标签：inf employee 重复 tin operation .com res rfid sid
2016年自己跟小伙伴一起搞的一个小活，客户是一家软件开发公司，专门做移动运动APP的，公司老板和一对IT男对无线提出了比较高的要求，用的是国产"菊花"厂的设备，当时对无线的很多概念仅仅停留在知道层面，理解的还不是很深入，搞了一个通宵之后交付给客户以后，自己当时小结了一下，翻出来，作为一个纪念。将接口GE0/0/1～GE0/0/5, 都加入VLAN100（AP管理VLAN，用于AC与AP之间互相通信）。
接口GE0/0/1～GE0/0/5下的配置完全一致，以配置接口GE0/0/1为例。
system-view
sysname MaLa-Switch
vlan batch 100
interface gigabitethernet 0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100
port-isolate enable
quit
#在交换机上创建VLANIF100～VLANIF103、VLANIF200和VLANIF201并配置IP地址。其中VLANIF100为AP的网关，VLANIF101为办公用户的网关，VLANIF102为开发部门员工的网关，VLANIF103为guest用户的网关；然后配置交换机接口GE0/0/6加入VLAN101～VLAN103（业务vlan）以及VLAN200，用于承载业务流量以及与交换机之间通信，接口GE0/0/24加入VLAN201, 于交换机与路由器通信。
interface vlanif 100
ip address 172.16.100.254 24
quit
interface vlanif 101
ip address 172.16.101.254 24
quit
interface vlanif 102
ip address 172.16.102.254 24
quit
interface vlanif 103
ip address 172.16.103.254 24
quit
int vlanif 200
ip add 10.10.200.2 24
quit
int vlanif 201
ip add 10.10.201.2 24
quit
interface gigabitethernet 0/0/6
port link-type trunk
port trunk allow-pass vlan 101 to 103 200
quit
interface gigabitethernet 0/0/24
port link-type trunk
port trunk allow-pass vlan 201
quit
<AC6605> system-view
[AC6605] sysname AC
[AC] vlan batch 101 to 103 200
[AC] interface vlanif 200
[AC-Vlanif200] ip address 10.10.200.1 24
[AC-Vlanif200] quit
[AC] interface gigabitethernet 0/0/1
[AC-GigabitEthernet0/0/1] port link-type trunk
[AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 101 to 103 200
[AC-GigabitEthernet0/0/1] quit
ip route-static 172.16.100.0 24 10.10.201.2
ip route-static 172.16.101.0 24 10.10.201.2
ip route-static 172.16.102.0 24 10.10.201.2
ip route-static 172.16.103.0 24 10.10.201.2
[Switch_B] ip route-static 0.0.0.0 0.0.0.0 10.10.201.1
[AC] ip route-static 172.16.100.0 24 10.10.200.2
步骤2 配置DHCP服务，为AP和终端机分配IP地址
dhcp enable
ip pool ap
network 172.16.100.0 mask 24
gateway-list 172.16.100.254
option 43 sub-option 3 ascii 10.10.200.1
quit
ip pool BanGong
network 172.16.101.0 mask 24
gateway-list 172.16.101.254
Dns-list 114.114.114.114
quit
ip pool KaiFa
network 172.16.102.0 mask 24
gateway-list 172.16.102.254
Dns-list 114.114.114.114
quit
ip pool Guest
network 172.16.103.0 mask 24
gateway-list 172.16.103.254
Dns-list 114.114.114.114
quit
步骤3 配置VLAN pool，用于承载无线的业务VLAN
说明：本例VLAN pool中的概念为：vlan用于在AC上隔离各终端，如果终端数量比较多，例如超出了255个，一个vlan pool中就可包含2个或者多个vlan，每个vlan对应一个网段，通过隔离用户的广播域，减轻对无线网络性能的影响。VLAN分配的算法配置为“hash”。分配算法缺省情况下为“hash”，如果之前没有修改其缺省配置，可以不用执行命令assignment hash。
本例VLAN pool仅以加入VLAN101和VLAN102两个VLAN为例，实际可以配置多个VLAN加入VLAN
pool，配置方法与VLAN101和VLAN102一致，也需要在Switch_B上创建对应的VLANIF接口、配置IP地址，在Router上配置IP地址池。
vlan pool mala-BanGong
vlan 101
assignment hash
quit
vlan pool mala-KaiFa
vlan 102
assignment hash
quit
vlan pool mala-Guest
vlan 103
assignment hash
quit
步骤4 配置AP上线
[AC] wlan
[AC-wlan-view] ap-group name MaLa-BanGong
[AC-wlan-ap-group-BanGong] quit
[AC-wlan-view] ap-group name MaLa-KaiFa
[AC-wlan-ap-group-KaiFa] quit
[AC-wlan-view] ap-group name MaLa-Guest
[AC-wlan-ap-group-Guest] quit
[AC-wlan-view] regulatory-domain-profile name domain1
[AC-wlan-regulatory-domain-prof-domain1] country-code cn
[AC-wlan-regulatory-domain-prof-domain1] quit
[AC-wlan-view] ap-group name MaLa-BanGong
[AC-wlan-ap-group-Mala-bangong] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-Mala-banggong] quit
[AC-wlan-view] ap-group name MaLa-KaiFa
[AC-wlan-ap-group-Mala-kaifa] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-Mala-kaifa] quit
[AC-wlan-view] ap-group name MaLa-Guest
[AC-wlan-ap-group-MaLa-Guest] regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-wlan-ap-group-MaLa-Guest] quit
[AC] capwap source interface vlanif 200 此条命令非常重要！！
区域的AP都加入到AP组“Maala-BanGong”，部署在2层办公区域的加入”Mala-kaifa“并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为60de-4474-9640的AP部署在办公区域2楼的1号房间，命名此AP为“Bangong-AP1”。
说明
ap auth-mode命令缺省情况下为MAC认证，如果之前没有修改其缺省配置，可以不用执行ap authmode
mac-auth。
举例中使用的AP为AP6010DN-AGN，具有射频0和射频1两个射频。AP6010DN-AGN的射频0为
2.4GHz射频，射频1为5GHz射频。
[AC] wlan
[AC-wlan-view] ap auth-mode mac-auth
[AC-wlan-view] ap-id 1 ap-mac 60de-4476-e360
[AC-wlan-ap-0] ap-name ap1
[AC-wlan-ap-0] ap-group mala-bangong
Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC-wlan-ap-0] quit
[AC-wlan-view] ap-id 2 ap-mac 60de-4476-e380
[AC-wlan-ap-1] ap-name ap2
[AC-wlan-ap-1] ap-group mala-bangong
Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC-wlan-ap-1] quit
[AC-wlan-view] ap-id 3 ap-mac 60de-4474-9640
[AC-wlan-ap-2] ap-name ap3
[AC-wlan-ap-2] ap-group mala-kaifa
Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC-wlan-ap-2] quit
[AC-wlan-view] ap-id 4 ap-mac 60de-4474-9660
[AC-wlan-ap-3] ap-name mala-kaifa
[AC-wlan-ap-3] ap-group employee
Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC-wlan-ap-3] quit
[AC-wlan-view] ap-id 5 ap-mac 60de-4474-9660
[AC-wlan-ap-3] ap-name ap5
[AC-wlan-ap-3] ap-group mala-guest
Warning: This operation may cause AP reset. If the country code changes, it will clear channel,power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC-wlan-ap-3] quit
Total: 4
步骤5 配置WLAN业务参数
说明：举例中以配置WPA2+PSK+AES的安全策略为例，密码分别为“a1234567”、“b1234567”，实际配置中请根据实际情况，配置符合实际要求的安全策略。
[AC-wlan-view] security-profile name mala-bangong
[AC-wlan-sec-prof-guest] security wpa2 psk pass-phrase mala.bangong.com aes
[AC-wlan-sec-prof-guest] quit
[AC-wlan-view] security-profile name mala-kaifa
[AC-wlan-sec-prof-employee] security wpa2 psk pass-phrase mala.kaifa.com aes
[AC-wlan-sec-prof-employee] quit
[AC-wlan-view] security-profile name mala-guest
[AC-wlan-sec-prof-employee] security wpa2 psk pass-phrase mala.guest.com aes
[AC-wlan-sec-prof-employee] quit
[AC-wlan-view] ssid-profile name mala-bangong
[AC-wlan-ssid-prof-guest] ssid MaLa-BanGong
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ssid-prof-guest] quit
[AC-wlan-view] ssid-profile name Mala-kaifa
[AC-wlan-ssid-prof-employee] ssid Mala-kaifa
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ssid-prof-employee] quit
[AC-wlan-view] ssid-profile name Mala-guest
[AC-wlan-ssid-prof-employee] ssid Mala-guest
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-ssid-prof-employee] quit
VLAN，并且引用安全模板和SSID模板。
[AC-wlan-view] vap-profile name mala-bangong
[AC-wlan-vap-prof-guest] forward-mode tunnel
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-vap-prof-guest] service-vlan vlan-pool mala-bangong
[AC-wlan-vap-prof-guest] security-profile mala-bangong
[AC-wlan-vap-prof-guest] ssid-profile mala-bangong
[AC-wlan-vap-prof-guest] quit
其余类似，不再重复。
[AC-wlan-view] ap-group name mala-bangong
[AC-wlan-ap-group-guest] vap-profile mala-bangong wlan 1 radio 0
[AC-wlan-ap-group-guest] vap-profile mala-bangong 1 radio 1
[AC-wlan-ap-group-guest] quit
其余类似，不再重复。
Total: 1 2.4G: 0 5G: 1
四、总结
当然，无线里面还涉及很多概念性的知识，例如：无线帧结构、CAPWAP的原理、客户端主/被动扫描、AP上线注册过程等等技术原理，华为的官方文档里面有很详细的介绍，在此不再赘述。本文图片和大部分文字也均摘抄自华为厂商文档：AC6605&AC6005&AC6003&ACU2V200R006(C10&C20) 配置指南(CLI)，如有侵权，请联系作者，及时删除。
整理者：路路 Email：ciscolulu@163.com 2016年8月
标签：inf employee 重复 tin operation .com res rfid sid
原文地址：http://blog.51cto.com/ciscolulu/2062801
