Example for Configuring MAC Address Authentication on the Wireless Side

Procedure

1. Set the NAC mode to unified mode on the AC (default setting). Configure SwitchA and the AC to allow the AP and AC to transmit CAPWAP packets.

   # Add GE0/0/1 that connects SwitchA to the AP and GE0/0/2 that connects SwitchA to the AC to the management VLAN 100.

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchA
   [SwitchA] vlan batch 100
   [SwitchA] interface gigabitethernet 0/0/1
   [SwitchA-GigabitEthernet0/0/1] port link-type trunk
   [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
   [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/1] quit
   [SwitchA] interface gigabitethernet 0/0/2
   [SwitchA-GigabitEthernet0/0/2] port link-type trunk
   [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/2] quit

   # Add GE1/0/1 that connects the AC to SwitchA to VLAN 100.

   <HUAWEI> system-view
   [HUAWEI] sysname AC
   [AC] vlan batch 100 101
   [AC] interface gigabitethernet 1/0/1
   [AC-GigabitEthernet1/0/1] port link-type trunk
   [AC-GigabitEthernet1/0/1] port trunk allow-pass vlan 100
   [AC-GigabitEthernet1/0/1] quit

2. Configure the AC to communicate with the upstream device.

   # Configure VLANIF 101 (service VLAN), VLANIF 102, and VLANIF 103.

   [AC] vlan batch 101 102 103
   [AC] interface vlanif 101
   [AC-Vlanif101] ip address 10.10.10.1 24
   [AC-Vlanif101] quit
   [AC] interface vlanif 102
   [AC-Vlanif102] ip address 10.11.10.2 24
   [AC-Vlanif102] quit
   [AC] interface vlanif 103
   [AC-Vlanif103] ip address 10.12.10.2 24
   [AC-Vlanif103] quit

   # Add GE1/0/2 that connects the AC to the Router to VLAN 102.

   [AC] interface gigabitethernet 1/0/2
   [AC-GigabitEthernet1/0/2] port link-type trunk
   [AC-GigabitEthernet1/0/2] port trunk allow-pass vlan 102
   [AC-GigabitEthernet1/0/2] quit

   # Add GE1/0/2 that connects the AC to the RADIUS server to VLAN 103.

   [AC] interface gigabitethernet 1/0/3
   [AC-GigabitEthernet1/0/3] port link-type trunk
   [AC-GigabitEthernet1/0/3] port trunk allow-pass vlan 103
   [AC-GigabitEthernet1/0/3] quit

   # On the AC, configure a static route.

   [AC] ip route-static 0.0.0.0 0.0.0.0 10.11.10.1

3. Configure the AC to assign an IP address to the AP and configure the Router to assign IP addresses to STAs.

   # Configure the AC to assign an IP address to the AP from an interface IP address pool.

   [AC] dhcp enable
   [AC] interface vlanif 100
   [AC-Vlanif100] ip address 192.168.10.1 24
   [AC-Vlanif100] dhcp select interface  //Configure an interface-based address pool.
   [AC-Vlanif100] quit

   # Configure the AC as the DHCP relay agent and enable user entry detection on the AC.

   [AC] interface vlanif 101
   [AC-Vlanif101] dhcp select relay  //Configure the DHCP relay function.
   [AC-Vlanif101] dhcp relay server-ip 10.11.10.1  //Set the DHCP server address for DHCP relay to 10.11.10.1, which resides on Router.
   [AC-Vlanif101] quit

   # Configure the Router as a DHCP server to assign IP addresses to STAs.

   <Huawei> system-view
   [Huawei] sysname Router
   [Router] dhcp enable
   [Router] ip pool sta  //Configure the address pool to assign IP addresses to STAs.
   [Router-ip-pool-sta] gateway-list 10.10.10.1
   [Router-ip-pool-sta] network 10.10.10.0 mask 24
   [Router-ip-pool-sta] quit
   [Router] vlan batch 102
   [Router] interface vlanif 102
   [Router-Vlanif102] ip address 10.11.10.1 24
   [Router-Vlanif102] dhcp select global  //Configure a global address pool.
   [Router-Vlanif102] quit
   [Router] interface gigabitethernet 2/0/0
   [Router-GigabitEthernet2/0/0] port link-type trunk
   [Router-GigabitEthernet2/0/0] port trunk allow-pass vlan 102
   [Router-GigabitEthernet2/0/0] quit
   [Router] ip route-static 10.10.10.0 24 10.11.10.2  //Configure a route on the Router destined for the network segment 10.10.10.0/24.

4. Configure RADIUS authentication.
   1. Configure a RADIUS server template, an AAA authentication scheme, and domain information.

      The STA sends its MAC address as the user name to the RADIUS server for authentication, so the AC needs to be disabled from adding a domain name to the user name (default setting).

      [AC] radius-server template radius_huawei
      [AC-radius-radius_huawei] radius-server authentication 10.12.10.1 1812
      [AC-radius-radius_huawei] radius-server shared-key cipher YsHsjx_202206
      [AC-radius-radius_huawei] quit
      [AC] aaa
      [AC-aaa] authentication-scheme radius_huawei
      [AC-aaa-authen-radius_huawei] authentication-mode radius
      [AC-aaa-authen-radius_huawei] quit
      [AC-aaa] domain huawei.com
      [AC-aaa-domain-huawei.com] authentication-scheme radius_huawei
      [AC-aaa-domain-huawei.com] radius-server radius_huawei
      [AC-aaa-domain-huawei.com] quit
      [AC-aaa] quit

   2. Globally configure user names in MAC address authentication without the delimiter "-" (default setting).
   3. Test whether a STA can be authenticated using RADIUS authentication. In MAC address authentication, a STA's MAC address is used as the user name and password.

      [AC] test-aaa 001122334455 001122334455 radius-template radius_huawei
      Info: Account test succeed.
      

5. Configure AC system parameters.

   # Configure the country code.

   [AC] wlan ac-global country-code cn
   Warning: Modify the country code may delete configuration on those AP which use 
   the global country code and reset them, continue?[Y/N]:y

   # Configure the AC ID and carrier ID.

   [AC] wlan ac-global ac id 1 carrier id other  //The default AC ID is 0. Set the AC ID to 1.

   # Configure the source interface.

   [AC] wlan
   [AC-wlan-view] wlan ac source interface vlanif 100

6. Manage the AP on the AC.

   # Check the AP type ID after obtaining the MAC address of the AP.

   [AC-wlan-view] display ap-type all
     All AP types information:     
     ------------------------------------------------------------------------------
     ID     Type                   
     ------------------------------------------------------------------------------
     17     AP6010SN-GN            
     19     AP6010DN-AGN           
     21     AP6310SN-GN            
     23     AP6510DN-AGN           
     25     AP6610DN-AGN           
     27     AP7110SN-GN            
     28     AP7110DN-AGN           
     29     AP5010SN-GN            
     30     AP5010DN-AGN           
     31     AP3010DN-AGN           
     33     AP6510DN-AGN-US        
     34     AP6610DN-AGN-US        
     35     AP5030DN               
     36     AP5130DN               
     37     AP7030DE                                                               
     38     AP2010DN                                                               
     39     AP8130DN                                                               
     40     AP8030DN                                                               
     42     AP9330DN                                                               
     43     AP4030DN                                                               
     44     AP4130DN                                                               
     45     AP3030DN                                                               
     46     AP2030DN                                                               
     ------------------------------------------------------------------------------
     Total number: 23

   # Set the AP authentication mode to MAC address authentication (default setting). Add the AP offline based on the AP type ID. Assume that the AP type is AP6010DN-AGN, and the MAC address of the AP is 00e0-fc11-1111.

   [AC-wlan-view] ap id 0 type-id 19 mac 00e0-fc11-1111
   [AC-wlan-ap-0] quit

   # Configure an AP region and add the AP to the AP region.

   [AC-wlan-view] ap-region id 10  //Create AP region 10.
   [AC-wlan-ap-region-10] quit
   [AC-wlan-view] ap id 0
   [AC-wlan-ap-0] region-id 10  //Add AP to region 10.
   [AC-wlan-ap-0] quit

   # Power on the APs and run the display ap all command on the AC to check the AP running status. The command output shows that the AP status is normal.

   [AC-wlan-view] display ap all
     All AP information:             Normal[1],Fault[0],Commit-failed[0],Committing[0],Config[0],Download[0]       
     Config-failed[0],Standby[0],Type-not-match[0],Ver-mismatch[0]            
     ------------------------------------------------------------------------------
     AP    AP               AP              Profile   AP              AP           
                                            /Region                                
     ID    Type             MAC             ID        State           Sysname      
     ------------------------------------------------------------------------------
     0     AP6010DN-AGN     00e0-fc11-1111 0/10      normal          ap-0         
     ------------------------------------------------------------------------------
     Total number: 1,printed: 1   
   

7. Configure WLAN service parameters.

   # Create a WMM profile named wmm.

   [AC-wlan-view] wmm-profile name wmm id 1
   [AC-wlan-wmm-prof-wmm] quit

   # Create a radio profile named radio and bind the WMM profile wmm to the radio profile.

   [AC-wlan-view] radio-profile name radio id 1 
   [AC-wlan-radio-prof-radio] wmm-profile name wmm 
   [AC-wlan-radio-prof-radio] quit
   [AC-wlan-view] quit

   # Create WLAN-ESS interface 1.

   [AC] interface wlan-ess 1
   [AC-Wlan-Ess1] port trunk allow-pass vlan 101
   [AC-Wlan-Ess1] quit

   # Create a security profile named security.

   [AC] wlan
   [AC-wlan-view] security-profile name security id 1
   [AC-wlan-sec-prof-security] security open
   [AC-wlan-sec-prof-security] quit

   # Create a traffic profile named traffic.

   [AC-wlan-view] traffic-profile name traffic id 1
   [AC-wlan-traffic-prof-traffic] quit

   # Create a service set named test and bind the WLAN-ESS interface, security profile, and traffic profile to the service set.

   [AC-wlan-view] service-set name test id 1
   [AC-wlan-service-set-test] ssid test    //Set the SSID name to test.
   [AC-wlan-service-set-test] wlan-ess 1 
   [AC-wlan-service-set-test] security-profile name security
   [AC-wlan-service-set-test] traffic-profile name traffic
   [AC-wlan-service-set-test] service-vlan 101    //Set the VLAN ID of the service set to 101. The default value is 1.
   [AC-wlan-service-set-test] forward-mode tunnel    //Set the forwarding mode to tunnel forwarding.
   [AC-wlan-service-set-test] quit

8. Configure MAC address authentication on the WLAN-ESS interface.

   [AC-wlan-view] quit
   [AC] interface wlan-ess 1
   [AC-Wlan-Ess1] authentication mac-authen
   [AC-Wlan-Ess1] domain name huawei.com force
   [AC-Wlan-Ess1] permit-domain name huawei.com
   [AC-Wlan-Ess1] quit
   [AC] wlan

9. Configure a VAP and deliver VAP parameters to the AP.

   # Configure a VAP.

   [AC-wlan-view] ap 0 radio 0
   [AC-wlan-radio-0/0] radio-profile name radio  //Bind the radio template to a radio.
   [AC-wlan-radio-0/0] service-set name test  //Bind the service set to the radio.
   [AC-wlan-radio-0/0] quit

   # Commit the configuration.

   [AC-wlan-view] commit ap 0
   Warning: Committing configuration may cause service interruption, continue?[Y/N]y

10. Verify the configuration.
    • The WLAN with SSID test is available for STAs connected to the AP.
    • After the WLAN function is enabled on wireless devices, they can access the WLAN and provide public services.
    • After the STA connects to the WLAN, authentication is performed automatically. You can then directly access the WLAN.