CloudEngine S8700 V600R023C10 配置指南-用户接入与认证
https://support.huawei.com/enterprise/zh/doc/EDOC1100366594/1777aea9
举例：配置无线Portal认证示例（使用Portal协议）
组网需求
如图3-56所示，某企业DeviceA作为WAC，与AP直连。通过WLAN部署，提供名为“wlan-net”的无线网络方便员工接入。同时，WAC作为DHCP服务器为无线用户提供10.23.101.0/24网段的IP地址。
为降低企业网络安全风险，可在WAC上部署Portal认证并结合RADIUS服务器（RADIUS服务器与Portal服务器集成在一起），对接入网络的STA进行准入控制，满足企业的安全性需求。
本例中Interface1、Interface2分别代表10GE1/0/1、10GE1/0/2。
配置思路
配置WLAN基本业务，实现WAC与上下游网络互通和AP上线。
配置RADIUS认证参数。
配置Portal服务器模板。
配置Portal接入模板，并绑定Portal服务器模板。
配置免认证规则模板，实现WAC放行访问DNS服务器的报文。
配置认证模板，管理NAC认证的相关配置。
配置WLAN业务参数，在VAP模板下绑定安全模板和认证模板等，对访问WLAN网络的STA进行接入控制。
数据规划
配置项 | 数据 |
|---|---|
RADIUS认证参数 |
|
Portal服务器模板 |
|
Portal接入模板 |
|
免认证规则模板 |
|
认证域 | 认证域名称：example.com，并且绑定：
|
认证模板 |
|
DHCP服务器 | WAC作为DHCP服务器为STA和AP分配IP地址 |
AP的IP地址池 | 10.23.100.2～10.23.100.254/24 |
STA的IP地址池 | 10.23.101.2～10.23.101.254/24 |
WAC的源接口IP地址 | VLANIF100：10.23.100.1/24 |
AP组 |
|
域管理模板 |
|
SSID模板 |
|
安全模板 |
|
VAP模板 |
|
操作步骤
配置设备作为WAC，使AP与WAC之间能够传输CAPWAP报文
# 配置WAC，将接口10GE1/0/1加入VLAN100（管理VLAN）。
本示例的业务数据转发方式采用隧道转发。如果用户的数据转发方式为直接转发，建议在WAC连接AP的接口10GE1/0/1上配置端口隔离，如果不配置端口隔离，可能会在VLAN内产生不必要的广播报文，或者导致不同AP间的WLAN用户二层互通的问题。
隧道转发模式下，管理VLAN和业务VLAN不能配置为同一VLAN。
<HUAWEI> system-view [HUAWEI] sysname DeviceA [DeviceA] vlan batch 100 101 [DeviceA] interface 10ge 1/0/1 [DeviceA-10GE1/0/1] portswitch [DeviceA-10GE1/0/1] port link-type trunk [DeviceA-10GE1/0/1] port trunk pvid vlan 100 [DeviceA-10GE1/0/1] port trunk allow-pass vlan 100 [DeviceA-10GE1/0/1] quit
配置WAC与上层网络设备互通
# 配置WAC上行接口10GE1/0/2加入VLAN101（业务VLAN）。
[DeviceA] interface 10ge 1/0/2 [DeviceA-10GE1/0/2] portswitch [DeviceA-10GE1/0/2] port link-type trunk [DeviceA-10GE1/0/2] port trunk allow-pass vlan 101 [DeviceA-10GE1/0/2] quit
配置WAC作为DHCP服务器，为STA和AP分配IP地址
# 配置基于接口地址池的DHCP服务器，其中，VLANIF100接口为AP提供IP地址，VLANIF101为STA提供IP地址。
DNS服务器地址请根据实际需要配置。常用配置方法如下：
[DeviceA] dhcp enable [DeviceA] interface vlanif 100 [DeviceA-Vlanif100] ip address 10.23.100.1 24 [DeviceA-Vlanif100] dhcp select interface [DeviceA-Vlanif100] quit [DeviceA] interface vlanif 101 [DeviceA-Vlanif101] ip address 10.23.101.1 24 [DeviceA-Vlanif101] dhcp select interface [DeviceA-Vlanif101] quit
接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。
配置WAC到服务器区的路由（假设与WAC相连的上游设备的IP地址为10.23.101.2）
[DeviceA] ip route-static 10.23.200.0 255.255.255.0 10.23.101.2
配置AP上线
# 创建AP组，用于将相同配置的AP都加入同一AP组中。
[WAC] wlan [WAC-wlan] ap-group name ap-group1 [WAC-wlan-ap-group-ap-group1] quit
# 创建域管理模板，在域管理模板下配置WAC的国家码并在AP组下引用域管理模板。
[WAC-wlan] regulatory-domain-profile name domain1 [WAC-wlan-regulate-domain-domain1] country-code cn Warning: Modifying the country code will clear the channel and power configurations of radios, and requires the APs to be restarted if they run V200R019C10 or earlier. Continue? [Y/N]:y [WAC-wlan-regulate-domain-domain1] quit [WAC-wlan] ap-group name ap-group1 [WAC-wlan-ap-group-ap-group1] regulatory-domain-profile domain1 Warning: This configuration change will clear the channel and power configurations of radios, and may restart APs. Continue?[Y/N]:y [WAC-wlan-ap-group-ap-group1] quit [WAC-wlan] quit
# 配置WAC的源接口。
[WAC] interface vlanif 100 [WAC-Vlanif100] ip address 10.23.100.1 24 [WAC-Vlanif100] quit [WAC] capwap dtls no-auth enable Warning: This operation allows for device access in non-DTLS encryption mode even when DTLS is enabled and brings security risks. Af ter the device goes online for the first time, disable this function to prevent security risks. Continue? [Y/N]:y [WAC] capwap source interface vlanif 100 Set the DTLS PSK(contains 8-32 plain-text characters, or 128 or 148 cipher-text characters that must be a combination of at least tw o of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):******** Confirm PSK:******** Set the user name for FIT APs(The value is a string of 4 to 31 characters, which can contain letters, underscores, and digits, and m ust start with a letter):******** Set the password for FIT APs(plain-text password of 8-128 characters or cipher-text password of 128-268 characters that must be a co mbination of at least three of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):****** Confirm password:******** Set the PSK of the global offline management VAP(plain-text password of 8-63 characters or cipher-text password of 128-188 character s that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and speci al characters):******** Confirm PSK:********
为确保网络安全，在对端设备上线后，应及时执行命令undo capwap dtls no-auth enable，关闭CAPWAP的DTLS会话使用不认证方式，避免未授权设备接入网络。
# 在WAC上离线导入AP，并将AP加入AP组“ap-group1”中。假设AP的MAC地址为00e0-fc12-3456，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为00e0-fc12-3456的AP部署在1号区域，命名此AP为area_1。
ap auth-mode命令缺省情况下为MAC认证，如果之前没有修改其缺省配置，可以不用执行ap auth-mode mac-auth命令。
[WAC] wlan [WAC-wlan] ap auth-mode mac-auth Warning: The authentication mode is switched to MAC address authentication. Ensure that the APs added offline have MAC address information. Otherwise, configurations of these APs may be lost after the device restarts. Continue? [Y/N]:y [WAC-wlan] ap-id 0 ap-mac 00e0-fc12-3456 [WAC-wlan-ap-0] ap-name area_1 [WAC-wlan-ap-0] ap-group ap-group1 Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y [WAC-wlan-ap-0] quit [WAC-wlan] quit
# AP正常上线后，去使能CAPWAP的DTLS会话使用不认证方式。
[WAC] undo capwap dtls no-auth enable
配置RADIUS服务器模板、认证方案和计费方案。
请确保RADIUS服务器地址、端口号、共享密钥配置正确，并且和RADIUS服务器保持一致。
# 配置RADIUS服务器模板。
[DeviceA] radius-server template radius_huawei [DeviceA-radius-radius_huawei] radius-server authentication 10.23.200.1 1812 [DeviceA-radius-radius_huawei] radius-server accounting 10.23.200.1 1813 [DeviceA-radius-radius_huawei] radius-server shared-key cipher YsHsjx_202206mc@1 [DeviceA-radius-radius_huawei] quit
# 配置RADIUS方式的认证方案。
[DeviceA] aaa [DeviceA-aaa] authentication-scheme scheme1 [DeviceA-aaa-authen-scheme1] authentication-mode radius [DeviceA-aaa-authen-scheme1] quit
# 配置RADIUS方式的计费方案。
[DeviceA-aaa] accounting-scheme scheme2 [DeviceA-aaa-accounting-scheme2] accounting-mode radius [DeviceA-aaa-accounting-scheme2] accounting realtime 15 [DeviceA-aaa-accounting-scheme2] quit
用户数
实时计费间隔
1～99
3min
100～499
6min
500～999
12min
≥1000
≥15min
# 创建认证域“example.com”，并在其上绑定认证方案、计费方案和RADIUS服务器模板。
[DeviceA-aaa] domain example.com [DeviceA-aaa-domain-example.com] authentication-scheme scheme1 [DeviceA-aaa-domain-example.com] accounting-scheme scheme2 [DeviceA-aaa-domain-example.com] radius-server radius_huawei [DeviceA-aaa-domain-example.com] quit [DeviceA-aaa] quit
以设备与iMaster NCE-Campus对接为例，计费功能并非真实意义上的计算费用，而是通过计费报文维护终端的在线信息。
accounting realtime命令用来配置实时计费间隔。实时计费间隔的取值对设备和RADIUS服务器的性能有要求，实时计费间隔的取值越小，对设备和RADIUS服务器的性能就越高。请根据用户数设置实时计费间隔。
配置Portal服务器模板
请确保Portal服务器地址、URL地址、端口号、共享密钥配置正确，并且和Portal服务器保持一致。
[DeviceA] web-auth-server server-source all-interface [DeviceA] web-auth-server abc [DeviceA-web-auth-server-abc] server-ip 10.23.200.1 [DeviceA-web-auth-server-abc] shared-key cipher YsHsjx_202206 [DeviceA-web-auth-server-abc] port 50200 [DeviceA-web-auth-server-abc] url https://10.23.200.1:8445/portal [DeviceA-web-auth-server-abc] quit
配置Portal接入模板“portal1”，并绑定Portal服务器模板
[DeviceA] portal-access-profile name portal1 [DeviceA-portal-access-profile-portal1] web-auth-server abc [DeviceA-portal-access-profile-portal1] quit
配置免认证规则模板
[DeviceA] free-rule-template name default_free_rule [DeviceA-free-rule-default_free_rule] free-rule 1 destination ip 10.23.200.2 mask 24 [DeviceA-free-rule-default_free_rule] quit
配置认证模板“p1”
[DeviceA] authentication-profile name p1 [DeviceA-authentication-profile-p1] portal-access-profile portal1 [DeviceA-authentication-profile-p1] free-rule-template default_free_rule [DeviceA-authentication-profile-p1] access-domain example.com force [DeviceA-authentication-profile-p1] quit
配置WLAN业务参数
# 创建名为“wlan-security”的安全模板，并配置安全策略。
[DeviceA] wlan [DeviceA-wlan] security-profile name wlan-security [DeviceA-wlan-sec-prof-wlan-security] security open [DeviceA-wlan-sec-prof-wlan-security] quit
# 创建名为“wlan-ssid”的SSID模板，并配置SSID名称为“wlan-net”。
[DeviceA-wlan] ssid-profile name wlan-ssid [DeviceA-wlan-ssid-prof-wlan-ssid] ssid wlan-net [DeviceA-wlan-ssid-prof-wlan-ssid] quit
# 创建名为“wlan-vap”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、SSID模板和认证模板。
[DeviceA-wlan] vap-profile name wlan-vap [DeviceA-wlan-vap-prof-wlan-vap] forward-mode tunnel [DeviceA-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101 [DeviceA-wlan-vap-prof-wlan-vap] security-profile wlan-security [DeviceA-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid [DeviceA-wlan-vap-prof-wlan-vap] authentication-profile p1 [DeviceA-wlan-vap-prof-wlan-vap] quit
# 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-vap”的配置。
[DeviceA-wlan] ap-group name ap-group1 [DeviceA-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0 [DeviceA-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1 [DeviceA-wlan-ap-group-ap-group1] quit
配置AP射频的信道和功率。
射频的信道和功率自动调优功能默认开启，如果不关闭此功能则会导致手动配置不生效。举例中AP射频的信道和功率仅为示例，实际配置中请根据AP的国家码和网规结果进行配置。
# 关闭AP射频0的信道和功率自动调优功能，并配置AP射频0的信道和功率。
[DeviceA-wlan] ap-id 0 [DeviceA-wlan-ap-0] radio 0 [DeviceA-wlan-ap-0-radio-0] calibrate auto-channel-select disable [DeviceA-wlan-ap-0-radio-0] calibrate auto-txpower-select disable [DeviceA-wlan-ap-0-radio-0] channel 20mhz 6 Warning: This action may cause service interruption. Continue?[Y/N]y [DeviceA-wlan-ap-0-radio-0] eirp 127 [DeviceA-wlan-ap-0-radio-0] quit
# 关闭AP射频1的信道和功率自动调优功能，并配置AP射频1的信道和功率。
[DeviceA-wlan-ap-0] radio 1 [DeviceA-wlan-ap-0-radio-1] calibrate auto-channel-select disable [DeviceA-wlan-ap-0-radio-1] calibrate auto-txpower-select disable [DeviceA-wlan-ap-0-radio-1] channel 20mhz 149 Warning: This action may cause service interruption. Continue?[Y/N]y [DeviceA-wlan-ap-0-radio-1] eirp 127 [DeviceA-wlan-ap-0-radio-1] quit [DeviceA-wlan-ap-0] quit [DeviceA-wlan] quit
检查配置结果。
完成配置后，STA可以搜索到SSID为wlan-net的无线网络。
STA关联到无线网络上后，能够被分配相应的IP地址。
STA上打开浏览器访问网络时，会自动跳转到Portal服务器提供的认证页面，在页面上输入正确的用户名和密码后，STA认证成功并可以访问网络。
配置文件
DeviceA的配置文件
# sysname DeviceA # vlan batch 100 to 101 # authentication-profile name p1 portal-access-profile portal1 free-rule-template default_free_rule access-domain example.com force # dhcp enable # radius-server template radius_huawei radius-server shared-key cipher %^%#Oc6_BMCw#9gZ2@SMVtk!PAC6>Ou*eLW/"qLp+f#$%^%# radius-server authentication 10.23.200.1 1812 weight 80 radius-server accounting 10.23.200.1 1813 weight 80 # free-rule-template name default_free_rule free-rule 1 destination ip 10.23.200.2 mask 255.255.255.0 # web-auth-server server-source all-interface web-auth-server abc server-ip 10.23.200.1 port 50200 shared-key cipher %^%#4~ZXE3]6@BXu;2;aw}hA{rSb,@"L@T#e{%6G1AiD%^%# url https://10.23.200.1:8445/portal # portal-access-profile name portal1 web-auth-server abc # aaa authentication-scheme scheme1 authentication-mode radius accounting-scheme scheme2 accounting-mode radius accounting realtime 15 domain example.com authentication-scheme scheme1 accounting-scheme scheme2 radius-server radius_huawei # interface Vlanif100 ip address 10.23.100.1 255.255.255.0 dhcp select interface # interface Vlanif101 ip address 10.23.101.1 255.255.255.0 dhcp select interface # interface 10GE1/0/1 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 # interface 10GE1/0/2 port link-type trunk port trunk allow-pass vlan 101 # ip route-static 10.23.200.0 255.255.255.0 10.23.101.2 # capwap source interface vlanif 100 # wlan security-profile name wlan-security security open ssid-profile name wlan-ssid ssid wlan-net vap-profile name wlan-vap forward-mode tunnel service-vlan vlan-id 101 ssid-profile wlan-ssid security-profile wlan-security authentication-profile p1 regulatory-domain-profile name domain1 ap-group name ap-group1 regulatory-domain-profile domain1 radio 0 vap-profile wlan-vap wlan 1 radio 1 vap-profile wlan-vap wlan 1 ap-id 0 type-id 1 ap-mac 00e0-fc12-3456 ap-sn 210235554710CB000042 ap-name area_1 ap-group ap-group1 radio 0 channel 20mhz 6 eirp 127 calibrate auto-channel-select disable calibrate auto-txpower-select disable radio 1 channel 20mhz 149 eirp 127 calibrate auto-channel-select disable calibrate auto-txpower-select disable # return推荐本站淘宝优惠价购买喜欢的宝贝:
本文链接：https://hqyman.cn/post/8751.html 非本站原创文章欢迎转载，原创文章需保留本站地址！
微信支付宝扫一扫，打赏作者吧～休息一下~~
官码2024000195号
萌ICP备20248119号
