配置802.1X+RADIUS认证方式下的终端类型识别示例

操作步骤

1. 在AC上配置NAC模式为统一模式，以保证用户能够正常接入网络

   <HUAWEI> system-view
   [HUAWEI] sysname AC
   [AC] authentication unified-mode

   • 缺省情况下，NAC配置模式即为统一模式。
   • 传统模式切换到统一模式后，管理员必须保存配置并重启设备，新配置模式的各项功能才能生效。

2. 配置SwitchA和AC，使AP与AC之间能够传输CAPWAP报文

   # 配置SwitchA连接AP的接口GE0/0/1加入VLAN100（管理VLAN），SwitchA连接AC的接口GE0/0/2加入VLAN100。

   <HUAWEI> system-view
   [HUAWEI] sysname SwitchA
   [SwitchA] vlan batch 100
   [SwitchA] interface gigabitethernet 0/0/1
   [SwitchA-GigabitEthernet0/0/1] port link-type trunk
   [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
   [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/1] port-isolate enable
   [SwitchA-GigabitEthernet0/0/1] quit
   [SwitchA] interface gigabitethernet 0/0/2
   [SwitchA-GigabitEthernet0/0/2] port link-type trunk
   [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100
   [SwitchA-GigabitEthernet0/0/2] quit

   # 配置AC连接SwitchA的接口GE0/0/1加入VLAN100。

   [AC] vlan batch 100
   [AC] interface gigabitethernet 0/0/1
   [AC-GigabitEthernet0/0/1] port link-type trunk
   [AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
   [AC-GigabitEthernet0/0/1] quit

3. 配置AC与上层网络设备互通

   # 配置VLANIF101（业务VLAN）、VLANIF102和VLANIF103。

   [AC] vlan batch 101 102 103
   [AC] interface vlanif 101
   [AC-Vlanif101] ip address 10.23.101.1 24
   [AC-Vlanif101] quit
   [AC] interface vlanif 102
   [AC-Vlanif102] ip address 10.23.102.2 24
   [AC-Vlanif102] quit
   [AC] interface vlanif 103
   [AC-Vlanif103] ip address 10.23.103.2 24
   [AC-Vlanif103] quit

   # 配置AC连接Router的接口GE0/0/2加入VLAN102。

   [AC] interface gigabitethernet 0/0/2
   [AC-GigabitEthernet0/0/2] port link-type trunk
   [AC-GigabitEthernet0/0/2] port trunk allow-pass vlan 102
   [AC-GigabitEthernet0/0/2] quit

   # 配置AC连接RADIUS服务器的接口GE0/0/3加入VLAN103。

   [AC] interface gigabitethernet 0/0/3
   [AC-GigabitEthernet0/0/3] port link-type trunk
   [AC-GigabitEthernet0/0/3] port trunk pvid vlan 103
   [AC-GigabitEthernet0/0/3] port trunk allow-pass vlan 103
   [AC-GigabitEthernet0/0/3] quit

   # 配置AC的缺省路由。

   [AC] ip route-static 0.0.0.0 0.0.0.0 10.23.102.1

4. 配置AC给AP分配IP地址，Router给STA分配IP地址

   # 配置AC通过接口地址池为AP分配IP地址。

   [AC] dhcp enable
   [AC] interface vlanif 100
   [AC-Vlanif100] ip address 10.23.100.1 24
   [AC-Vlanif100] dhcp select interface
   [AC-Vlanif100] quit

   # 配置AC作为DHCP中继，并配置DHCP中继所代理的DHCP服务器地址。

   [AC] interface vlanif 101
   [AC-Vlanif101] dhcp select relay
   [AC-Vlanif101] dhcp relay server-ip 10.23.102.1
   [AC-Vlanif101] quit

   # 配置Router作为DHCP服务器通过全局地址池为STA分配IP地址。其中，DHCP客户端的出口网关地址为10.23.101.1，全局地址池的网段为10.23.101.0/24。

   <HUAWEI> system-view
   [HUAWEI] sysname Router
   [Router] dhcp enable
   [Router] ip pool sta
   [Router-ip-pool-sta] gateway-list 10.23.101.1
   [Router-ip-pool-sta] dns-list 8.8.8.8
   [Router-ip-pool-sta] network 10.23.101.0 mask 24
   [Router-ip-pool-sta] quit
   [Router] vlan batch 102
   [Router] interface vlanif 102
   [Router-Vlanif102] ip address 10.23.102.1 24
   [Router-Vlanif102] dhcp select global
   [Router-Vlanif102] quit
   [Router] interface gigabitethernet 2/0/0
   [Router-GigabitEthernet2/0/0] port link-type trunk
   [Router-GigabitEthernet2/0/0] port trunk allow-pass vlan 102
   [Router-GigabitEthernet2/0/0] quit
   [Router] ip route-static 10.23.101.0 24 10.23.102.2

5. 配置RADIUS认证参数

   # 创建RADIUS服务器模板。

   [AC] radius-server template radius_huawei
   [AC-radius-radius_huawei] radius-server authentication 10.23.103.1 1812
   [AC-radius-radius_huawei] radius-server shared-key cipher Example@123
   [AC-radius-radius_huawei] quit

   # 创建RADIUS方式的认证方案。

   [AC] aaa
   [AC-aaa] authentication-scheme radius_huawei
   [AC-aaa-authen-radius_huawei] authentication-mode radius
   [AC-aaa-authen-radius_huawei] quit

   # 创建AAA域并配置域的RADIUS服务器模板和认证方案。

   [AC-aaa] domain huawei.com
   [AC-aaa-domain-huawei.com] radius-server radius_huawei
   [AC-aaa-domain-huawei.com] authentication-scheme radius_huawei
   [AC-aaa-domain-huawei.com] quit
   [AC-aaa] quit

   配置了域“huawei.com”后，认证用户名后面需要加上域名。

   # 测试用户是否能够通过RADIUS模板的认证。（已在RADIUS服务器上配置了测试用户test@huawei.com，用户密码123456）

   [AC] test-aaa test@huawei.com 123456 radius-template radius_huawei
   Info: Account test succeeded.
   

6. 配置802.1X接入模板，管理802.1X接入控制参数

   # 创建名为“wlan-dot1x”的802.1X接入模板。

   [AC] dot1x-access-profile name wlan-dot1x

   # 配置认证方式为EAP中继模式。

   [AC-dot1x-access-profile-wlan-dot1x] dot1x authentication-method eap
   [AC-dot1x-access-profile-wlan-dot1x] quit

7. 创建名为“wlan-authentication”的认证模板，绑定802.1X接入模板，并配置用户强制域

   [AC] authentication-profile name wlan-authentication
   [AC-authen-profile-wlan-authentication] dot1x-access-profile wlan-dot1x
   [AC-authen-profile-wlan-authentication] access-domain huawei.com dot1x force
   [AC-authen-profile-wlan-authentication] quit

8. 配置终端类型识别功能

   # 使能终端类型感知功能。

   [AC] device-sensor dhcp option 12 55 60

   # 使能UA功能。

   [AC] http parse user-agent enable

   # 创建名为huawei的终端类型识别模板。

   [AC] device-profile profile-name huawei
   [AC-device-profile-huawei] device-type huawei
   [AC-device-profile-huawei] rule 0 dhcp-option 12 sub-match ascii android-9f09b5dc88a64c37
   [AC-device-profile-huawei] rule 1 dhcp-option 55 sub-match ascii \001!\003\006\017\0343:; 
   [AC-device-profile-huawei] rule 2 dhcp-option 60 sub-match ascii dhcpcd-5.2.10
   [AC-device-profile-huawei] rule 3 mac 00e0-fc12-ffff mask 24
   [AC-device-profile-huawei] rule 4 user-agent sub-match Mozille/5.0 (Linux; U; Android 4.1.2; zh-CN; ZTE U956 Build/JZ054K) AppleWebKit/534.31 (KHTNL, like Gecko) UCBrowser/8.8.3.276 U3/0.8.8 Moblie Sofari/534.31 
   [AC-device-profile-huawei] if-match rule 0 or rule 1 or rule 2 or rule 3 or rule 4
   [AC-device-profile-huawei] enable
   [AC-device-profile-huawei] quit

9. 配置AP上线

   # 创建AP组，用于将相同配置的AP都加入同一AP组中。

   [AC] wlan
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] quit

   # 创建域管理模板，在域管理模板下配置AC的国家码并在AP组下引用域管理模板。

   [AC-wlan-view] regulatory-domain-profile name domain1
   [AC-wlan-regulatory-domain-prof-domain1] country-code cn
   [AC-wlan-regulatory-domain-prof-domain1] quit
   [AC-wlan-view] ap-group name ap-group1
   [AC-wlan-ap-group-ap-group1] regulatory-domain-profile domain1
   Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y  [AC-wlan-ap-group-ap-group1] quit
   [AC-wlan-view] quit

   # 配置AC的源接口。

   [AC] capwap source interface vlanif 100

   # 在AC上离线导入AP，并将AP加入AP组“ap-group1”中。假设AP的MAC地址为00e0-fc12-3456，并且根据AP的部署位置为AP配置名称，便于从名称上就能够了解AP的部署位置。例如MAC地址为00e0-fc12-3456的AP部署在1号区域，命名此AP为area_1。

   [AC] wlan
   [AC-wlan-view] ap auth-mode mac-auth
   [AC-wlan-view] ap-id 0 ap-mac 00e0-fc12-3456
   [AC-wlan-ap-0] ap-name area_1
   [AC-wlan-ap-0] ap-group ap-group1
   Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y  [AC-wlan-ap-0] quit

   # 将AP上电后，当执行命令display ap all查看到AP的“State”字段为“nor”时，表示AP正常上线。

   [AC-wlan-view] display ap all
   Total AP information:nor  : normal          [1]
   --------------------------------------------------------------------------------
   ID   MAC            Name   Group     IP            Type            State STA Uptime
   --------------------------------------------------------------------------------
   0    600e0-fc12-3456area_1 ap-group1 10.23.100.254 AP6010DN-AGN    nor   0   10S
   --------------------------------------------------------------------------------
   Total: 1

10. 配置WLAN业务参数

    # 创建名为“wlan-security”的安全模板，并配置安全策略。

    [AC-wlan-view] security-profile name wlan-security
    [AC-wlan-sec-prof-wlan-security] security wpa2 dot1x aes
    [AC-wlan-sec-prof-wlan-security] quit

    # 创建名为“wlan-ssid”的SSID模板，并配置SSID名称为“wlan-net”。

    [AC-wlan-view] ssid-profile name wlan-ssid
    [AC-wlan-ssid-prof-wlan-ssid] ssid wlan-net
    Warning: This action may cause service interruption. Continue?[Y/N]y [AC-wlan-ssid-prof-wlan-ssid] quit

    # 创建名为“wlan-vap”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板、认证模板和SSID模板。

    [AC-wlan-view] vap-profile name wlan-vap
    [AC-wlan-vap-prof-wlan-vap] forward-mode tunnel
    Warning: This action may cause service interruption. Continue?[Y/N]y [AC-wlan-vap-prof-wlan-vap] service-vlan vlan-id 101
    [AC-wlan-vap-prof-wlan-vap] security-profile wlan-security
    [AC-wlan-vap-prof-wlan-vap] authentication-profile wlan-authentication
    [AC-wlan-vap-prof-wlan-vap] ssid-profile wlan-ssid
    [AC-wlan-vap-prof-wlan-vap] quit

    # 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-vap”的配置。

    [AC-wlan-view] ap-group name ap-group1
    [AC-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio all
    [AC-wlan-ap-group-ap-group1] quit

11. 检查配置结果
    • 完成配置后，用户可通过无线终端搜索到SSID为wlan-net的无线网络。
    • 用户关联到无线网络上后，无线PC能够被分配相应的IP地址。
    • 对于“huawei”无线客户端，在支持CHAP认证方式的客户端软件上输入正确的用户名和密码后，认证成功，可以正常访问Internet上的资源。对于非“huawei”无线客户端，在支持CHAP认证方式的客户端软件上即使输入正确的用户名和密码后，仍然不能认证成功。