无线接入控制器(AC和FIT AP) V200R019C00 配置指南(命令行)
配置WLAN AC间二层漫游示例
组网需求
- AC组网方式：AC_1和AC_2属于同一个漫游组。
- DHCP部署方式：AC_1作为DHCP服务器为AP和STA分配IP地址。
- 业务数据转发方式：隧道转发。
图13-17 配置WLAN AC间二层漫游示例组网图
![]()
数据规划
表13-8 AC数据规划表
配置项 |
数据 |
|---|---|
DHCP服务器 |
AC_1作为DHCP服务器为STA和AP分配IP地址 |
AP的IP地址池 |
10.23.100.3～10.23.100.254/24 |
STA的IP地址池 |
10.23.101.3～10.23.101.254/24 |
AC的源接口IP地址 |
源接口：VLANIF100
|
AP组 |
|
域管理模板 |
|
SSID模板 |
|
安全模板 |
|
VAP模板 |
|
空口扫描模板 |
|
2G射频模板 |
|
5G射频模板 |
|
漫游组 |
|
配置思路
- 配置AP、AC和周边网络设备之间实现网络互通。
- 配置AP上线。
- 创建AP组，用于将需要进行相同配置的AP都加入到AP组，实现统一配置。
- 配置AC的系统参数，包括国家码、AC与AP之间通信的源接口。
- 配置AP上线的认证方式并离线导入AP，实现AP正常上线。
- 配置WLAN业务参数，实现STA访问WLAN网络功能。
- 配置AC_1和AC_2的WLAN漫游功能，实现AC间漫游。
当用户新开局时，对于AP的射频信道的设置，用户可根据网络规划手动指定，也可使用射频调优功能自动选择最佳信道。本例中采用射频调优功能自动选择最佳信道。
配置注意事项
- 纯组播报文由于协议要求在无线空口没有ACK机制保障，且无线空口链路不稳定，为了纯组播报文能够稳定发送，通常会以低速报文形式发送。如果网络侧有大量异常组播流量涌入，则会造成无线空口拥堵。为了减小大量低速组播报文对无线网络造成的冲击，建议配置组播报文抑制功能。配置前请确认是否有组播业务，如果有，请谨慎配置限速值。
- 业务数据转发方式采用直接转发时，建议在直连AP的交换机接口上配置组播报文抑制。
- 业务数据转发方式采用隧道转发时，建议在AC的流量模板下配置组播报文抑制。
建议在与AP直连的设备接口上配置端口隔离，如果不配置端口隔离，尤其是业务数据转发方式采用直接转发时，可能会在VLAN内形成大量不必要的广播报文，导致网络阻塞，影响用户体验。
隧道转发模式下，管理VLAN和业务VLAN不能配置为同一VLAN，且AP和AC之间只能放通管理VLAN，不能放通业务VLAN。
操作步骤
- 配置周边设备# 配置接入交换机Switch_1的GE0/0/1和GE0/0/2接口加入VLAN100，GE0/0/1的缺省VLAN为VLAN100。
<HUAWEI> system-view [HUAWEI] sysname Switch_1 [Switch_1] vlan batch 100 [Switch_1] interface gigabitethernet 0/0/1 [Switch_1-GigabitEthernet0/0/1] port link-type trunk [Switch_1-GigabitEthernet0/0/1] port trunk pvid vlan 100 [Switch_1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [Switch_1-GigabitEthernet0/0/1] quit [Switch_1] interface gigabitethernet 0/0/2 [Switch_1-GigabitEthernet0/0/2] port link-type trunk [Switch_1-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 [Switch_1-GigabitEthernet0/0/2] quit
# 配置接入交换机Switch_2的GE0/0/1和GE0/0/2接口加入VLAN100，GE0/0/1的缺省VLAN为VLAN100。<HUAWEI> system-view [HUAWEI] sysname Switch_2 [Switch_2] vlan batch 100 [Switch_2] interface gigabitethernet 0/0/1 [Switch_2-GigabitEthernet0/0/1] port link-type trunk [Switch_2-GigabitEthernet0/0/1] port trunk pvid vlan 100 [Switch_2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [Switch_2-GigabitEthernet0/0/1] quit [Switch_2] interface gigabitethernet 0/0/2 [Switch_2-GigabitEthernet0/0/2] port link-type trunk [Switch_2-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 [Switch_2-GigabitEthernet0/0/2] quit
- 配置AC与其它网络设备互通# 配置AC_1的接口GE0/0/1加入VLAN100，AC_1的接口GE0/0/2加入VLAN100和VLAN101。
<HUAWEI> system-view [HUAWEI] sysname AC_1 [AC_1] vlan batch 100 101 [AC_1] interface gigabitethernet 0/0/1 [AC_1-GigabitEthernet0/0/1] port link-type trunk [AC_1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [AC_1-GigabitEthernet0/0/1] quit [AC_1] interface gigabitethernet 0/0/2 [AC_1-GigabitEthernet0/0/2] port link-type trunk [AC_1-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101 [AC_1-GigabitEthernet0/0/2] quit [AC_1] interface vlanif 100 [AC_1-Vlanif100] ip address 10.23.100.1 255.255.255.0 [AC_1-Vlanif100] quit [AC_1] interface vlanif 101 [AC_1-Vlanif101] ip address 10.23.101.1 255.255.255.0 [AC_1-Vlanif101] quit
# 配置AC_2的接口GE0/0/1加入VLAN100，AC_2的接口GE0/0/2加入VLAN100和VLAN101。<HUAWEI> system-view [HUAWEI] sysname AC_2 [AC_2] vlan batch 100 101 [AC_2] interface gigabitethernet 0/0/1 [AC_2-GigabitEthernet0/0/1] port link-type trunk [AC_2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [AC_2-GigabitEthernet0/0/1] quit [AC_2] interface gigabitethernet 0/0/2 [AC_2-GigabitEthernet0/0/2] port link-type trunk [AC_2-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101 [AC_2-GigabitEthernet0/0/2] quit [AC_2] interface vlanif 100 [AC_2-Vlanif100] ip address 10.23.100.2 255.255.255.0 [AC_2-Vlanif100] quit [AC_2] interface vlanif 101 [AC_2-Vlanif101] ip address 10.23.101.2 255.255.255.0 [AC_2-Vlanif101] quit
- 配置DHCP服务器为STA和AP分配IP地址# 在AC_1上配置VLANIF100接口为AP提供IP地址，VLANIF101接口为STA提供IP地址。
![]()
DNS服务器地址请根据实际需要配置。常用配置方法如下：- 接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
- 全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。
[AC_1] dhcp enable [AC_1] interface vlanif 100 [AC_1-Vlanif100] dhcp select interface [AC_1-Vlanif100] dhcp server excluded-ip-address 10.23.100.2 [AC_1-Vlanif100] quit [AC_1] interface vlanif 101 [AC_1-Vlanif101] dhcp select interface [AC_1-Vlanif101] dhcp server excluded-ip-address 10.23.101.2 [AC_1-Vlanif101] quit
- 在AC_1上配置AP上线# 创建AP组，用于将相同配置的AP都加入同一AP组中。
[AC_1] wlan [AC_1-wlan-view] ap-group name ap-group1 [AC_1-wlan-ap-group-ap-group1] quit
# 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。[AC_1-wlan-view] regulatory-domain-profile name default [AC_1-wlan-regulate-domain-default] country-code cn [AC_1-wlan-regulate-domain-default] quit [AC_1-wlan-view] ap-group name ap-group1 [AC_1-wlan-ap-group-ap-group1] regulatory-domain-profile default Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y [AC_1-wlan-ap-group-ap-group1] quit [AC_1-wlan-view] quit
# 配置AC的源接口。[AC_1] capwap source interface vlanif 100
# 在AC上离线导入AP，并将AP加入AP组“ap-group1”中。假设AP的MAC地址为60de-4476-e360，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为60de-4476-e360的AP部署在1号区域，命名此AP为area_1。![]()
ap auth-mode命令缺省情况下为MAC认证，如果之前没有修改其缺省配置，可以不用执行ap auth-mode mac-auth。
举例中使用的AP为AP5030DN，具有射频0和射频1两个射频。AP5030DN的射频0为2.4GHz射频，射频1为5GHz射频。
[AC_1] wlan [AC_1-wlan-view] ap auth-mode mac-auth [AC_1-wlan-view] ap-id 0 ap-mac 60de-4476-e360 [AC_1-wlan-ap-0] ap-name area_1 Warning: This operation may cause AP reset. Continue? [Y/N]:y [AC_1-wlan-ap-0] ap-group ap-group1 Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y [AC_1-wlan-ap-0] quit
# 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。[AC_1-wlan-view] display ap all Total AP information: nor : normal [1] Extra information: P : insufficient power supply -------------------------------------------------------------------------------------------------- ID MAC Name Group IP Type State STA Uptime ExtraInfo -------------------------------------------------------------------------------------------------- 0 60de-4476-e360 area_1 ap-group1 10.23.100.254 AP5030DN nor 0 10S - -------------------------------------------------------------------------------------------------- Total: 1
- 配置WLAN业务参数# 创建名为“wlan-net”的安全模板，并配置安全策略。
![]()
举例中以配置WPA-WPA2+PSK+AES的安全策略为例，密码为“a1234567”，实际配置中请根据实际情况，配置符合实际要求的安全策略。
[AC_1-wlan-view] security-profile name wlan-net [AC_1-wlan-sec-prof-wlan-net] security wpa-wpa2 psk pass-phrase a1234567 aes [AC_1-wlan-sec-prof-wlan-net] quit
# 创建名为“wlan-net”的SSID模板，并配置SSID名称为“wlan-net”。[AC_1-wlan-view] ssid-profile name wlan-net [AC_1-wlan-ssid-prof-wlan-net] ssid wlan-net [AC_1-wlan-ssid-prof-wlan-net] quit
# 创建名为“wlan-net”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板和SSID模板。[AC_1-wlan-view] vap-profile name wlan-net [AC_1-wlan-vap-prof-wlan-net] forward-mode tunnel [AC_1-wlan-vap-prof-wlan-net] service-vlan vlan-id 101 [AC_1-wlan-vap-prof-wlan-net] security-profile wlan-net [AC_1-wlan-vap-prof-wlan-net] ssid-profile wlan-net [AC_1-wlan-vap-prof-wlan-net] quit
# 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-net”的配置。[AC_1-wlan-view] ap-group name ap-group1 [AC_1-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0 [AC_1-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1 [AC_1-wlan-ap-group-ap-group1] quit
- 开启射频调优功能自动选择AP最佳信道和功率# 使能射频的信道和功率自动调优功能。
[AC_1-wlan-view] ap-group name ap-group1 [AC_1-wlan-ap-group-ap-group1] radio 0 [AC_1-wlan-group-radio-ap-group1/0] calibrate auto-channel-select enable [AC_1-wlan-group-radio-ap-group1/0] calibrate auto-txpower-select enable [AC_1-wlan-group-radio-ap-group1/0] quit [AC_1-wlan-ap-group-ap-group1] radio 1 [AC_1-wlan-group-radio-ap-group1/1] calibrate auto-channel-select enable [AC_1-wlan-group-radio-ap-group1/1] calibrate auto-txpower-select enable [AC_1-wlan-group-radio-ap-group1/1] quit [AC_1-wlan-ap-group-ap-group1] quit
# 在域管理模板下配置调优信道集合。[AC-wlan-view] regulatory-domain-profile name default [AC_1-wlan-regulate-domain-default] dca-channel 2.4g channel-set 1,6,11 [AC_1-wlan-regulate-domain-default] dca-channel 5g bandwidth 20mhz [AC_1-wlan-regulate-domain-default] dca-channel 5g channel-set 149,153,157,161 [AC_1-wlan-regulate-domain-default] quit
# 创建空口扫描模板“wlan-airscan”，并配置调优信道集合、扫描间隔时间和扫描持续时间。
[AC-wlan-view] air-scan-profile name wlan-airscan [AC_1-wlan-air-scan-prof-wlan-airscan] scan-channel-set dca-channel [AC_1-wlan-air-scan-prof-wlan-airscan] scan-period 60 [AC_1-wlan-air-scan-prof-wlan-airscan] scan-interval 60000 [AC_1-wlan-air-scan-prof-wlan-airscan] quit
# 创建2G射频模板“wlan-radio2g”，并在该模板下引用空口扫描模板“wlan-airscan”。
[AC_1-wlan-view] radio-2g-profile name wlan-radio2g [AC_1-wlan-radio-2g-prof-wlan-radio2g] air-scan-profile wlan-airscan [AC_1-wlan-radio-2g-prof-wlan-radio2g] quit
# 创建5G射频模板“wlan-radio5g”，并在该模板下引用空口扫描模板“wlan-airscan”。
[AC_1-wlan-view] radio-5g-profile name wlan-radio5g [AC_1-wlan-radio-5g-prof-wlan-radio5g] air-scan-profile wlan-airscan [AC_1-wlan-radio-5g-prof-wlan-radio5g] quit
# 在名为“ap-group1”的AP组下引用5G射频模板“wlan-radio5g”和2G射频模板“wlan-radio2g”。
[AC_1-wlan-view] ap-group name ap-group1 [AC_1-wlan-ap-group-ap-group1] radio-5g-profile wlan-radio5g radio 1 [AC_1-wlan-ap-group-ap-group1] radio-2g-profile wlan-radio2g radio 0 [AC_1-wlan-ap-group-ap-group1] quit
# 配置射频调优模式为手动调优，并手动触发射频调优。
[AC_1-wlan-view] calibrate enable manual [AC_1-wlan-view] calibrate manual startup
# 待执行手动调优一小时后，调优结束。将射频调优模式改为定时调优，并将调优时间定为用户业务空闲时段（如当地时间凌晨00:00-06:00时段）。[AC_1-wlan-view] calibrate enable schedule time 03:00:00
- 配置AC_2上的AP上线、WLAN业务参数和射频调优功能
配置AC_2上的AP上线、WLAN业务参数和射频调优功能的配置请参考AC_1的配置过程，具体的配置请参见AC_2的配置文件。以下仅列出有差异的配置项：
- AC_2上添加MAC地址为dcd2-fc04-b500的AP，AP名称配置为“area_2”。
- 配置AC_1的WLAN漫游功能
# 创建漫游组，并配置AC_1和AC_2为漫游组成员。
[AC_1-wlan-view] mobility-group name mobility [AC_1-mc-mg-mobility] member ip-address 10.23.100.1 [AC_1-mc-mg-mobility] member ip-address 10.23.100.2 [AC_1-mc-mg-mobility] quit
- 配置AC_2的WLAN漫游功能
# 创建漫游组，并配置AC_1和AC_2为漫游组成员。
[AC_2-wlan-view] mobility-group name mobility [AC_2-mc-mg-mobility] member ip-address 10.23.100.1 [AC_2-mc-mg-mobility] member ip-address 10.23.100.2 [AC_2-mc-mg-mobility] quit
- 验证配置结果# WLAN业务配置会自动下发给AP，配置完成后，分别在AC_1和AC_2上执行命令display vap ssid wlan-net查看VAP信息，当“Status”显示为“ON”时，表示AP对应射频上的VAP已创建成功。
[AC_1-wlan-view] display vap ssid wlan-net WID : WLAN ID -------------------------------------------------------------------------------------- AP ID AP name RfID WID BSSID Status Auth type STA SSID -------------------------------------------------------------------------------------- 0 area_1 0 1 60DE-4476-E360 ON WPA/WPA2-PSK 0 wlan-net 0 area_1 1 1 60DE-4476-E370 ON WPA/WPA2-PSK 0 wlan-net --------------------------------------------------------------------------------------- Total: 2
[AC_2-wlan-view] display vap ssid wlan-net WID : WLAN ID -------------------------------------------------------------------------------------- AP ID AP name RfID WID BSSID Status Auth type STA SSID -------------------------------------------------------------------------------------- 1 area_2 0 1 DCD2-FC04-B500 ON WPA/WPA2-PSK 0 wlan-net 1 area_2 1 1 DCD2-FC04-B510 ON WPA/WPA2-PSK 0 wlan-net ------------------------------------------------------------------------------------- Total: 2
# 在AC_1上执行命令display mobility-group name mobility查看漫游组成员AC_1和AC_2的状态，当“State”显示为“normal”时，表示AC_1和AC_2正常。[AC_1-wlan-view] display mobility-group name mobility -------------------------------------------------------------------------------- State IP address Description -------------------------------------------------------------------------------- normal 10.23.100.1 - normal 10.23.100.2 - -------------------------------------------------------------------------------- Total: 2
# STA在AP_1的覆盖范围内搜索到SSID为“wlan-net”的无线网络，输入密码“a1234567”并正常关联后，在AC_1上执行命令display station ssid wlan-net，查看STA的接入信息，可以看到STA关联到了AP_1，STA的MAC地址为“e019-1dc7-1e08”。[AC_1-wlan-view] display station ssid wlan-net Rf/WLAN: Radio ID/WLAN ID Rx/Tx: link receive rate/link transmit rate(Mbps) ------------------------------------------------------------------------------------ STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP address ------------------------------------------------------------------------------------ e019-1dc7-1e08 0 area_1 1/1 5G 11n 46/59 -57 101 10.23.101.254 ------------------------------------------------------------------------------------ Total: 1 2.4G: 0 5G: 1
# 当STA从AP_1的覆盖范围移动到AP_2的覆盖范围时，在AC_2上执行命令display station ssid wlan-net，查看STA的接入信息，可以看到STA关联到了AP_2。[AC_2-wlan-view] display station ssid wlan-net Rf/WLAN: Radio ID/WLAN ID Rx/Tx: link receive rate/link transmit rate(Mbps) ------------------------------------------------------------------------------------ STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP address ------------------------------------------------------------------------------------ e019-1dc7-1e08 1 area_2 1/1 5G 11n 46/59 -58 101 10.23.101.254 ------------------------------------------------------------------------------------ Total: 1 2.4G: 0 5G: 1
# 在AC_2上执行命令display station roam-track sta-mac e019-1dc7-1e08，可以查看该STA的漫游轨迹。[AC_2-wlan-view] display station roam-track sta-mac e019-1dc7-1e08 Access SSID:wlan-net Rx/Tx: link receive rate/link transmit rate(Mbps) c:PMK Cache Roam r:802.11r Roam s:Same Frequency Network ------------------------------------------------------------------------------ L2/L3 AC IP AP name Radio ID BSSID TIME In/Out RSSI Out Rx/Tx ------------------------------------------------------------------------------ -- 10.23.100.1 area_1 1 60de-4476-e360 2015/02/09 16:11:51 -57/-57 22/3 L2 10.23.100.2 area_2 1 dcd2-fc04-b500 2015/02/09 16:13:53 -58/- -/- ------------------------------------------------------------------------------ Number: 1
配置文件
Switch_1的配置文件
# sysname Switch_1 # vlan batch 100 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 # return
Switch_2的配置文件
# sysname Switch_2 # vlan batch 100 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 # return
AC_1的配置文件
# sysname AC_1 # vlan batch 100 to 101 # dhcp enable # interface Vlanif100 ip address 10.23.100.1 255.255.255.0 dhcp select interface dhcp server excluded-ip-address 10.23.100.2 # interface Vlanif101 ip address 10.23.101.1 255.255.255.0 dhcp select interface dhcp server excluded-ip-address 10.23.101.2 # interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 to 101 # capwap source interface vlanif100 # wlan security-profile name wlan-net security wpa2 psk pass-phrase %^%#]:krYrz_r<ee}|Cq@9V(W{ZD$"\-R-HD_y.4#U4,%^%# aes ssid-profile name wlan-net ssid wlan-net vap-profile name wlan-net forward-mode tunnel service-vlan vlan-id 101 ssid-profile wlan-net security-profile wlan-net regulatory-domain-profile name default dca-channel 5g channel-set 149,153,157,161 mobility-group name mobility member ip-address 10.23.100.1 member ip-address 10.23.100.2 air-scan-profile name wlan-airscan scan-period 60 scan-interval 60000 radio-2g-profile name wlan-radio2g air-scan-profile wlan-airscan radio-5g-profile name wlan-radio5g air-scan-profile wlan-airscan ap-group name ap-group1 radio 0 radio-2g-profile wlan-radio2g vap-profile wlan-net wlan 1 radio 1 radio-5g-profile wlan-radio5g vap-profile wlan-net wlan 1 ap-id 0 type-id 35 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042 ap-name area_1 ap-group ap-group1 # return
AC_2的配置文件
# sysname AC_2 # vlan batch 100 to 101 # interface Vlanif100 ip address 10.23.100.2 255.255.255.0 # interface Vlanif101 ip address 10.23.101.2 255.255.255.0 # interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 101 # capwap source interface vlanif100 # wlan security-profile name wlan-net security wpa2 psk pass-phrase %^%#]:krYrz_r<ee}|Cq@9V(W{ZD$"\-R-HD_y.4#U4,%^%# aes ssid-profile name wlan-net ssid wlan-net vap-profile name wlan-net forward-mode tunnel service-vlan vlan-id 101 ssid-profile wlan-net security-profile wlan-net regulatory-domain-profile name default dca-channel 5g channel-set 149,153,157,161 mobility-group name mobility member ip-address 10.23.100.1 member ip-address 10.23.100.2 air-scan-profile name wlan-airscan scan-channel-set dca-channel radio-2g-profile name wlan-radio2g air-scan-profile wlan-airscan radio-5g-profile name wlan-radio5g air-scan-profile wlan-airscan ap-group name ap-group1 radio 0 radio-2g-profile wlan-radio2g vap-profile wlan-net wlan 1 calibrate auto-channel-select disable calibrate auto-txpower-select disable radio 1 radio-5g-profile wlan-radio5g vap-profile wlan-net wlan 1 calibrate auto-channel-select disable calibrate auto-txpower-select disable ap-id 1 type-id 35 ap-mac dcd2-fc04-b500 ap-sn 210235554710CB000078 ap-name area_2 ap-group ap-group1 # return