操作步骤

1. 配置周边设备
   # 配置接入交换机SwitchA的GE0/0/1和GE0/0/2接口加入VLAN100，GE0/0/1的缺省VLAN为VLAN100。

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchA
   [SwitchA] vlan batch 100
   [SwitchA] interface gigabitethernet 0/0/1
   [SwitchA-GigabitEthernet0/0/1] port link-type trunk
   [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
   [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/1] port-isolate enable
   [SwitchA-GigabitEthernet0/0/1] quit
   [SwitchA] interface gigabitethernet 0/0/2
   [SwitchA-GigabitEthernet0/0/2] port link-type trunk
   [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/2] quit

   # 配置汇聚交换机SwitchB的接口GE0/0/1和GE0/0/2加入VLAN100，接口GE0/0/2和GE0/0/3加入VLAN101。

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchB
   [SwitchB] vlan batch 100 101
   [SwitchB] interface gigabitethernet 0/0/1
   [SwitchB-GigabitEthernet0/0/1] port link-type trunk
   [SwitchB-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [SwitchB-GigabitEthernet0/0/1] quit
   [SwitchB] interface gigabitethernet 0/0/2
   [SwitchB-GigabitEthernet0/0/2] port link-type trunk
   [SwitchB-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
   [SwitchB-GigabitEthernet0/0/2] quit
   [SwitchB] interface gigabitethernet 0/0/3
   [SwitchB-GigabitEthernet0/0/3] port link-type trunk
   [SwitchB-GigabitEthernet0/0/3] port trunk allow-pass vlan 101
   [SwitchB-GigabitEthernet0/0/3] quit

   # 配置Router的接口GE1/0/0加入VLAN101，创建接口VLANIF101并配置IP地址为10.23.101.2/24。

   <Huawei> system-view
   [Huawei] sysname Router
   [Router] vlan batch 101
   [Router] interface gigabitethernet 1/0/0
   [Router-GigabitEthernet1/0/0] port link-type trunk
   [Router-GigabitEthernet1/0/0] port trunk allow-pass vlan 101
   [Router-GigabitEthernet1/0/0] quit
   [Router] interface vlanif 101
   [Router-Vlanif101] ip address 10.23.101.2 24
   [Router-Vlanif101] quit

2. 配置AC与其它网络设备互通

   如果AC直接连接AP，需要在AC直连AP的接口上配置缺省VLAN为管理VLAN100。

   # 配置AC的接口GE0/0/1加入VLAN100和VLAN101。

   <HUAWEI> system-view
   [HUAWEI] sysname AC
   [AC] vlan batch 100 101
   [AC] interface gigabitethernet 0/0/1
   [AC-GigabitEthernet0/0/1] port link-type trunk
   [AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
   [AC-GigabitEthernet0/0/1] quit

3. 配置DHCP服务器为STA和AP分配IP地址
   # 在AC上配置VLANIF100接口为AP提供IP地址。

   [AC] dhcp enable
   [AC] interface vlanif 100
   [AC-Vlanif100] ip address 10.23.100.1 24
   [AC-Vlanif100] dhcp select interface
   [AC-Vlanif100] quit

   # 在SwitchB上配置VLANIF101接口为STA提供IP地址，并指定10.23.101.2作为STA的默认网关地址。

   DNS服务器地址请根据实际需要配置。常用配置方法如下：

   • 接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
   • 全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。

   [SwitchB] dhcp enable
   [SwitchB] interface vlanif 101
   [SwitchB-Vlanif101] ip address 10.23.101.1 24
   [SwitchB-Vlanif101] dhcp select interface
   [SwitchB-Vlanif101] dhcp server gateway-list 10.23.101.2
   [SwitchB-Vlanif101] quit

4. 配置AC到DNS服务器的路由

   [AC] interface vlanif 101 
   [AC-Vlanif101] ip address 10.23.101.3 24 
   [AC-Vlanif101] quit
   [AC] ip route-static 0.0.0.0 0.0.0.0 10.23.101.2

5. 配置AP上线
   # 创建AP组，用于将相同配置的AP都加入同一AP组中。

   [AC] wlan
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] quit

   # 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。

   [AC-wlan-view] regulatory-domain-profile name default
   [AC-wlan-regulate-domain-default] country-code cn
   [AC-wlan-regulate-domain-default] quit
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] regulatory-domain-profile default
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y  
   [AC-wlan-ap-group-ap-group1] quit
   [AC-wlan-view] quit

   # 配置AC的源接口。

   V200R021C00版本开始，配置CAPWAP源接口或源地址时，会检查和安全相关的配置是否已存在，包括DTLS加密的PSK、AC间DTLS加密的PSK、登录AP的用户名和密码、全局离线管理VAP的登录密码，均已存在才能成功配置，否则会提示用户先完成相关的配置。

   [AC] capwap source interface vlanif 100
   Set the DTLS PSK(contains 6-32 plain-text characters, or 48 or 68 cipher-text characters that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):******
   
   Set the DTLS inter-controller PSK(contains 6-32 plain-text characters, or 48 or 68 cipher-text characters that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):******
   
   Set the user name for FIT APs(contains 4-31 plain-text characters, which can only include letters, digits and underlines. And the first character must be a letter):admin
   
   Set the password for FIT APs(plain-text password of 8-128 characters or cipher-text password of 48-188 characters that must be a combination of at least three of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):********
   
   Set the global temporary-management psk(contains 8-63 plain-text characters, or 48-108 cipher-text characters that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):********

   # 开启CAPWAP DTLS不认证方式。（V200R021C00及之后版本）

   [AC] capwap dtls no-auth enable

   V200R021C00版本开始，AC默认开启CAPWAP控制隧道的DTLS加密功能。开启该功能，添加AP时AP会上线失败，此时需要先开启CAPWAP DTLS不认证方式让AP上线，以便AP获取安全凭证，AP上线后应及时关闭该功能，避免未授权AP上线。

   # 在AC上离线导入AP，并将AP加入AP组“ap-group1”中。假设AP的MAC地址为60de-4476-e360，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为60de-4476-e360的AP部署在1号区域，命名此AP为area_1。

   ap auth-mode命令缺省情况下为MAC认证，如果之前没有修改其缺省配置，可以不用执行ap auth-mode mac-auth。

   举例中使用的AP为AP5030DN，具有射频0和射频1两个射频。AP5030DN的射频0为2.4GHz射频，射频1为5GHz射频。

   [AC] wlan
   [AC-wlan-view] ap auth-mode mac-auth
   [AC-wlan-view] ap-id 0 ap-mac 60de-4476-e360
   [AC-wlan-ap-0] ap-name area_1
   Warning: This operation may cause AP reset. Continue? [Y/N]:y  
   [AC-wlan-ap-0] ap-group ap-group1
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y  
   [AC-wlan-ap-0] quit

   # 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。

   [AC-wlan-view] display ap all
   Total AP information:
   nor  : normal          [1]
   Extra information:
   P  : insufficient power supply
   --------------------------------------------------------------------------------------------------
   ID   MAC            Name   Group     IP            Type            State STA Uptime      ExtraInfo
   --------------------------------------------------------------------------------------------------
   0    60de-4476-e360 area_1 ap-group1 10.23.100.254 AP5030DN        nor   0   10S         -
   --------------------------------------------------------------------------------------------------
   Total: 1

   # 关闭CAPWAP DTLS不认证方式。（V200R021C00及之后版本）

   [AC-wlan-view] quit
   [AC] undo capwap dtls no-auth enable
   [AC] wlan

6. 配置本地认证

   # 配置本地认证方案“wlan-net”。

   [AC] aaa
   [AC-aaa] authentication-scheme wlan-net
   [AC-aaa-authen-wlan-net] authentication-mode local
   [AC-aaa-authen-wlan-net] quit

   # 配置本地用户的用户名、密码和服务类型。

   [AC-aaa] local-user guest password cipher guest@123
   [AC-aaa] local-user guest service-type web
   [AC-aaa] quit

7. 配置SSL策略“sslserver”并加载数字证书。

   # 加载证书和RSA密钥对。

   不想申请证书时，可以不执行此步骤，直接使用设备默认的SSL策略“default_policy”，该策略下使用default域下的预置证书。

   已申请获取到本地证书、CA证书和RSA密钥分别为abc_local.pem、abc_ca.pem、privatekey.pem，并已将这些都上传到设备的存储介质中。如果申请到多个CA证书，请执行相同的操作加载到设备内存中。生成privatekey.pem时的密钥为Huawei@123。

   [AC] pki realm abc
   [AC-pki-realm-abc] quit 
   [AC] pki import-certificate local realm abc pem filename abc_local.pem
   [AC] pki import-certificate ca realm abc pem filename abc_ca.pem
   [AC] pki import rsa-key-pair key1 pem privatekey.pem password Huawei@123

   # 配置SSL策略“sslserver”并加载数字证书。

   [AC] ssl policy sslserver type server
   [AC-ssl-policy-sslserver] pki-realm abc
   [AC-ssl-policy-sslserver] version tls1.2
   [AC-ssl-policy-sslserver] ciphersuite ecdhe_rsa_aes128_gcm_sha256 ecdhe_rsa_aes256_gcm_sha384
   [AC-ssl-policy-sslserver] quit

   # 查看SSL策略的配置信息，其中CA与本地证书的状态必须为loaded。

   [AC] display ssl policy sslserver
   ------------------------------------------------------------------------------
     Policy name                            :   sslserver                             
     Policy ID                              :   2                                
     Policy type                            :   Server                            
     Cipher suite                           :   ecdhe_rsa_aes128_gcm_sha256
                                                ecdhe_rsa_aes256_gcm_sha384 
     PKI realm                              :   abc
     Version                                :   tls1.2  
     Cache number                           :   128                                
     Time out(second)                       :   3600                              
     Server certificate load status         :   loaded                            
     CA certificate chain load status       :   loaded                            
     SSL renegotiation status               :   enable
     Bind number                            :   1                                 
     SSL connection number                  :   0                                 
     ------------------------------------------------------------------------------
   

8. 配置Portal接入模板“wlan-net”

   # 使能内置Portal服务器功能，并配置其使用的SSL策略名称为sslserver。

   [AC] interface loopback 1
   [AC-LoopBack1] ip address 10.1.1.1 24
   [AC-LoopBack1] quit
   [AC] portal local-server ip 10.1.1.1
   [AC] portal local-server https ssl-policy sslserver port 20000

   # 创建Portal接入模板“wlan-net”，并配置其使用内置Portal服务器。

   [AC] portal-access-profile name wlan-net
   [AC-portal-access-profile-wlan-net] portal local-server enable
   [AC-portal-access-profile-wlan-net] quit

9. 在STA的网关设备Router上配置到Portal服务器地址的路由

   [Router] ip route-static 10.1.1.1 32 10.23.101.3

10. 配置免认证规则模板，使用户在认证前可以访问DNS服务器

    [AC] free-rule-template name default_free_rule
    [AC-free-rule-default_free_rule] free-rule 1 destination ip 8.8.8.8 mask 32
    [AC-free-rule-default_free_rule] quit

11. 配置认证模板“wlan-net”

    [AC] authentication-profile name wlan-net
    [AC-authentication-profile-wlan-net] portal-access-profile wlan-net
    [AC-authentication-profile-wlan-net] free-rule-template default_free_rule
    [AC-authentication-profile-wlan-net] authentication-scheme wlan-net
    [AC-authentication-profile-wlan-net] quit

12. 配置WLAN业务参数

    # 创建名为“wlan-net”的安全模板，并配置安全策略为open方式的开放认证。

    [AC] wlan
    [AC-wlan-view] security-profile name wlan-net
    [AC-wlan-sec-prof-wlan-net] security open
    [AC-wlan-sec-prof-wlan-net] quit

    # 创建名为“wlan-net”的SSID模板，并配置SSID名称为“wlan-net”。

    [AC-wlan-view] ssid-profile name wlan-net
    [AC-wlan-ssid-prof-wlan-net] ssid wlan-net
    [AC-wlan-ssid-prof-wlan-net] quit

    # 创建名为“wlan-net”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、SSID模板和认证模板。

    [AC-wlan-view] vap-profile name wlan-net
    [AC-wlan-vap-prof-wlan-net] forward-mode tunnel
    [AC-wlan-vap-prof-wlan-net] service-vlan vlan-id 101
    [AC-wlan-vap-prof-wlan-net] security-profile wlan-net
    [AC-wlan-vap-prof-wlan-net] ssid-profile wlan-net
    [AC-wlan-vap-prof-wlan-net] authentication-profile wlan-net
    [AC-wlan-vap-prof-wlan-net] quit

    # 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-net”的配置。

    [AC-wlan-view] ap-group name ap-group1
    [AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0
    [AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1
    [AC-wlan-ap-group-ap-group1] quit
    [AC-wlan-view] quit

13. 检查配置结果

    • 完成配置后，STA可以搜索到SSID为wlan-net的无线网络。

    • STA关联到无线网络上后，能够被分配相应的IP地址。
    • STA上打开浏览器访问网络时，会自动跳转到Portal服务器提供的认证页面，在页面上输入正确的用户名和密码后，STA认证成功并可以访问网络。