苏州大型网站设计公司,建设路84号 网站备案,浙江建设工程信息网查询平台,人像摄影作品网络运维与网络安全 学习笔记 第三十一天
今日目标
实现AP自动注册、配置WLAN业务参数、无线终端通过wifi互访
实现AP自动注册
项目背景 企业内网的大量AP已经通过DHCP的方式获得IP地址 为了实现后期大量AP的统一管理#xff0c;希望通过AC实现集中控制 在AC设备上#…网络运维与网络安全 学习笔记 第三十一天
今日目标
实现AP自动注册、配置WLAN业务参数、无线终端通过wifi互访
实现AP自动注册
项目背景 企业内网的大量AP已经通过DHCP的方式获得IP地址 为了实现后期大量AP的统一管理希望通过AC实现集中控制 在AC设备上为了便于设备管理按照统一的命名格式
项目分析
需要确保AP知道AC服务器的IP地址 需要确保AP可以与AC保持IP层面的连通性 需要确保在AC上提前添加了AP的相关信息实现顺利注册
解决方案
需要确保AP知道AC服务器的IP地址 因为AP的地址信息全部来自于DHCP服务器所以我们需要调整DHCP服务器的配置内容在AP所在的VLAN的地址池中指定AC服务器的IP地址 需要确保AP可以与AC保持IP层面的连通性 需要确保在AC上提前添加了AP的相关信息实现顺利注册 配置思路 ①修改DHCP服务器的地址池添加AC服务器的IP地址 ②配置AC接口地址和路由实现AC与AP的网关设备之间的互通 ③配置AC服务器进行AP的自动注册 创建VLAN pool用于无线终端用户使用的vlan 创建AP组将需要使用相同配置的AP加入到同一个AP组实现统一配置 配置AC的系统参数包括国家代码、AC服务器与AP通信时使用的接口地址 配置AP的上线方式并离线导入AP实现AP正常上线 配置命令 确保AP知道AC服务器的IP地址 [DHCP]ip pool VLAN100 [DHCP-ip-pool-VLAN100]option 43 sub-option 3 ascii 192.168.200.1 [DHCP-ip-pool-VLAN100]quit 确保AP与AC之间的互通 [SW2]vlan 200 [SW2-vlan200]quit
[SW2]interface GigabitEthernet0/0/10 [SW2-GigabitEthernet0/0/10]port link-type access [SW2-GigabitEthernet0/0/10]port default vlan 200 [SW2-GigabitEthernet0/0/10]quit
[SW2]interface Vlanif 200 [SW2-Vlanif200]ip address 192.168.200.254 24 [SW2-Vlanif200]quit 确保AP与AC之间的互通 [AC6605]vlan 200 [AC6605-vlan200]quit
[AC6605]interface GigabitEthernet0/0/10 [AC6605-GigabitEthernet0/0/10]port link-type access [AC6605-GigabitEthernet0/0/10]port default vlan 200 [AC6605-GigabitEthernet0/0/10]quit
[AC6605]interface Vlanif 200 [AC6605-Vlanif200]ip address 192.168.200.1 24 [AC6605-Vlanif200]quit
[AC6605]ip route-static 0.0.0.0 0 192.168.200.254 配置AC创建VLAN pool 为无线终端用户提供服务 [AC6605]vlan pool pool1 [AC6605-vlan-pool-pool1]vlan 101 102 [AC6605-vlan-pool-pool1]quit
[AC6605]vlan pool pool2 [AC6605-vlan-pool-pool2]vlan 103 104 [AC6605-vlan-pool-pool2]quit [AC6605] 配置AC创建AP组以及国家代码和AC与AP的通信接口地址 [AC6605]wlan [AC6605-wlan-view]ap-group name neibu [AC6605-wlan-ap-group-neibu]quit
[AC6605-wlan-view]ap-group name wailai [AC6605-wlan-ap-goup-wailai]quit
[AC6605-wlan-view]regulatory-domain-profile name domain1 [AC6605-wlan-regulate-domain-domian1]country-code cn [AC6605-wlan-regulate-domain-domian1]quit [AC6605-wlan-view]ap-group name neibu [AC6605-wlan-ap-group-neibu]regulatory-domain-profile domain1 Warning:Modifying the country code will clear channel,power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y [AC6605-wlan-ap-group-group1]quit
[AC6605-wlan-view]ap-group name wailai [AC6605-wlan-ap-group-wailai]regulatory-domian-profile domain1 Warning:Modifying the country code will clear channel,power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y [AC6605-wlan-ap-group-group2]quit
[AC6605]capwap source interface Vlanif 200 配置AC离线导入AP [AC6605]wlan [AC6605-wlan-view]ap-id 1 ap-mac 00E0-FC9D-1580 [AC6605-wlan-ap-1]ap-name neibu-1 [AC6605-wlan-ap-1]ap-group neibu Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y [AC6605-wlan-ap-1]quit
[AC6605-wlan-view]ap-id 2 ap-mac 00e0-fc60-4c70 [AC6605-wlan-ap-2]ap-name neibu-2 [AC6605-wlan-ap-2]ap-group neibu Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y [AC6605-wlan-ap-2]quit
[AC6605-wlan-view]ap-id 3 ap-mac 00e0-fc56-6320 [AC6605-wlan-ap-3]ap-name wailai-1 [AC6605-wlan-ap-3]ap-group wailai Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y [AC6605-wlan-ap-3]quit
[AC6605-wlan-view]ap-id 4 ap-mac 00e0-fc4e-2fd0 [AC6605-wlan-ap-4]ap-name wailai-2 [AC6605-wlan-ap-4]ap-group wailai Warning:This operation may cause AP reset. If the country code changaes,it willclear channel,power and antenna gain configurations of the radio ,Whether to continue?[Y/N]:y [AC6605-wlan-ap-4]quit 在AC上查看AP的注册状态 [AC6605]display ap all Info:This operation may take a few seconds.Please wait for a moment.done. Total AP information: idle : idle [0] nor : normal [4] ID MAC Name Group IP Type State STA Uptime 1 00e0-fc9d-1580 neibu group1 192.168.100.253 AP5030DN nor 0 9M:54S 2 00e0-fc60-4c70 neibu group1 192.168.100.251 AP5030DN nor 0 3M:45S 3 00e0-fc56-6320 wailai group2 192.168.100.250 AP5030DN nor 0 9M:44S 4 00e0-fc4e-2fd0 wailai group2 192.168.100.252 AP5030DN nor 0 9m:44S
项目总结
AP在进行自助注册时必须通过DHCP获得AC服务器的IP地址 必须确保AP所在的VLAN与AC服务器之间的互通 必须在AC服务器上指定与AP通信时所使用的IP地址与DHCP服务区中的AC服务器的IP地址相同 在AC上离线导入AP的时候必须手动确认每个AP的MAC地址确保输入正确否则不能注册成功
配置WLAN业务参数
项目背景 企业内网的无线网络改造已经完成大部分工作AP成功注册到AC 基于分配好的IP方案为不同的无线终端动态分配IP地址 配置AC为不同的AP下发不同的位置确保可以发射无线信号 实现不同的“无线终端”可以成功连接AP并成功获得IP地址 实现不同的“无线终端”之间的互通
项目分析
首先需要确保AP能够发射出无线信号确保无线终端能够搜索到 其次确保每个无线关联了特定的VLAN信息 再次确保无线终端输入正确的wifi密码正确连接到wifi 然后再DHCP服务器上为每个无线终端 的VLAN创建了DHCP地址池 最后测试多个无线终端之间的连通性
解决方案
确定AP已经成功注册到AC通过配置AC为AP开启无线功能 确定AP发射的无线信号已经与“无线终端”的VLAN相关联 为每个终端用户所属于的VLAN配置DHCP服务 无线终端设备之间彼此测试连通性 配置思路 ①在AC上为AP配置WLAN业务参数 ②为每个终端用户的VLAN配置DHCP服务 在DHCP服务器上配置每个VLAN的地址池 为每个VLAN配置DHCP中继 配置路由条目确保DHCP服务器与每个VLAN的DHCP中继互通 ③测试无线终端设备之间的连通性 配置命令 ①在AC上为AP配置WLAN业务参数 [AC6605]wlan [AC6605-wlan-view]security-profile name neibu [AC6605-wlan-sec-prof-neibu]security wpa2 psk pass-phrase a1234567890 aes [AC6605-wlan-sec-prof-neibu]quit
[AC6605-wlan-view]security-profile name wailai [AC6605-wlan-sec-prof-wailai]security wpa2 psk pass-phrase b1234567890 aes [AC6605-wlan-sec-prof-wailai]quit
[AC6605-wlan-view]ssid-profile name wailai [AC6605-wlan-ssid-prof-wailai]ssid wailai [AC6605-wlan-ssid-prof-wailai]quit
[AC6605-wlan-view]ssid-profile name neibu [AC6605-wlan-ssid-prof-neibu]ssid name neibu [AC6605-wlan-ssid-prof-neibu]quit ②在AC上为AP配置WLAN业务参数 [AC6605-wlan-view]vap-profile name neibu [AC6605-wlan-vap-prof-neibu]security-profile neibu [AC6605-wlan-vap-prof-neibu]ssid-profile neibu [AC6605-wlan-vap-prof-neibu]service-vlan vlan-pool pool1 [AC6605-wlan-vap-prof-neibu]quit
[AC6605-wlan-view]vap-profile name wailai [AC6605-wlan-vap-prof-wailai]security-profile wailai [AC6605-wlan-vap-prof-wailai]ssid-profile wailai [AC6605-wlan-vap-prof-wailai]service-vlan vlan-pool pool2 [AC6605-wlan-vap-prof-wailai]quit
[AC6605-wlan-view]ap-group name neibu [AC6605-wlan-ap-group-neibu]vap-profile neibu wlan 1 radio 0 [AC6605-wlan-ap-group-neibu]vap-profile neibu wlan 1 radio 1 [AC6605-wlan-ap-group-neibu]quit
[AC6605-wlan-view]ap-group name wailai [AC6605-wlan-ap-group-wailai]vap-profile wailaiwlan 1 radio 0 [AC6605-wlan-ap-group-wailai]vap-profile wailaiwlan 1 radio 1 [AC6605-wlan-ap-group-wailai]quit ③为终端用户配置DHCP地址池 [DHCP]ip pool VLAN101 [DHCP-ip-pool-VLAN101]network 192.168.101.0 mask 24 [DHCP-ip-pool-VLAN101]gateway-list 192.168.101.254 [DHCP-ip-pool-VLAN101]quit
[DHCP]ip pool VLAN102 [DHCP-ip-pool-VLAN102]network 192.168.102.0 mask 24 [DHCP-ip-pool-VLAN102]gateway-list 192.168.102.254 [DHCP-ip-pool-VLAN102]quit
[DHCP]ip pool VLAN103 [DHCP-ip-pool-VLAN103]network 192.168.103.0 mask 24 [DHCP-ip-pool-VLAN103]gateway-list 192.168.103.254 [DHCP-ip-pool-VLAN103]quit
[DHCP]ip pool VLAN104 [DHCP-ip-pool-VLAN104]network 192.168.104.0 mask 24 [DHCP-ip-pool-VLAN104]gateway-list 192.168.104.254 [DHCP-ip-pool-VLAN104]quit
[DHCP]ip route-static 0.0.0.0 0 192.168.210.254 ④为终端用户配置DHCP中继 [SW1]vlan batch 101 102 103 104
[SW2]vlan batch 101 102 103 104 [SW2]dhcp enable
[SW2]interface Vlanif101 [SW2-Vlanif101]ip address 192.168.101.254 24 [SW2-Vlanif101]dhcp select relay [SW2-Vlanif101]dhcp relay server-ip 192.168.210.1 [SW2-Vlanif101]quit
[SW2]interface Vlanif102 [SW2-Vlanif102]ip address 192.168.102.254 24 [SW2-Vlanif102]dhcp select relay [SW2-Vlanif102]dhcp relay server-ip 192.168.210.1 [SW2-Vlanif102]quit
[SW2]interface Vlanif103 [SW2-Vlanif103]ip address 192.168.103.254 24 [SW2-Vlanif103]dhcp select relay [SW2-Vlanif103]dhcp relay server-ip 192.168.210.1 [SW2-Vlanif103]quit
[SW2]interface Vlanif104 [SW2-Vlanif104]ip address 192.168.104.254 24 [SW2-Vlanif104]dhcp select relay [SW2-Vlanif104]dhcp relay server-ip 192.168.210.1 [SW2-Vlanif104]quit ⑤无线终端连接到wifi信号输入密码获取IP地址 ⑥在无线终端的命令行验证IP地址是否正确ipconfig ⑦在无线终端的命令行验证设备之间的互通性ping x.x.x.x
项目总结
为了实现AP的批量管理需要将AP加入到ap-group 为了配置AP需要为ap-group关联vap-profile Vap-profile表示的是AP设备在AC上的配置文件 Vap-profile中包含了AP的无线名字、密码以及属于的VLAN 为确保无线终端可以顺利获得IP地址需要提前配置DHCP服务器和DHCP中继并确保两者之间的连通性
