC 1为根桥。

[AC1] stp root primary

# 使能STP功能。

[AC1] stp enable

(3)     配置VRRP

# 创建VRRP备份组1,并配置VRRP备份组1的虚拟IPv4地址为192.168.3.100,虚拟IPv6地址为FE80::30和3003::100。

[AC1] interface vlan-interface 300

[AC1-Vlan-interface300] vrrp vrid 1 virtual-ip 192.168.3.100

[AC1-Vlan-interface300] vrrp ipv6 vrid 1 virtual-ip fe80::30 link-local

[AC1-Vlan-interface300] vrrp ipv6 vrid 1 virtual-ip 3003::100

# 配置VLAN接口300在VRRP备份组1中的优先级为254。

[AC1-Vlan-interface300] vrrp vrid 1 priority 254

[AC1-Vlan-interface300] vrrp ipv6 vrid 1 priority 254

[AC1-Vlan-interface300] quit

# 创建VRRP备份组2,并配置VRRP备份组2的虚拟IPv4地址为192.168.100.245,虚拟IPv6地址为FE80::40和2003::100。

[AC1] interface vlan-interface 1

[AC1-Vlan-interface1] vrrp vrid 2 virtual-ip 192.168.100.245

[AC1-Vlan-interface1] vrrp ipv6 vrid 2 virtual-ip fe80::40 link-local

[AC1-Vlan-interface1] vrrp ipv6 vrid 2 virtual-ip 2003::100

# 配置VLAN接口1在VRRP备份组2中的优先级为254。

[AC1-Vlan-interface1] vrrp vrid 2 priority 254

[AC1-Vlan-interface1] vrrp ipv6 vrid 2 priority 254

[AC1-Vlan-interface400] quit

(4)     配置Portal认证

# 配置IPv4 Portal服务器:名称为officev4,IPv4地址为192.168.100.240、密钥为明文123456789,URL为http://192.168.100.240:8080/portal。

[AC1] portal server officev4 ip 192.168.100.240 key simple 123456789 url http://192.168.100.240:8080/portal

# 配置IPv6 Portal服务器:名称为officev6,IPv6地址为2003::2。

[AC1] portal server officev6 ipv6 2003::2 key simple 123456789 url http://[2003::2]:8080/portal

# 在VLAN接口300上配置Portal用户报文的控制模式为MAC,IPv4或者IPv6用户通过Portal认证上线后,同时允许该用户的IPv4和IPv6报文通过认证接口。

[AC1] interface vlan-interface 300

[AC1-Vlan-interface300] portal control-mode mac

# 在VLAN接口300上使能Portal认证,并配置为直接认证方式。

[AC1-Vlan-interface300] portal server officev4 method direct

[AC1-Vlan-interface300] portal server officev6 method direct

[AC1-Vlan-interface300] quit

(5)     配置IPv4 RADIUS方案

# 创建名为rs4的RADIUS方案并进入其视图。

[AC1] radius scheme rs4

# 配置RADIUS方案的主认证服务器的IPv4地址为192.168.100.240,认证报文的共享密钥设置为明文123456。

[AC1-radius-rs4] primary authentication 192.168.100.240

[AC1-radius-rs4] key authentication 123456

# 配置发送给RADIUS服务器的用户名不携带ISP域名。

[AC1-radius-rs4] user-name-format without-domain

[AC1-radius-rs4] quit

(6)     配置IPv6 RADIUS方案

# 创建名为rs6的RADIUS方案并进入其视图。

[AC1] radius scheme rs6

# 配置RADIUS方案的主认证服务器的IPv6地址为2003::2,认证报文的共享密钥设置为明文123456。

[AC1-radius-rs6] primary authentication ipv6 2003::2

[AC1-radius-rs6] key authentication 123456

# 配置发送给RADIUS服务器的用户名不携带ISP域名。

[AC1-radius-rs6] user-name-format without-domain

[AC1-radius-rs6] quit

(7)     配置IPv4认证域

# 创建名为dm4的ISP域,并进入其视图。

[AC1] domain dm4

# 配置Portal用户使用RADIUS方案rs4进行认证,不对用户使用的网络服务进行授权和计费。

[AC1-isp-dm4] authentication portal radius-scheme rs4

[AC1-isp-dm4] authorization portal none

[AC1-isp-dm4] accounting portal none

# 允许ISP域office中的用户启用闲置切断功能,闲置检测时间为50分钟,允许用户闲置时的最小数据流量为1024个字节。

[AC1-isp-dm4] idle-cut enable 50 1024

[AC1-isp-dm4] quit

(8)     配置IPv6认证域

# 创建名为dm6的ISP域,并进入其视图。

[AC1] domain dm6

# 配置Portal用户使用RADIUS方案rs6进行认证,不对用户使用的网络服务进行授权和计费。

[AC1-isp-dm6] authentication portal radius-scheme rs6

[AC1-isp-dm6] authorization portal none

[AC1-isp-dm6] accounting portal none

# 允许ISP域office中的用户启用闲置切断功能,闲置检测时间为50分钟,允许用户闲置时的最小数据流量为1024个字节。

[AC1-isp-dm6] idle-cut enable 50 1024

[AC1-isp-dm6] quit

(9)     配置Portal支持双机热备

# 配置VLAN接口300属于Portal备份组1。

[AC1] interface vlan-interface 300

[AC1-Vlan-interface300] portal backup-group 1

# 配置接口VLAN 300发送Portal报文使用的IPv4源地址为192.168.3.100、IPv6源地址为3003::100。

[AC1-Vlan-interface300] portal nas-ip 192.168.3.100

[AC1-Vlan-interface300] portal nas-ip ipv6 3003::100

[AC1-Vlan-interface300] quit

# 配置双机热备模式下的设备ID为1,输入“Y”确认。

[AC1] nas device-id 1

Warning: This command will cut all user connections on this device. Continue? [Y/N]Y

# 配置发送RADIUS报文使用的源IPv4地址为VRRP备份组2的虚拟IPv4地址。

[AC1] radius nas-ip 192.168.100.245

# 配置发送RADIUS报文使用的源IPv6地址为VRRP备份组2的虚拟IPv6地址。

[AC1] radius nas-ip ipv6 2003::100

# 指定IPv4 Portal用户的认证域为dm4。

[AC1] interface vlan-interface 300

[AC1-Vlan-interface300] portal domain dm4

# 指定IPv6 Portal用户的认证域为dm6。

[AC1-Vlan-interface300] portal domain ipv6 dm6

[AC1-Vlan-interface300] quit

(10)     配置WLAN服务

# 配置全局备份AC的IPv4地址为192.168.1.2。

[AC1] wlan backup-ac ip 192.168.1.2

# 配置全局备份AC的IPv6地址为3001::2。

[AC1] wlan backup-ac ipv6 3001::2

# 使能AC间热备份功能。

[AC1] hot-backup enable

# 配置AC间用于热备份的VLAN为VLAN 10。

[AC1] hot-backup vlan 10

# 创建接口WLAN-ESS 1,并设置端口的链路类型为Hybrid。

[AC1] interface wlan-ess 1

[AC1-WLAN-ESS1] port link-type hybrid

# 配置当前Hybrid端口的PVID为VLAN 200,禁止VLAN 1通过并允许VLAN 200和VLAN 300不带Tag通过。

[AC1-WLAN-ESS1] undo port hybrid vlan 1

[AC1-WLAN-ESS1] port hybrid vlan 200 300 untagged

[AC1-WLAN-ESS1] port hybrid pvid vlan 200

# 使能MAC VLAN功能。

[AC1-WLAN-ESS1] mac-vlan enable

[AC1-WLAN-ESS1] quit

# 配置WLAN服务模板,SSID为service,将接口WLAN-ESS 1与该服务模板绑定,并开启WLAN服务。

[AC1] wlan service-template 1 clear

[AC1-wlan-st-1] ssid service

[AC1-wlan-st-1] bind wlan-ess 1

[AC1-wlan-st-1] service-template enable

[AC1-wlan-st-1] quit

# 在AC 1的AP视图下配置AP名称为officeap,型号名称选择WA2620E-AGN。

[AC1] wlan ap officeap model WA2620E-AGN

# 设置AP的序列号为21023529G007C000020。

[AC1-wlan-ap-officeap] serial-id 21023529G007C000020

# 配置AP的接入优先级设置为7,该值越大优先级越高,缺省为4。

[AC1-wlan-ap-officeap] priority level 7

# 进入radio 2射频视图。

[AC1-wlan-ap-officeap] radio 2

# 将在AC上配置的clear类型的服务模板1与射频2进行关联,同时设置绑定到该射频的VLAN为VLAN 300。

[AC1-wlan-ap-officeap-radio-2] service-template 1 vlan-id 300

# 使能AP的radio 2。

[AC1-wlan-ap-officeap-radio-2] radio enable

[AC1-wlan-ap-officeap-radio-2] quit

[AC1-wlan-ap-officeap] quit

(11)     配置双机热备

# 配置备份VLAN为VLAN 10。

[AC1] dhbk vlan 10

# 使能双机热备功能,且支持对称路径。

[AC1] dhbk enable backup-type symmetric-path

3.4.2  AC 2的配置

(1)     配置AC 2的接口

# 全局使能IPv6功能。

<AC2> system-view

[AC2] ipv6

# 创建VLAN 10作为双机热备的VLAN。

[AC2] vlan 10

[AC2-vlan10] quit

# 创建VLAN 100及其对应的VLAN接口,并为该接口配置IPv4和IPv6地址。AP将通过该VLAN与AC建立LWAPP隧道。

[AC2] vlan 100

[AC2-vlan100] quit

[AC2] interface vlan-interface 100

[AC2-Vlan-interface100] ip address 192.168.1.2 24

[AC2-Vlan-interface100] ipv6 address 3001::2 96

[AC2-Vlan-interface100] quit

# 创建VLAN 200作为WLAN-ESS接口的缺省VLAN。

[AC2] vlan 200

[AC2-vlan200] quit

# 创建VLAN 300作为Client接入的业务VLAN,并为该接口配置IPv4和IPv6地址。

[AC2] vlan 300

[AC2-vlan300] quit

[AC2] interface vlan-interface 300

[AC2-Vlan-interface300] ip address 192.168.3.2 24

[AC2-Vlan-interface300] ipv6 address fe80::3 link-local

[AC2-Vlan-interface300] ipv6 address 3003::2 96

[AC2-Vlan-interface300] quit

# 创建VLAN 1作为与RADIUS server通信的VLAN,并为该接口配置IPv4和IPv6地址。

[AC2] vlan 1

[AC2-vlan1] quit

[AC2] interface vlan-interface 1

[AC2-Vlan-interface1] ip address 192.168.100.163 24

[AC2-Vlan-interface1] ipv6 address fe80::4 link-local

[AC2-Vlan-interface1] ipv6 address 2003::3 64

[AC2-Vlan-interface1] quit

# 配置AC 1与AC 2相连的GigabitEthernet1/0/2接口的链路类型为Access,当前Access口允许VLAN 10通过。

[AC2] interface gigabitethernet 1/0/2

[AC2-GigabitEthernet1/0/2] port link-type access

[AC2-GigabitEthernet1/0/2] port access vlan 10

[AC2-GigabitEthernet1/0/2] quit

# 配置AC 2下行链路的GigabitEthernet1/0/3接口的链路类型为Trunk,当前Trunk口的PVID100,并允许VLAN 100和VLAN 300的报文通过。

[AC2] interface gigabitethernet 1/0/3

[AC2-GigabitEthernet1/0/3] port link-type trunk

[AC2-GigabitEthernet1/0/3] port trunk permit vlan 100 300

[AC2-GigabitEthernet1/0/3] port trunk pvid vlan 100

[AC2-GigabitEthernet1/0/3] quit

(2)     配置MSTP

# 配置生成树的工作模式为MSTP。

[AC2] stp mode mstp

# 激活MST域。

[AC2] stp region-configuration

[AC2-mst-region] active region-configuration

[AC2-mst-region] quit

# 使能STP功能。

[AC2] stp enable

(3)     配置VRRP

# 创建VRRP备份组1,并配置VRRP备份组1的虚拟IPv4地址为192.168.3.100,虚拟IPv6地址为FE80::30和3003::100。

[AC2] interface vlan-interface 300

[AC2-Vlan-interface300] vrrp vrid 1 virtual-ip 192.168.3.100

[AC2-Vlan-interface300] vrrp ipv6 vrid 1 virtual-ip fe80::30 link-local

[AC2-Vlan-interface300] vrrp ipv6 vrid 1 virtual-ip 3003::100

[AC2-Vlan-interface300] quit

# 创建VRRP备份组2,并配置VRRP备份组2的虚拟IPv4地址为192.168.100.245,虚拟IPv6地址为FE80::40和2003::100。

[AC2] interface vlan-interface 1

[AC2-Vlan-interface1] vrrp vrid 2 virtual-ip 192.168.100.245

[AC2-Vlan-interface1] vrrp ipv6 vrid 2 virtual-ip fe80::40 link-local

[AC2-Vlan-interface1] vrrp ipv6 vrid 2 virtual-ip 2003::100

[AC2-Vlan-interface1] quit

(4)     配置Portal认证

# 配置IPv4 Portal服务器:名称为officev4,IPv4地址为192.168.100.240、密钥为明文123456789,URL为http://192.168.100.240:8080/portal。

[AC2] portal server officev4 ip 192.168.100.240 key simple 123456789 url http://192.168.100.240:8080/portal

# 配置IPv6 Portal服务器:名称为officev6,IPv6地址为2003::2。

[AC2] portal server officev6 ipv6 2003::2 key simple 123456789 url http://[2003::2]:8080/portal

# 在VLAN接口300上配置Portal用户报文的控制模式为MAC,IPv4或者IPv6用户通过Portal认证上线后,同时允许该用户的IPv4和IPv6报文通过认证接口。

[AC2] interface vlan-interface 300

[AC2-Vlan-interface300] portal control-mode mac

# 在VLAN接口300上使能Portal认证,并配置为直接认证方式。

[AC2-Vlan-interface300] portal server officev4 method direct

[AC2-Vlan-interface300] portal server officev6 method direct

[AC2-Vlan-interface300] quit

(5)     配置IPv4 RADIUS方案

# 创建名为rs4的RADIUS方案并进入其视图。

[AC2] radius scheme rs4

# 配置RADIUS方案的主认证服务器的IPv4地址为192.168.100.240,认证报文的共享密钥设置为明文123456。

[AC2-radius-rs4] primary authentication 192.168.100.240

[AC2-radius-rs4] key authentication 123456

# 配置发送给RADIUS服务器的用户名不携带ISP域名。

[AC2-radius-rs4] user-name-format without-domain

[AC2-radius-rs4] quit

(6)     配置IPv6 RADIUS方案

# 创建名为rs6的RADIUS方案并进入其视图。

[AC2] radius scheme rs6

# 配置RADIUS方案的主认证服务器的IPv6地址为2003::2,认证报文的共享密钥设置为明文123456。

[AC2-radius-rs6] primary authentication ipv6 2003::2

[AC2-radius-rs6] key authentication 123456

# 配置发送给RADIUS服务器的用户名不携带ISP域名。

[AC2-radius-rs6] user-name-format without-domain

[AC2-radius-rs6] quit

(7)     配置IPv4认证域

# 创建名为dm4的ISP域,并进入其视图。

[AC2] domain dm4

# 配置Portal用户使用RADIUS方案rs4进行认证,不对用户使用的网络服务进行授权和计费。

[AC2-isp-dm4] authentication portal radius-scheme rs4

[AC2-isp-dm4] authorization portal none

[AC2-isp-dm4] accounting portal none

# 允许ISP域office中的用户启用闲置切断功能,闲置检测时间为50分钟,允许用户闲置时的最小数据流量为1024个字节。

[AC2-isp-dm4] idle-cut enable 50 1024

[AC2-isp-dm4] quit

(8)     配置IPv6认证域

# 创建名为dm6的ISP域,并进入其视图。

[AC2] domain dm6

# 配置Portal用户使用RADIUS方案rs6进行认证,不对用户使用的网络服务进行授权和计费。

[AC2-isp-dm6] authentication portal radius-scheme rs6

[AC2-isp-dm6] authorization portal none

[AC2-isp-dm6] accounting portal none

# 允许ISP域office中的用户启用闲置切断功能,闲置检测时间为50分钟,允许用户闲置时的最小数据流量为1024个字节。

[AC2-isp-dm6] idle-cut enable 50 1024

[AC2-isp-dm6] quit

(9)     配置Portal支持双机热备

# 配置VLAN接口300属于Portal备份组1。

[AC2] interface vlan-interface 300

[AC2-Vlan-interface300] portal backup-group 1

# 配置接口VLAN 300发送Portal报文使用的IPv4源地址为192.168.3.100、IPv6源地址为3003::100。

[AC2-Vlan-interface300] portal nas-ip 192.168.3.100

[AC2-Vlan-interface300] portal nas-ip ipv6 3003::100

[AC2-Vlan-interface300] quit

# 配置双机热备模式下的设备ID为2,输入“Y”确认。

[AC2] nas device-id 2

Warning: This command will cut all user connections on this device. Continue? [Y/N]Y

# 配置发送RADIUS报文使用的源IPv4地址为VRRP备份组2的虚拟IPv4地址。

[AC2] radius nas-ip 192.168.100.245

# 配置发送RADIUS报文使用的源IPv6地址为VRRP备份组2的虚拟IPv6地址。

[AC1] radius nas-ip ipv6 2003::100

# 指定IPv4 portal用户的认证域为dm4。

[AC2] interface vlan-interface 300

[AC2-Vlan-interface300] portal domain dm4

# 指定IPv6 Portal用户的认证域为dm6。

[AC2-Vlan-interface300] portal domain ipv6 dm6

[AC2-Vlan-interface300] quit

(10)     配置WLAN服务

# 配置全局备份AC的IPv4地址为192.168.1.1。

[AC2] wlan backup-ac ip 192.168.1.1

# 配置全局备份AC的IPv6地址为3001::1。

[AC1] wlan backup-ac ipv6 3001::1

# 使能AC间热备份功能。

[AC2] hot-backup enable

# 配置AC间用于热备份的VLAN为VLAN 10。

[AC2] hot-backup vlan 10

# 创建接口WLAN-ESS 1,并设置端口的链路类型为Hybrid。

[AC2] interface wlan-ess 1

[AC2-WLAN-ESS1] port link-type hybrid

# 配置当前Hybrid端口的PVID为VLAN 200,禁止VLAN 1通过并允许VLAN 200不带Tag通过。

[AC2-WLAN-ESS1] undo port hybrid vlan 1

[AC2-WLAN-ESS1] port hybrid vlan 200 300 untagged

[AC2-WLAN-ESS1] port hybrid pvid vlan 200

[AC2-WLAN-ESS1] mac-vlan enable

[AC2-WLAN-ESS1] quit

# 配置WLAN服务模板,SSID为service,将接口WLAN-ESS 1与该服务模板绑定,并开启WLAN服务。

[AC2] wlan service-template 1 clear

[AC2-wlan-st-1] ssid service

[AC2-wlan-st-1] bind wlan-ess 1

[AC2-wlan-st-1] service-template enable

[AC2-wlan-st-1] quit

# 在AC 2的AP视图下配置AP名称为officeap,型号名称选择WA2620E-AGN。

[AC2] wlan ap officeap model WA2620E-AGN

# 设置AP的序列号为21023529G007C000020。

[AC2-wlan-ap-officeap] serial-id 21023529G007C000020

# 进入radio 2射频视图。

[AC2-wlan-ap-officeap] radio 2

# 将在AC上配置的clear类型的服务模板1与射频2进行关联,同时设置绑定到该射频的VLAN为VLAN 300。

[AC2-wlan-ap-officeap-radio-2] service-template 1 vlan-id 300

# 使能AP的radio 2。

[AC2-wlan-ap-officeap-radio-2] radio enable

[AC2-wlan-ap-officeap-radio-2] quit

[AC2-wlan-ap-officeap] quit

(11)     配置双机热备

# 配置备份VLAN为VLAN 10。

[AC2] dhbk vlan 10

# 使能双机热备功能,且支持对称路径。

[AC2] dhbk enable backup-type symmetric-path

3.4.3  Switch 1的配置

# 全局使能IPv6功能。

<Switch1> system-view

[Switch1] ipv6

# 配置生成树的工作模式为MSTP。

[Switch1] stp mode mstp

# 激活MST域。

[Switch1] stp region-configuration

[Switch1-mst-region] active region-configuration

[Switch1-mst-region] quit

# 使能STP功能。

[Switch1] stp enable

3.4.4  Switch 2的配置

(1)     配置Switch2的接口

# 全局使能IPv6功能。

<Switch2> system-view

[Switch2] ipv6

# 创建VLAN 100和VLAN 300,其中VLAN 100用于转发AC和AP间LWAPP隧道内的流量,VLAN 300为无线客户端接入的VLAN。

[Switch2] vlan 100

[Switch2-vlan100] quit

[Switch2] vlan 300

[Switch2-vlan300] quit

# 配置Switch 2与AC 1相连的GigabitEthernet1/0/1接口链路类型为Trunk,当前Trunk口的PVID为100,允许VLAN 100和VLAN 300通过。

[Switch2] interface gigabitethernet 1/0/1

[Switch2-GigabitEthernet1/0/1] port link-type trunk

[Switch2-GigabitEthernet1/0/1] port trunk permit vlan 100 300

[Switch2-GigabitEthernet1/0/1] port trunk pvid vlan 100

[Switch2-GigabitEthernet1/0/1] quit

# 配置Switch 2与AC 2相连的GigabitEthernet1/0/2接口链路类型为Trunk,当前Trunk口的PVID为100,允许VLAN 100和VLAN 300通过。

[Switch2] interface gigabitethernet 1/0/2

[Switch2-GigabitEthernet1/0/2] port link-type trunk

[Switch2-GigabitEthernet1/0/2] port trunk permit vlan 100 300

[Switch2-GigabitEthernet1/0/2] port trunk pvid vlan 100

[Switch2-GigabitEthernet1/0/2] quit

# 配置Switch 2与AP相连的GigabitEthernet1/0/3接口链路类型为Access,当前Access口允许VLAN 100通过,并使能PoE功能。

[Switch2] interface gigabitethernet 1/0/3

[Switch2-GigabitEthernet1/0/3] port link-type access

[Switch2-GigabitEthernet1/0/3] port access vlan 100

[Switch2-GigabitEthernet1/0/3] poe enable

[Switch2-GigabitEthernet1/0/3] quit

# 配置生成树的工作模式为MSTP。

[Switch2] stp mode mstp

# 激活MST域。

[Switch2] stp region-configuration

[Switch2-mst-region] active region-configuration

[Switch2-mst-region] quit

# 使能STP功能。

[Switch2] stp enable

3.4.5  Portal/RADIUS服务器的配置

说明

下面以IMC为例(使用IMC版本为:iMC PLAT 7.1(E0303)、iMC EIA 7.1(E0304)、iMC EIP 7.1(E0304)),说明Portal server、Radius Server的基本配置。

 

# 增加接入设备

登录进入IMC管理平台,选择“用户”页签,单击导航树中的[接入设备管理/接入设备配置/接入设备配置]菜单项,进入“接入设备配置”页面,在该页面中单击<增加>按钮,进入“增加接入设备”页面。

·     设置与AC交互报文时使用的认证、计费共享密钥为“123456”;

·     设置认证及计费的端口号分别为“1812”和“1813”;

·     选择业务类型为“LAN接入业务”;

·     选择接入设备类型为“H3C(General)”;

·     在设备列表中,单击<手工增加>按钮,添加IP地址为192.168.100.245的接入设备;

·     单击<增加IPv6设备>按钮,进入“手工增加接入设备”页面,填写起始IP地址为2003::100,单击<确定>按钮完成操作;

·     其它参数采用缺省值,并单击<确定>按钮完成操作。

图2 增加IPv4接入设备

 

图3 增加IPv6接入设备

 

# 增加接入策略。

选择“用户”页签,单击导航树中的[接入策略管理/接入策略管理]菜单项,进入“接入策略管理”页面,单击<增加>按钮,进入“增加接入策略”页面。

·     接入策略名为“portal”,该名称可以自行定义;

·     业务分组选择“未分组”;

·     其它参数采用缺省值,并单击<确定>按钮完成操作。

图4 增加接入策略

 

# 增加接入服务配置。

选择“用户”页签,单击导航树中的[接入策略管理/接入服务管理]菜单项,进入“接入服务管理”页面,在该页面中单击<增加>按钮,进入“增加接入服务”页面。

·     输入服务名“portal auth”,该名称可以自行定义;

·     业务分组“未分组”;

·     缺省接入策略“portal”,即上一步配置的接入策略名;

·     其它参数采用缺省值,并单击<确定>按钮完成操作。

图5 增加接入服务

 

# 增加接入用户。

选择“用户”页签,单击导航树中的[接入用户管理/接入用户]菜单项,进入接入用户列表页面,在该页面中单击<增加>按钮,进入增加接入用户页面。

·     在增加接入用户页面,单击<增加用户>按钮弹出增加用户窗口;

·     输入用户名“admin”;

·     输入证件号码“12345”;

·     单击<检查是否可用>按钮;

·     如用户姓名和证件号码可用,单击<确定>按钮完成操作。

图6 增加用户

 

在“增加接入用户”页面,按如下方式配置。

·     输入账号名“portal”;

·     输入密码“123456”;

·     接入服务选择“portal auth”;

·     其他配置保持默认;

·     单击<确定>按钮完成操作。

图7 增加接入用户

 

# 配置Portal主页

选择“用户”页签,单击导航树中的[接入策略管理/Portal服务管理/服务器配置]菜单项,进入“服务器配置”页面,配置Portal主页,采用默认配置即可,单击<确定>按钮完成。

图8 服务器配置

 

# 配置Portal认证的地址组范围

选择“用户”页签,单击导航树中的[接入策略管理/Portal服务管理/IP地址组配置]菜单项,单击<增加>按钮,配置Portal认证的地址组范围。

·     填写IP地址组名;

·     IPv6选择“是”(仅IPv6,IPv4地址选“否”);

·     输入起始地址和终止地址,输入的地址范围中应包含用户主机的IP地址;

·     选择业务分组,本例中使用缺省的“未分组”;

·     选择IP地址组的类型为“普通”。(仅IPv4地址组配置本项)

图9 增加IPv4地址组

 

图10 增加IPv6地址组配置页面

 

# 配置接入设备信息

选择“用户”页签,单击导航树中的[接入策略管理/Portal服务管理/设备配置]菜单项,单击“增加”按钮,配置Portal认证的接入设备。

·     填写设备名;

·     IPv4用户版本选择“Portal 2.0”,IPv6用户版本选择“Portal 3.0”;

·     指定IP地址为与接入用户相连的设备接口IP;

·     选择是否支持逃生心跳功能和用户心跳功能,本例中选择否。

·     输入密钥,与AC上的配置保持一致;

·     选择组网方式为直连;

·     其它参数可采用缺省配置。

图11 增加IPv4设备信息

 

图12 增加IPv6设备信息配置页面

 

# 配置端口组

返回[用户接入管理/Portal服务管理/设备配置]菜单项,在“设备信息列表”中点击AC4或者AC6设备的<端口组信息管理>链接,进入端口组信息配置页面。

图13 设备配置

 

在 “端口组信息列表”子页签,单击<增加>按钮,进入到“增加端口组信息”页面。

·     填写端口组名;

·     选择IP地址组,用户接入网络时使用的IP地址必须属于所选的IP地址组;

·     其他采用默认配置即可;

·     单击<确定>按钮完成操作。

图14 增加IPv4端口组信息

 

图15 增加IPv6端口组信息配置页面

 

3.5  验证配置

# Client从AC 1成功上线后,在AC 1上通过命令display portal user all查看该用户的认证情况。可以看到Portal用户的工作模式为主用户模式primary,表示该用户是由AC 1上线。

[AC1] display portal user all

 Index:0

 State:ONLINE

 SubState:NONE

 ACL:NONE

 Work-mode:primary

 MAC              IP                Vlan   Interface

 ----------------------------------------------------------------------------

 3ca9-f414-4c20   192.168.3.5         300    Vlan-interface300

 Total 1 user(s) matched, 1 listed.

# Client从AC 1成功上线后,在AC 2通过命令display portal user all查看该用户的认证情况。可以看到Portal用户的工作模式为备用户模式secondary,表示该用户的认证信息同步到AC 2上。

[AC2] display portal user all

 Index:0

 State:ONLINE

 SubState:NONE

 ACL:NONE

 Work-mode:secondary

 MAC              IP                Vlan   Interface

 ----------------------------------------------------------------------------

 3ca9-f414-4c20   192.168.3.5         300    Vlan-interface300

 Total 1 user(s) matched, 1 listed.

# 通过将AC 1下电模拟主AC宕机的情形,使得AC发生主备切换,此时,在AC 2上便可以查看到用户的状态由“secondary”转换为“stand-alone”状态,说明此时只有AC 2处于工作状态。

[AC2] display portal user all

 Index:0

 State:ONLINE

 SubState:NONE

 ACL:NONE

 Work-mode: stand-alone

 MAC              IP                Vlan   Interface

 ----------------------------------------------------------------------------

 3ca9-f414-4c20   192.168.3.5         300    Vlan-interface300

 Total 1 user(s) matched, 1 listed.

3.6  配置文件

·     AC 1的配置文件:

#                                                                              

 radius nas-ip ipv6 2003::0100                                                  

 nas device-id 1                                                               

#                                                                              

 ipv6                                                                           

#                                                                              

 portal server officev4 ip 192.168.100.240 key cipher $c$3$k404VUVwII8mp/Re6WpNU

wk4JrBbXsRiUzYb9A== url http://192.168.100.240:8080/portal server-type imc      

 portal server officev6 ipv6 2003::2 key cipher $c$3$bP0W+eBZJdxE/mKX1GmoGi1c/gW

kv0y6abC6PQ== url http://[2003::2]:8080/portal server-type imc                                                             

 portal free-rule 0 source interface GigabitEthernet1/0/1 destination any      

#                                                                              

 wlan backup-ac ip 192.168.1.2                                                 

 wlan backup-ac ipv6 3001::2                                                   

#                                                                              

 hot-backup enable domain 1                                                    

 hot-backup vlan 10                                                            

#                                                                              

vlan 1                                                                         

#                                                                               

vlan 10                                                                        

#                                                                              

vlan 100                                                                        

#                                                                              

vlan 200                                                                       

#                                                                               

vlan 300                                                                       

#                                                                              

radius scheme rs6                                                               

 primary authentication ipv6 2003::0002                                        

 primary accounting ipv6 2003::0002                                            

 key authentication cipher $c$3$YvYFuVf9PIY6Jg/eYeuH7VLV0vbhAmh0gg==            

 user-name-format without-domain                                               

radius scheme rs4                                                              

 primary authentication 192.168.100.240                                        

 primary accounting 192.168.100.240                                            

 key authentication cipher $c$3$zdQLHG1FGgNpAuye0JS333lP6s0KQNvmrw==           

 key accounting cipher $c$3$OIc+iiVqnz13BQBHa/LiDTlVVIFQ0RbZJA==               

 user-name-format without-domain                                               

#                                                                              

domain dm4                                                                     

 authentication portal radius-scheme rs4                                       

 authorization portal none                                                     

 accounting portal none                                                        

 access-limit disable                                                          

 state active                                                                  

 idle-cut enable 50 1024                                                       

 self-service-url disable                                                       

domain dm6                                                                     

 authentication portal radius-scheme rs6                                       

 authorization portal none                                                      

 accounting portal none                                                        

 access-limit disable                                                          

 state active                                                                   

 idle-cut enable 50 1024                                                       

 self-service-url disable                                                      

#                                                                               

 stp instance 0 root primary                                                   

 stp enable                                                                    

#                                                                               

wlan service-template 1 clear                                                  

 ssid service                                                                  

 bind WLAN-ESS 1                                                               

 service-template enable                                                       

#                                                                              

interface Vlan-interface1                                                      

 ipv6 address 2003::1/64                                                       

 ipv6 address FE80::2 link-local                                               

 ip address 192.168.100.147 255.255.255.0                                      

 vrrp vrid 2 virtual-ip 192.168.100.245                                        

 vrrp vrid 2 priority 254                                                      

 vrrp ipv6 vrid 2 virtual-ip FE80::40 link-local                               

 vrrp ipv6 vrid 2 virtual-ip 2003::100                                         

 vrrp ipv6 vrid 2 priority 254                                                 

#                                                                              

interface Vlan-interface10                                                     

 ipv6 address 3010::1/96                                                       

 ip address 192.168.10.1 255.255.255.0                                         

#                                                                               

interface Vlan-interface100                                                    

 ipv6 address 3001::1/96                                                       

 ip address 192.168.1.1 255.255.255.0                                           

#                                                                              

interface Vlan-interface200                                                    

#                                                                               

interface Vlan-interface300                                                    

 ipv6 address 3003::1/96                                                       

 ipv6 address FE80::1 link-local                                                

 ip address 192.168.3.1 255.255.255.0                                          

 vrrp vrid 1 virtual-ip 192.168.3.100                                          

 vrrp vrid 1 priority 254                                                      

 vrrp ipv6 vrid 1 virtual-ip FE80::30 link-local                               

 vrrp ipv6 vrid 1 virtual-ip 3003::100                                         

 vrrp ipv6 vrid 1 priority 254                                                 

 portal control-mode mac

 portal server officev4 method direct                                          

 portal server officev6 method direct                                          

 portal domain dm4                                                             

 portal domain ipv6 dm6                                                        

 portal backup-group 1                                                         

portal nas-ip 192.168.3.100                                                   

 portal nas-ip ipv6 3003::100

#                                                                              

interface GigabitEthernet1/0/1                                                 

 port link-type trunk                                                           

 port trunk permit vlan 1 100 300                                              

#                                                                              

interface GigabitEthernet1/0/2                                                 

 port link-type trunk                                                          

 port trunk permit vlan 1 100                                                  

#                                                                              

interface GigabitEthernet1/0/3                                                 

 port access vlan 10                                                           

#                                                                              

interface WLAN-ESS1                                                             

 port link-type hybrid                                                         

 undo port hybrid vlan 1                                                       

 port hybrid vlan 200 300 untagged                                              

 port hybrid pvid vlan 200                                                     

 mac-vlan enable                                                               

#                                                                               

wlan ap ap1 model WA2620E-AGN id 1                                             

 serial-id 21023529G007C000020                                                

 radio 1                                                                        

  radio enable                                                                 

 radio 2                                                                       

  service-template 1 vlan-id 300                                               

  radio enable                                                                 

#                                                                              

 dhbk enable backup-type symmetric-path                                        

 dhbk vlan 10                                                                  

#                                                                              

return                                                                         

#

·     AC 2的配置文件:

#                                                                               

 radius nas-ip ipv6 2003::0100                                                 

 nas device-id 2                                                               

#                                                                               

 ipv6                                                                          

#                                                                              

 portal server officev4 ip 192.168.100.240 key cipher $c$3$mxaC233QhDqkyRJvd9EeX

NOmM8DKhZyITJCtNA== url http://192.168.100.240:8080/portal server-type imc     

 portal server officev6 ipv6 2003::2 key cipher $c$3$G0WJL9a+wgLa8WMMBncBj83nPk9

S7nTYmM1pOg== url http://[2003::2]:8080/portal server-type imc                                                                 

 portal free-rule 0 source interface GigabitEthernet1/0/1 destination any      

#                                                                              

 wlan backup-ac ip 192.168.1.1                                                 

 wlan backup-ac ipv6 3001::1                                                   

#                                                                              

 hot-backup enable domain 1                                                     

 hot-backup vlan 10                                                            

#                                                                              

vlan 1                                                                         

#                                                                              

vlan 10                                                                        

#                                                                               

vlan 100                                                                       

#                                                                              

vlan 200                                                                        

#                                                                              

vlan 300                                                                       

#                                                                               

radius scheme rs4                                                              

 primary authentication 192.168.100.240                                        

 key authentication cipher $c$3$ezwUorHFXLxU0eaO2OyoyURVFuZwUNflAA==           

 user-name-format without-domain                                               

radius scheme rs6                                                              

 primary authentication ipv6 2003::0002                                         

 key authentication cipher $c$3$+qsA4GoP0aSDprsQyjFcsijBFDr2wsISTg==           

 user-name-format without-domain                                               

#                                                                               

domain dm4                                                                     

 authentication portal radius-scheme rs4                                       

 authorization portal none                                                     

 accounting portal none                                                        

 access-limit disable                                                          

 state active                                                                  

 idle-cut enable 50 1024                                                       

 self-service-url disable                                                      

domain dm6                                                                     

 authentication portal radius-scheme rs6                                       

 authorization portal none                                                     

 accounting portal none                                                        

 access-limit disable                                                          

 state active                                                                  

 idle-cut enable 50 1024                                                       

 self-service-url disable                                                       

#                                                                              

 stp enable                                                                    

#                                                                               

wlan service-template 1 clear                                                  

 ssid service                                                                  

 bind WLAN-ESS 1                                                                

 service-template enable                                                       

#                                                                              

interface NULL0                                                                 

#                                                                              

interface Vlan-interface1                                                      

 ipv6 address 2003::3/64                                                        

 ipv6 address FE80::4 link-local                                               

 ip address 192.168.100.163 255.255.255.0                                      

 vrrp vrid 2 virtual-ip 192.168.100.245                                        

 vrrp ipv6 vrid 2 virtual-ip FE80::40 link-local                               

 vrrp ipv6 vrid 2 virtual-ip 2003::100                                         

#                                                                              

interface Vlan-interface10                                                     

 ipv6 address 3010::2/96                                                       

 ip address 192.168.10.2 255.255.255.0                                         

#                                                                               

interface Vlan-interface100                                                    

 ipv6 address 3001::2/96                                                       

 ip address 192.168.1.2 255.255.255.0                                          

#                                                                              

interface Vlan-interface200                                                    

#                                                                               

interface Vlan-interface300                                                    

 ipv6 address 3003::2/96                                                       

 ipv6 address FE80::3 link-local                                               

 ip address 192.168.3.2 255.255.255.0                                          

 vrrp vrid 1 virtual-ip 192.168.3.100                                          

 vrrp ipv6 vrid 1 virtual-ip FE80::30 link-local                               

 vrrp ipv6 vrid 1 virtual-ip 3003::100                                         

 portal control-mode mac

 portal server officev4 method direct                                          

 portal server officev6 method direct                                          

 portal domain dm4                                                             

 portal domain ipv6 dm6                                                        

 portal backup-group 1                                                          

portal nas-ip 192.168.3.100                                                   

 portal nas-ip ipv6 3003::100

#                                                                              

interface GigabitEthernet1/0/1                                                 

 port link-type trunk                                                          

 port trunk permit vlan 1 100 300                                              

#                                                                               

interface GigabitEthernet1/0/2                                                 

 port link-type trunk                                                          

 port trunk permit vlan 1 100                                                  

#                                                                              

interface GigabitEthernet1/0/3                                                 

 port access vlan 10                                                           

#                                                                              

interface WLAN-ESS1                                                            

 port link-type hybrid                                                          

 undo port hybrid vlan 1                                                       

 port hybrid vlan 200 300 untagged                                             

 port hybrid pvid vlan 200                                                      

 mac-vlan enable                                                               

#                                                                              

wlan ap ap1 model WA2620E-AGN id 1                                              

 serial-id 21023529G007C000020                                                

 radio 1                                                                       

 radio 2                                                                        

  service-template 1 vlan-id 300                                               

  radio enable                                                                 

#                                                                               

 dhbk enable backup-type symmetric-path                                        

 dhbk vlan 10                                                                  

#                                                                              

return                                                                          

·     Switch 1的配置文件:

#

 stp enable

#                                                                              

 

·     L2 Switch的配置文件:

#

 dhcp enable                                                                   

#                                                                              

 ipv6 dhcp server forbidden-address 3001::1 3001::4                            

 ipv6 dhcp server forbidden-address 3003::1 3003::4                            

#                                                                              

#                                                                              

vlan 1                                                                          

#                                                                              

vlan 100                                                                       

#                                                                               

vlan 200                                                                       

#                                                                              

vlan 300                                                                        

#                                                                              

 stp global enable                                                             

#                                                                               

dhcp server ip-pool 100                                                        

 network 192.168.1.0 mask 255.255.255.0                                        

#                                                                               

dhcp server ip-pool 300                                                        

 network 192.168.3.0 mask 255.255.255.0                                        

#                                                                              

ipv6 dhcp pool 1                                                               

 network 3001::/96                                                             

#                                                                              

ipv6 dhcp pool 2                                                               

 network 3003::/96                                                             

#                                                                              

ipv6 dhcp pool global                                                          

#                                                                              

interface NULL0                                                                

#                                                                               

interface Vlan-interface100                                                    

 ip address 192.168.1.3 255.255.255.0                                          

 ipv6 dhcp select server                                                        

 ipv6 dhcp server apply pool 1                                                 

 ipv6 address 3001::3/96                                                       

 ipv6 nd autoconfig managed-address-flag                                        

 ipv6 nd autoconfig other-flag                                                 

 undo ipv6 nd ra halt                                                          

#                                                                               

interface Vlan-interface300                                                    

 ip address 192.168.3.3 255.255.255.0                                          

 ipv6 dhcp select server                                                        

 ipv6 dhcp server apply pool 2                                                 

 ipv6 address 3003::3/96                                                       

 ipv6 nd autoconfig managed-address-flag                                       

 ipv6 nd autoconfig other-flag                                                 

 undo ipv6 nd ra halt                                                          

#                                                                              

interface GigabitEthernet1/0/1                                                 

 port link-type trunk                                                          

 port trunk permit vlan 1 100 300                                              

#                                                                               

interface GigabitEthernet1/0/2                                                 

 port access vlan 100                                                          

 poe enable                                                                    

#                                                                              

interface GigabitEthernet1/0/3                                                 

 port link-type trunk                                                          

 port trunk permit vlan 1 100 300                                              

 poe enable                                                                    

#                                                                               

return                                                                         

4  相关资料

·     《H3C无线控制器产品 配置指导》中的“WLAN配置指导”。

·     《H3C无线控制器产品 命令参考》中的“WLAN命令参考”。

·     《H3C无线控制器产品 配置指导》中的“安全配置指导”。

·     《H3C无线控制器产品 命令参考》中的“安全命令参考”。

·     《H3C无线控制器产品 配置指导》中的“二层技术配置指导”。

·     《H3C无线控制器产品 命令参考》中的“二层技术命令参考”。

·     《H3C无线控制器产品 配置指导》中的“可靠性配置指导”。

·     《H3C无线控制器产品 命令参考》中的“可靠性命令参考”。

 

不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!

新华三官网
联系我们