WDS Backhaul

Networking Requirements

This section describes how to deploy WDS backhaul in a native AC solution to eliminate the restriction of wired network deployment. For details about deploying the native AC solution, see Native AC Solution: Core Switches Function as the Gateway for Wired and Wireless Users. In this example, the networking is similar to that in the native AC solution, but Area C where AP5 resides requires wireless coverage. The existing access layer cannot support a wired connection to AP5 due to construction difficulties. Therefore, WDS backhaul in Area A where AP2 is located allows for network data transmission to Area B where AP3 and AP4 are located. Then AP4 transmits the data to AP5 through WDS backhaul, and AP5 provides wireless access to users.

Figure 2-23 Networking diagram for WDS backhaul

Device Requirements and Versions

Deployment Roadmap

Data Plan

Deployment Precautions

• It is not recommended that VLAN 1 be used as a service VLAN. Remove all interfaces from VLAN 1. Allow an interface to transparently transmit packets from a VLAN based on actual service requirements. Do not allow an interface to transparently transmit packets from all VLANs.

• In tunnel forwarding mode, the management VLAN and service VLAN must be different. Otherwise, MAC address flapping will occur, leading to a packet forwarding error. The network between the AC and APs needs to permit only packets tagged with the management VLAN ID and deny packets tagged with the service VLAN ID.

Procedure

1. Configure network connectivity and WLAN services on AP1. For details, see Native AC Solution: Core Switches Function as the Gateway for Wired and Wireless Users.

   The following focuses on how to configure AP2, AP3, AP4, and AP5.

2. Configure APs to go online on CORE.

   # In the back-to-back WDS networking, create AP groups wds-root1 and wds-root2 for root APs and AP groups wds-leaf1 and wds-leaf2 for leaf APs, and bind the regulatory domain profile domain1 to the AP groups.

   [CORE] wlan
   [CORE-wlan-view] ap-group name wds-root1
   [CORE-wlan-ap-group-wds-root1] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
   [CORE-wlan-ap-group-wds-root1] quit
   [CORE-wlan-view] ap-group name wds-root2
   [CORE-wlan-ap-group-wds-root2] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
   [CORE-wlan-ap-group-wds-root2] quit
   [CORE-wlan-view] ap-group name wds-leaf1
   [CORE-wlan-ap-group-wds-leaf1] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
   [CORE-wlan-ap-group-wds-leaf1] quit
   [CORE-wlan-view] ap-group name wds-leaf2
   [CORE-wlan-ap-group-wds-leaf2] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
   [CORE-wlan-ap-group-wds-leaf2] quit

   # Add AP2 to the AP group wds-root1, AP4 to the AP group wds-root2, AP3 to the AP group wds-leaf1, and AP5 to the AP group wds-leaf2.

   [CORE] wlan
   [CORE-wlan-view] ap auth-mode mac-auth
   [CORE-wlan-view] ap-id 2 ap-mac 60de-4474-9640
   [CORE-wlan-ap-2] ap-name AP2
   Warning: This operation may cause AP reset. Continue? [Y/N]:y
   [CORE-wlan-ap-2] ap-group wds-root1
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, whether to continue? [Y/N]:y
   [CORE-wlan-ap-2] quit
   [CORE-wlan-view] ap-id 3 ap-mac dcd2-fc04-b500
   [CORE-wlan-ap-3] ap-name AP3
   Warning: This operation may cause AP reset. Continue? [Y/N]:y
   [CORE-wlan-ap-3] ap-group wds-leaf1
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, whether to continue? [Y/N]:y
   [CORE-wlan-ap-3] quit
   [CORE-wlan-view] ap-id 4 ap-mac dcd2-fcf6-76a0
   [CORE-wlan-ap-4] ap-name AP4
   Warning: This operation may cause AP reset. Continue? [Y/N]:y
   [CORE-wlan-ap-4] ap-group wds-root2
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, whether to continue? [Y/N]:y
   [CORE-wlan-ap-4] quit
   [CORE-wlan-view] ap-id 5 ap-mac 60de-4476-e360
   [CORE-wlan-ap-5] ap-name AP5
   Warning: This operation may cause AP reset. Continue? [Y/N]:y
   [CORE-wlan-ap-5] ap-group wds-leaf2
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, whether to continue? [Y/N]:y
   [CORE-wlan-ap-5] quit

   # Configure radio parameters for WDS nodes. Radio 1 on the 5 GHz frequency band is used as an example. The parameter coverage distance indicates the radio coverage distance parameter, which is 3 (unit: 100 m) by default. This example sets the radio coverage distance parameter to 4. You can configure the parameter based on site requirements

   [CORE-wlan-view] ap-group name wds-root1
   [CORE-wlan-ap-group-wds-root1] radio 1
   [CORE-wlan-group-radio-wds-root1/1] channel 40mhz-plus 157    //Configure the channel and bandwidth for the WDS link, which must be the same on the two ends of the link.
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-group-radio-wds-root1/1] coverage distance 4     //Configure the radio coverage distance parameter based on the actual distance between APs, based on which the APs adjust the values of slottime, acktimeout, and ctstimeout.
   [CORE-wlan-group-radio-wds-root1/1] quit
   [CORE-wlan-ap-group-wds-root1] quit
   [CORE-wlan-view] ap-group name wds-root2
   [CORE-wlan-ap-group-wds-root2] radio 1
   [CORE-wlan-group-radio-wds-root2/1] channel 40mhz-plus 149
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-group-radio-wds-root2/1] coverage distance 4
   [CORE-wlan-group-radio-wds-root2/1] quit
   [CORE-wlan-ap-group-wds-root2] quit
   [CORE-wlan-view] ap-group name wds-leaf1
   [CORE-wlan-ap-group-wds-leaf1] radio 1
   [CORE-wlan-group-radio-wds-leaf1/1] channel 40mhz-plus 157
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-group-radio-wds-leaf1/1] coverage distance 4
   [CORE-wlan-group-radio-wds-leaf1/1] quit
   [CORE-wlan-ap-group-wds-leaf1] quit
   [CORE-wlan-view] ap-group name wds-leaf2
   [CORE-wlan-ap-group-wds-leaf2] radio 1
   [CORE-wlan-group-radio-wds-leaf2/1] channel 40mhz-plus 149
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-group-radio-wds-leaf2/1] coverage distance 4
   [CORE-wlan-group-radio-wds-leaf2/1] quit
   [CORE-wlan-ap-group-wds-leaf2] quit

   # Configure the security profile wds-sec referenced by WDS links. Configure the security policy of WPA2+PSK+AES for this security profile.

   [CORE-wlan-view] security-profile name wds-sec
   [CORE-wlan-sec-prof-wds-sec] security wpa2 psk pass-phrase YsHsjx_202206 aes
   [CORE-wlan-sec-prof-wds-sec] quit

   # Configure WDS whitelists. Configure the WDS whitelist wds-list1 to be bound to AP2 and add only the MAC address of AP3 to the whitelist. Configure the WDS whitelist wds-list2 to be bound to AP4 and add only the MAC address of AP5 to the whitelist.

   [CORE-wlan-view] wds-whitelist-profile name wds-list1
   [CORE-wlan-wds-whitelist-wds-list1] peer-ap mac dcd2-fc04-b500
   [CORE-wlan-wds-whitelist-wds-list1] quit
   [CORE-wlan-view] wds-whitelist-profile name wds-list2
   [CORE-wlan-wds-whitelist-wds-list2] peer-ap mac 60de-4476-e360
   [CORE-wlan-wds-whitelist-wds-list2] quit

   # Configure the WDS profile wds-net1. Set the WDS name to wds-net and WDS mode to root. Bind the WDS profile to the security profile wds-sec and allow packets from service VLAN 40 to pass through in tagged mode.

   [CORE-wlan-view] wds-profile name wds-net1
   [CORE-wlan-wds-prof-wds-net1] wds-name wds-net    //Only APs with the same WDS name can set up WDS links with each other.
   [CORE-wlan-wds-prof-wds-net1] wds-mode root
   [CORE-wlan-wds-prof-wds-net1] security-profile wds-sec
   [CORE-wlan-wds-prof-wds-net1] vlan tagged 40
   [CORE-wlan-wds-prof-wds-net1] quit

   # Configure the WDS profile wds-net2. Set the WDS name to wds-net and WDS mode to root. Bind the WDS profile to the security profile wds-sec and allow packets from service VLAN 40 to pass through in tagged mode.

   [CORE-wlan-view] wds-profile name wds-net2
   [CORE-wlan-wds-prof-wds-net2] wds-name wds-net
   [CORE-wlan-wds-prof-wds-net2] wds-mode root
   [CORE-wlan-wds-prof-wds-net2] security-profile wds-sec
   [CORE-wlan-wds-prof-wds-net2] vlan tagged 40
   [CORE-wlan-wds-prof-wds-net2] quit

   # Configure the WDS profile wds-net3. Set the WDS name to wds-net and WDS mode to leaf. Bind the WDS profile to the security profile wds-sec and allow packets from service VLAN 40 to pass through in tagged mode.

   [CORE-wlan-view] wds-profile name wds-net3
   [CORE-wlan-wds-prof-wds-net3] wds-name wds-net
   [CORE-wlan-wds-prof-wds-net3] wds-mode leaf
   [CORE-wlan-wds-prof-wds-net3] security-profile wds-sec
   [CORE-wlan-wds-prof-wds-net3] vlan tagged 40
   [CORE-wlan-wds-prof-wds-net3] quit

   # Bind the WDS whitelist wds-list1 to radio 1 in the AP group wds-root1 to permit access only from AP3. Bind the WDS whitelist wds-list2 to radio 1 in the AP group wds-root2 to permit access only from AP5.

   [CORE-wlan-view] ap-group name wds-root1
   [CORE-wlan-ap-group-wds-root1] radio 1
   [CORE-wlan-group-radio-wds-root1/1] wds-whitelist-profile wds-list1
   [CORE-wlan-group-radio-wds-root1/1] quit
   [CORE-wlan-ap-group-wds-root1] quit
   [CORE-wlan-view] ap-group name wds-root2
   [CORE-wlan-ap-group-wds-root2] radio 1
   [CORE-wlan-group-radio-wds-root2/1] wds-whitelist-profile wds-list2
   [CORE-wlan-group-radio-wds-root2/1] quit
   [CORE-wlan-ap-group-wds-root2] quit

   # Bind the WDS profile wds-net1 to the AP group wds-root1.

   [CORE-wlan-view] ap-group name wds-root1
   [CORE-wlan-ap-group-wds-root1] wds-profile wds-net1 radio 1
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-ap-group-wds-root1] quit

   # Bind the WDS profile wds-net2 to the AP group wds-root2.

   [CORE-wlan-view] ap-group name wds-root2
   [CORE-wlan-ap-group-wds-root2] wds-profile wds-net2 radio 1
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-ap-group-wds-root2] quit

   # Bind the WDS profile wds-net3 to the AP group wds-leaf1.

   [CORE-wlan-view] ap-group name wds-leaf1
   [CORE-wlan-ap-group-wds-leaf1] wds-profile wds-net3 radio 1
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-ap-group-wds-leaf1] quit

   # Bind the WDS profile wds-net3 to the AP group wds-leaf2.

   [CORE-wlan-view] ap-group name wds-leaf2
   [CORE-wlan-ap-group-wds-leaf2] wds-profile wds-net3 radio 1
   Warning: This action may cause service interruption. Continue?[Y/N]y
   [CORE-wlan-ap-group-wds-leaf2] quit

   # Configure the access switch Switch_C. Configure GE0/0/1 and GE0/0/2 to allow packets from the service VLAN to pass through.

   <HUAWEI> system-view
   [HUAWEI] sysname Switch_C
   [Switch_C] vlan batch 40
   [Switch_C] interface gigabitEthernet 0/0/1
   [Switch_C-GigabitEthernet0/0/1] port link-type trunk
   [Switch_C-GigabitEthernet0/0/1] port trunk allow-pass vlan 40
   [Switch_C-GigabitEthernet0/0/1] undo port trunk allow-pass vlan 1
   [Switch_C-GigabitEthernet0/0/1] stp edged-port enable
   [Switch_C-GigabitEthernet0/0/1] port-isolate enable
   [Switch_C-GigabitEthernet0/0/1] quit
   [Switch_C] interface gigabitEthernet 0/0/2
   [Switch_C-GigabitEthernet0/0/2] port link-type trunk
   [Switch_C-GigabitEthernet0/0/2] port trunk allow-pass vlan 40
   [Switch_C-GigabitEthernet0/0/2] undo port trunk allow-pass vlan 1
   [Switch_C-GigabitEthernet0/0/2] quit

3. Configure WLAN services.

   # Configure WLAN service parameters for AP5.

   [CORE-wlan-view] security-profile name sec2  
   [CORE-wlan-sec-prof-sec2] security open
   [CORE-wlan-sec-prof-sec2] quit
   [CORE-wlan-view] ssid-profile name ssid2
   [CORE-wlan-ssid-prof-ssid2] ssid test02
   [CORE-wlan-ssid-prof-ssid2] quit
   [CORE-wlan-view] traffic-profile name traff2
   [CORE-wlan-traffic-prof-traff2] user-isolate l2
   [CORE-wlan-traffic-prof-traff2] quit

   # Create WLAN VAP profiles, configure the service data forwarding mode and service VLANs, apply security profiles and SSID profiles, and enable strict STA IP address learning through DHCP, IPSG, and dynamic ARP inspection. For user access authentication modes, see Wired and Wireless User Access Authentication Deployment.

   [CORE-wlan-view] vap-profile name vap2
   [CORE-wlan-vap-prof-vap2] forward-mode direct
   [CORE-wlan-vap-prof-vap2] service-vlan vlan-id 40
   [CORE-wlan-vap-prof-vap2] security-profile sec2
   [CORE-wlan-vap-prof-vap2] ssid-profile ssid2
   [CORE-wlan-vap-prof-vap2] traffic-profile traff2
   [CORE-wlan-vap-prof-vap2] ip source check user-bind enable
   [CORE-wlan-vap-prof-vap2] arp anti-attack check user-bind enable
   [CORE-wlan-vap-prof-vap2] learn-client-address dhcp-strict
   [CORE-wlan-vap-prof-vap2] quit

   The prerequisites for running the ip source check user-bind enable command are as follows:

   As the IP packet check is based on the binding table:

   • For DHCP users, DHCP snooping on the device has been enabled to automatically generate dynamic binding entries.
   • For users using static IP addresses, static binding entries have been manually configured.

   The prerequisites for running the learn-client-address dhcp-strict command are as follows:

   • The DHCP trusted interface configured on an AP has been disabled using the undo dhcp trust port command in the VAP profile view.
   • STA IP address learning has been enabled using the undo learn-client-address { ipv4 | ipv6 } disable command.

   # Bind the VAP profile to the AP group wds-leaf2 to use the 2.4 GHz radio for WLAN coverage.

   [CORE-wlan-view] ap-group name wds-leaf2
   [CORE-wlan-ap-group-wds-leaf2] vap-profile vap2 wlan 2 radio 0
   [CORE-wlan-ap-group-wds-leaf2] quit
   [CORE-wlan-view] quit

Verifying the Deployment

Expected Result

WDS links are established and wireless users can access the network through AP5.

Verification Method

# Run the display ap all command to verify that WDS nodes go online successfully. If State displays as nor, APs have gone online successfully.

[CORE-wlan-view] display ap all
Total AP information:
nor  : normal          [4]
Extra information: P  : insufficient power supply
---------------------------------------------------------------------------------------------------
ID   MAC            Name Group          IP              Type            State STA Uptime ExtraInfo 
---------------------------------------------------------------------------------------------------
2    60de-4474-9640 AP2  wds-root1      172.16.20.250  AP6050DN        nor   0  1M:06S  -
3    dcd2-fc04-b500 AP3  wds-leaf1      172.16.20.251  AP6050DN        nor   0  1M:23S  -
4    dcd2-fcf6-76a0 AP4  wds-root2      172.16.20.252  AP6050DN        nor   0  1M:11S  -
5    60de-4476-e360 AP5  wds-leaf2      172.16.20.253  AP6050DN        nor   0  2M:06S  -
---------------------------------------------------------------------------------------------------
Total: 4

# Run the display wlan wds link all command to check information about the WDS links.

[CORE-wlan-view] display wlan wds link all
Rf   : radio ID             Dis  : coverage distance(100m)
Ch   : channel              Per  : drop percent(%)
TSNR : total SNR(dB)        P-   : peer
WDS  : WDS mode             Re   : retry ratio(%)
RSSI : RSSI(dBm)            MaxR : max RSSI(dBm)
-------------------------------------------------------------------------------------------------
APName  P-APName  Rf Dis   Ch   WDS     P-Status        RSSI  MaxR  Per  Re   TSNR  SNR(Ch0~2:dB)
-------------------------------------------------------------------------------------------------
AP2     AP3       1  3     157  root    normal          -44   -40   0    3    50   45/49/-
AP3     AP2       1  3     157  leaf    normal          -38   -36   0    49   57   36/31/57
AP4     AP5       1  3     149  root    normal          -11   -7    0    1    83   81/80/-
AP5     AP4       1  3     149  leaf    normal          -4    -4    0    0    91   90/85/-
-------------------------------------------------------------------------------------------------
Total: 4

# After a wireless user connects to AP5, you can view information about the wireless user on the AC.

[CORE-wlan-view] display station ssid test02
Rf/WLAN: Radio ID/WLAN ID
Rx/Tx: link receive rate/link transmit rate(Mbps)
-----------------------------------------------------------------------------------------------
STA MAC          AP ID Ap name  Rf/WLAN  Band  Type  Rx/Tx      RSSI  VLAN  IP address
-----------------------------------------------------------------------------------------------
00e0-fc12-3388   5     AP5      0/2      2.4G  11n   117/115    -71   40    172.16.40.180
-----------------------------------------------------------------------------------------------
Total: 1 2.4G: 1 5G: 0

Configuration Files

# AC configuration file

#
wlan
 traffic-profile name traff2
  user-isolate l2
 security-profile name sec2
  security open
 security-profile name wds-sec
  security wpa2 psk pass-phrase %^%#"G$t160(|>N&R$"<Z@6:\VY@T(}}]BJpHqK95`T6%^%# aes
 ssid-profile name ssid2
  ssid test02
 vap-profile name vap2
  service-vlan vlan-id 40
  ssid-profile ssid2
  traffic-profile traff2
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 wds-whitelist-profile name wds-list1
  peer-ap mac dcd2-fc04-b500
 wds-whitelist-profile name wds-list2
  peer-ap mac 60de-4476-e360
 wds-profile name wds-net1
  security-profile wds-sec
  vlan tagged 40
  wds-name wds-net
  wds-mode root
 wds-profile name wds-net2
  security-profile wds-sec
  vlan tagged 40
  wds-name wds-net
  wds-mode root
 wds-profile name wds-net3
  security-profile wds-sec
  vlan tagged 40
  wds-name wds-net
 regulatory-domain-profile name domain1
 ap-group name wds-leaf1
  regulatory-domain-profile domain1
  radio 1
   wds-profile wds-net3
   channel 40mhz-plus 157
   coverage distance 4
 ap-group name wds-leaf2
  regulatory-domain-profile domain1
  radio 0
   vap-profile vap2 wlan 2
  radio 1
   wds-profile wds-net3
   channel 40mhz-plus 149
   coverage distance 4
 ap-group name wds-root1
  regulatory-domain-profile domain1
  radio 1
   wds-profile wds-net1
   wds-whitelist-profile wds-list1
   channel 40mhz-plus 157
   coverage distance 4
 ap-group name wds-root2
  regulatory-domain-profile domain1
  radio 1
   wds-profile wds-net2
   wds-whitelist-profile wds-list2
   channel 40mhz-plus 149
   coverage distance 4
 ap-id 2 ap-mac 60de-4474-9640
  ap-name AP2
  ap-group wds-root1
 ap-id 3 ap-mac dcd2-fc04-b500
  ap-name AP3
  ap-group wds-leaf1
 ap-id 4 ap-mac dcd2-fcf6-76a0
  ap-name AP4
  ap-group wds-root2
 ap-id 5 ap-mac 60de-4476-e360
  ap-name AP5
  ap-group wds-leaf2
 provision-ap
#
return

# Switch_C configuration file

#
sysname Switch_C
#                          
 vlan batch 40
#                         
interface GigabitEthernet0/0/1                        
 port link-type trunk                          
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 40  
 stp edged-port enable
 port-isolate enable group 1
#                  
interface GigabitEthernet0/0/2                         
 port link-type trunk                             
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 40
#
return