标签:src main exchange min quit rsa auth table 交换机
组网图形
如图1所示,FAT AP通过有线方式接入Internet,通过无线方式连接终端。现某企业分支机构为了保证工作人员可以随时随地的访问公司网络,需要通过部署WLAN基本业务实现移动办公。
项目 | 数据 |
---|---|
STA业务VLAN |
VLAN101 |
DHCP服务器 |
Router作为STA的DHCP服务器 |
STA地址池 |
10.23.101.3~10.23.101.254/24 |
SSID模板 |
|
安全模板 |
|
VAP模板 |
|
纯组播报文由于协议要求在无线空口没有ACK机制保障,且无线空口链路不稳定,为了纯组播报文能够稳定发送,通常会以低速报文形式发送。如果网络侧有大量异常组播流量涌入,则会造成无线空口拥堵。为了减小大量低速组播报文对无线网络造成的冲击,建议在直连AP的交换机接口上配置组播报文抑制功能。配置前请确认是否有组播业务,如果有,请谨慎配置限速值。配置方法请参见如何配置组播报文抑制,减小大量低速组播报文对无线网络造成的冲击?。
# 配置基于接口地址池的DHCP服务器,GE1/0/0为STA提供IP地址。
[Router] dhcp enable [Router] interface gigabitethernet 1/0/0 [Router-GigabitEthernet1/0/0] ip address 10.23.101.1 24 [Router-GigabitEthernet1/0/0] dhcp select interface [Router-GigabitEthernet1/0/0] dhcp server excluded-ip-address 10.23.101.2 [Router-GigabitEthernet1/0/0] quit
实例配置:
[Huawei]dis current-configuration # http secure-server ssl-policy default_policy http server enable # undo clock timezone # vlan batch 100 to 101 # authentication-profile name default_authen_profile authentication-profile name dot1x_authen_profile authentication-profile name mac_authen_profile authentication-profile name portal_authen_profile authentication-profile name macportal_authen_profile # dns resolve dns proxy enable # radius-server template default # pki realm default rsa local-key-pair default enrollment self-signed # ssl policy default_policy type server pki-realm default version tls1.0 tls1.1 tls1.2 ciphersuite rsa_aes_128_cbc_sha rsa_aes_128_sha256 rsa_aes_256_sha256 # acl name nat 2000 rule 5 permit # free-rule-template name default_free_rule # portal-access-profile name portal_access_profile # aaa authentication-scheme default authentication-scheme radius authentication-mode radius authorization-scheme default accounting-scheme default domain default authentication-scheme default domain default_admin authentication-scheme default local-user admin password irreversible-cipher $1a$=VGg7L*Co$$R7i^U\v%u%6e^N*Nj{*9RvhKGmsC{$t:&,A-$4b3$ local-user admin privilege level 15 local-user admin service-type ssh http # interface Vlanif1 ip address 169.254.1.1 255.255.0.0 nat outbound 2000 ip address dhcp-alloc unicast # interface Vlanif100 ip address 192.168.100.200 255.255.255.0 # interface Vlanif101 ip address 192.168.1.200 255.255.255.0 # interface GigabitEthernet0/0/0 port link-type access port default vlan 101 mac-learning priority 3 # interface NULL0 # undo snmp-agent # stelnet server enable undo telnet server enable ssh server secure-algorithms cipher aes256_ctr aes128_ctr ssh server secure-algorithms hmac sha2_256 ssh server key-exchange dh_group14_sha1 ssh client secure-algorithms cipher aes256_ctr aes128_ctr ssh client secure-algorithms hmac sha2_256 ssh client key-exchange dh_group14_sha1 # user-interface con 0 authentication-mode password set authentication password cipher %^%#Jln(HwG8$‘RnxlJ/{#pWXVd@.#_>D0JoC2~ze/=P;!,922n.nChp;N3}Q8$/%^%# user-interface vty 0 4 authentication-mode aaa protocol inbound ssh user-interface vty 16 20 protocol inbound all # wlan traffic-profile name default traffic-profile name default-ssid security-profile name default security-profile name zhiyi-new security wpa-wpa2 psk pass-phrase %^%#Jc>Q&D61r.%HY5Fvod.JZUiW-=GoX0<"08<T@J]%%^%# aes security-profile name default-ssid ssid-profile name default ssid-profile name zhiyi-new ssid zhiyi-new ssid-profile name default-ssid ssid HUAWEI-27A0 vap-profile name default vap-profile name zhiyi-new service-vlan vlan-id 101 ssid-profile zhiyi-new security-profile zhiyi-new vap-profile name default-ssid service-vlan vlan-id 100 ssid-profile default-ssid security-profile default-ssid traffic-profile default-ssid air-scan-profile name default rrm-profile name default radio-2g-profile name default radio-5g-profile name default wids # interface Wlan-Radio0/0/0 vap-profile default-ssid wlan 1 vap-profile zhiyi-new wlan 2 calibrate auto-txpower-select disable # interface Wlan-Radio0/0/1 vap-profile default-ssid wlan 1 vap-profile zhiyi-new wlan 2 calibrate auto-txpower-select disable # dot1x-access-profile name dot1x_access_profile # mac-access-profile name mac_access_profile # undo ntp-service enable # return [Huawei]
华为ap3010DN-V2刷出胖AP并配置接入POE交换机实现上网
标签:src main exchange min quit rsa auth table 交换机
原文地址:https://www.cnblogs.com/weifeng1463/p/10792528.html