Example for Configuring VPN Traversal Between the AC and APs

WLAN V200R019C00 Typical Configuration Examples

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Service Requirements

Enterprise users can access the network through WLANs, which is the basic requirement of mobile office. Furthermore, users' services are not affected during roaming in the coverage area.

APs are located in an enterprise branch, while the AC is located at the headquarters. Administrators require unified AP management by the AC and protection on traffic exchanged between the branch and headquarters. Therefore, an IPSec tunnel is established between the branch and headquarters to protect traffic.

Networking Requirements

AC networking mode: IPSec tunnel between the AC at the headquarters and APs in the branch.
DHCP deployment mode: Router_1 functions as a DHCP server to assign IP addresses to APs and STAs.
Service data forwarding mode: direct forwarding

Figure 5-24 Networking for configuring VPN traversal between the AC and APs

Data Planning

Table 5-24 AC data planning

Item	Data
WLAN service data planning on the AC
Management VLAN for APs	VLAN 200
Service VLAN for STAs	VLAN 101
DHCP server	Router_1 functions as a DHCP server to assign IP addresses to APs and STAs.
IP address pool for APs	10.23.100.2-10.23.100.254/24
IP address pool for STAs	10.23.101.2-10.23.101.254/24
AC's source interface address	VLANIF 200: 10.23.200.1/24
AP group	Name: ap-group1 Referenced profiles: VAP profile wlan-net and regulatory domain profile default
Regulatory domain profile	Name: default Country code: China
SSID profile	Name: wlan-net SSID name: wlan-net
Security profile	Name: wlan-net Security policy: WPA-WPA2+PSK+AES Password: a1234567
VAP profile	Name: wlan-net Forwarding mode: direct forwarding Service VLAN: VLAN 101 Referenced profiles: SSID profile wlan-net and security profile wlan-net
IPSec data planning on Router_2
IKE parameters	IKE version: IKEv1 Negotiation mode: main Peer IP address: 192.168.1.1 Authentication mode: pre-shared key authentication Pre-shared key: huawei@1234 Authentication algorithm: SHA2-256 Encryption algorithm: AES-128 DH group number: group14
IPSec parameters	Security protocol: ESP ESP negotiation mode: main ESP authentication algorithm: SHA2-256 ESP encryption algorithm: AES-128 Encapsulation mode: tunnel
IPSec policy	Connection name: map1 Interface name: gigabitethernet 0/0/1 Networking mode: branch site Connection number: 10 ACL number: 3101

Configuration Roadmap

Configure network interworking of the AC, APs, and other network devices.
Configure IPSec parameters to set up an IPSec tunnel.
1. Configure an IP address and a static route on each interface to implement communication between both ends.
2. Configure ACLs and define the data flows to be protected by the IPSec tunnel.
3. Configure an IPSec proposal to define the traffic protection method.
4. Configure IKE peers and define the attributes used for IKE negotiation.
5. Configure an IPSec policy, and apply the ACL, IPSec proposal, and IKE peers to the IPSec policy to define the data flows to be protected and protection method.
6. Apply the IPSec policy to the interface so that the interface can protect traffic.
Configure the APs to go online.
1. Create an AP group and add APs that require the same configuration to the group for unified configuration.
2. Configure AC system parameters, including the country code and source interface used by the AC to communicate with the APs.
3. Configure the AP authentication mode and import the APs offline to allow the APs to go online.
Configure WLAN service parameters for STAs to access the WLAN.

Configuration Notes

No ACK mechanism is provided for multicast packet transmission on air interfaces. In addition, wireless links are unstable. To ensure stable transmission of multicast packets, they are usually sent at low rates. If a large number of such multicast packets are sent from the network side, the air interfaces may be congested. You are advised to configure multicast packet suppression to reduce impact of a large number of low-rate multicast packets on the wireless network. Exercise caution when configuring the rate limit; otherwise, the multicast services may be affected.
- In direct forwarding mode, you are advised to configure multicast packet suppression on switch interfaces connected to APs.
- In tunnel forwarding mode, you are advised to configure multicast packet suppression in traffic profiles of the AC.
For details on how to configure traffic suppression, see How Do I Configure Multicast Packet Suppression to Reduce Impact of a Large Number of Low-Rate Multicast Packets on the Wireless Network?.
Configure port isolation on the interfaces of the device directly connected to APs. If port isolation is not configured and direct forwarding is used, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.
In tunnel forwarding mode, the management VLAN and service VLAN cannot be the same. Only packets from the management VLAN are transmitted between the AC and APs. Packets from the service VLAN are not allowed between the AC and APs.

Procedure

Configure the network devices.

# On Switch, add GE0/0/1 and GE0/0/2 to VLAN 100 and VLAN 101. VLAN 100 is the default VLAN of GE0/0/1.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 100 101
[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type trunk
[Switch-GigabitEthernet0/0/1] port trunk pvid vlan 100
[Switch-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[Switch-GigabitEthernet0/0/1] port-isolate enable
[Switch-GigabitEthernet0/0/1] quit
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type trunk
[Switch-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
[Switch-GigabitEthernet0/0/2] quit

# On Router_1, add GE1/0/0 to VLAN 100 and VLAN 101. If the peer end of GE0/0/1 is at 192.168.1.2/24, set the IP address of GE0/0/1 to 192.168.1.1/24.

<Huawei> system-view
[Huawei] sysname Router_1
[Router_1] vlan batch 100 101
[Router_1] interface gigabitethernet 1/0/0
[Router_1-GigabitEthernet1/0/0] port link-type trunk
[Router_1-GigabitEthernet1/0/0] port trunk allow-pass vlan 100 101
[Router_1-GigabitEthernet1/0/0] quit
[Router_1] interface gigabitethernet 0/0/1
[Router_1-GigabitEthernet0/0/1] ip address 192.168.1.1 255.255.255.0
[Router_1-GigabitEthernet0/0/1] quit

# Configure a default route with the next hop address 192.168.1.2 on Router_1.

[Router_1] ip route-static 0.0.0.0 0.0.0.0 192.168.1.2

# On Router_2, add GE1/0/0 to VLAN 200. Create VLANIF 200 and set its IP address to 10.23.200.2/24. If the peer end of GE0/0/1 is at 192.168.2.2/24, set the IP address of GE0/0/1 to 192.168.2.1/24.

<Huawei> system-view
[Huawei] sysname Router_2
[Router_2] vlan batch 200
[Router_2] interface gigabitethernet 1/0/0
[Router_2-GigabitEthernet1/0/0] port link-type trunk
[Router_2-GigabitEthernet1/0/0] port trunk allow-pass vlan 200
[Router_2-GigabitEthernet1/0/0] quit
[Router_2] interface gigabitethernet 0/0/1
[Router_2-GigabitEthernet0/0/1] ip address 192.168.2.1 255.255.255.0
[Router_2-GigabitEthernet0/0/1] quit
[Router_2] interface vlanif 200
[Router_2-Vlanif200] ip address 10.23.200.2 24
[Router_2-Vlanif200] quit

# Configure a static route from Router_2 to APs with the next hop address 192.168.2.2 on Router_2.

[Router_2] ip route-static 10.23.100.0 255.255.255.0 192.168.2.2
[Router_2] ip route-static 192.168.1.0 255.255.255.0 192.168.2.2

Configure a DHCP server to assign IP addresses to APs and STAs.

# Configure Router_1 as a DHCP server to assign IP addresses to APs and STAs.

[Router_1] dhcp enable
[Router_1] interface vlanif 100
[Router_1-Vlanif100] ip address 10.23.100.1 255.255.255.0
[Router_1-Vlanif100] dhcp select global
[Router_1-Vlanif100] quit
[Router_1] ip pool ap
[Router_1-ip-pool-ap] gateway-list 10.23.100.1
[Router_1-ip-pool-ap] network 10.23.100.0 mask 24
[Router_1-ip-pool-ap] option 43 sub-option 3 ascii 10.23.200.1
[Router_1-ip-pool-ap] quit
[Router_1] interface vlanif 101
[Router_1-Vlanif101] ip address 10.23.101.1 255.255.255.0
[Router_1-Vlanif101] dhcp select interface
[Router_1-Vlanif101] quit

Configure the DNS server as required. The common methods are as follows:

In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.

Configure ACLs and define the data flows to be protected by the IPSec tunnel.
# On Router_2, configure an ACL to protect the data flows from the AC (IP address 10.23.200.0/24) at the headquarters to the APs (IP address 10.23.100.0/24) in the branch.
```
[Router_2] acl number 3101
[Router_2-acl-adv-3101] rule permit ip source 10.23.200.0 0.0.0.255 destination 10.23.100.0 0.0.0.255
[Router_2-acl-adv-3101] quit
```
# On Router_1, configure an ACL to protect the data flows from the APs (IP address 10.23.100.0/24) in the branch to the AC (IP address 10.23.200.0/24) at the headquarters.
```
[Router_1] acl number 3101
[Router_1-acl-adv-3101] rule permit ip source 10.23.100.0 0.0.0.255 destination 10.23.200.0 0.0.0.255
[Router_1-acl-adv-3101] quit
```

Configure IPSec.

Create an IPSec proposal on Router_2 and Router_1.

# Create an IPSec proposal on Router_2.

[Router_2] ipsec proposal tran1
[Router_2-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[Router_2-ipsec-proposal-tran1] esp encryption-algorithm aes-128
[Router_2-ipsec-proposal-tran1] quit

# Create an IPSec proposal on Router_1.

[Router_1] ipsec proposal tran1
[Router_1-ipsec-proposal-tran1] esp authentication-algorithm sha2-256
[Router_1-ipsec-proposal-tran1] esp encryption-algorithm aes-128
[Router_1-ipsec-proposal-tran1] quit

Create IKE peers on Router_2 and Router_1.

# Create an IKE proposal on Router_2.

[Router_2] ike proposal 5
[Router_2-ike-proposal-5] authentication-algorithm sha2-256 
[Router_2-ike-proposal-5] encryption-algorithm aes-128
[Router_2-ike-proposal-5] dh group14
[Router_2-ike-proposal-5] quit

# Configure an IKE peer on Router_2, and configure the pre-shared key and peer ID based on the default settings.

[Router_2] ike peer spub
[Router_2-ike-peer-spub] undo version 2 
[Router_2-ike-peer-spub] ike-proposal 5
[Router_2-ike-peer-spub] pre-shared-key cipher huawei@1234
[Router_2-ike-peer-spub] remote-address 192.168.1.1
[Router_2-ike-peer-spub] quit

# Create an IKE proposal on Router_1.

[Router_1] ike proposal 5
[Router_1-ike-proposal-5] authentication-algorithm sha2-256 
[Router_1-ike-proposal-5] encryption-algorithm aes-128
[Router_1-ike-proposal-5] dh group14
[Router_1-ike-proposal-5] quit

# Configure an IKE peer on Router_1, and configure the pre-shared key and peer ID based on the default settings.

[Router_1] ike peer spua
[Router_1-ike-peer-spub] undo version 2
[Router_1-ike-peer-spub] ike-proposal 5
[Router_1-ike-peer-spua] pre-shared-key cipher huawei@1234
[Router_1-ike-peer-spua] remote-address 192.168.2.1
[Router_1-ike-peer-spua] quit

Create IPSec policies on Router_2 and Router_1.

# Configure an IPSec policy in IKE negotiation mode on Router_2.

[Router_2] ipsec policy map1 10 isakmp
[Router_2-ipsec-policy-isakmp-map1-10] ike-peer spub
[Router_2-ipsec-policy-isakmp-map1-10] proposal tran1
[Router_2-ipsec-policy-isakmp-map1-10] security acl 3101
[Router_2-ipsec-policy-isakmp-map1-10] quit

# Configure an IPSec policy in IKE negotiation mode on Router_1.

[Router_1] ipsec policy use1 10 isakmp
[Router_1-ipsec-policy-isakmp-use1-10] ike-peer spua
[Router_1-ipsec-policy-isakmp-use1-10] proposal tran1
[Router_1-ipsec-policy-isakmp-use1-10] security acl 3101
[Router_1-ipsec-policy-isakmp-use1-10] quit

Apply the IPSec policies to the interfaces of Router_2 and Router_1, so that the interfaces can protect traffic.

# Apply the IPSec policy to the interface of Router_2.

[Router_2] interface gigabitethernet 0/0/1
[Router_2-GigabitEthernet0/0/1] ipsec policy map1
[Router_2-GigabitEthernet0/0/1] quit

# Apply the IPSec policy to the interface of Router_1.

[Router_1] interface gigabitethernet 0/0/1
[Router_1-GigabitEthernet0/0/1] ipsec policy use1
[Router_1-GigabitEthernet0/0/1] quit

Configure system parameters for the AC.
1. Perform basic AC configurations.
  # Choose Configuration > Config Wizard > AC. The Basic AC Configuration page is displayed.
  
  # Set Country/Region based on actual situations. For example, set Country/Region to China. Set System time to Manual and Date and time to PC.
  
  # Click Next. The Port Configuration page is displayed.
2. Configure interfaces.
  # Select GigabitEthernet0/0/1 and expand Batch Modify. Set Interface type to Trunk and add GigabitEthernet0/0/1 to VLAN 200 (management VLAN).
  
  # Click Apply. In the dialog box that is displayed, click OK.
  
  # Click Next. The Network Interconnection Configuration page is displayed.
3. Configuring network interconnections.
  # Click Create under Interface Configuration. The Create Interface Configuration page is displayed.
  
  # Set the IP address of VLANIF 200 to 10.23.200.1/24.
  
  # Click Create under DHCPv4 Address Pool List, select Interface address pool and select VLANIF 200.
  
  # Click OK. An address pool for VLANIF 200 is configured.
  
  Configure the DNS server address as required.
  
  # Under Static Route Table, click Create. The Create Static Route Table page is displayed.
  
  # Set Destination IP to 0.0.0.0, Subnet Mask to 0(0.0.0.0), and Next hop address to 10.23.200.2.
  
  # Click OK.
  
  # Click Next.
  
  # Click Next. The AC Source Address page is displayed.
4. Configure the source address for AC.
  # Set AC source address to VLANIF. Click the browse button and select Vlanif200.
  
  # Click Next. The Confirm Settings page is displayed.
5. Confirm the configuration.
  # Confirm the configuration and click Continue With AP Online.
Configure APs to go online.
1. Configure APs to go online.
  # Click Batch Import. The Batch Import page is displayed. Click to download an AP template file to your local computer.
  # Fill in the AP template file with AP information according to the following example. To add multiple APs, fill in the file with information of the APs.
  - AP MAC: 60de-4476-e360
  - AP SN: 210235419610CB002287
  - AP Name: area_1
  - AP Group: ap-group1
  If you set AP authentication mode to MAC address authentication, the AP's MAC address is mandatory and the AP's SN is optional.
  If you set AP authentication mode to SN authentication, the AP's SN is mandatory and the AP's MAC address is optional.
  
  You are advised to export the radio ID, AP channel, frequency bandwidth, and power planned on WLAN Planner to a .csv file, and then enter them in the AP template file. Set the longitude and latitude as required.
  # Click next to Import AP File, select the AP template file, and click Import.
  
  # On the page that displays the template import result, click OK.
  
  # Click Next. The Group APs page is displayed.
  
  # AP group information has been added in the AP template file. Click Next. The Confirm Configurations page is displayed.
2. Confirm the configuration.
  # Confirm the configuration and click Continue With Wireless Service Configuration.
Configure WLAN services.
# Click Create. The Basic Information page is displayed.

# Set the SSID name, forwarding mode, and service VLAN.

# Click Next. The Security Authentication page is displayed.

# Set Security settings to Key (applicable to personnel networks) and set the key.

# Click Next. The Access Control page is displayed.

# Set Binding the AP group to ap-group1.

# Click Finish.
Set the AP channel and power.
1. Disable automatic channel and power calibration functions of AP radios, and manually configure the AP channel and power.
  
  Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled.
  
  # Choose Configuration > AP Config > AP Config > AP Info. The AP List page is displayed.
  
  # Click the ID of the AP whose channel and power need to be configured. The AP customized settings page is displayed.
  
  # Click next to Radio Management. The profiles under Radio Management are displayed.
  
  # Click Radio 0. On the radio 0 configuration page that is displayed, disable the automatic channel and power calibration functions, and set the channel to 20-MHz channel 6 and transmit power to 127 dBm.
  
  # The configuration of Radio 1 is similar to that of Radio0. Disable automatic channel and power calibration functions, and set the AP channel to 20-MHz channel 149 and transmit power to 127 dBm.
  
  # Click Apply. In the dialog box that is displayed, click OK.
Verify the configuration.
1. Choose Monitoring > SSID > VAP. In VAP List, check VAP status. You can see that the status of the VAP in wlan-net is normal.
2. The WLAN with the SSID wlan-net is available.
3. The STA can associate with the WLAN and obtain an IP address 10.23.101.x/24, and its gateway address is 10.23.101.1.
4. Choose Monitoring > User > User List. All online users are displayed in User List. You can use the filtering function to filter the display results. For example, click next to SSID. Set the filtering condition, enter wlan-net, and click OK. Users connected to the SSID wlan-net are displayed. Multi-column filtering is supported to accurately query online users.