H3C AC+FIT完全设置
路由器: H3C MSR20-20
AC: H3C WX3024E
AP :2210-AG
用户采用PON线路，动态分配地址，无固定IP，每月1088元，如果带有固定IP，则需要每月7088元，采用较经济的方式，每次用户查询ip138得到公网IP后远程管理。
MSR上PPPOE拨号，建立2 VLAN,一个给内部使用，一个给访客，用访问列表对2Vlan做隔离。
具体配置如下：
# firewall enable 必须启用，否则ACL不起作用
# domain default enable system # telnet server enable 也必须开启 # dar p2p signature-file flash:/p2p_default.mtd # port-security enable # acl number 3000 rule 0 permit ip source 10.20.0.0 0.0.255.255 内部用VLAN rule 1 permit ip source 10.30.30.0 0.0.0.255 访客用VLAN acl number 3002 rule 0 deny ip source 10.20.0.0 0.0.255.255 destination 10.30.30.0 0.0.0.255 禁止访客访问内部网络 # vlan 1 # vlan 3 # domain system access-limit disable state active idle-cut disable self-service-url disable # user-group system group-attribute allow-guest # local-user admin password XXXXXXXXXXXXXXXXX
authorization-attribute level 3 service-type telnet service-type web local-user XXXXX
password XXXXXXXXXXXXXXXXXXX
authorization-attribute level 3 service-type telnet service-type web # cwmp undo cwmp enable # interface Aux0 async mode flow link-protocol ppp # interface Cellular0/0 async mode protocol link-protocol ppp # interface Dialer1 nat outbound 3000 link-protocol ppp ppp chap user ADXXXXXXXX
ppp chap password XXXXXXXXXX
ppp pap local-user adXXXXXX password SIMPLE XXXXXXXXX
ip address ppp-negotiate dialer user adXXXXXXX dialer-group 1 dialer bundle 1 # interface Ethernet0/0 port link-mode route 内部接口 # interface Ethernet0/0.20 H3C必须通过子接口的方式创建VLAN vlan-type dot1q vid 2 ip address 10.20.0.254 255.255.0.0 # interface Ethernet0/0.30 vlan-type dot1q vid 3 firewall packet-filter 3002 inbound firewall packet-filter 3002 outbound ip address 10.30.30.254 255.255.255.0 # interface Ethernet0/1 port link-mode route pppoe-client dial-bundle-number 1 # interface NULL0 # interface Vlan-interface1 # ip route-static 0.0.0.0 0.0.0.0 Dialer1 静态路由 # load xml-configuration # load tr069-configuration # user-interface tty 12 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3 #
接下来是AC控制器
尽量通过web上做设计，下面只是命令行显示的
总体思路，开启2个VLAN的DHCP
# telnet server enable # port-security enable # oap management-ip 192.168.0.101 slot 0 # wlan auto-ap enable # vlan 1 # vlan 2 # domain system access-limit disable state active idle-cut disable self-service-url disable # dhcp server ip-pool poolvlan1 管理vlan network 192.168.0.0 mask 255.255.255.0 # dhcp server ip-pool poolvlan2 内部VLAN network 10.20.0.0 mask 255.255.0.0 gateway-list 10.20.0.254 dns-list 202.96.209.5 8.8.8.8 # dhcp server ip-pool poolvlan3 访客vlan network 10.30.30.0 mask 255.255.255.0 gateway-list 10.30.30.254 dns-list 202.96.209.5 8.8.8.8 # user-group system group-attribute allow-guest # local-user admin password
authorization-attribute level 3 service-type telnet service-type web # wlan rrm dot11a mandatory-rate 6 12 24 dot11a supported-rate 9 18 36 48 54 dot11b mandatory-rate 1 2 dot11b supported-rate 5.5 11 dot11g mandatory-rate 1 2 5.5 11 dot11g supported-rate 6 9 12 18 24 36 48 54 load-balance session 15 # wlan radio-policy 1025 # wlan radio-policy 1537 # wlan radio-policy 1793 # wlan radio-policy 2049 # wlan radio-policy 2305 # wlan service-template 1 crypto ssid XXXXX
bind WLAN-ESS 0 cipher-suite tkip security-ie rsn service-template enable # interface Bridge-Aggregation1 port link-type trunk port trunk permit vlan all # interface NULL0 # interface Vlan-interface1 ip address 192.168.0.100 255.255.255.0 # interface Vlan-interface2 ip address 10.20.0.250 255.255.0.0 # interface GigabitEthernet1/0/1 port link-type trunk port trunk permit vlan all port link-aggregation group 1 # interface GigabitEthernet1/0/2 port link-type trunk port trunk permit vlan all port link-aggregation group 1 # interface WLAN-ESS0 port link-type hybrid port hybrid vlan 1 to 2 untagged port hybrid pvid vlan 2 mac-vlan enable port-security port-mode psk port-security tx-key-type 11key port-security preshared-key pass-phrase
interface WLAN-ESS1 port link-type hybrid port hybrid vlan 1 untagged # wlan ap ap-1 model WA2210-AG id 2 serial-id
radio 1 radio-policy 513 service-template 1 vlan-id 2 radio enable # wlan ap ap-10 model WA2210-AG id 9 serial-id 210235A0HTB118000791 radio 1 radio-policy 2305 service-template 1 vlan-id 2 radio enable # wlan ap ap-11 model WA2210-AG id 10 serial-id 210235A0HTC118000273 radio 1 radio-policy 2561 service-template 1 vlan-id 2 radio enable # wlan ap ap-16 model WA2210-AG id 12 serial-id 210235A0HTB118001313 radio 1 radio-policy 3073 service-template 1 vlan-id 2 radio enable # wlan ap auto-ap model WA2210-AG id 5 serial-id auto radio 1 # wlan load-balance-group 1 负载均衡 description 26 ap ap-4 radio 1 ap ap-3 radio 1 ap ap-2 radio 1 # wlan load-balance-group 2 description 27 ap ap-9 radio 1 ap ap-8 radio 1 ap ap-11 radio 1 ap ap-10 radio 1 # wlan load-balance-group 3 description 28 ap ap-14 radio 1 ap ap-13 radio 1 # ip route-static 0.0.0.0 0.0.0.0 10.20.0.254 # dhcp enable # arp-snooping enable # load xml-configuration # user-interface con 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3 #
telnet到AC上后
oap connect slot 0可以切换到交换引擎
dhcp server ip-pool swpoolvlan3 network 10.30.30.0 mask 255.255. gateway-list 10.30.30.254 dns-list 202.96.209.5 8.8.8.8 #
interface Bridge-Aggregation1 port link-type trunk port trunk permit vlan all #
interface Vlan-interface3 ip address 10.30.30.251 255.255. # interface GigabitEthernet1/0/1 poe enable # interface GigabitEthernet1/0/2 poe enable # interface GigabitEthernet1/0/22 此接口接FAT AP port access vlan 3 poe enable # interface GigabitEthernet1/0/23 此接口为上联接口 port link-type trunk port trunk permit vlan all # interface GigabitEthernet1/0/24 port link-type trunk port trunk permit vlan all #
interface GigabitEthernet1/0/29 内部和AC相连的接口，运行所有VLAN port link-type trunk port trunk permit vlan all port link-aggregation group 1 # interface GigabitEthernet1/0/30 port link-type trunk port trunk permit vlan all port link-aggregation group 1 #