No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Fat AP and Cloud AP V200R008C00 CLI-based Configuration Guide

Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Configuration Examples

Configuration Examples

Example for Configuring a WEP Security Policy

Configuration Process

You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile,and WIDS profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. After that, the configuration is automatically delivered to and takes effect on the RUs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.

Networking Requirements

As shown in Figure 25-22, the central AP and RU are directly connected. A residential community provides a WLAN with the SSID wlan-net so that residents can access the network anywhere at any time. STAs automatically obtain IP addresses.

Because the WLAN is open to users, there are potential security risks. Users do not require high security, so a WEP security policy using shared key authentication and WEP encryption can be configured.

Figure 25-22  Networking diagram for configuring a WEP security policy
Configuration Roadmap
  1. Configure WLAN basic services so that STAs can access the WLAN.
  2. Configure a WEP security policy using shared key authentication and WEP-128 encryption in a security profile to ensure data security.
Table 25-6  Data planning

Item

Data

DHCP server The central AP functions as a DHCP server to assign IP addresses to the STAs and RU.
IP address pool for the RU 10.23.100.2-10.23.100.254/24
IP address pool for STAs 10.23.101.2-10.23.101.254/24
AP group
  • Name: ap-group1
  • Referenced profile: VAP profile wlan-vap and regulatory domain profile domain1
Regulatory domain profile
  • Name: domain1
  • Country code: CN
SSID profile
  • Name: wlan-ssid
  • SSID name: wlan-net
Security profile
  • Name: wlan-security
  • Security policy: WEP-128 encryption
  • Encryption key: a123456781234567
VAP profile
  • Name: wlan-vap
  • Service VLAN: VLAN 101
  • Referenced profile: SSID profile wlan-ssid and security profile wlan-security
Configuration Notes

Configure port isolation on the interfaces of the device directly connected to RUs. If port isolation is not configured, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.

Procedure

  1. Configure the central AP so that the RU and central AP can transmit CAPWAP packets.

    # Configure the central AP: add interface GE0/0/1 to management VLAN 100.

    <Huawei> system-view
    [Huawei] sysname AP
    [AP] vlan batch 100 101
    [AP] interface gigabitethernet 0/0/1
    [AP-GigabitEthernet0/0/1] port link-type trunk
    [AP-GigabitEthernet0/0/1] port trunk pvid vlan 100
    [AP-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
    [AP-GigabitEthernet0/0/1] quit
    

  2. Configure the central AP to communicate with the upstream device.

    NOTE:

    Configure central AP uplink interfaces to transparently transmit packets of service VLANs as required and communicate with the upstream device.

    # Add central AP uplink interface GE0/0/24 to service VLAN 101.

    [AP] interface gigabitethernet 0/0/24
    [AP-GigabitEthernet0/0/24] port link-type trunk
    [AP-GigabitEthernet0/0/24] port trunk allow-pass vlan 101
    [AP-GigabitEthernet0/0/24] quit
    

  3. Configure the central AP as a DHCP server to allocate IP addresses to STAs and the RU.

    # Configure the central AP as the DHCP server to allocate an IP address to the RU from the IP address pool on VLANIF 100, and allocate IP addresses to STAs from the IP address pool on VLANIF 101.

    NOTE:
    Configure the DNS server as required. The common methods are as follows:
    • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
    • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
    [AP] dhcp enable
    [AP] interface vlanif 100
    [AP-Vlanif100] ip address 10.23.100.1 24
    [AP-Vlanif100] dhcp select interface
    [AP-Vlanif100] quit
    [AP] interface vlanif 101
    [AP-Vlanif101] ip address 10.23.101.1 24
    [AP-Vlanif101] dhcp select interface
    [AP-Vlanif101] quit
    

  4. Configure the RU to go online.

    # Create an AP group and add the RU to the AP group.

    [AP] wlan
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] quit
    

    # Create a regulatory domain profile, configure the central AP country code in the profile, and apply the profile to the AP group.

    [AP-wlan-view] regulatory-domain-profile name domain1
    [AP-wlan-regulate-domain-domain1] country-code cn
    [AP-wlan-regulate-domain-domain1] quit
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
    e?[Y/N]:y 
    [AP-wlan-ap-group-ap-group1] quit
    [AP-wlan-view] quit
    

    # Configure the management VLAN for RUs connected to the central AP.

    [AP] management-vlan 100
    
    # Import the RU offline on the central AP and add the RU to AP group ap-group1. Assume that the RU's MAC address is 60de-4476-e360. Configure a name for the RU based on the RU's deployment location, so that you can know where the RU is deployed from its name. For example, name the RU area_1 if it is deployed in Area 1.
    NOTE:

    The default RU authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.

    In this example, the R240D is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).

    [AP] wlan
    [AP-wlan-view] ap auth-mode mac-auth
    [AP-wlan-view] ap-id 1 ap-mac 60de-4476-e360
    [AP-wlan-ap-1] ap-name area_1
    [AP-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
    s of the radio, Whether to continue? [Y/N]:y 
    [AP-wlan-ap-1] quit
    

    # After the RU is powered on, run the display ap all command to check the RU state. If the State field is displayed as nor, the RU goes online normally.

    [AP-wlan-view] display ap all
    Total AP information:
    nor  : normal          [1]
    -------------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    -------------------------------------------------------------------------------------
    1    60de-4476-e360 area_1 ap-group1 10.23.100.254 R240D           nor   0   10S
    -------------------------------------------------------------------------------------
    Total: 1

  5. Configure WLAN service parameters.

    # Create the security profile wlan-security and set the security policy to WEP.

    [AP-wlan-view] security-profile name wlan-security
    [AP-wlan-sec-prof-wlan-security] security wep share-key
    Warning:  If the wmm disable command, TKIP, WEP, or radio type of 802.11a/b/g is configured, the function of denying access of legacy STAs cannot take effect. 
    [AP-wlan-sec-prof-wlan-security] wep key 0 wep-128 pass-phrase a123456781234567
    [AP-wlan-sec-prof-wlan-security] wep default-key 0
    [AP-wlan-sec-prof-wlan-security] quit
    

    # Create the SSID profile wlan-ssid and set the SSID name to wlan-net.

    [AP-wlan-view] ssid-profile name wlan-ssid
    [AP-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AP-wlan-ssid-prof-wlan-ssid] quit
    

    # Create the VAP profile wlan-vap, set the service VLAN, and apply the security profile and SSID profile to the VAP profile.

    [AP-wlan-view] vap-profile name wlan-vap
    [AP-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AP-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AP-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AP-wlan-vap-prof-wlan-vap] quit
    

    # Bind the VAP profile wlan-vap to the AP group and apply the profile to radio 0 and radio 1 of the RU.

    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1
    [AP-wlan-ap-group-ap-group1] quit
    

  6. Set channels and power for the RU radios.

    NOTE:

    Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The channel and power configuration for the RU radios in this example is for reference only. In actual scenarios, configure channels and power for RU radios based on country codes of RUs and network planning results.

    # Disable automatic channel and power calibration functions of radio 0, and configure the channel and power for radio 0.
    [AP-wlan-view] ap-id 1
    [AP-wlan-ap-1] radio 0
    [AP-wlan-radio-1/0] calibrate auto-channel-select disable
    [AP-wlan-radio-1/0] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/0] eirp 127
    [AP-wlan-radio-1/0] quit
    # Disable automatic channel and power calibration functions of radio 1, and configure the channel and power for radio 1.
    [AP-wlan-ap-1] radio 1
    [AP-wlan-radio-1/1] calibrate auto-channel-select disable
    [AP-wlan-radio-1/1] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/1] eirp 127
    [AP-wlan-radio-1/1] quit
    [AP-wlan-ap-1] quit

  7. Verify the configuration.

    The WLAN with SSID wlan-net is available for STAs connected to the RU.

    If a STA has an incorrect shared key configured, the STA cannot access the WLAN.

    NOTE:
    After the PC scans an SSID, if you double-click the SSID and enter the key, association may fail. You need to add a WLAN on the PC.
    • Configuration on the Windows XP operating system:

      1. On the Association tab page of the Wireless network properties dialog box, add SSID wlan-net, cancel the selection of The key is provided for me automatically, set the network authentication mode to shared-key mode and encryption mode to WEP, and configure the network key and corresponding key index.
    • Configuration on the Windows 7 operating system:

      1. Access the Manage wireless networks page, click Add, and select Manually create a network profile. Add SSID wlan-net, set the encryption and authentication modes, and click Next.
      2. Click Change connection settings, click the Security tab, and set the key index on the Security tab page.

Configuration Files

Central AP configuration file

#
 sysname AP
#
vlan batch 100 to 101
#
dhcp enable
#
interface Vlanif100
 ip address 10.23.100.1 255.255.255.0
 dhcp select interface
#
interface Vlanif101
 ip address 10.23.101.1 255.255.255.0
 dhcp select interface
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/24
 port link-type trunk
 port trunk allow-pass vlan 101
#
management-vlan 100
#
wlan
 security-profile name wlan-security
  security wep share-key
  wep key 0 wep-128 pass-phrase %^%#n}@bOmft:IG"|%Sq.Rs0GYm=Sc.iX4k<_b9mL^LT%^%#
 ssid-profile name wlan-ssid
  ssid wlan-net
 vap-profile name wlan-vap
  service-vlan vlan-id 101
  ssid-profile wlan-ssid
  security-profile wlan-security
 regulatory-domain-profile name domain1
 ap-group name ap-group1
  regulatory-domain-profile domain1
  radio 0
   vap-profile wlan-vap wlan 1
  radio 1
   vap-profile wlan-vap wlan 1
 ap-id 1 type-id 55 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
  ap-name area_1
  ap-group ap-group1
  radio 0
   channel 20mhz 6
   eirp 127
   calibrate auto-channel-select disable
   calibrate auto-txpower-select disable
  radio 1
   channel 20mhz 149
   eirp 127
   calibrate auto-channel-select disable
   calibrate auto-txpower-select disable
#
return

Example for Configuring a WPA2-PSK-AES Security Policy

Configuration Process

You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile,and WIDS profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. After that, the configuration is automatically delivered to and takes effect on the RUs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.

Networking Requirements

A residential community provides a WLAN with the SSID wlan-net so that residents can access the network anywhere at any time. As shown in Figure 25-23, the RU deployed in a resident's home is directly connected to the central AP. STAs automatically obtain IP addresses.

Because the WLAN is open to users, there are potential security risks if no security policy is configured on the WLAN. Users do not require high WLAN security, so no authentication server is required. A WEP or WPA/WPA2 (pre-shared key) security policy can be configured. STAs support WPA/WPA2, TKIP encryption, and AES encryption, so pre-shared key authentication and AES encryption are used to secure data transmission. WEP security policy that is easy to be deciphered is not used.

Figure 25-23  Networking diagram for configuring a WPA2-PSK-AES security policy
Configuration Roadmap
  1. Configure WLAN basic services so that STAs can access the WLAN.
  2. Configure a WPA2 security policy using pre-shared key authentication and AES encryption in a security profile to ensure data security.
Table 25-7  Data planning

Item

Data

DHCP server The central AP functions as a DHCP server to assign IP addresses to the STAs and RU.
IP address pool for the RU 10.23.100.2-10.23.100.254/24
IP address pool for STAs 10.23.101.2-10.23.101.254/24
AP group
  • Name: ap-group1
  • Referenced profile: VAP profile wlan-vap and regulatory domain profile domain1
Regulatory domain profile
  • Name: domain1
  • Country code: CN
SSID profile
  • Name: wlan-ssid
  • SSID name: wlan-net
Security profile
  • Name: wlan-security
  • Security policy: WPA2-PSK-AES
  • Password: a1234567
VAP profile
  • Name: wlan-vap
  • Service VLAN: VLAN 101
  • Referenced profile: SSID profile wlan-ssid and security profile wlan-security
Configuration Notes

Configure port isolation on the interfaces of the device directly connected to RUs. If port isolation is not configured, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.

Procedure

  1. Configure the central AP so that the RU and central AP can transmit CAPWAP packets.

    # Configure the central AP: add interface GE0/0/1 to management VLAN 100.

    <Huawei> system-view
    [Huawei] sysname AP
    [AP] vlan batch 100 101
    [AP] interface gigabitethernet 0/0/1
    [AP-GigabitEthernet0/0/1] port link-type trunk
    [AP-GigabitEthernet0/0/1] port trunk pvid vlan 100
    [AP-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
    [AP-GigabitEthernet0/0/1] quit
    

  2. Configure the central AP to communicate with the upstream device.

    NOTE:

    Configure central AP uplink interfaces to transparently transmit packets of service VLANs as required and communicate with the upstream device.

    # Add central AP uplink interface GE0/0/24 to service VLAN 101.

    [AP] interface gigabitethernet 0/0/24
    [AP-GigabitEthernet0/0/24] port link-type trunk
    [AP-GigabitEthernet0/0/24] port trunk allow-pass vlan 101
    [AP-GigabitEthernet0/0/24] quit
    

  3. Configure the central AP as a DHCP server to allocate IP addresses to STAs and the RU.

    # Configure the central AP as the DHCP server to allocate an IP address to the RU from the IP address pool on VLANIF 100, and allocate IP addresses to STAs from the IP address pool on VLANIF 101.

    NOTE:
    Configure the DNS server as required. The common methods are as follows:
    • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
    • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
    [AP] dhcp enable
    [AP] interface vlanif 100
    [AP-Vlanif100] ip address 10.23.100.1 24
    [AP-Vlanif100] dhcp select interface
    [AP-Vlanif100] quit
    [AP] interface vlanif 101
    [AP-Vlanif101] ip address 10.23.101.1 24
    [AP-Vlanif101] dhcp select interface
    [AP-Vlanif101] quit
    

  4. Configure the RU to go online.

    # Create an AP group and add the RU to the AP group.

    [AP] wlan
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] quit
    

    # Create a regulatory domain profile, configure the central AP country code in the profile, and apply the profile to the AP group.

    [AP-wlan-view] regulatory-domain-profile name domain1
    [AP-wlan-regulate-domain-domain1] country-code cn
    [AP-wlan-regulate-domain-domain1] quit
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
    e?[Y/N]:y 
    [AP-wlan-ap-group-ap-group1] quit
    [AP-wlan-view] quit
    

    # Configure the management VLAN for RUs connected to the central AP.

    [AP] management-vlan 100
    
    # Import the RU offline on the central AP and add the RU to AP group ap-group1. Assume that the RU's MAC address is 60de-4476-e360. Configure a name for the RU based on the RU's deployment location, so that you can know where the RU is deployed from its name. For example, name the RU area_1 if it is deployed in Area 1.
    NOTE:

    The default RU authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.

    In this example, the R240D is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).

    [AP] wlan
    [AP-wlan-view] ap auth-mode mac-auth
    [AP-wlan-view] ap-id 1 ap-mac 60de-4476-e360
    [AP-wlan-ap-1] ap-name area_1
    [AP-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
    s of the radio, Whether to continue? [Y/N]:y 
    [AP-wlan-ap-1] quit
    

    # After the RU is powered on, run the display ap all command to check the RU state. If the State field is displayed as nor, the RU goes online normally.

    [AP-wlan-view] display ap all
    Total AP information:
    nor  : normal          [1]
    -------------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    -------------------------------------------------------------------------------------
    1    60de-4476-e360 area_1 ap-group1 10.23.100.254 R240D           nor   0   10S
    -------------------------------------------------------------------------------------
    Total: 1

  5. Configure WLAN service parameters.

    # Create the security profile wlan-security and set the security policy to WPA2-PSK-AES.

    [AP-wlan-view] security-profile name wlan-security
    [AP-wlan-sec-prof-wlan-security] security wpa2 psk pass-phrase a1234567 aes
    [AP-wlan-sec-prof-wlan-security] quit
    

    # Create the SSID profile wlan-ssid and set the SSID name to wlan-net.

    [AP-wlan-view] ssid-profile name wlan-ssid
    [AP-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AP-wlan-ssid-prof-wlan-ssid] quit
    

    # Create the VAP profile wlan-vap, set the service VLAN, and apply the security profile and SSID profile to the VAP profile.

    [AP-wlan-view] vap-profile name wlan-vap
    [AP-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AP-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AP-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AP-wlan-vap-prof-wlan-vap] quit
    

    # Bind the VAP profile wlan-vap to the AP group and apply the profile to radio 0 and radio 1 of the RU.

    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1
    [AP-wlan-ap-group-ap-group1] quit
    

  6. Set channels and power for the RU radios.

    NOTE:

    Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The channel and power configuration for the RU radios in this example is for reference only. In actual scenarios, configure channels and power for RU radios based on country codes of RUs and network planning results.

    # Disable automatic channel and power calibration functions of radio 0, and configure the channel and power for radio 0.
    [AP-wlan-view] ap-id 1
    [AP-wlan-ap-1] radio 0
    [AP-wlan-radio-1/0] calibrate auto-channel-select disable
    [AP-wlan-radio-1/0] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/0] eirp 127
    [AP-wlan-radio-1/0] quit
    # Disable automatic channel and power calibration functions of radio 1, and configure the channel and power for radio 1.
    [AP-wlan-ap-1] radio 1
    [AP-wlan-radio-1/1] calibrate auto-channel-select disable
    [AP-wlan-radio-1/1] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/1] eirp 127
    [AP-wlan-radio-1/1] quit
    [AP-wlan-ap-1] quit

  7. Verify the configuration.

    • The WLAN with SSID wlan-net is available for STAs connected to the RU.
    • The wireless PC obtains an IP address after it associates with the WLAN. The STA can access the WLAN after the wireless user enters the password.

Configuration Files
  • Central AP configuration file

    #
     sysname AP
    #
    vlan batch 100 to 101
    #
    dhcp enable
    #
    interface Vlanif100
     ip address 10.23.100.1 255.255.255.0
     dhcp select interface
    #
    interface Vlanif101
     ip address 10.23.101.1 255.255.255.0
     dhcp select interface
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk pvid vlan 100
     port trunk allow-pass vlan 100
    #
    interface GigabitEthernet0/0/24
     port link-type trunk
     port trunk allow-pass vlan 101
    #
    management-vlan 100
    #
    wlan
     security-profile name wlan-security
      security wpa2 psk pass-phrase %^%#m"tz0f>~7.[`^6RWdzwCy16hJj/Mc!,}s`X*B]}A%^%# aes
     ssid-profile name wlan-ssid
      ssid wlan-net
     vap-profile name wlan-vap
      service-vlan vlan-id 101
      ssid-profile wlan-ssid
      security-profile wlan-security
     regulatory-domain-profile name domain1
     ap-group name ap-group1
      regulatory-domain-profile domain1
      radio 0
       vap-profile wlan-vap wlan 1
      radio 1
       vap-profile wlan-vap wlan 1
     ap-id 1 type-id 55 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
      ap-name area_1
      ap-group ap-group1
      radio 0
       channel 20mhz 6
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
      radio 1
       channel 20mhz 149
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
    #
    return

Example for Configuring a WPA2-802.1X-AES Security Policy

Configuration Process

You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile,and WIDS profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. After that, the configuration is automatically delivered to and takes effect on the RUs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.

Networking Requirements

As shown in Figure 25-24, the enterprise's central AP connects to the egress gateway (Router) and RADIUS server, and connects to the RU through SwitchA. The WLAN with the SSID wlan-net is available for employees to access network resources. The gateway also functions as a DHCP server to provide IP addresses on the 10.23.101.0/24 network segment for STAs. The central AP controls and manages STAs.

Because the WLAN is open to users, there are potential security risks to enterprise information if no security policy is configured for the WLAN. The enterprise requires high information security, so a WPA2 security policy using 802.1X authentication and AES encryption can be configured. The RADIUS server authenticates STA identities. The central AP must be configured to function as an EAP relay, so the central AP supports 802.1X authentication.

Figure 25-24  Networking diagram for configuring 802.1X authentication
Configuration Roadmap
  1. Configure the RU, central AP, and upper-layer devices to communicate with each other.
  2. Configure the central AP to assign an IP address to the RU and the Router to assign IP addresses to STAs.
  3. Configure RADIUS authentication parameters.
  4. Configure an 802.1X access profile to manage 802.1X access control parameters.
  5. Configure an authentication profile, and apply the 802.1X access profile, authentication scheme, and RADIUS server template to the authentication profile.
  6. Configure the RU to go online.
  7. Configure WLAN service parameters, set the security policy to WPA2-802.1X-AES, and bind the security profile and authentication profile to the VAP profile to control access from STAs.
NOTE:

Ensure that the RADIUS server IP address, port number, and shared key are correct and consistent with the RADIUS server. When the central AP functions as an EAP relay, ensure that the RADIUS server supports the EAP protocol. Otherwise, the RADIUS server cannot process 802.1X authentication requests.

Table 25-8  Data planning

Item

Data

Management VLAN

VLAN 100

Service VLAN

VLAN 101

SwitchA VLAN

VLAN 100

DHCP server

  • IP address that the central AP assigns to the RU: 10.23.100.2-10.23.100.254/24
  • IP addresses that Router assigns to STAs: 10.23.101.2-10.23.101.254/24
  • IP address of DNS server: 8.8.8.8

Gateway for the RU

VLANIF 100: 10.23.100.1/24

Gateway for STAs

VLANIF 101: 10.23.101.1/24

RADIUS authentication parameters

  • Name of a RADIUS server template: radius_huawei
  • IP address: 10.23.103.1
  • Authentication port number: 1812
  • Shared key: huawei@123
  • Authentication scheme: radius_huawei

User name and password of STAs

  • User name: test
  • Password: 123456

802.1X access profile

  • Name: wlan-dot1x
  • Authentication mode: EAP

Authentication profile

  • Name: wlan-authentication
  • Referenced profile, authentication scheme, and template: 802.1X access profile wlan-dot1x, authentication scheme radius_huawei, and RADIUS server template radius_huawei
AP group
  • Name: ap-group1
  • Referenced profile: VAP profile wlan-vap and regulatory domain profile domain1
Regulatory domain profile
  • Name: domain1
  • Country code: CN
SSID profile
  • Name: wlan-ssid
  • SSID name: wlan-net
Security profile
  • Name: wlan-security
  • Security policy: WPA2-802.1X-AES
VAP profile
  • Name: wlan-vap
  • Service VLAN: VLAN 101
  • Referenced profile: SSID profile wlan-ssid, security profile wlan-security, and authentication profile wlan-authentication
Configuration Notes

Configure port isolation on the interfaces of the device directly connected to RUs. If port isolation is not configured, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.

Procedure

  1. Configure SwitchA and the central AP so that the RU and central AP can transmit CAPWAP packets.

    # Add GE0/0/1 that connects SwitchA to the RU to management VLAN 100 and VLAN 101, and add GE0/0/2 that connects SwitchA to the central AP to the same VLAN.

    <HUAWEI> system-view
    [HUAWEI] sysname SwitchA
    [SwitchA] vlan batch 100 101
    [SwitchA] interface gigabitethernet 0/0/1
    [SwitchA-GigabitEthernet0/0/1] port link-type trunk
    [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
    [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
    [SwitchA-GigabitEthernet0/0/1] port-isolate enable
    [SwitchA-GigabitEthernet0/0/1] quit
    [SwitchA] interface gigabitethernet 0/0/2
    [SwitchA-GigabitEthernet0/0/2] port link-type trunk
    [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
    [SwitchA-GigabitEthernet0/0/2] quit
    

    # Add GE0/0/1 that connects the central AP to SwitchA to VLAN 100 and VLAN 101.

    <Huawei> system-view
    [Huawei] sysname AP
    [AP] vlan batch 100 101
    [AP] interface gigabitethernet 0/0/1
    [AP-GigabitEthernet0/0/1] port link-type trunk
    [AP-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
    [AP-GigabitEthernet0/0/1] quit
    

  2. Configure the central AP to communicate with the upstream device.

    # Configure VLANIF 101 (service VLAN), VLANIF 102, and VLANIF 103.

    [AP] vlan batch 101 102 103
    [AP] interface vlanif 101
    [AP-Vlanif101] ip address 10.23.101.1 24
    [AP-Vlanif101] quit
    [AP] interface vlanif 102
    [AP-Vlanif102] ip address 10.23.102.2 24
    [AP-Vlanif102] quit
    [AP] interface vlanif 103
    [AP-Vlanif103] ip address 10.23.103.2 24
    [AP-Vlanif103] quit
    

    # Add GE0/0/24 that connects the central AP to the Router to VLAN 102.

    [AP] interface gigabitethernet 0/0/24
    [AP-GigabitEthernet0/0/24] port link-type trunk
    [AP-GigabitEthernet0/0/24] port trunk allow-pass vlan 102
    [AP-GigabitEthernet0/0/24] quit

    # Add GE0/0/25 that connects the central AP to the RADIUS server to VLAN 103.

    [AP] interface gigabitethernet 0/0/25
    [AP-GigabitEthernet0/0/25] port link-type trunk
    [AP-GigabitEthernet0/0/25] port trunk pvid vlan 103
    [AP-GigabitEthernet0/0/25] port trunk allow-pass vlan 103
    [AP-GigabitEthernet0/0/25] quit

    # On the central AP, configure a static route.

    [AP] ip route-static 0.0.0.0 0.0.0.0 10.23.102.1

  3. Configure the central AP to assign an IP address to the RU and the Router to assign IP addresses to STAs.

    NOTE:
    Configure the DNS server as required. The common methods are as follows:
    • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
    • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.

    # Configure the central AP to assign an IP address to the RU from an interface address pool.

    [AP] dhcp enable
    [AP] interface vlanif 100
    [AP-Vlanif100] ip address 10.23.100.1 24
    [AP-Vlanif100] dhcp select interface
    [AP-Vlanif100] quit

    # Configure the central AP as a DHCP relay agent, enable user entry detection on the central AP, and specify the DHCP server IP address on the DHCP relay agent.

    [AP] dhcp relay detect enable
    [AP] interface vlanif 101
    [AP-Vlanif101] dhcp select relay
    [AP-Vlanif101] dhcp relay server-ip 10.23.102.1
    [AP-Vlanif101] quit

    # Configure the Router as a DHCP server to assign IP addresses to STAs from a global address pool. The egress gateway address of the DHCP client is 10.23.101.1, and the network segment of the global address pool is 10.23.101.0/24.

    <Huawei> system-view
    [Huawei] sysname Router
    [Router] dhcp enable
    [Router] ip pool sta
    [Router-ip-pool-sta] gateway-list 10.23.101.1
    [Router-ip-pool-sta] dns-list 8.8.8.8
    [Router-ip-pool-sta] network 10.23.101.0 mask 24
    [Router-ip-pool-sta] quit
    [Router] vlan batch 102
    [Router] interface vlanif 102
    [Router-Vlanif102] ip address 10.23.102.1 24
    [Router-Vlanif102] dhcp select global
    [Router-Vlanif102] quit
    [Router] interface gigabitethernet 2/0/0
    [Router-GigabitEthernet2/0/0] port link-type trunk
    [Router-GigabitEthernet2/0/0] port trunk allow-pass vlan 102
    [Router-GigabitEthernet2/0/0] quit
    [Router] ip route-static 10.23.101.0 24 10.23.102.2
    

  4. Configure RADIUS authentication parameters.

    NOTE:
    Configure the same shared key for the central AP and RADIUS server.

    # Create a RADIUS server template.

    [AP] radius-server template radius_huawei
    [AP-radius-radius_huawei] radius-server authentication 10.23.103.1 1812
    [AP-radius-radius_huawei] radius-server shared-key cipher huawei@123
    [AP-radius-radius_huawei] quit
    

    # Configure a RADIUS authentication scheme.

    [AP] aaa
    [AP-aaa] authentication-scheme radius_huawei
    [AP-aaa-authen-radius_huawei] authentication-mode radius
    [AP-aaa-authen-radius_huawei] quit
    [AP-aaa] quit
    

    # Test whether a STA can be authenticated using RADIUS authentication. A user name test and password 123456 have been configured on the RADIUS server.

    [AP] test-aaa test 123456 radius-template radius_huawei
    Info: Account test succeed.
    

  5. Configure an 802.1X access profile to manage 802.1X access control parameters.

    # Create the 802.1X access profile wlan-dot1x.

    [AP] dot1x-access-profile name wlan-dot1x
    

    # Set the authentication mode to EAP relay.

    [AP-dot1x-access-profile-wlan-dot1x] dot1x authentication-method eap
    [AP-dot1x-access-profile-wlan-dot1x] quit
    

  6. Create the authentication profile wlan-authentication, and apply the 802.1X access profile, authentication scheme, and RADIUS server template to the authentication profile.

    [AP] authentication-profile name wlan-authentication
    [AP-authentication-profile-wlan-authentication] dot1x-access-profile wlan-dot1x
    [AP-authentication-profile-wlan-authentication] authentication-scheme radius_huawei
    [AP-authentication-profile-wlan-authentication] radius-server radius_huawei
    [AP-authentication-profile-wlan-authentication] quit

  7. Configure the RU to go online.

    # Create an AP group and add the RU to the AP group.

    [AP] wlan
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] quit
    

    # Create a regulatory domain profile, configure the central AP country code in the profile, and apply the profile to the AP group.

    [AP-wlan-view] regulatory-domain-profile name domain1
    [AP-wlan-regulatory-domain-prof-domain1] country-code cn
    [AP-wlan-regulatory-domain-prof-domain1] quit
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
    e?[Y/N]:y 
    [AP-wlan-ap-group-ap-group1] quit
    [AP-wlan-view] quit
    

    # Configure the management VLAN for RUs connected to the central AP.

    [AP] management-vlan 100
    
    # Import the RU offline on the central AP and add the RU to AP group ap-group1. Assume that the RU's MAC address is 60de-4476-e360. Configure a name for the RU based on the RU's deployment location, so that you can know where the RU is deployed from its name. For example, name the RU area_1 if it is deployed in Area 1.
    NOTE:

    The default RU authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.

    In this example, the R240D is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).

    [AP] wlan
    [AP-wlan-view] ap auth-mode mac-auth
    [AP-wlan-view] ap-id 1 ap-mac 60de-4476-e360
    [AP-wlan-ap-1] ap-name area_1
    [AP-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
    s of the radio, Whether to continue? [Y/N]:y 
    [AP-wlan-ap-1] quit
    

    # After the RU is powered on, run the display ap all command to check the RU state. If the State field is displayed as nor, the RU goes online normally.

    [AP-wlan-view] display ap all
    Total AP information:
    nor  : normal          [1]
    --------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    --------------------------------------------------------------------------------
    1   60de-4476-e360 area_1 ap-group1 10.23.100.254 R240D            nor   0   10S
    --------------------------------------------------------------------------------
    Total: 1
    

  8. Configure WLAN service parameters.

    # Create the security profile wlan-security and set the security policy in the profile.

    [AP-wlan-view] security-profile name wlan-security
    [AP-wlan-sec-prof-wlan-security] security wpa2 dot1x aes
    [AP-wlan-sec-prof-wlan-security] quit
    

    # Create the SSID profile wlan-ssid and set the SSID name to wlan-net.

    [AP-wlan-view] ssid-profile name wlan-ssid
    [AP-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AP-wlan-ssid-prof-wlan-ssid] quit
    

    # Create the VAP profile wlan-vap, set the service VLAN, and apply the security profile, SSID profile, and authentication profile to the VAP profile.

    [AP-wlan-view] vap-profile name wlan-vap
    [AP-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AP-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AP-wlan-vap-prof-wlan-vap] authentication-profile wlan-authentication
    [AP-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AP-wlan-vap-prof-wlan-vap] quit
    

    # Bind the VAP profile wlan-vap to the AP group and apply the profile to radio 0 and radio 1 of the RU.

    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1
    [AP-wlan-ap-group-ap-group1] quit
    

  9. Set channels and power for the RU radios.

    NOTE:

    Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The channel and power configuration for the RU radios in this example is for reference only. In actual scenarios, configure channels and power for RU radios based on country codes of RUs and network planning results.

    # Disable automatic channel and power calibration functions of radio 0, and configure the channel and power for radio 0.
    [AP-wlan-view] ap-id 1
    [AP-wlan-ap-1] radio 0
    [AP-wlan-radio-1/0] calibrate auto-channel-select disable
    [AP-wlan-radio-1/0] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/0] eirp 127
    [AP-wlan-radio-1/0] quit
    # Disable automatic channel and power calibration functions of radio 1, and configure the channel and power for radio 1.
    [AP-wlan-ap-1] radio 1
    [AP-wlan-radio-1/1] calibrate auto-channel-select disable
    [AP-wlan-radio-1/1] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/1] eirp 127
    [AP-wlan-radio-1/1] quit
    [AP-wlan-ap-1] quit

  10. Verify the configuration.

    • The WLAN with SSID wlan-net is available for STAs connected to the RU.
    • The wireless PC obtains an IP address after it associates with the WLAN.
    • Use the 802.1X authentication client on a STA and enter the correct user name and password. The STA is authenticated and can access the WLAN. You must configure the client for PEAP authentication.
      • Configuration on the Windows XP operating system:

        1. On the Association tab page of the Wireless network properties dialog box, add SSID wlan-net, set the authentication mode to WPA2, and encryption algorithm to AES.
        2. On the Authentication tab page, set EAP type to PEAP and click Properties. In the Protected EAP Properties dialog box, deselect Validate server certificate and click Configure. In the displayed dialog box, deselect Automatically use my Windows logon name and password and click OK.
      • Configuration on the Windows 7 operating system:

        1. Access the Manage wireless networks page, click Add, and select Manually create a network profile. Add SSID wlan-net. Set the authentication mode to WPA2-Enterprise, and encryption algorithm to AES. Click Next.
        2. Click Change connection settings. On the Wireless Network Properties page that is displayed, select the Security tab page and click Settings. On the Protected EAP Properties page, deselect Validate server certificate and click Configure. On the dialog box that is displayed, deselect Automatically use my Windows logon name and password and click OK.
        3. On the Wireless Network Properties page, click Advanced settings. On the Advanced settings page that is displayed, select Specify authentication mode, set the identity authentication mode to User authentication, and click OK.

Configuration Files
  • SwitchA configuration file

    #
    sysname SwitchA
    #
    vlan batch 100 to 101
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk pvid vlan 100
     port trunk allow-pass vlan 100 to 101
     port-isolate enable
    #
    interface GigabitEthernet0/0/2
     port link-type trunk
     port trunk allow-pass vlan 100 to 101
    #
    return
  • Router configuration file

    #
    sysname Router
    #
    vlan batch 102
    #
    dhcp enable
    #
    ip pool sta
     gateway-list 10.23.101.1
     network 10.23.101.0 mask 255.255.255.0
     dns-list 8.8.8.8
    #
    interface Vlanif102
     ip address 10.23.102.1 255.255.255.0
     dhcp select global
    #
    interface GigabitEthernet2/0/0
     port link-type trunk
     port trunk allow-pass vlan 102
    #
    ip route-static 10.23.101.0 255.255.255.0 10.23.102.2
    #
    return
    
  • Central AP configuration file

    #
     sysname AP
    #
    vlan batch 100 to 103
    #
    authentication-profile name wlan-authentication
     dot1x-access-profile wlan-dot1x
     authentication-scheme radius_huawei
     radius-server radius_huawei
    #
    dot1x-access-profile name wlan-dot1x
    #
    dhcp enable
    #
    radius-server template radius_huawei
     radius-server shared-key cipher %^%#*7d1;XNof/|Q0:DsP!,W51DIYPx}`AARBdJ'0B^$%^%#
     radius-server authentication 10.23.103.1 1812 weight 80
    #
    aaa
     authentication-scheme radius_huawei
      authentication-mode radius
    #
    interface Vlanif100
     ip address 10.23.100.1 255.255.255.0
     dhcp select interface
    #
    interface Vlanif101
     ip address 10.23.101.1 255.255.255.0
     dhcp select relay
     dhcp relay server-ip 10.23.102.1
    #
    interface Vlanif102
     ip address 10.23.102.2 255.255.255.0
    #
    interface Vlanif103
     ip address 10.23.103.2 255.255.255.0
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk allow-pass vlan 100 to 101
    #
    interface GigabitEthernet0/0/24
     port link-type trunk
     port trunk allow-pass vlan 102
    #
    interface GigabitEthernet0/0/25
     port link-type trunk
     port trunk pvid vlan 103
     port trunk allow-pass vlan 103
    #
    ip route-static 0.0.0.0 0.0.0.0 10.23.102.1
    #
    management-vlan 100
    #
    wlan
     security-profile name wlan-security
      security wpa2 dot1x aes
     ssid-profile name wlan-ssid
      ssid wlan-net
     vap-profile name wlan-vap
      service-vlan vlan-id 101
      ssid-profile wlan-ssid
      security-profile wlan-security
      authentication-profile wlan-authentication
     regulatory-domain-profile name domain1
     ap-group name ap-group1
      regulatory-domain-profile domain1
      radio 0
       vap-profile wlan-vap wlan 1
      radio 1
       vap-profile wlan-vap wlan 1
     ap-id 1 type-id 55 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
      ap-name area_1
      ap-group ap-group1
      radio 0
       channel 20mhz 6
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
      radio 1
       channel 20mhz 149
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
    #
    return

Example for Configuring a WAPI-PSK Security Policy

Configuration Process

You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile,and WIDS profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. After that, the configuration is automatically delivered to and takes effect on the RUs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.

Networking Requirements

A residential community provides a WLAN with the SSID wlan-net so that residents can access the network anywhere at any time. As shown in Figure 25-25, the RU deployed in a resident's home is directly connected to the central AP. STAs automatically obtain IP addresses.

Because the WLAN is open to users, there are potential security risks to service data. Users do not require high WLAN security, so no extra authentication system is required. STAs support WAPI, so a WAPI security policy using pre-shared key authentication can be configured. Unicast and broadcast keys are updated based on time to secure data transmission.

Figure 25-25  Networking diagram for configuring a WAPI-PSK security policy
Configuration Roadmap
  1. Configure WLAN basic services so that STAs can access the WLAN.
  2. Create a security profile and set the security policy to WAPI-PSK to meet security requirements of users.
Table 25-9  Data planning

Item

Data

DHCP server The central AP functions as a DHCP server to assign IP addresses to the STAs and RU.
IP address pool for the RU 10.23.100.2-10.23.100.254/24
IP address pool for STAs 10.23.101.2-10.23.101.254/24
AP group
  • Name: ap-group1
  • Referenced profile: VAP profile wlan-vap and regulatory domain profile domain1
Regulatory domain profile
  • Name: domain1
  • Country code: CN
SSID profile
  • Name: wlan-ssid
  • SSID name: wlan-net
Security profile
  • Name: wlan-security
  • Security policy: WAPI-PSK
  • Encryption key: 1234567@
VAP profile
  • Name: wlan-vap
  • Service VLAN: VLAN 101
  • Referenced profile: SSID profile wlan-ssid and security profile wlan-security
Configuration Notes

Configure port isolation on the interfaces of the device directly connected to RUs. If port isolation is not configured, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.

Procedure

  1. Configure the central AP so that the RU and central AP can transmit CAPWAP packets.

    # Configure the central AP: add interface GE0/0/1 to management VLAN 100.

    <Huawei> system-view
    [Huawei] sysname AP
    [AP] vlan batch 100 101
    [AP] interface gigabitethernet 0/0/1
    [AP-GigabitEthernet0/0/1] port link-type trunk
    [AP-GigabitEthernet0/0/1] port trunk pvid vlan 100
    [AP-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
    [AP-GigabitEthernet0/0/1] quit
    

  2. Configure the central AP to communicate with the upstream device.

    NOTE:

    Configure central AP uplink interfaces to transparently transmit packets of service VLANs as required and communicate with the upstream device.

    # Add central AP uplink interface GE0/0/24 to service VLAN 101.

    [AP] interface gigabitethernet 0/0/24
    [AP-GigabitEthernet0/0/24] port link-type trunk
    [AP-GigabitEthernet0/0/24] port trunk allow-pass vlan 101
    [AP-GigabitEthernet0/0/24] quit
    

  3. Configure the central AP as a DHCP server to allocate IP addresses to STAs and the RU.

    # Configure the central AP as the DHCP server to allocate an IP address to the RU from the IP address pool on VLANIF 100, and allocate IP addresses to STAs from the IP address pool on VLANIF 101.

    NOTE:
    Configure the DNS server as required. The common methods are as follows:
    • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
    • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
    [AP] dhcp enable
    [AP] interface vlanif 100
    [AP-Vlanif100] ip address 10.23.100.1 24
    [AP-Vlanif100] dhcp select interface
    [AP-Vlanif100] quit
    [AP] interface vlanif 101
    [AP-Vlanif101] ip address 10.23.101.1 24
    [AP-Vlanif101] dhcp select interface
    [AP-Vlanif101] quit
    

  4. Configure the RU to go online.

    # Create an AP group and add the RU to the AP group.

    [AP] wlan
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] quit
    

    # Create a regulatory domain profile, configure the central AP country code in the profile, and apply the profile to the AP group.

    [AP-wlan-view] regulatory-domain-profile name domain1
    [AP-wlan-regulate-domain-domain1] country-code cn
    [AP-wlan-regulate-domain-domain1] quit
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
    e?[Y/N]:y 
    [AP-wlan-ap-group-ap-group1] quit
    [AP-wlan-view] quit
    

    # Configure the management VLAN for RUs connected to the central AP.

    [AP] management-vlan 100
    
    # Import the RU offline on the central AP and add the RU to AP group ap-group1. Assume that the RU's MAC address is 60de-4476-e360. Configure a name for the RU based on the RU's deployment location, so that you can know where the RU is deployed from its name. For example, name the RU area_1 if it is deployed in Area 1.
    NOTE:

    The default RU authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.

    In this example, the R240D is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).

    [AP] wlan
    [AP-wlan-view] ap auth-mode mac-auth
    [AP-wlan-view] ap-id 1 ap-mac 60de-4476-e360
    [AP-wlan-ap-1] ap-name area_1
    [AP-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
    s of the radio, Whether to continue? [Y/N]:y 
    [AP-wlan-ap-1] quit
    

    # After the RU is powered on, run the display ap all command to check the RU state. If the State field is displayed as nor, the RU goes online normally.

    [AP-wlan-view] display ap all
    Total AP information:
    nor  : normal          [1]
    -------------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    -------------------------------------------------------------------------------------
    1    60de-4476-e360 area_1 ap-group1 10.23.100.254 R240D           nor   0   10S
    -------------------------------------------------------------------------------------
    Total: 1

  5. Configure WLAN service parameters.

    # Create the security profile wlan-security, set the security policy to WAPI-PSK, configure time-based unicast and multicast key updates, and set the update interval to 20,000s.

    [AP-wlan-view] security-profile name wlan-security
    [AP-wlan-sec-prof-wlan-security] security wapi psk pass-phrase 1234567@
    [AP-wlan-sec-prof-wlan-security] wapi usk key-update time-based
    [AP-wlan-sec-prof-wlan-security] wapi msk key-update time-based
    [AP-wlan-sec-prof-wlan-security] wapi usk-update-interval 20000
    [AP-wlan-sec-prof-wlan-security] wapi msk-update-interval 20000
    [AP-wlan-sec-prof-wlan-security] quit
    

    # Create the SSID profile wlan-ssid and set the SSID name to wlan-net.

    [AP-wlan-view] ssid-profile name wlan-ssid
    [AP-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AP-wlan-ssid-prof-wlan-ssid] quit
    

    # Create the VAP profile wlan-vap, set the service VLAN, and apply the security profile and SSID profile to the VAP profile.

    [AP-wlan-view] vap-profile name wlan-vap
    [AP-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AP-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AP-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AP-wlan-vap-prof-wlan-vap] quit
    

    # Bind the VAP profile wlan-vap to the AP group and apply the profile to radio 0 and radio 1 of the RU.

    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio all
    [AP-wlan-ap-group-ap-group1] quit
    

  6. Set channels and power for the RU radios.

    NOTE:

    Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The channel and power configuration for the RU radios in this example is for reference only. In actual scenarios, configure channels and power for RU radios based on country codes of RUs and network planning results.

    # Disable automatic channel and power calibration functions of radio 0, and configure the channel and power for radio 0.
    [AP-wlan-view] ap-id 1
    [AP-wlan-ap-1] radio 0
    [AP-wlan-radio-1/0] calibrate auto-channel-select disable
    [AP-wlan-radio-1/0] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/0] eirp 127
    [AP-wlan-radio-1/0] quit
    # Disable automatic channel and power calibration functions of radio 1, and configure the channel and power for radio 1.
    [AP-wlan-ap-1] radio 1
    [AP-wlan-radio-1/1] calibrate auto-channel-select disable
    [AP-wlan-radio-1/1] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/1] eirp 127
    [AP-wlan-radio-1/1] quit
    [AP-wlan-ap-1] quit

  7. Verify the configuration.

    • The WLAN with SSID wlan-net is available for mobile phones connected to the RU.
    • The mobile phone obtains an IP address after it associates with the WLAN. The mobile phone can access the WLAN after the wireless user enters the password.

Configuration Files

Central AP configuration file

#
 sysname AP
#
vlan batch 100 to 101 
#
dhcp enable
#
interface Vlanif100
 ip address 10.23.100.1 255.255.255.0
 dhcp select interface
#
interface Vlanif101
 ip address 10.23.101.1 255.255.255.0
 dhcp select interface
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/24
 port link-type trunk
 port trunk allow-pass vlan 101
#
management-vlan 100
#
wlan
 security-profile name wlan-security
  security wapi psk pass-phrase %^%#cWul9=qe~"#{UzRlWz["^Gzo<X/k8-21m37N4;n'%^%#
  wapi usk-update-interval 20000
  wapi msk-update-interval 20000
 ssid-profile name wlan-ssid
  ssid wlan-net
 vap-profile name wlan-vap
  service-vlan vlan-id 101
  ssid-profile wlan-ssid
  security-profile wlan-security
 regulatory-domain-profile name domain1
 ap-group name ap-group1
  regulatory-domain-profile domain1
  radio 0
   vap-profile wlan-vap wlan 1
  radio 1
   vap-profile wlan-vap wlan 1
 ap-id 1 type-id 55 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
  ap-name area_1
  ap-group ap-group1
  radio 0
   channel 20mhz 6
   eirp 127
   calibrate auto-channel-select disable
   calibrate auto-txpower-select disable
  radio 1
   channel 20mhz 149
   eirp 127
   calibrate auto-channel-select disable
   calibrate auto-txpower-select disable
#
return

Example for Configuring a WAPI-Certificate Security Policy

Configuration Process

You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile,and WIDS profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. After that, the configuration is automatically delivered to and takes effect on the RUs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.

Networking Requirements

As shown in Figure 25-26, the enterprise's central AP connects to the egress gateway (Router) and ASU certificate server, and connects to the RU through SwitchA. The WLAN with the SSID wlan-net is available for employees to access network resources. The gateway also functions as a DHCP server to provide IP addresses on the 10.23.101.0/24 network segment for STAs. The central AP controls and manages STAs.

Because the WLAN is open to users, there are potential security risks to enterprise information if no security policy is configured for the WLAN. To meet enterprise's high information security requirement and implement bidirectional authentication between the WLAN clients and server, configure a WAPI security policy. Compared with WPA/WPA2, an ASU certificate server and WAPI encryption provide higher security for WLAN networks.

Figure 25-26  Networking diagram for configuring a WAPI-certificate security policy

Configuration Roadmap
  1. Configure WLAN basic services so that STAs can access the WLAN.
  2. Configure a WAPI security policy using certificate authentication in a security profile and import the obtained certificates to ensure data security.
Table 25-10  Data planning

Item

Data

Management VLAN

VLAN 100

Service VLAN

VLAN 101

SwitchA VLAN

VLAN 100

DHCP server

  • IP address that the central AP assigns to the RU: 10.23.100.2-10.23.100.254/24
  • IP addresses that Router assigns to STAs: 10.23.101.2-10.23.101.254/24

Gateway for the RU

VLANIF 100: 10.23.100.1/24

Gateway for STAs

VLANIF 101: 10.23.101.1/24

AP group

  • Name: ap-group1
  • Referenced profile: VAP profile wlan-vap and regulatory domain profile domain1

Regulatory domain profile

  • Name: domain1
  • Country code: CN

SSID profile

  • Name: wlan-ssid
  • SSID name: wlan-net

Security profile

  • Name: wlan-security
  • Security policy: WAPI-certificate

VAP profile

  • Name: wlan-vap
  • Service VLAN: VLAN 101
  • Referenced profile: SSID profile wlan-ssid and security profile wlan-security
Configuration Notes

Configure port isolation on the interfaces of the device directly connected to RUs. If port isolation is not configured, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.

Procedure

  1. Configure SwitchA and the central AP so that the RU and central AP can transmit CAPWAP packets.

    # Add GE0/0/1 that connects SwitchA to the RU to management VLAN 100 and VLAN 101, and add GE0/0/2 that connects SwitchA to the central AP to the same VLAN.

    <HUAWEI> system-view
    [HUAWEI] sysname SwitchA
    [SwitchA] vlan batch 100 101
    [SwitchA] interface gigabitethernet 0/0/1
    [SwitchA-GigabitEthernet0/0/1] port link-type trunk
    [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
    [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
    [SwitchA-GigabitEthernet0/0/1] port-isolate enable
    [SwitchA-GigabitEthernet0/0/1] quit
    [SwitchA] interface gigabitethernet 0/0/2
    [SwitchA-GigabitEthernet0/0/2] port link-type trunk
    [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
    [SwitchA-GigabitEthernet0/0/2] quit
    

    # Add GE0/0/1 that connects the central AP to SwitchA to VLAN 100 and VLAN 101.

    <Huawei> system-view
    [Huawei] sysname AP
    [AP] vlan batch 100 101
    [AP] interface gigabitethernet 0/0/1
    [AP-GigabitEthernet0/0/1] port link-type trunk
    [AP-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
    [AP-GigabitEthernet0/0/1] quit
    

  2. Configure the central AP to communicate with the upstream device.

    # Configure VLANIF 101 (service VLAN), VLANIF 102, and VLANIF 103.

    [AP] vlan batch 101 102 103
    [AP] interface vlanif 101
    [AP-Vlanif101] ip address 10.23.101.1 24
    [AP-Vlanif101] quit
    [AP] interface vlanif 102
    [AP-Vlanif102] ip address 10.23.102.2 24
    [AP-Vlanif102] quit
    [AP] interface vlanif 103
    [AP-Vlanif103] ip address 10.23.103.2 24
    [AP-Vlanif103] quit
    

    # Add GE0/0/24 that connects the central AP to the Router to VLAN 102.

    [AP] interface gigabitethernet 0/0/24
    [AP-GigabitEthernet0/0/24] port link-type trunk
    [AP-GigabitEthernet0/0/24] port trunk allow-pass vlan 102
    [AP-GigabitEthernet0/0/24] quit

    # Add GE0/0/25 that connects the central AP to the ASU server to VLAN 103.

    [AP] interface gigabitethernet 0/0/25
    [AP-GigabitEthernet0/0/25] port link-type trunk
    [AP-GigabitEthernet0/0/25] port trunk pvid vlan 103
    [AP-GigabitEthernet0/0/25] port trunk allow-pass vlan 103
    [AP-GigabitEthernet0/0/25] quit

    # On the central AP, configure a static route.

    [AP] ip route-static 0.0.0.0 0.0.0.0 10.23.102.1

  3. Configure the central AP to assign an IP address to the RU and the Router to assign IP addresses to STAs.

    NOTE:
    Configure the DNS server as required. The common methods are as follows:
    • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
    • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.

    # Configure the central AP to assign an IP address to the RU from an interface address pool.

    [AP] dhcp enable
    [AP] interface vlanif 100
    [AP-Vlanif100] ip address 10.23.100.1 24
    [AP-Vlanif100] dhcp select interface
    [AP-Vlanif100] quit

    # Configure the central AP as a DHCP relay agent, enable user entry detection on the central AP, and specify the DHCP server IP address on the DHCP relay agent.

    [AP] dhcp relay detect enable
    [AP] interface vlanif 101
    [AP-Vlanif101] dhcp select relay
    [AP-Vlanif101] dhcp relay server-ip 10.23.102.1
    [AP-Vlanif101] quit

    # Configure the Router as a DHCP server to assign IP addresses to STAs from a global address pool. The egress gateway address of the DHCP client is 10.23.101.1, and the network segment of the global address pool is 10.23.101.0/24.

    <Huawei> system-view
    [Huawei] sysname Router
    [Router] dhcp enable
    [Router] ip pool sta
    [Router-ip-pool-sta] gateway-list 10.23.101.1
    [Router-ip-pool-sta] network 10.23.101.0 mask 24
    [Router-ip-pool-sta] quit
    [Router] vlan batch 102
    [Router] interface vlanif 102
    [Router-Vlanif102] ip address 10.23.102.1 24
    [Router-Vlanif102] dhcp select global
    [Router-Vlanif102] quit
    [Router] interface gigabitethernet 2/0/0
    [Router-GigabitEthernet2/0/0] port link-type trunk
    [Router-GigabitEthernet2/0/0] port trunk allow-pass vlan 102
    [Router-GigabitEthernet2/0/0] quit
    [Router] ip route-static 10.23.101.0 24 10.23.102.2
    

  4. Configure the RU to go online.

    # Create an AP group and add the RU to the AP group.

    [AP] wlan
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] quit
    

    # Create a regulatory domain profile, configure the central AP country code in the profile, and apply the profile to the AP group.

    [AP-wlan-view] regulatory-domain-profile name domain1
    [AP-wlan-regulatory-domain-prof-domain1] country-code cn
    [AP-wlan-regulatory-domain-prof-domain1] quit
    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu
    e?[Y/N]:y 
    [AP-wlan-ap-group-ap-group1] quit
    [AP-wlan-view] quit
    

    # Configure the management VLAN for RUs connected to the central AP.

    [AP] management-vlan 100
    
    # Import the RU offline on the central AP and add the RU to AP group ap-group1. Assume that the RU's MAC address is 60de-4476-e360. Configure a name for the RU based on the RU's deployment location, so that you can know where the RU is deployed from its name. For example, name the RU area_1 if it is deployed in Area 1.
    NOTE:

    The default RU authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.

    In this example, the R240D is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).

    [AP] wlan
    [AP-wlan-view] ap auth-mode mac-auth
    [AP-wlan-view] ap-id 1 ap-mac 60de-4476-e360
    [AP-wlan-ap-1] ap-name area_1
    [AP-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration
    s of the radio, Whether to continue? [Y/N]:y 
    [AP-wlan-ap-1] quit
    

    # After the RU is powered on, run the display ap all command to check the RU state. If the State field is displayed as nor, the RU goes online normally.

    [AP-wlan-view] display ap all
    Total AP information:
    nor  : normal          [1]
    --------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    --------------------------------------------------------------------------------
    1   60de-4476-e360 area_1 ap-group1 10.23.100.254 R240D            nor   0   10S
    --------------------------------------------------------------------------------
    Total: 1
    

  5. Configure WLAN service parameters.

    # Create the security profile wlan-security and set the security policy to WAPI-certificate.

    [AP-wlan-view] security-profile name wlan-security
    [AP-wlan-sec-prof-wlan-security] security wapi certificate
    [AP-wlan-sec-prof-wlan-security] wapi asu ip 10.23.103.1
    [AP-wlan-sec-prof-wlan-security] wapi import certificate ac format pem file-name flash:/ae.cer
    [AP-wlan-sec-prof-wlan-security] wapi import certificate asu format pem file-name flash:/as.cer
    [AP-wlan-sec-prof-wlan-security] wapi import certificate issuer format pem file-name flash:/as.cer
    [AP-wlan-sec-prof-wlan-security] wapi import private-key format pem file-name flash:/ae.cer
    [AP-wlan-sec-prof-wlan-security] quit
    
    NOTE:
    • Before configuring WAPI-certificate authentication, upload the certificate file to the flash memory of the device.
    • If the authentication system uses only two certificates, the issuer certificate is the same as the ASU certificate, with the same file name. If the authentication system uses three certificates, the issuer certificate and ASU certificate are different from each other and both must be imported.
    • The certificates must be valid and correct.

    # Create the SSID profile wlan-ssid and set the SSID name to wlan-net.

    [AP-wlan-view] ssid-profile name wlan-ssid
    [AP-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AP-wlan-ssid-prof-wlan-ssid] quit
    

    # Create the VAP profile wlan-vap, set the service VLAN, and apply the security profile and SSID profile to the VAP profile.

    [AP-wlan-view] vap-profile name wlan-vap
    [AP-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AP-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AP-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AP-wlan-vap-prof-wlan-vap] quit
    

    # Bind the VAP profile wlan-vap to the AP group and apply the profile to radio 0 and radio 1 of the RU.

    [AP-wlan-view] ap-group name ap-group1
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0
    [AP-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1
    [AP-wlan-ap-group-ap-group1] quit
    

  6. Set channels and power for the RU radios.

    NOTE:

    Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The channel and power configuration for the RU radios in this example is for reference only. In actual scenarios, configure channels and power for RU radios based on country codes of RUs and network planning results.

    # Disable automatic channel and power calibration functions of radio 0, and configure the channel and power for radio 0.
    [AP-wlan-view] ap-id 1
    [AP-wlan-ap-1] radio 0
    [AP-wlan-radio-1/0] calibrate auto-channel-select disable
    [AP-wlan-radio-1/0] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/0] eirp 127
    [AP-wlan-radio-1/0] quit
    # Disable automatic channel and power calibration functions of radio 1, and configure the channel and power for radio 1.
    [AP-wlan-ap-1] radio 1
    [AP-wlan-radio-1/1] calibrate auto-channel-select disable
    [AP-wlan-radio-1/1] calibrate auto-txpower-select disable
    [AP-wlan-radio-1/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y
    [AP-wlan-radio-1/1] eirp 127
    [AP-wlan-radio-1/1] quit
    [AP-wlan-ap-1] quit

  7. Verify the configuration.

    • The WLAN with SSID wlan-net is available for mobile phones connected to the RU.
    • The mobile phone obtains an IP address after it associates with the WLAN. The mobile phone is automatically authenticated and can access the WLAN.

Configuration Files
  • SwitchA configuration file

    #
    sysname SwitchA
    #
    vlan batch 100 to 101
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk pvid vlan 100
     port trunk allow-pass vlan 100 to 101
     port-isolate enable
    #
    interface GigabitEthernet0/0/2
     port link-type trunk
     port trunk allow-pass vlan 100 to 101
    #
    return
  • Router configuration file

    #
    sysname Router
    #
    vlan batch 102
    #
    dhcp enable
    #
    ip pool sta
     gateway-list 10.23.101.1
     network 10.23.101.0 mask 255.255.255.0
    #
    interface Vlanif102
     ip address 10.23.102.1 255.255.255.0
     dhcp select global
    #
    interface GigabitEthernet2/0/0
     port link-type trunk
     port trunk allow-pass vlan 102
    #
    ip route-static 10.23.101.0 255.255.255.0 10.23.102.2
    #
    return
    
  • Central AP configuration file

    #
     sysname AP
    #
    vlan batch 100 to 103
    #
    dhcp enable
    #
    dhcp relay detect enable
    #
    interface Vlanif100
     ip address 10.23.100.1 255.255.255.0
     dhcp select interface
    #
    interface Vlanif101
     ip address 10.23.101.1 255.255.255.0
     dhcp select relay
     dhcp relay server-ip 10.23.102.1
    #
    interface Vlanif102
     ip address 10.23.102.2 255.255.255.0
    #
    interface Vlanif103
     ip address 10.23.103.2 255.255.255.0
    #
    interface GigabitEthernet0/0/1
     port link-type trunk
     port trunk allow-pass vlan 100 to 101
    #
    interface GigabitEthernet0/0/24
     port link-type trunk
     port trunk allow-pass vlan 102
    #
    interface GigabitEthernet0/0/25
     port link-type trunk
     port trunk pvid vlan 103
     port trunk allow-pass vlan 103
    #
    ip route-static 0.0.0.0 0.0.0.0 10.23.102.1
    #
    management-vlan 100
    #
    wlan
     security-profile name wlan-security
      security wapi certificate
      wapi asu ip 10.23.103.1
      wapi import certificate ac format pem file-name flash:/ae.cer
      wapi import certificate asu format pem file-name flash:/as.cer
      wapi import certificate issuer format pem file-name flash:/as.cer
      wapi import private-key format pem file-name flash:/ae.cer
     ssid-profile name wlan-ssid
      ssid wlan-net
     vap-profile name wlan-vap
      service-vlan vlan-id 101
      ssid-profile wlan-ssid
      security-profile wlan-security
     regulatory-domain-profile name domain1
     ap-group name ap-group1
      ap-system-profile wlan-system
      regulatory-domain-profile domain1
      radio 0
       vap-profile wlan-vap wlan 1
      radio 1
       vap-profile wlan-vap wlan 1
     ap-id 1 type-id 55 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
      ap-name area_1
      ap-group ap-group1
      radio 0
       channel 20mhz 6
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
      radio 1
       channel 20mhz 149
       eirp 127
       calibrate auto-channel-select disable
       calibrate auto-txpower-select disable
    #
    return
Translation
Download
Updated: 2019-01-11

Document ID: EDOC1000176006

Views: 130450

Downloads: 312

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next