操作步骤

1. 【设备】配置接入交换机S2750EI，保证网络互通。

   <HUAWEI> system-view
   [HUAWEI] sysname S2700
   [S2700] vlan batch 100 101   //创建VLAN100、VLAN101
   [S2700] interface gigabitethernet 0/0/1  //连接AP的接口
   [S2700-GigabitEthernet0/0/1] port link-type trunk  //修改接口gigabitethernet0/0/1的链路类型为trunk
   [S2700-GigabitEthernet0/0/1] port trunk pvid vlan 100  //设置接口gigabitethernet0/0/1的缺省VLAN为VLAN100
   [S2700-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101  //把接口gigabitethernet0/0/1加入VLAN100、VLAN101
   [S2700-GigabitEthernet0/0/1] quit
   [S2700] interface gigabitethernet 0/0/4  //连接AP的接口
   [S2700-GigabitEthernet0/0/4] port link-type trunk  //修改接口gigabitethernet0/0/4的链路类型为trunk
   [S2700-GigabitEthernet0/0/4] port trunk pvid vlan 100  //设置接口gigabitethernet0/0/4的缺省VLAN为VLAN100
   [S2700-GigabitEthernet0/0/4] port trunk allow-pass vlan 100 101  //把接口gigabitethernet0/0/4加入VLAN100、VLAN101
   [S2700-GigabitEthernet0/0/4] quit

   #创建Eth-Trunk接口1，并把GE0/0/2和GE0/0/3加入Eth-Trunk1。

   [S2700] interface eth-trunk 1  //创建Eth-Trunk1
   [S2700-Eth-Trunk1] quit
   [S2700] interface gigabitethernet 0/0/2  //将接口gigabitethernet0/0/2加入Eth-Trunk1
   [S2700-GigabitEthernet0/0/2] eth-trunk 1
   [S2700-GigabitEthernet0/0/2] quit
   [S2700] interface gigabitethernet 0/0/3  //将接口gigabitethernet0/0/3加入Eth-Trunk1
   [S2700-GigabitEthernet0/0/3] eth-trunk 1
   [S2700-GigabitEthernet0/0/3] quit

   #将Eth-Trunk1加入VLAN。

   [S2700] interface eth-trunk 1  //连接汇聚交换机的接口
   [S2700-Eth-Trunk1] port link-type trunk  //修改Eth-Trunk1的链路类型为trunk
   [S2700-Eth-Trunk1] port trunk allow-pass vlan 100 101  //把Eth-Trunk1加入VLAN100、VLAN101
   [S2700-Eth-Trunk1] undo port trunk allow-pass vlan 1
   [S2700-Eth-Trunk1] quit
   [S2700] quit
   <S2700> save  //保存配置

2. 【设备】配置汇聚交换机S5720HI，保证网络互通。

   <HUAWEI> system-view
   [HUAWEI] sysname S5700
   [S5700] dhcp enable   //启用DHCP服务
   [S5700] vlan batch 100 101   //批量创建VLAN100、VLAN101
   [S5700] interface vlanif 100  //进入VLANIF100接口视图
   [S5700-Vlanif100] ip address 172.18.10.4 24  //为VLANIF100接口配置IP地址，作为AP网关
   [S5700-Vlanif100] dhcp select interface
   [S5700-Vlanif100] dhcp server excluded-ip-address 172.18.10.1 172.18.10.3  //在DHCP地址池中去掉已经被占用的IP地址
   [S5700-Vlanif100] dhcp server excluded-ip-address 172.18.10.5 172.18.10.6
   [S5700-Vlanif100] quit

   #创建Eth-Trunk接口1，并把GE0/0/1和GE0/0/2加入Eth-Trunk1。

   [S5700] interface eth-trunk 1
   [S5700-Eth-Trunk1] quit
   [S5700] interface gigabitethernet 0/0/1
   [S5700-GigabitEthernet0/0/1] eth-trunk 1
   [S5700-GigabitEthernet0/0/1] quit
   [S5700] interface gigabitethernet 0/0/2
   [S5700-GigabitEthernet0/0/2] eth-trunk 1
   [S5700-GigabitEthernet0/0/2] quit

   #将Eth-Trunk1加入VLAN。

   [S5700] interface eth-trunk 1  //连接接入交换机S2700的接口
   [S5700-Eth-Trunk1] port link-type trunk
   [S5700-Eth-Trunk1] port trunk allow-pass vlan 100 101
   [S5700-Eth-Trunk1] undo port trunk allow-pass vlan 1
   [S5700-Eth-Trunk1] quit

   #创建Eth-Trunk接口2，并把GE0/0/3和GE0/0/4加入Eth-Trunk2。

   [S5700] interface eth-trunk 2
   [S5700-Eth-Trunk2] quit
   [S5700] interface gigabitethernet 0/0/3
   [S5700-GigabitEthernet0/0/3] eth-trunk 2
   [S5700-GigabitEthernet0/0/3] quit
   [S5700] interface gigabitethernet 0/0/4
   [S5700-GigabitEthernet0/0/4] eth-trunk 2
   [S5700-GigabitEthernet0/0/4] quit

   #将Eth-Trunk2加入VLAN。

   [S5700] interface eth-trunk 2  //连接核心交换机S7700A的接口
   [S5700-Eth-Trunk2] port link-type trunk
   [S5700-Eth-Trunk2] port trunk allow-pass vlan 100 101
   [S5700-Eth-Trunk2] undo port trunk allow-pass vlan 1
   [S5700-Eth-Trunk2] quit

   #创建Eth-Trunk接口3，并把GE0/0/5和GE0/0/6加入Eth-Trunk3。

   [S5700] interface eth-trunk 3
   [S5700-Eth-Trunk3] quit
   [S5700] interface gigabitethernet 0/0/5
   [S5700-GigabitEthernet0/0/5] eth-trunk 3
   [S5700-GigabitEthernet0/0/5] quit
   [S5700] interface gigabitethernet 0/0/6
   [S5700-GigabitEthernet0/0/6] eth-trunk 3
   [S5700-GigabitEthernet0/0/6] quit

   #将Eth-Trunk3加入VLAN。

   [S5700] interface eth-trunk 3  //连接核心交换机S7700B的接口
   [S5700-Eth-Trunk3] port link-type trunk
   [S5700-Eth-Trunk3] port trunk allow-pass vlan 100 101
   [S5700-Eth-Trunk3] undo port trunk allow-pass vlan 1
   [S5700-Eth-Trunk3] quit
   [S5700] quit
   <S5700> save  //保存配置

3. 【设备】配置核心交换机S7700A，保证网络互通。

   <HUAWEI> system-view
   [HUAWEI] sysname S7700A
   [S7700A] vlan batch 100 101 103   //批量创建VLAN100、VLAN101、VLAN103

   #创建Eth-Trunk接口1，并把GE1/0/1和GE1/0/2加入Eth-Trunk1。

   [S7700A] interface eth-trunk 1
   [S7700A-Eth-Trunk1] quit
   [S7700A] interface gigabitethernet 1/0/1
   [S7700A-GigabitEthernet1/0/1] eth-trunk 1
   [S7700A-GigabitEthernet1/0/1] quit
   [S7700A] interface gigabitethernet 1/0/2
   [S7700A-GigabitEthernet1/0/2] eth-trunk 1
   [S7700A-GigabitEthernet1/0/2] quit

   #将Eth-Trunk1加入VLAN。

   [S7700A] interface eth-trunk 1  //连接汇聚交换机S7700的接口
   [S7700A-Eth-Trunk1] port link-type trunk
   [S7700A-Eth-Trunk1] port trunk allow-pass vlan 100 101
   [S7700A-Eth-Trunk1] undo port trunk allow-pass vlan 1
   [S7700A-Eth-Trunk1] quit
   [S7700A] dhcp enable
   [S7700A] interface vlanif 101  //进入VLANIF101接口视图
   [S7700A-Vlanif101] ip address 172.19.10.2 24  //为VLANIF101接口配置IP地址，用于与S7700B的VLANIF101接口通信
   [S7700A-Vlanif101] dhcp select interface  //VLANIF101的接口虚地址配置为员工的网关，需要在VLANIF101上配置dhcp
   [S7700A-Vlanif101] dhcp server dns-list 172.22.10.4  //配置DNS服务器地址
   [S7700A-Vlanif101] dhcp server excluded-ip-address 172.19.10.1  //在DHCP地址池中去掉已经被占用的IP地址
   [S7700A-Vlanif101] dhcp server excluded-ip-address 172.19.10.3
   [S7700A-Vlanif101] quit

   #创建Eth-Trunk接口2，并把GE1/0/3和GE1/0/4加入Eth-Trunk2。

   [S7700A] interface eth-trunk 2
   [S7700A-Eth-Trunk2] quit
   [S7700A] interface gigabitethernet 1/0/3
   [S7700A-GigabitEthernet1/0/3] eth-trunk 2
   [S7700A-GigabitEthernet1/0/3] quit
   [S7700A] interface gigabitethernet 1/0/4
   [S7700A-GigabitEthernet1/0/4] eth-trunk 2
   [S7700A-GigabitEthernet1/0/4] quit

   #将Eth-Trunk2加入VLAN。

   [S7700A] interface eth-trunk 2  //连接AC1的接口
   [S7700A-Eth-Trunk2] port link-type trunk
   [S7700A-Eth-Trunk2] port trunk allow-pass vlan 100 101
   [S7700A-Eth-Trunk2] undo port trunk allow-pass vlan 1
   [S7700A-Eth-Trunk2] quit
   [S7700A] interface vlanif 100  //进入VLANIF100接口视图
   [S7700A-Vlanif100] ip address 172.18.10.5 24  //为VLANIF100接口配置IP地址，用于与AC1通信
   [S7700A-Vlanif100] quit

   #为连接出口路由器的接口配置IP地址。

   [S7700A] interface gigabitethernet 1/0/5  //连接出口路由器的接口
   [S7700A-GigabitEthernet1/0/5] port link-type trunk
   [S7700A-GigabitEthernet1/0/5] port trunk pvid vlan 103
   [S7700A-GigabitEthernet1/0/5] port trunk allow-pass vlan 103
   [S7700A-GigabitEthernet1/0/5] quit
   [S7700A] interface vlanif 103
   [S7700A-Vlanif103] ip address 172.22.20.1 24
   [S7700A-Vlanif103] quit
   [S7700A] ip route-static 0.0.0.0 0 172.22.20.2
   [S7700A] quit
   <S7700A> save  

4. 【设备】配置核心交换机S7700B，保证网络互通。

   <HUAWEI> system-view
   [HUAWEI] sysname S7700B
   [S7700B] vlan batch 100 101 103   //批量创建VLAN100、VLAN101、VLAN103

   #创建Eth-Trunk接口1，并把GE1/0/1和GE1/0/2加入Eth-Trunk1。

   [S7700B] interface eth-trunk 1
   [S7700B-Eth-Trunk1] quit
   [S7700B] interface gigabitethernet 1/0/1
   [S7700B-GigabitEthernet1/0/1] eth-trunk 1
   [S7700B-GigabitEthernet1/0/1] quit
   [S7700B] interface gigabitethernet 1/0/2
   [S7700B-GigabitEthernet1/0/2] eth-trunk 1
   [S7700B-GigabitEthernet1/0/2] quit

   #将Eth-Trunk1加入VLAN。

   [S7700B] interfacee eth-trunk 1  //连接汇聚交换机S5720HI的接口
   [S7700B-Eth-Trunk1] port link-type trunk
   [S7700B-Eth-Trunk1] port trunk allow-pass vlan 100 101
   [S7700B-Eth-Trunk1] undo port trunk allow-pass vlan 1
   [S7700B-Eth-Trunk1] quit
   [S7700B] dhcp enable
   [S7700B] interface vlanif 101  //进入VLANIF101接口视图
   [S7700B-Vlanif101] ip address 172.19.10.3 24  //为VLANIF101接口配置IP地址，用于与S7700A的VLANIF101接口通信
   [S7700B-Vlanif101] dhcp select interface  //VLANIF101的接口虚地址配置为员工的网关，需要在VLANIF101上配置dhcp
   [S7700B-Vlanif101] dhcp server dns-list 172.22.10.4  //配置DNS服务器地址
   [S7700B-Vlanif101] dhcp server excluded-ip-address 172.19.10.1 172.19.10.2  //在DHCP地址池中去掉已经被占用的IP地址
   [S7700B-Vlanif101] quit

   #创建Eth-Trunk接口2，并把GE1/0/3和GE1/0/4加入Eth-Trunk2。

   [S7700B] interface eth-trunk 2
   [S7700B-Eth-Trunk2] quit
   [S7700B] interface gigabitethernet 1/0/3
   [S7700B-GigabitEthernet1/0/3] eth-trunk 2
   [S7700B-GigabitEthernet1/0/3] quit
   [S7700B] interface gigabitethernet 1/0/4
   [S7700B-GigabitEthernet1/0/4] eth-trunk 2
   [S7700B-GigabitEthernet1/0/4] quit

   #将Eth-Trunk2加入VLAN。

   [S7700B] interface eth-trunk 2  //连接AC2的接口
   [S7700B-Eth-Trunk2] port link-type trunk
   [S7700B-Eth-Trunk2] port trunk allow-pass vlan 100 101 
   [S7700B-Eth-Trunk2] undo port trunk allow-pass vlan 1
   [S7700B-Eth-Trunk2] quit
   [S7700B] interface vlanif 100  //进入VLANIF100接口视图
   [S7700B-Vlanif100] ip address 172.18.10.6 24  //为VLANIF100接口配置IP地址，用于与AC2通信
   [S7700B-Vlanif100] quit

   #为连接出口路由器的接口配置IP地址。

   [S7700B] interface gigabitethernet 1/0/5  //连接出口路由器的接口
   [S7700B-GigabitEthernet1/0/5] port link-type trunk
   [S7700B-GigabitEthernet1/0/5] port trunk pvid vlan 103
   [S7700B-GigabitEthernet1/0/5] port trunk allow-pass vlan 103
   [S7700B-GigabitEthernet1/0/5] quit
   [S7700B] interface vlanif 103
   [S7700B-Vlanif103] ip address 172.23.20.1 24
   [S7700B-Vlanif103] quit
   [S7700B] ip route-static 0.0.0.0 0 172.23.20.2
   [S7700B] quit
   <S7700B> save  

5. 【设备】配置核心交换机S7700的VRRP备份组。

   # 在S7700A上VLANIF101下创建VRRP备份组1，配置S7700A在该备份组中的优先级为120，并配置抢占时间为20s，备份组1的虚地址为员工网关。

   <S7700A> system-view
   [S7700A] interface vlanif 101
   [S7700A-Vlanif101] vrrp vrid 1 virtual-ip 172.19.10.1
   [S7700A-Vlanif101] vrrp vrid 1 priority 120
   [S7700A-Vlanif101] vrrp vrid 1 preempt-mode timer delay 20
   [S7700A-Vlanif101] quit

   # 在S7700B上VLANIF101下创建VRRP备份组1，该备份组中的优先级使用缺省值100。

   <S7700B> system-view
   [S7700B] interface vlanif 101
   [S7700B-Vlanif101] vrrp vrid 1 virtual-ip 172.19.10.1
   [S7700B-Vlanif101] quit

6. 【设备】配置AC，保证网络互通。

   # 在AC1上配置网络互通，创建Eth-Trunk1和Eth-Trunk2，Eth-Trunk1加入VLAN100、Eth-Trunk2加入VLAN104，AC1连接核心交换机S7700A的接口GE0/0/1和GE0/0/2加入Eth-Trunk1、AC1连接AC2的接口GE0/0/3和GE0/0/4加入Eth-Trunk2。

   <AC6605> system-view
   [AC6605] sysname AC1
   [AC1] vlan batch 100 101 104
   [AC1] interface eth-trunk 1
   [AC1-Eth-Trunk1] port link-type trunk
   [AC1-Eth-Trunk1] port trunk allow-pass vlan 100
   [AC1-Eth-Trunk1] trunkport GigabitEthernet 0/0/1 0/0/2  //将连接核心交换机S7700A的接口GE0/0/1和GE0/0/2加入Eth-Trunk1
   [AC1-Eth-Trunk1] quit
   [AC1] interface eth-trunk 2
   [AC1-Eth-Trunk2] port link-type trunk
   [AC1-Eth-Trunk2] port trunk allow-pass vlan 104
   [AC1-Eth-Trunk2] trunkport GigabitEthernet 0/0/3 0/0/4  //将连接AC2的接口GE0/0/3和GE0/0/4加入Eth-Trunk2
   [AC1-Eth-Trunk2] quit

   # 配置AC1上的IP地址，用于和其它网元进行通信。

   [AC1] interface vlanif 104
   [AC1-Vlanif104] ip address 10.10.11.1 24  //用于和AC2之间通信和备份数据传输
   [AC1-Vlanif104] quit
   [AC1] interface vlanif 100
   [AC1-Vlanif100] ip address 172.18.10.2 24 
   [AC1-Vlanif100] quit

   # 配置AC1的缺省路由，报文默认转发到核心交换机。

   [AC1] ip route-static 0.0.0.0 0 172.18.10.5

   # 在AC2上配置网络互通，创建Eth-Trunk1和Eth-Trunk2，Eth-Trunk1加入VLAN100、Eth-Trunk2加入VLAN104，AC2连接核心交换机S7700B的接口GE0/0/1和GE0/0/2加入Eth-Trunk1、AC2连接AC1的接口GE0/0/3和GE0/0/4加入Eth-Trunk2。

   <AC6605> system-view
   [AC6605] sysname AC2
   [AC2] vlan batch 100 101 104
   [AC2] interface eth-trunk 1
   [AC2-Eth-Trunk1] port link-type trunk
   [AC2-Eth-Trunk1] port trunk allow-pass vlan 100
   [AC2-Eth-Trunk1] trunkport GigabitEthernet 0/0/1 0/0/2  //将连接核心交换机S7700B的接口GE0/0/1和GE0/0/2加入Eth-Trunk1
   [AC2-Eth-Trunk1] quit
   [AC2] interface eth-trunk 2
   [AC2-Eth-Trunk2] port link-type trunk
   [AC2-Eth-Trunk2] port trunk allow-pass vlan 104
   [AC2-Eth-Trunk2] trunkport GigabitEthernet 0/0/3 0/0/4  //将连接AC1的接口GE0/0/3和GE0/0/4加入Eth-Trunk2
   [AC2-Eth-Trunk2] quit

   # 配置AC2上的IP地址，用于和其它网元进行通信。

   [AC2] interface vlanif 104
   [AC2-Vlanif104] ip address 10.10.11.2 24  //用于和AC1之间通信和备份数据传输
   [AC2-Vlanif104] quit
   [AC2] interface vlanif 100
   [AC2-Vlanif100] ip address 172.18.10.3 24 
   [AC2-Vlanif100] quit

   # 配置AC2的缺省路由，报文默认转发到核心交换机。

   [AC2] ip route-static 0.0.0.0 0 172.18.10.6

7. 【设备】在AC1上配置VRRP方式的双机热备份。

   # 配置VRRP备份组的状态恢复延迟时间为30秒。

   [AC1] vrrp recover-delay 30

   # 在AC1上创建管理VRRP备份组，配置AC1在该备份组中的优先级为120，并配置抢占时间为1200秒。

   [AC1] interface vlanif 100
   [AC1-Vlanif100] vrrp vrid 1 virtual-ip 172.18.10.1  //配置管理VRRP备份组的虚拟IP地址
   [AC1-Vlanif100] vrrp vrid 1 priority 120  //配置AC1在管理VRRP备份组中的优先级
   [AC1-Vlanif100] vrrp vrid 1 preempt-mode timer delay 1200  //配置AC1在VRRP备份组中的抢占延迟时间
   [AC1-Vlanif100] admin-vrrp vrid 1  //配置vrid 1为管理VRRP备份组
   [AC1-Vlanif100] quit

   # 在AC1上创建HSB主备服务0，并配置其主备通道IP地址和端口号，配置HSB主备服务报文的重传次数和发送间隔。

   [AC1] hsb-service 0
   [AC1-hsb-service-0] service-ip-port local-ip 10.10.11.1 peer-ip 10.10.11.2 local-data-port 10241 peer-data-port 10241
   [AC1-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
   [AC1-hsb-service-0] quit

   # 在AC1上创建HSB备份组0，并配置其绑定HSB主备服务0和管理VRRP备份组。

   [AC1] hsb-group 0
   [AC1-hsb-group-0] bind-service 0
   [AC1-hsb-group-0] track vrrp vrid 1 interface vlanif 100
   [AC1-hsb-group-0] quit

   # 配置NAC业务绑定HSB备份组。

   [AC1] hsb-service-type access-user hsb-group 0

   # 配置WLAN业务绑定HSB备份组。

   [AC1] hsb-service-type ap hsb-group 0

   # 配置DHCP业务绑定HSB备份组。

   [AC1] hsb-service-type dhcp hsb-group 0

   # 使能双机热备功能。

   [AC1] hsb-group 0
   [AC1-hsb-group-0] hsb enable
   [AC1-hsb-group-0] quit

8. 【设备】在AC2上配置VRRP方式的双机热备份。

   # 配置VRRP备份组的状态恢复延迟时间为30秒。

   [AC2] vrrp recover-delay 30

   # 在AC2上创建管理VRRP备份组。

   [AC2] interface vlanif 100
   [AC2-Vlanif100] vrrp vrid 1 virtual-ip 172.18.10.1  //配置管理VRRP备份组的虚拟IP地址
   [AC2-Vlanif100] admin-vrrp vrid 1  //配置vrid 1为管理VRRP备份组
   [AC2-Vlanif100] quit

   # 在AC2上创建HSB主备服务0，并配置其主备通道IP地址和端口号，配置HSB主备服务报文的重传次数和发送间隔。

   [AC2] hsb-service 0
   [AC2-hsb-service-0] service-ip-port local-ip 10.10.11.2 peer-ip 10.10.11.1 local-data-port 10241 peer-data-port 10241
   [AC2-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
   [AC2-hsb-service-0] quit

   # 在AC2上创建HSB备份组0，并配置其绑定HSB主备服务0和管理VRRP备份组。

   [AC2] hsb-group 0
   [AC2-hsb-group-0] bind-service 0
   [AC2-hsb-group-0] track vrrp vrid 1 interface vlanif 100
   [AC2-hsb-group-0] quit

   # 配置NAC业务绑定HSB备份组。

   [AC2] hsb-service-type access-user hsb-group 0

   # 配置WLAN业务绑定HSB备份组。

   [AC2] hsb-service-type ap hsb-group 0

   # 配置DHCP业务绑定HSB备份组。

   [AC2] hsb-service-type dhcp hsb-group 0

9. 【设备】在AC2上使能双机热备功能。

   # 使能双机热备功能。

   [AC2] hsb-group 0
   [AC2-hsb-group-0] hsb enable
   [AC2-hsb-group-0] quit

10. 【设备】检查VRRP配置结果。

    # 完成上述配置以后，在AC1和AC2上分别执行display vrrp命令，可以看到AC1的State字段的显示为Master，AC2的State字段的显示为Backup。

    [AC1] display vrrp
      Vlanif100 | Virtual Router 1
        State : Master
        Virtual IP : 172.18.10.1
        Master IP : 172.18.10.2
        PriorityRun : 120
        PriorityConfig : 120
        MasterPriority : 120
        Preempt : YES   Delay Time : 1200 s
        TimerRun : 1 s
        TimerConfig : 1 s
        Auth type : NONE
        Virtual MAC : 0000-5e00-0101
        Check TTL : YES
        Config type : admin-vrrp
        Backup-forward : disabled
        Create time : 2005-07-31 01:25:55 UTC+08:00
        Last change time : 2005-07-31 02:48:22 UTC+08:00
                                                                                    
    

    [AC2] display vrrp
      Vlanif100 | Virtual Router 1
        State : Backup
        Virtual IP : 172.18.10.1
        Master IP : 172.18.10.2
        PriorityRun : 100
        PriorityConfig : 100
        MasterPriority : 120
        Preempt : YES   Delay Time : 0 s
        TimerRun : 1 s
        TimerConfig : 1 s
        Auth type : NONE
        Virtual MAC : 0000-5e00-0101
        Check TTL : YES
        Config type : admin-vrrp
        Backup-forward : disabled
        Create time : 2005-07-31 02:11:07 UTC+08:00
        Last change time : 2005-07-31 03:40:45 UTC+08:00
    

    # 在AC1和AC2上执行display hsb-service 0 命令，查看主备服务的建立情况。可以看到Service State字段的显示为Connected，说明主备服务通道已经成功建立。

    [AC1] display hsb-service 0
    Hot Standby Service Information:
    ----------------------------------------------------------
      Local IP Address       : 10.10.11.1
      Peer IP Address        : 10.10.11.2
      Source Port            : 10241
      Destination Port       : 10241
      Keep Alive Times       : 2
      Keep Alive Interval    : 1
      Service State          : Connected
      Service Batch Modules  : 
    ----------------------------------------------------------
    

    [AC2] display hsb-service 0
    Hot Standby Service Information:
    ----------------------------------------------------------
      Local IP Address       : 10.10.11.2
      Peer IP Address        : 10.10.11.1
      Source Port            : 10241
      Destination Port       : 10241
      Keep Alive Times       : 2
      Keep Alive Interval    : 1
      Service State          : Connected
      Service Batch Modules  : 
    ----------------------------------------------------------
    

    # 在AC1和AC2上执行display hsb-group 0命令，查看HSB备份组的运行情况。

    [AC1] display hsb-group 0
    Hot Standby Group Information:                                                  
    ----------------------------------------------------------                      
      HSB-group ID                : 0                                               
      Vrrp Group ID               : 1                                               
      Vrrp Interface              : Vlanif100                                       
      Service Index               : 0                                               
      Group Vrrp Status           : Master                                          
      Group Status                : Active                                          
      Group Backup Process        : Realtime                                        
      Peer Group Device Type      : AC6605                                          
      Peer Group Software Version : V200R006C20           
      Group Backup Modules        : Access-user                                     
                                    AP
                                    DHCP                                            
    ----------------------------------------------------------  

    [AC2] display hsb-group 0
    Hot Standby Group Information:                                                  
    ----------------------------------------------------------                      
      HSB-group ID                : 0                                               
      Vrrp Group ID               : 1                                               
      Vrrp Interface              : Vlanif100                                       
      Service Index               : 0                                               
      Group Vrrp Status           : Backup                                          
      Group Status                : Inactive                                        
      Group Backup Process        : Realtime                                        
      Peer Group Device Type      : AC6605                                          
      Peer Group Software Version : V200R006C20           
      Group Backup Modules        : Access-user                                     
                                    DHCP                                            
                                    AP                                              
    ----------------------------------------------------------  

11. 【设备】配置AC，配置RADIUS服务器认证、计费和授权模板，以便AC能够与RADIUS服务器。

    # 配置AC1的RADIUS服务器认证、计费和授权模板。

    [AC1] radius-server template radius_template 
    [AC1-radius-radius_template] radius-server authentication 172.22.10.2 1812 weight 80  //配置RADIUS主认证服务器，权重值高于备认证服务器，认证端口1812 
    [AC1-radius-radius_template] radius-server authentication 172.22.10.3 1812 weight 40  //配置RADIUS备认证服务器，权重值低于主认证服务器，认证端口1812 
    [AC1-radius-radius_template] radius-server accounting 172.22.10.2 1813 weight 80  //配置RADIUS主计费服务器，权重值高于备计费服务器，以便获取终端用户的上下线信息，计费端口1813 
    [AC1-radius-radius_template] radius-server accounting 172.22.10.3 1813 weight 40  //配置RADIUS备计费服务器，权重值低于主计费服务器，以便获取终端用户的上下线信息，计费端口1813 
    [AC1-radius-radius_template] radius-server shared-key cipher Admin@123  //配置RADIUS服务器预共享密钥 
    [AC1-radius-radius_template] radius-server user-name original  //设备向RADIUS服务器发送的用户名为用户原始输入的用户名 
    [AC1-radius-radius_template] quit 
    [AC1] radius-server source ip-address 172.18.10.1  //配置AC使用172.18.10.1和RADIUS服务器通信。 
    [AC1] radius-server authorization 172.22.10.2 shared-key cipher Admin@123  //配置主RADIUS授权服务器的地址，共享密钥为Admin@123，必须与认证密钥和计费密钥一致。配置授权服务器以便RADIUS服务器向AC下发授权规则。V200R021C00及之后的版本，必须同时执行radius-server authorization server-source命令，配置可以接收和响应的RADIUS授权服务器请求报文的IPv4地址，RADIUS授权服务器功能才能生效
    [AC1] radius-server authorization 172.22.10.3 shared-key cipher Admin@123  //配置备RADIUS授权服务器的地址，共享密钥为Admin@123，必须与认证密钥和计费密钥一致。配置授权服务器以便RADIUS服务器向AC下发授权规则。配置了授权服务器后，接入控制设备才能处理Agile Controller-Campus。V200R021C00及之后的版本，必须同时执行radius-server authorization server-source命令，配置可以接收和响应的RADIUS授权服务器请求报文的IPv4地址，RADIUS授权服务器功能才能生效
    [AC1] aaa 
    [AC1-aaa] authentication-scheme auth_scheme 
    [AC1-aaa-authen-auth_scheme] authentication-mode radius  //AC与Agile Controller-Campus联动，业务控制器作为RADIUS服务器，认证方案必须配置为RADIUS 
    [AC1-aaa-authen-auth_scheme] quit 
    [AC1-aaa] accounting-scheme acco_scheme 
    [AC1-aaa-accounting-acco_scheme] accounting-mode radius  //配置计费方案为RADIUS方式。为了方便RADIUS服务器维护帐号的状态信息，例如上下线信息，强制帐号下线，计费模式必须配置为radius 
    [AC1-aaa-accounting-acco_scheme] accounting realtime 15  //配置实时计费周期为15分钟，计费周期需要按照下表根据实际用户数进行配置，本例以用户数2000来配置 
    [AC1-aaa-accounting-acco_scheme] quit
    [AC1-aaa] quit

    配置实时计费是为了认证控制设备与Agile Controller-Campus之间定期发送计费报文，确保在线状态信息一致。实时计费间隔的取值对设备和RADIUS服务器的性能有要求，实时计费间隔的取值越小，对设备和RADIUS服务器的性能就越高。请根据用户数设置计费间隔。

    表4-118 计费间隔

    用户数	实时计费间隔
    1～99	3min
    100～499	6min
    500～999	12min
    ≥1000	≥15min

    # 测试用户是否能够通过RADIUS模板的认证。（已在RADIUS服务器上配置了测试用户test，用户密码Admin_123）。

    [AC1] test-aaa test Admin_123 radius-template radius_template pap
    Info: Account test succeed.

    # 在AC2全局下配置设备与RADIUS服务器通信的源IP地址。AC2上的其他RADIUS相关配置通过后续步骤的无线配置同步功能同步。

    [AC2] radius-server source ip-address 172.18.10.1

12. 【设备】在AC1上配置AP上线。

    # 创建AP组，用于将相同配置的AP都加入同一AP组中。

    [AC1] wlan
    [AC1-wlan-view] ap-group name ap-group1
    [AC1-wlan-ap-group-ap-group1] quit

    # 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。

    [AC1-wlan-view] regulatory-domain-profile name domain1
    [AC1-wlan-regulatory-domain-prof-domain1] country-code cn
    [AC1-wlan-regulatory-domain-prof-domain1] quit
    [AC1-wlan-view] ap-group name ap-group1
    [AC1-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
    Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y 
    [AC1-wlan-ap-group-ap-group1] quit
    [AC1-wlan-view] quit

    # 配置AC的源接口。

    [AC1] capwap source ip-address 172.18.10.1

    # 在AC上离线导入AP，并将AP加入AP组“ap-group1”中。

    [AC1] wlan
    [AC1-wlan-view] ap auth-mode mac-auth
    [AC1-wlan-view] ap-id 0 ap-mac 60de-4476-e360
    [AC1-wlan-ap-0] ap-name ap_0
    [AC1-wlan-ap-0] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
    [AC1-wlan-ap-0] quit
    [AC1-wlan-view] ap-id 1 ap-mac 60de-4476-e380
    [AC1-wlan-ap-1] ap-name ap_1
    [AC1-wlan-ap-1] ap-group ap-group1
    Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configurations of the radio, Whether to continue? [Y/N]:y
    [AC1-wlan-ap-1] quit
    [AC1-wlan-view] quit

    # 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。

    [AC1] display ap all
    Total AP information:
    nor  : normal          [2]
    -------------------------------------------------------------------------------------
    ID   MAC            Name   Group     IP            Type            State STA Uptime
    -------------------------------------------------------------------------------------
    0    60de-4476-e360 ap_0 ap_group  172.18.10.254 AP6010DN-AGN    nor   0   10S
    1    60de-4476-e380 ap_1 ap_group  172.18.10.253 AP6010DN-AGN    nor   0   20S
    -------------------------------------------------------------------------------------
    Total: 2

13. 【设备】在AC1配置无线802.1X接入，AC2的配置与AC1一致，不再赘述。

    无线802.1X接入配置流程：

    1. 配置接入模板。

       接入模板定义802.1X认证协议、报文处理相关参数，默认采用EAP认证方式。

       [AC1] dot1x-access-profile name acc_dot1x
       [AC1-dot1x-access-profile-acc_dot1x] quit

    2. 配置认证模板。

       认证模板通过接入模板指定用户接入方式；绑定RADIUS认证的认证方案、计费方案和服务器模板指定使用RADIUS认证。

       [AC1] authentication-profile name auth_dot1x
       [AC1-authentication-profile-auth_dot1x] dot1x-access-profile acc_dot1x
       [AC1-authentication-profile-auth_dot1x] authentication-scheme auth_scheme
       [AC1-authentication-profile-auth_dot1x] accounting-scheme acco_scheme
       [AC1-authentication-profile-auth_dot1x] radius-server radius_template
       [AC1-authentication-profile-auth_dot1x] quit

    3. 配置无线802.1X业务参数。

       # 创建名为“security_dot1x”的安全模板，并配置安全策略。

       [AC1] wlan
       [AC1-wlan-view] security-profile name security_dot1x
       [AC1-wlan-sec-prof-security_dot1x] security wpa2 dot1x aes
       [AC1-wlan-sec-prof-security_dot1x] quit

       # 创建名为“wlan-ssid”的SSID模板，并配置SSID名称为“employee”。

       [AC1-wlan-view] ssid-profile name wlan-ssid
       [AC1-wlan-ssid-prof-wlan-ssid] ssid employee
       Warning: This action may cause service interruption. Continue?[Y/N]y
       [AC1-wlan-ssid-prof-wlan-ssid] quit

       # 创建名为“wlan-vap”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、SSID模板和认证模板。

       [AC1-wlan-view] vap-profile name wlan-vap
       [AC1-wlan-vap-prof-wlan-vap] forward-mode direct-forward  //直接转发
       [AC1-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
       [AC1-wlan-vap-prof-wlan-vap] security-profile security_dot1x
       [AC1-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
       [AC1-wlan-vap-prof-wlan-vap] authentication-profile auth_dot1x
       [AC1-wlan-vap-prof-wlan-vap] quit

       # 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-vap”的配置。

       [AC1-wlan-view] ap-group name ap-group1
       [AC1-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio all
       [AC1-wlan-ap-group-ap-group1] quit
       [AC1-wlan-view] quit

14. 【设备】在AC1上配置认证后允许访问的资源。本举例以认证后允许访问所有资源为例。

    [AC1] acl 3001  
    [AC1-acl-adv-3001] rule 1 permit ip  
    [AC1-acl-adv-3001] quit

15. 配置AC2的WLAN私有配置。

    # 配置AC2的源地址。

    [AC2] capwap source ip-address 172.18.10.1

    1. 配置VRRP热备份场景下的无线配置同步功能。

       # 配置AC1上的无线配置同步功能。

       [AC1] wlan 
       [AC1-wlan-view] master controller 
       [AC1-master-controller] master-redundancy peer-ip ip-address 10.10.11.2 local-ip ip-address 10.10.11.1 psk H@123456 
       [AC1-master-controller] master-redundancy track-vrrp vrid 1 interface vlanif 100 
       [AC1-master-controller] quit 
       [AC1-wlan-view] quit 

       # 配置AC2上的无线配置同步功能。

       [AC2] wlan
       [AC2-wlan-view] master controller
       [AC2-master-controller] master-redundancy peer-ip ip-address 10.10.11.1 local-ip ip-address 10.10.11.2 psk H@123456
       [AC2-master-controller] master-redundancy track-vrrp vrid 1 interface vlanif 100
       [AC2-master-controller] quit
       [AC2-wlan-view] quit

    2. 手动触发无线配置同步。

       # 执行命令display sync-configuration status查看无线配置同步状态信息，状态为“cfg-mismatch”。需要在Master AC上手动触发无线配置同步到Backup Master AC上。等待Backup Master AC自动重启完成。

       [AC1] display sync-configuration status
       Controller role:Master/Backup/Local
       ----------------------------------------------------------------------------------------------------
       Controller IP Role    Device Type     Version        Status                           Last synced
       ----------------------------------------------------------------------------------------------------
       10.10.11.2    Backup  AC6605          V200R008C10    cfg-mismatch(config check fail)  -
       ----------------------------------------------------------------------------------------------------
       Total: 1
       [AC1] synchronize-configuration
       Warning: This operation may reset the remote AC, synchronize configurations to it, and save all its configurations. Whether to conti
       nue? [Y/N]:y

16. 检查无线配置同步。

    # 在AC1和AC2上分别执行命令display sync-configuration status，查看无线配置同步状态信息。状态为“up”表示无线配置同步功能正常。

    [AC1] display sync-configuration status
    Controller role:Master/Backup/Local
    -----------------------------------------------------------------------------------------
    Controller IP Role    Device Type     Version              Status        Last synced
    -----------------------------------------------------------------------------------------
    10.10.11.2    Backup  AC6605          V200R008C10          up       2017-09-01/11:18:15
    -----------------------------------------------------------------------------------------
    Total: 1
    [AC2] display sync-configuration status
    Controller role:Master/Backup/Local
    -----------------------------------------------------------------------------------------
    Controller IP Role    Device Type     Version              Status        Last synced
    -----------------------------------------------------------------------------------------
    10.10.11.1    Master  AC6605          V200R008C10          up       2017-09-01/11:18:25
    -----------------------------------------------------------------------------------------
    Total: 1

17. 【Agile Controller-Campus】在业务管理器中添加AC设备，以便Agile Controller-Campus能与AC正常联动。
    1. 选择“资源 > 设备 > 设备管理”。
    2. 单击“增加”。
    3. 设置AC设备的参数。

       参数	取值	说明
       名称	AC	-
       IP地址	172.18.10.1	AC的虚地址。
       RADIUS认证密钥	Admin@123	必须与AC上配置的RADUIS认证密钥一致。
       RADIUS计费密钥	Admin@123	必须与AC上配置的RADUIS计费密钥一致。
       实时计费周期	15	必须与AC上配置的计费周期一致。

    4. 单击“确定”。
18. 配置认证授权。
    1. 可选：选择“策略 > 准入控制 > 认证授权 > 认证规则”，修改缺省认证规则或新建认证规则。

       缺省认证规则只针对本地数据源，如果使用第三方数据源（如AD数据源）需修改缺省认证规则或新建认证规则，正确选择认证数据源。

    2. 选择“策略 > 准入控制 > 认证授权 > 授权结果”，添加授权ACL。

       ACL编号与认证控制设备配置一致。

    3. 选择“策略 > 准入控制 > 认证授权 > 授权规则”，关联授权结果，指定用户认证通过后允许访问的资源。