Example for Configuring 802.1X Authentication

Procedure

1. Configure the switches and router.

   # Add GE0/0/1 and GE0/0/3 on the aggregation switch to VLAN 101.

   # Assign an IP address 10.23.101.2/24 to GE1/0/0 on Router and configure the router as the default gateway for the AP.

   # Configure a RADIUS server, configure a user name and password, and set the shared key to huawei123.

2. Configure WLAN services.
   1. Choose Wizard > Config Wizard. The Configure Wi-Fi Signals page is displayed.
   2. Configure Wi-Fi signals.

      # Click Create. The Basic Information page is displayed.

      # Configure basic information about an SSID.
      
      

      # Click Next. The IP and Rate page is displayed.

      # Set IP address parameters.
      
      

      # Click Finish.

   3. Configure Internet connection parameters.

      # Click Next. The Configure Internet Connection page is displayed.

      # Add an interface to VLAN 101 in tagged mode.

      If you log in to the web platform using a PC whose Ethernet interface is being modified, do not delete the existing VLAN configuration on the interface to ensure that the PC can communicate with Fat APs. As shown in the following figure, GigabitEthernet0/0/0 is added to VLAN 1 by default and STAs communicate with the AP through this interface. You can use the default IP address of the AP to log in to the web platform. If you need to use the default IP address to log in to the web platform, do not delete VLAN 1.

      
      
      

      # Click Finish.

3. Configure DNS.
   Configure the DNS server as required. The common methods are as follows:

   • In interface address pool scenarios, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
   • In global address pool scenarios, run the dns-list ip-address &<1-8> command in the IP address pool view.
   1. Choose Configuration > IP Service > DHCP > DHCP Address Pool. In Address Pool List, click Vlanif101. The Modify DHCP Address Pool page is displayed.
   2. Configure the DNS server address for the STA and click OK.

4. Configure a static route.
   1. Choose Configuration > IP Service > Route. The Route page is displayed.
   2. Click Create in Static Route Configuration Table.

      
      
      

   3. Click OK.
5. Verify the configuration.
   • The WLAN with SSID wlan-net is available for STAs connected to the AP.
   • The wireless PC obtains an IP address after it associates with the WLAN.
   • Use the 802.1X authentication client on a STA and enter the correct user name and password. The STA is authenticated and can access the WLAN. You must configure the client for PEAP authentication.

     • Configuration on the Windows XP operating system:

       1. On the Association tab page of the Wireless network properties dialog box, add SSID wlan-net, set the authentication mode to WPA2, and encryption algorithm to AES.
       2. On the Authentication tab page, set EAP type to PEAP and click Properties. In the Protected EAP Properties dialog box, deselect Validate server certificate and click Configure. In the displayed dialog box, deselect Automatically use my Windows logon name and password and click OK.

     • Configuration on the Windows 7 operating system:

       1. Access the Manage wireless networks page, click Add, and select Manually create a network profile. Add SSID wlan-net. Set the authentication mode to WPA2-Enterprise, and encryption algorithm to AES. Click Next.
       2. Click Change connection settings. On the Wireless Network Properties page that is displayed, select the Security tab page and click Settings. In the Protected EAP Properties dialog box, deselect Validate server certificate and click Configure. In the displayed dialog box, deselect Automatically use my Windows logon name and password and click OK.
       3. On the Wireless Network Properties page, click Advanced settings. On the Advanced settings page that is displayed, select Specify authentication mode, set the identity authentication mode to User authentication, and click OK.

   • After wireless users connect to the network, run the display access-user access-type dot1x command on the AP to view users in 802.1X authentication mode. The user huawei has gone online successfully.

     <HUAWEI> display access-user access-type dot1x 
     ------------------------------------------------------------------------------
     UserID Username                IP address       MAC            Status          
     ------------------------------------------------------------------------------
     460    huawei                  10.23.101.254    8000-6e74-e78a Success 
     ------------------------------------------------------------------------------
     Total: 1, printed: 1