配置MAC认证示例（AAA采用RADIUS方式）

操作步骤

1. 在AC上配置NAC模式为统一模式，以保证用户能够正常接入网络

   <HUAWEI> system-view
   [HUAWEI] authentication unified-mode

   如果当前NAC模式为传统模式，则配置NAC模式为统一模式后，需要保存配置并重启设备后生效。

2. 配置SwitchA和AC，使AP与AC之间能够传输CAPWAP报文

   # 配置SwitchA连接AP的接口GE0/0/1加入VLAN100（管理VLAN），SwitchA连接AC的接口GE0/0/2加入VLAN100。

   <HUAWEI> system-view
   [HUAWEI>] sysname SwitchA
   [SwitchA] vlan batch 100
   [SwitchA] interface gigabitethernet 0/0/1
   [SwitchA-GigabitEthernet0/0/1] port link-type trunk
   [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
   [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/1] quit
   [SwitchA] interface gigabitethernet 0/0/2
   [SwitchA-GigabitEthernet0/0/2] port link-type trunk
   [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/2] quit

   # 配置AC连接SwitchA的接口GE1/0/1加入VLAN100。

   [HUAWEI] sysname AC
   [AC] vlan batch 100 101
   [AC] interface gigabitethernet 1/0/1
   [AC-GigabitEthernet1/0/1] port link-type trunk
   [AC-GigabitEthernet1/0/1] port trunk allow-pass vlan 100
   [AC-GigabitEthernet1/0/1] quit

3. 配置AC与上层网络设备互通

   根据实际组网情况在AC上行口配置业务VLAN透传，和上行网络设备互通。

   # 配置AC上行接口GE1/0/2加入VLAN101（业务VLAN）。

   [AC] interface gigabitethernet 1/0/2
   [AC-GigabitEthernet1/0/2] port link-type trunk
   [AC-GigabitEthernet1/0/2] port trunk allow-pass vlan 101
   [AC-GigabitEthernet1/0/2] quit

4. 配置AC作为DHCP服务器，为STA和AP分配IP地址

   # 配置基于接口地址池的DHCP服务器，其中，VLANIF100接口为AP提供IP地址，VLANIF101为STA提供IP地址。

   DNS服务器地址请根据实际需要配置。常用配置方法如下：

   • 接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
   • 全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。

   [AC] dhcp enable
   [AC] interface vlanif 100
   [AC-Vlanif100] ip address 10.23.100.1 24
   [AC-Vlanif100] dhcp select interface
   [AC-Vlanif100] quit
   [AC] interface vlanif 101
   [AC-Vlanif101] ip address 10.23.101.1 24
   [AC-Vlanif101] dhcp select interface
   [AC-Vlanif101] quit

5. 配置AC到RADIUS服务器的路由（假设与AC相连的上游设备的IP地址为10.23.101.2）

   [AC] ip route-static 10.23.200.1 255.255.255.0 10.23.101.2

6. 配置AP上线

   # 创建AP组，用于将相同配置的AP都加入同一AP组中。

   [AC] wlan
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] quit

   # 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。

   [AC-wlan-view] regulatory-domain-profile name domain1
   [AC-wlan-regulate-domain-domain1] country-code cn
   [AC-wlan-regulate-domain-domain1] quit
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y  
   [AC-wlan-ap-group-ap-group1] quit
   [AC-wlan-view] quit

   # 配置AC的源接口。

   [AC] capwap source interface vlanif 100

   # 在AC上离线导入AP，并将AP加入AP组“ap-group1”中。假设AP的MAC地址为00e0-fc12-e360，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为00e0-fc12-e360的AP部署在1号区域，命名此AP为area_1。

   ap auth-mode命令缺省情况下为MAC认证，如果之前没有修改其缺省配置，可以不用执行ap auth-mode mac-auth命令。

   举例中使用的AP为AP5030DN，具有射频0和射频1两个射频。AP5030DN的射频0为2.4GHz射频，射频1为5GHz射频。

   [AC] wlan
   [AC-wlan-view] ap auth-mode mac-auth
   [AC-wlan-view] ap-id 0 ap-mac 00e0-fc12-e360
   [AC-wlan-ap-0] ap-name area_1
   [AC-wlan-ap-0] ap-group ap-group1
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y  
   [AC-wlan-ap-0] quit
   [AC-wlan-view] quit

   # 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。

   [AC] display ap all

   Total AP information: 
   nor  : normal          [1] 
   Extrainfo : Extra information 
   P  : insufficient power supply 
   -------------------------------------------------------------------------------------------------- 
   ID   MAC            Name   Group     IP            Type            State STA Uptime      ExtraInfo 
   -------------------------------------------------------------------------------------------------- 
   0    00e0-fc76-e360 area_1 ap-group1 10.23.100.254 AP5030DN        nor   0   10S         - 
   -------------------------------------------------------------------------------------------------- 
   Total: 1

7. 配置RADIUS服务器模板、RADIUS认证方案

   请确保RADIUS服务器地址、端口号、共享密钥配置正确，并且和RADIUS服务器保持一致。

   # 配置RADIUS服务器模板。

   [AC] radius-server template radius_huawei
   [AC-radius-radius_huawei] radius-server authentication 10.23.200.1 1812
   [AC-radius-radius_huawei] radius-server shared-key cipher Huawei@123
   [AC-radius-radius_huawei] quit

   # 配置RADIUS方式的认证方案。

   [AC] aaa
   [AC-aaa] authentication-scheme radius_huawei
   [AC-aaa-authen-radius_huawei] authentication-mode radius
   [AC-aaa-authen-radius_huawei] quit

   # 创建AAA域并配置域的RADIUS服务器模板和认证方案。

   [AC-aaa] domain huawei.com
   [AC-aaa-domain-huawei.com] radius-server radius_huawei
   [AC-aaa-domain-huawei.com] authentication-scheme radius_huawei
   [AC-aaa-domain-huawei.com] quit
   [AC-aaa] quit

8. 配置MAC接入模板“m1”

   MAC接入模板中，MAC认证用户的用户名和密码默认均为不带分隔符“-”的MAC地址。

   [AC] mac-access-profile name m1
   [AC-mac-access-profile-m1] quit

9. 配置认证模板“p1”

   [AC] authentication-profile name p1
   [AC-authen-profile-p1] mac-access-profile m1
   [AC-authen-profile-p1] access-domain huawei.com mac-authen force
   [AC-authen-profile-p1] quit

10. 配置WLAN业务参数

    # 创建名为“wlan-security”的安全模板，并配置安全策略。

    [AC] wlan
    [AC-wlan-view] security-profile name wlan-security
    [AC-wlan-sec-prof-wlan-security] security open
    [AC-wlan-sec-prof-wlan-security] quit

    # 创建名为“wlan-ssid”的SSID模板，并配置SSID名称为“wlan-net”。

    [AC-wlan-view] ssid-profile name wlan-ssid
    [AC-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    [AC-wlan-ssid-prof-wlan-ssid] quit

    # 创建名为“wlan-vap”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、SSID模板和认证模板。

    [AC-wlan-view] vap-profile name wlan-vap
    [AC-wlan-vap-prof-wlan-vap] forward-mode tunnel
    [AC-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AC-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AC-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AC-wlan-vap-prof-wlan-vap] authentication-profile p1
    [AC-wlan-vap-prof-wlan-vap] quit

    # 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-vap”的配置。

    [AC-wlan-view] ap-group name ap-group1
    [AC-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0
    [AC-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1
    [AC-wlan-ap-group-ap-group1] quit

11. 配置AP射频的信道和功率

    射频的信道和功率自动调优功能默认开启，如果不关闭此功能则会导致手动配置不生效。举例中AP射频的信道和功率仅为示例，实际配置中请根据AP的国家码和网规结果进行配置。

    # 关闭AP射频0的信道和功率自动调优功能，并配置AP射频0的信道和功率。

    [AC-wlan-view] ap-id 0
    [AC-wlan-ap-0] radio 0
    [AC-wlan-radio-0/0] calibrate auto-channel-select disable
    [AC-wlan-radio-0/0] calibrate auto-txpower-select disable
    [AC-wlan-radio-0/0] channel 20mhz 6
    Warning: This action may cause service interruption. Continue?[Y/N]y 
    [AC-wlan-radio-0/0] eirp 127
    [AC-wlan-radio-0/0] quit

    # 关闭AP射频1的信道和功率自动调优功能，并配置AP射频1的信道和功率。

    [AC-wlan-ap-0] radio 1
    [AC-wlan-radio-0/1] calibrate auto-channel-select disable
    [AC-wlan-radio-0/1] calibrate auto-txpower-select disable
    [AC-wlan-radio-0/1] channel 20mhz 149
    Warning: This action may cause service interruption. Continue?[Y/N]y 
    [AC-wlan-radio-0/1] eirp 127
    [AC-wlan-radio-0/1] quit
    [AC-wlan-ap-0] quit

12. 检查配置结果

    哑终端关联到无线网络后，自动完成认证，认证成功后能够访问网络。