Hcna-wlan Experiment Guide Cli Issue v1.6
84
0
0
Full text
(2) n e /. m o i.c. e w a u .h. t t h. g n i n r lea. // : p. M. : s e c HCNA-WALN Courseur o WLAN Engineers(CLI) Experiment Guidesfor Re g n i rn a e L e r o Issue. 1.60. Date. 2014-12-20. HUAWEI TECHNOLOGIES CO., LTD..
(3) Copyright © Huawei Technologies Co., Ltd. 2014. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd.. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders.. n e /. m o i.c. Notice. The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied.. e w a u .h. g n i n r lea. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied.. : s e c r u Huawei Technologiesso Co., Ltd. Re g n i rn a e L e r o M Address:. t t h. // : p. Huawei Industrial Base Bantian, Longgang Shenzhen 518129. People's Republic of China. Website:. http://support.huawei.com/learning/Index!toTrainIndex. Email:. [email protected]. (2014-12-20). Huawei Proprietary and Confidential Copyright © Huawei Technologies C., Ltd.. i.
(4) HCNA-WLAN. Huawei Certificate System. Huawei Certificate System. n e /. m o i.c. Relying on the strong technical strength and professional training system, Huawei provides a practical and professional four-level certificate system to meet various customer requirements on different WLAN technologies.. e w a u .h. Huawei Certified Network Associate-Wireless Local Area Network (HCNA-WLAN) is designed for Huawei local offices, online engineers in representative offices, and readers who want to understand Huawei WLAN products and technology. HCNA-WLAN covers WLAN basics, Control and Provisioning of Wireless Access Points (CAPWAP) protocol, WLAN networking, Huawei WLAN product features, security configuration, WLAN advanced technology, antennas, WLAN network planning and optimization, and WLAN fault troubleshooting.. g n i n r lea. The HCNA-WLAN certificate system introduces you to the industry and market, helps you in innovation, and enables you to stand atop the WLAN frontiers.. : s e c r u o. g n i n. t t h. // : p. s e R. r a e L e. or. M. (2014-12-20). Huawei Proprietary and Confidential Copyright © Huawei Technologies C., Ltd.. ii.
(5) HCNA-WLAN. Huawei Certificate System. About This Document. n e /. Overview. m o i.c. This document is applicable to the candidates who are preparing for the HCNA-WLAN exam and the readers who want to understand the WLAN basics, the CAPWAP protocol, WLAN networking, Huawei WLAN product features, security configuration, WLAN advanced technology, antennas, WLAN network planning and optimization, and WLAN fault troubleshooting.. e w a u .h. Description. g n i n r lea. // : p. This experiment guide introduces the following seven experiments, covering basic configurations, and configurations and implementation of Layer 2 networking, security, Layer 3 networking, and the network management software eSight: . t t h. Experiment 1: Experiment environment preparations. : s e c r u o. This experiment includes checking whether all required devices are ready, connecting devices on the network, and clearing AC configurations. This experiment helps you know about HCNA-WLAN devices and network construction. . Experiment 2: AC configuration initialization. s e R. This experiment involves basis operations and configurations on an AC, helping you know the AC6605 and its basic functions.. g n i n . r a e L e. or. M. Experiment 3: AP authentication and WLAN configuration process This experiment lets you know basic WLAN network capabilities through basic WLAN configurations.. . Experiment 4: WLAN security configuration This experiment mainly introduces 802.1x authentication, helping you know WLAN security and the configuration process.. . Experiment 5: Bypass Layer 3 networking This experiment uses the AC6605 and Layer 3 networking. The Layer 3 network configuration helps you comprehensively know WLAN networking modes.. . Experiment 6: WLAN configuration on eSight This experiment involves how to add WLAN devices to the eSight and deliver WLAN services using the configuration wizard.. . Experiment 7: Configuration file backup and AC configuration clearance This experiment describes how to back up configuration files through File Transfer Protocol (FTP).. (2014-12-20). Huawei Proprietary and Confidential Copyright © Huawei Technologies C., Ltd.. iii.
(6) HCNA-WLAN. Huawei Certificate System. Background Knowledge Required The intended audience should know basic WLAN knowledge, Huawei switching devices, and basic datacom knowledge.. n e /. m o i.c. e w a u .h. : s e c r u o. g n i n. t t h. g n i n r lea. // : p. s e R. r a e L e. or. M. (2014-12-20). Huawei Proprietary and Confidential Copyright © Huawei Technologies C., Ltd.. iv.
(7) HCNA-WLAN. Huawei Certificate System. Common Icons. n e /. m o i.c. AC. AP. e w a Switch hu . g in n r a le. t t h. // : p. : s eSight Server eRADIUS Server c r u o s e R ing. STA. n. r a e L e. or. M. (2014-12-20). Huawei Proprietary and Confidential Copyright © Huawei Technologies C., Ltd.. v.
(8) Experiment Environment Overview. n e /. Networking Introduction. i e w a u .h. m o .c. This experiment environment is prepared for WLAN engineers who are preparing for the HCNA-WLAN exam. Each suite of experiment environment includes 2-9 ACs, 2-9 APs, 1 core switch, and 1 Remote Authentication Dial In User Service (RADIUS) or eSight server. Each suite of experiment environment is applicable to 4 to 16 candidates.. Device Introduction. // : p. g n i n r lea. The following table lists devices recommended for HCNA-WLAN experiments and the mappings between the device name, model, and software version. Device Name. o M. L e r. s e c r ou. Software Version. Core switch. S3700-28TP-PWR-EI. Version 5.70 (S3700 V100R005C01SPC100). AC. AC6605-26-PWR. AC6605 V200R005C00SPC200. AP6010DN-AGN. AP6010DN-AGN:V200R005C00SPC600. AP. r a e. t t :h. Model. g n i n. s e R.
(9) HCNA-WLAN. Contents. Contents. n e Huawei Certificate System ....................................................................................................... /ii miii About This Document .............................................................................................................. o c v . i Common Icons ............................................................................................................................. e w Experiment Environment Overview ......................................................................................... 1 a 1 Practice 1: Preparing the Lab Environment ........................................................................... 5 hu . g n i n r a e l // : tp t h : s 2 Basic Configuration of AC .................................................................................................... 12 e c r u o s Re g n i rn a e L e 3 APrAuthentication and WLAN Configuration Roadmap ................................................. 20 o M 1.1 About This Course ..................................................................................................................................... 5. 1.2 Confirming the Readiness of the Devices ................................................................................................... 5 1.2.1 Confirming the Readiness of the Devices .......................................................................................... 5. 1.3 Network Topology Description 1: Chain Networking ................................................................................. 6 1.4 Network Topology Description 2: Branched Networking ............................................................................ 7. 1.5 Description the Connection of Console Cable............................................................................................. 8. 1.6 Reset the Configuration of AC .................................................................................................................. 11. 2.1 Objectives ................................................................................................................................................12 2.2 Networking Deployment Description ........................................................................................................12 2.3 Configuration Procedure ...........................................................................................................................13. 2.3.1 Configuring Initialization Password .................................................................................................13 2.3.2 Configuring the Basic Information of AC .........................................................................................13 2.3.3 Confirming and Testing the Telnet/SSH Service (AAA Authentication) .............................................16. 2.3.4 Save the Configuration.....................................................................................................................17. 2.4 Configuration Reference ...........................................................................................................................17. 3.1 Objectives ................................................................................................................................................20 3.2 Networking Deployment Description ........................................................................................................20 3.3 Configuration Procedure ...........................................................................................................................21 3.3.1 Configuring Roadmap ......................................................................................................................21 3.3.2 Configuring the Switch ....................................................................................................................21 3.3.3 Configuring the Basic Information of AC .........................................................................................22. 3.3.4 Configuring AP Authentication and Connection with AC ..................................................................22 3.3.5 Configuring AP Radio ......................................................................................................................24. 04/20/2014. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd.. ii.
(10) Hands-on Exercise Guide to WLAN Product Basic Operation and Maintenance. Contents. 3.3.6 Configuring WLAN-ESS Interface ...................................................................................................24 3.3.7 Configuring Security Profile/Traffic Profile/WLAN Service-set .......................................................24 3.3.8 Configuring Service-set to AP ..........................................................................................................25 3.3.9 Verify the Configuration ..................................................................................................................26 3.4 Configuration Reference ...........................................................................................................................29 3.4.1 Configuration of AC ........................................................................................................................29. 4 WLAN Security Configuration ............................................................................................. 33. n e /. 4.1 Objectives ................................................................................................................................................33 4.2 Networking Deployment Description ........................................................................................................33. m o .c. 4.3 Configuration Procedure ...........................................................................................................................34 4.3.1 Configuring WEP Authentication .....................................................................................................34. i e w a u .h. 4.3.2 Configuring WPA PSK Authentication .............................................................................................36 4.3.3 Configuring WPA EAP Authentication .............................................................................................39 4.3.4 Configuring EAP Client ...................................................................................................................41 4.4 Security Policies Configuration Precautions ..............................................................................................44. g n i n r 5 eSight Management for WLAN (Optional) ........................................................................ 49 a e /: /l tp t h : s e c r u o s e 6 Branched NetworkingR + Layer 3 Networking Practice ...................................................... 59 g n i rn a e L e r o M 4.5 Configuration Reference ...........................................................................................................................45 4.5.1 AC’s configuration ...........................................................................................................................45. 5.1 Objectives ................................................................................................................................................49 5.2 Networking Deployment Description ........................................................................................................49 5.3 Configuration Procedure ...........................................................................................................................49 5.3.1 Configuring AC SNMP Community .................................................................................................49 5.3.2 Configuring AC Discover AP ...........................................................................................................50 5.3.3 Configuring Service-set by eSight Wizard ........................................................................................51 5.3.4 Checking the Configuration by eSight ..............................................................................................57. 5.4 Configuration Reference ...........................................................................................................................58. 6.1 Objectives ................................................................................................................................................59 6.2 Networking Deployment Description ........................................................................................................59 6.3 Configuration Procedure ...........................................................................................................................60 6.3.1 Re-connecting AP to Switch .............................................................................................................60 6.3.2 Re-configuring VLAN and Trunk .....................................................................................................60 6.3.3 AP Online Configuration ..................................................................................................................61 6.3.4 Changing the Forwarding Mode to Tunnel Forwarding .....................................................................61. 6.4 Configuration Reference ...........................................................................................................................63. 7 Backup the Configuration and Reset the Device ............................................................... 67 7.1 Objectives ................................................................................................................................................67 7.2 Network Deployment Description .............................................................................................................67 7.3 Configuration Procedure ...........................................................................................................................67 7.3.1 Save the Configuration.....................................................................................................................67.
(11) Hands-on Exercise Guide to WLAN Product Basic Operation and Maintenance. Contents. 7.3.2 Configuring FTP Service onAC........................................................................................................68 7.3.3 Backup the Configuration to PC .......................................................................................................68 7.3.4 Reset the Configuration ...................................................................................................................69 7.4 Configuration Reference ...........................................................................................................................69 7.4.1 Configuration of AC ........................................................................................................................69. 8 Appendix: Configuration of the SW .................................................................................... 70 Figures. n e /. Figure 1-1 Devices List................................................................................................................................... 5. m o .c. Figure 1-2 Chain networking Topology ........................................................................................................... 6. i e w a u .h. Figure 1-3 Branched networking topology ...................................................................................................... 7 Figure 1-4 Network connection of console cable ............................................................................................. 8 Figure 1-5 Creating a connection .................................................................................................................... 9 Figure 1-6 Configuring the connection port ....................................................................................................10. g n i n r lea. Figure 1-7 Setting the communication parameters ..........................................................................................10 Figure 2-1 Networking deployment information .............................................................................................12 Figure 3-1 AP Authentication and WLAN configuration roadmap parameters description ...............................20. // : p. Figure 3-2 WLAN configuration roadmap......................................................................................................21. t t :h. Figure 4-1 WLAN security configuration parameters description ....................................................................33. s e c r ou. Figure 5-1 eSight network deployment ...........................................................................................................49 Figure 6-1 Branched networking topology .....................................................................................................59. r a e. o M. L e r. g n i n. s e R.
(12) HCNA-WLAN. 1. Contents. Practice 1: Preparing the Lab Environmen / ent om. 1.1 About This Course. g n i n r lea. c . i e w a u .h. This course helps you set up the lab environment of WLAN. This course covers the following contents: . Confirming the readiness of the devices. . Understanding the topology of the practice. . Reset the configuration of the devices. // : p. t t h of the Devices : 1.2 Confirming the Readiness s e c of the Devices 1.2.1 Confirming the Readiness r u o s e R g n i rn a e L e r o M. The following figure shows the devices which need to be used in this practice, please confirm it before the practice begin. Figure 1-1 Devices List Name. Huawei Quidway S3700 PoE switch or. Count. 1 SW for all groups. All practice groups share the SW and the pre-configuration was ready. AC6605. 1 AC per group. AC with PoE power module. AP6010DN. 1 AP per group. Laptop or desktop PC. 1 PC per group. Huawei Quidway S5700 PoE swithch. 04/20/2014. Description. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd.. PC with wireless network card. 5.
(13) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. RJ-45 cables. 4 cables for each group. Console Cable. 1 cable per group. Each group please confirms the devices in advance: . One AC6605 device. . One AP6010DN. . One laptop or desktop PC. . Three RJ-45 cables. . Console cable. n e /. m o .c. i e w a 1.3 Network Topology Description 1: Chain Networking hu . g n i n r a e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M Figure 1-2 Chain networking Topology. Radius Server 10.254.1.100. eSight Server 10.254.1.200. GE0/0/23. GE0/0/24. Core Switch. GE0/0/1. GE0/0/10. GE0/0/2. GE0/0/24. GE0/0/24. AC1. GE0/0/24. AC10. GE0/0/1. AC2. GE0/0/1. GE0/0/1. AP1. AP10. AP2. …………. Description of the chain networking: . The required practices of this exercise are based on the chain networking topology. . The chain networking deployment suit to the small and medium-sized WLAN network.
(14) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. . For group 1: The 24th port of AC1 connect to switch port 1, the 1st port of AC connect to the AP1. . For group 2: The 24th port of AC2 connect to switch port 2, the 1st port of AC connect to the AP2. . For group 3: The 24th port of AC3 connect to switch port 3, the 1st port of AC connect to the AP3. . And so on……. . For group 10: The 24th port of AC10 connect to switch port 10, the 1st port of AC connect to the AP10. . The configuration of the switch was ready and the students no need to configure it (You can reference it in the reference configuration part). n e /. i e w a 1.4 Network Topology Description 2: Branched hu . g Networking n i n r a e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M . m o .c. The radius server and eSight server was ready for using, no need to configure it. Figure 1-3 Branched networking topology. Radius Server 10.254.1.100. eSight Server 10.254.1.200. GE0/0/23. GE0/0/24. Core Switch. AC1. GE0/0/24. GE0/0/1. GE0/0/11. GE0/0/2. GE0/0/20. GE0/0/24. AP10. GE0/0/10. GE0/0/12. AP1. AC10. …………. GE0/0/24. AC2. AP2.
(15) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. Description of the branched networking: . The branched networking deployment suit to the large-scale WLAN network, the optional practice of this exercise is based on this topology. . For group 1: The 24th port of AC1 connect to switch port 1, the 11th port of SW connect to the AP1. . For group 2: The 24th port of AC2 connect to switch port 2, the 12th port of SW connect to the AP2. . For group 3: The 24th port of AC3 connect to switch port 3, the 13th port of SW connect to the AP3. . And so on ……. . For group 10: The 24th port of AC10 connect to switch port 10, the 20th port of SW connect to the AP10. . The configuration of the switch was ready and the students no need to configure it (You can reference it in the reference configuration part). . The radius server and eSight server was ready for using, no need to configure it. i e w a u .h. g n i n Cable r 1.5 Description the Connection of Console a e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M Figure 1-4 Network connection of console cable. n e /. m o .c.
(16) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. As show in figure 1-4, please connect the console cable to the AC, and power on the devices, plug in the console cable to the laptop. This course takes the HyperTerminal of Windows XP as an example to explain how to log in to the AC6605 command line interface through the HyperTerminal. If other similar software such as the PuTTy and SecureCRT is used, refer to the user guide of related software. 1. Enable the HyperTerminal on the PC Choose Start > Programs > Accessories > Communications > HyperTerminal to start the HyperTerminal in Windows XP.. n e /. 2. Create a connection. m o .c. As shown in Figure 1-5, enter the name of the new connection in the Name text box and choose a nicon, then click OK. Figure 1-5 Creating a connection. t t :h. // : p. g n i n r lea. i e w a u .h. s e c r ou. g n i n. s e R. 3. Set the connection port. r a e. o M. L e r. In the Connection to dialog box as shown in Figure 1-6, choose the COM port of the computer, then click OK..
(17) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. Figure 1-6 Configuring the connection port. n e /. 4. Set the communication parameter. g n i n r lea. i e w a u .h. m o .c. After the COM1 Properties dialog box displayed, set the COM1 properties as shown in Figure 1-7, or use the default settings by clicking Restore Defaults.. // : p. Figure 1-7 Setting the communication parameters. t t :h. s e c r ou. r a e. o M. L e r. g n i n. s e R.
(18) HCNA-WLAN. 1Practice 1: Preparing the Lab Environment. After the preceding settings are complete, press Enter. Wait until the following message is displayed prompting you to set a login password. The system automatically saves the password setting. An initial password is required for the first login via the console. Set a password and keep it safe! Otherwise you will not be able to login via the console. Please configure the login password (6-16) Enter Password:. n e /. 1.6 Reset the Configuration of AC. i e w a u .h. m o .c. We need to reset the configuration of the devices before the practice, so as to avoid the impacting to the practice, please following below procedures to reset the configuration and reboot the device. The login password is huawei123 in this exercise: Login authentication Password:huawei123 <AC6605>reset saved-configuration. g n i n r lea. This will delete the configuration in the flash memory.. // : p. The device configurations will be erased to reconfigure. Are you sure? (y/n)[n]:y. Clear the configuration in the device successfully.. t t :h. s e c r ou. Reboot the device: <AC6605>reboot. Info: The system is comparing the configuration, please wait.. s e R. Warning: All the configuration will be saved to the next startup configuration. Continue ? [y/n]:n. System will reboot! Continue ? [y/n]:y. g n i n. Info: system is rebooting ,please wait.... r a e. o M. L e r. You have finished practice 1!.
(19) HCNA-WLAN. 2Basic Configuration of AC. 2. Basic Configuration of AC. n e /. 2.1 Objectives Upon completion of this task, you will be able to: . Configure the initialization password. . Configure VLAN and routing in the AC. . Configure telnet service of the AC. . Save the configuration in the AC. g n i n 2.2 Networking Deployment Description r a e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M. i e w a u .h. m o .c. We need to configure the device’s vlan, trunk and ip address in this exercise, after the students get the group number, please following below network development requires to configure the device.. Suppose the student belongs to group X (X=0, 1, 2, 3 … 10), please get the information as shown in Figure 2-1. Figure 2-1 Networking deployment information. Student belongs to Group X (X=1, 2, 3 … 10). AC Parameters. Name. ACX. Initialization Password. huawei123. AP Management VLAN. VLAN: X0. IP: 10.1.X0.100. Service VLAN (Employee). VLAN: X1. IP: 10.1.X1.100 Service VLAN (Voice VLAN). VLAN: X2 IP: 10.1.X2.100.
(20) HCNA-WLAN. 2Basic Configuration of AC. Service VLAN (Guest VLAN). VLAN: X3 IP: 192.168.X.1. AC Interface (Link to Management PC). MEth 0/0/1 IP: 192.168.100.200 GE0/0/1. AC Interface (Link to AP). n e /. Allow-pass VLAN in the Trunk: X0 to X3 GE0/0/24. AC Interface (Link to Switch). i e w a u .h. m o .c. Allow-pass VLAN in the Trunk: X0 to X2 Network topology: Chain Networking + Layer 2 Networking. In this practice, PC configured with IP 192.168.100.10, and test the telnet function of AC.. 2.3 Configuration Procedure. // : p. g n i n r lea. 2.3.1 Configuring Initialization Password. t t :h. Press Enter and Wait until the following message is displayed prompting you to set a login password.. s e c r ou. NOTE: The password value is a string of 6 to 16 case-sensitive characters. It must contain at least two types of characters, including upper-case and lower-case letters, digits, and special characters. The special characters cannot contain space or question mark (?). Password entered in interactive mode is not displayed on the terminal screen. When you log in to the AC using the password, you must enter the password set during your first login.. eL. r a e. g n i n. s e R. Please configure the login password (maximum length 16) Enter password:huawei123. or M2.3.2 Configuring the Basic Information of AC Confirm password:huawei123 <AC6605>. <AC6605>system-view [AC6605]sysname AC1. Create management VLAN 10, service VLAN 11, 12, 13. [AC1]vlan batch 10 to 13. Configure the interface g0/0/1 which used to link the AP..
(21) HCNA-WLAN. 2Basic Configuration of AC [AC1]interface g0/0/1 [AC1-GigabitEthernet0/0/1]port link-type trunk [AC1-GigabitEthernet0/0/1]port trunk pvid vlan 10 [AC1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 to 13 [AC1-GigabitEthernet0/0/1]quit. Configure the interface g0/0/24 which used to link the switch. [AC1]interface g0/0/24 [AC1-GigabitEthernet0/0/24]port link-type trunk. n e /. [AC1-GigabitEthernet0/0/24]port trunk allow-pass vlan 10 to 12 [AC1-GigabitEthernet0/0/24]quit. Use command dis port vlan to check configure result. [AC1]dis port vlan Port. Link Type. PVID. Trunk VLAN List. i e w a u .h. m o .c. ------------------------------------------------------------------------------GigabitEthernet0/0/1. trunk. 10. 1 10-13. GigabitEthernet0/0/2. hybrid. 1. -. GigabitEthernet0/0/3. hybrid. 1. -. GigabitEthernet0/0/4. hybrid. 1. -. GigabitEthernet0/0/5. hybrid. 1. -. GigabitEthernet0/0/6. hybrid. 1. -. GigabitEthernet0/0/7. hybrid. 1. -. GigabitEthernet0/0/8. hybrid. 1. -. GigabitEthernet0/0/9. hybrid. 1. -. GigabitEthernet0/0/10. hybrid. 1. -. GigabitEthernet0/0/11. hybrid. 1. -. GigabitEthernet0/0/12. hybrid. 1. -. GigabitEthernet0/0/13. hybrid. -. GigabitEthernet0/0/14. hybrid. 1. -. GigabitEthernet0/0/15. hybrid. 1. -. GigabitEthernet0/0/16. es. 1. hybrid. 1. -. GigabitEthernet0/0/17. hybrid. 1. -. GigabitEthernet0/0/18. hybrid. 1. -. GigabitEthernet0/0/19. hybrid. 1. -. GigabitEthernet0/0/20. hybrid. 1. -. GigabitEthernet0/0/21. hybrid. 1. -. GigabitEthernet0/0/22. hybrid. 1. -. GigabitEthernet0/0/23. hybrid. 1. GigabitEthernet0/0/24. trunk. 1. XGigabitEthernet0/0/1. hybrid. 1. -. XGigabitEthernet0/0/2. hybrid. 1. -. c r ou. or M. eL. r a e. g n i n. s e R. t t :h. // : p. Configure the vlanif interface of the VLANs [AC1]interface vlan 10 [AC1-Vlanif10]ip address 10.1.10.100 24 [AC1-Vlanif10]quit [AC1]interface vlan 11 [AC1-Vlanif11]ip address 10.1.11.100 24 [AC1-Vlanif11]quit [AC1]interface vlan 12 [AC1-Vlanif11]ip address 10.1.12.100 24 [AC1-Vlanif11]quit. g n i n r lea. 1 10-12.
(22) HCNA-WLAN. 2Basic Configuration of AC. Enable the DHCP service, and configure the DHCP pool for WLAN guest VLAN (Notice: If you configure the AC as the service VLAN gateway, WLAN service-set must be configured to tunnel forwarding mode, but in direct forwarding mode, the gateway of the service VLAN can be configured in external switch). [AC1]dhcp enable [AC1]interface Vlanif 13 [AC1-Vlanif12]ip address 192.168.1.1 24 [AC1-Vlanif12]dhcp select interface [AC1-Vlanif13]dhcp server dns-list 8.8.8.8. n e /. Conform the status of the interfaces: [AC1]display ip interface brief …………. i e w a u .h. Interface. IP Address/Mask. Physical. Protocol. MEth0/0/1. 192.168.100.200/24. down. down. NULL0. unassigned. up. Vlanif10. 10.1.10.100/24. up. Vlanif11. 10.1.11.100/24. up. Vlanif12. 10.1.12.100/24. up. Vlanif13. 192.168.1.1/24. up. g n i n r lea. m o .c. up(s) up up up. up. Checking the reachablility from AC to the Layer 3 switch, the IP address 100.100.100.100 is a loopback interface IP address, simulated to the public network, the destination should be unreachable right now.. t t :h. [AC1]ping -a 192.168.1.1 10.1.10.1 PING 10.1.10.1: 56. // : p. data bytes, press CTRL_C to break. Reply from 10.1.10.1: bytes=56 Sequence=1 ttl=255 time=11 ms. s e c r ou. Reply from 10.1.10.1: bytes=56 Sequence=2 ttl=255 time=11 ms Reply from 10.1.10.1: bytes=56 Sequence=3 ttl=255 time=10 ms Reply from 10.1.10.1: bytes=56 Sequence=4 ttl=255 time=11 ms Reply from 10.1.10.1: bytes=56 Sequence=5 ttl=255 time=20 ms. s e R. --- 10.1.10.1 ping statistics --5 packet(s) transmitted. g n i n. 5 packet(s) received 0.00% packet loss. or M. eL. r a e. round-trip min/avg/max = 10/12/20 ms. [AC1]ping -a 192.168.1.1 100.100.100.100 PING 100.100.100.100: 56. data bytes, press CTRL_C to break. Request time out Request time out Request time out Request time out Request time out. Configure the static default route point to the switch in AC. [AC1]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1. Ping to the destination IP address 100.100.100.100 again: [AC1]ping -a 192.168.1.1 100.100.100.100 PING 100.100.100.100: 56. data bytes, press CTRL_C to break.
(23) HCNA-WLAN. 2Basic Configuration of AC Reply from 100.100.100.100: bytes=56 Sequence=1 ttl=255 time=7 ms Reply from 100.100.100.100: bytes=56 Sequence=2 ttl=255 time=10 ms Reply from 100.100.100.100: bytes=56 Sequence=3 ttl=255 time=10 ms Reply from 100.100.100.100: bytes=56 Sequence=4 ttl=255 time=10 ms Reply from 100.100.100.100: bytes=56 Sequence=5 ttl=255 time=10 ms --- 100.100.100.100 ping statistics --5 packet(s) transmitted 5 packet(s) received 0.00% packet loss. n e /. round-trip min/avg/max = 7/9/10 ms. 2.3.3 Confirming and Testing the Telnet/SSH Service (AAA Authentication). i e w a u .h. m o .c. Enable and configure telnet service in the AC, add account huawei for AAA authentication. [AC1]telnet server enable Info: TELNET server has been enabled. [AC1]stelnet server enable. g n i n r lea. Info: Succeeded in starting the STELNET server. [AC1]aaa. [AC1-aaa] local-user huawei password cipher huawei123 [AC1-aaa] local-user huawei service-type telnet ssh. // : p. [AC1-aaa]local-user huawei privilege level 15 [AC1-aaa]quit [AC1]user-interface vty 0 4. t t :h. [AC1-ui-vty0-4]authentication-mode aaa. Configure the management interface MEth0/0/1:. s e c r ou. [AC1]interface MEth 0/0/1. [AC1-MEth0/0/1]ip address 192.168.100.200 24. s e R. Connect the interface from PC to the AC management port(in left of the console port), configure PC’s IP address 192.168.100.10 255.255.255.0 and test the telnet service.. g n i n. C:\Users\zWX>ping 192.168.100.200. or M. eL. r a e. Pinging 192.168.100.200 with 32 bytes of data: Reply from 192.168.100.200:bytes=32 time=23ms TTL=255 Reply from 192.168.100.200:bytes=32 time=1ms TTL=255 Reply from 192.168.100.200:bytes=32 time=7ms TTL=255 Reply from 192.168.100.200:bytes=32 time=4ms TTL=255 Ping statistics for 192.168.100.200: Packets: Sent = 4，Received = 4，Lost = 0 (0% loss)， Approximate round trip times in milli-seconds: Minimum = 1ms，Maximum = 23ms，Average = 8ms C:\Users\zWX>telnet 192.168.100.200 Login authentication Username:huawei Password:huawei123 Info: The max number of VTY users is 10, and the number of current VTY users on line is 1. <AC1>sys.
(24) HCNA-WLAN. 2Basic Configuration of AC Enter system view, return user view with Ctrl+Z. [AC1]display access-user -----------------------------------------------------------------------------UserID Username. IP address. MAC. -----------------------------------------------------------------------------132. huawei. 192.168.100.10. -. ------------------------------------------------------------------------------. 2.3.4 Save the Configuration. n e /. Save the configuration of AC: <AC1>save The current configuration will be written to the device. Are you sure to continue? (y/n)[n]:y. i e w a u .h. m o .c. It will take several minutes to save configuration file, please wait.......... . Configuration file had been saved successfully. Note: The configuration file will take effect after being activated. 2.4 Configuration Reference Take group 1 for example: # sysname AC1. t t :h. #. // : p. g n i n r lea. snmp-agent local-engineid 800007DB03FC48EFC76DB7. s e c r ou. undo snmp-agent community complexity-check disable snmp-agent #. http server enable. s e R. http secure-server ssl-policy default_policy http secure-server enable #. g n i n. vlan batch 10 to 13 #. or M. eL. r a e. dhcp enable #. diffserv domain default # pki realm default enrollment self-signed # ssl policy default_policy type server pki-realm default. # aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password cipher [email protected].
(25) HCNA-WLAN. 2Basic Configuration of AC local-user admin privilege level 15 local-user admin service-type telnet http local-user huawei password cipher huawei123 local-user huawei privilege level 15 local-user huawei service-type telnet ssh # interface Vlanif10 ip address 10.1.10.100 255.255.255.0 # interface Vlanif11. n e /. ip address 10.1.11.100 255.255.255.0 # interface Vlanif12 ip address 10.1.12.100 255.255.255.0 # interface Vlanif13 ip address 192.168.1.1 255.255.255.0 dhcp select interface dhcp server dns-list 8.8.8.8 # interface MEth0/0/1 ip address 192.168.100.200 255.255.255.0 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 10. // : p. port trunk allow-pass vlan 10 to 13. t t :h. #. interface GigabitEthernet0/0/2. g n i n r lea. s e c r ou. #. interface GigabitEthernet0/0/3 # ……………… #. s e R. interface GigabitEthernet0/0/24 port link-type trunk. g n i n. port trunk allow-pass vlan 10 to 12. #. or M. eL. r a e. interface XGigabitEthernet0/0/1 #. interface XGigabitEthernet0/0/2 # interface NULL0 # stelnet server enable # ip route-static 0.0.0.0 0.0.0.0 10.1.10.1. # user-interface con 0 authentication-mode password set authentication password cipher huawei123 user-interface vty 0 4 authentication-mode aaa user privilege level 15 protocol inbound all. i e w a u .h. m o .c.
(26) HCNA-WLAN. 2Basic Configuration of AC user-interface vty 16 20 # wlan # return #. You have finshed practice 2!. n e /. t t :h. s e c r ou. r a e. o M. L e r. g n i n. s e R. // : p. g n i n r lea. i e w a u .h. m o .c.
(27) HCNA-WLAN. 3. 3AP Authentication and WLAN Configuration Roadmap. AP Authentication and WLAN Configu ration Roadmap. n e /. 3.1 Objectives Upon completion of this task, you will be able to: . Configure AP authentication. . Understand WLAN configuration profile. . Understand WLAN configuration roadmap. . Configure open system authentication. g n i n r a e l 3.2 Networking Deployment Description // : tp t h : s e c r u o s e R g n i rn a e L e r o M. i e w a u .h. m o .c. Figure 3-1 AP Authentication and WLAN configuration roadmap parameters description. Suppose the student belongs to group X (X=1, 2, 3 … 10), for example the WMM profile name of group 1 is wmm-prof-guest1 Network topology. Chain Network + Layer 2 networking. AC Global Information. Country code: CN Carrier ID: other. WLAN source: VLAN X0. AP Authentication. AP authentication mode: mac-auth AP MAC address. WMM Profile. WMM profile: wmm-prof-X. Radio Profile. 2.4G radio profile: radio0-prof-X 5G radio profile: radio1-prof-X. Service-set. SSID: huawei-guestX.
(28) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap. Service VLAN:vlan13 Forwarding mode: direct-forward Traffic profile: traffic-prof-X Security profile: security-prof-X. n e /. Wlan-ess interface 0 User isolation: closed. 3.3 Configuration Procedure 3.3.1 Configuring Roadmap. g n i n r lea. i e w a u .h. m o .c. Figure 3-2 WLAN configuration roadmap. t t :h. // : p. s e c r ou. r a e. g n i n. s e R. L e r. o M. 3.3.2 Configuring the Switch Continue the configuration from practice 2, the configuration of the switch has been ready..
(29) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap. 3.3.3 Configuring the Basic Information of AC Configure the global information of AC: [AC1]wlan ac-global country-code CN [AC1]wlan ac-global ac id 0 carrier id other. By default, the country-code parameter is CN, carrier IDs have four types and for enterprise is other: cmcc. China Mobile. ctc. China Telecom. cuc. China Unicom. other. other service provider (default value). n e /. i e w a u .h. m o .c. 3.3.4 Configuring AP Authentication and Connection with AC. Configure the DHCP pool of AP and the AP authtication mode, address discoverying use option 43 method. [AC1]ip pool vlan10. g n i n r lea. [AC1-ip-pool-vlan10]network 10.1.10.0 mask 255.255.255.0 [AC1-ip-pool-vlan10]excluded-ip-address 10.1.10.100 [AC1-ip-pool-vlan10]gateway-list 10.1.10.1. // : p. [AC1-ip-pool-vlan10]dns-list 10.254.1.100. [AC1-ip-pool-vlan10]option 43 sub-option 3 ascii 10.1.10.100. t t :h. [AC1]interface vlan 10. s e c r ou. [AC1-Vlanif10]dhcp select global [AC1-Vlanif10]quit. Then the AP will get the ip address: 10.1.X0.254, run ping command to test the connection between AP and AC.. s e R. [AC1]ping 10.1.10.254. PING 10.1.10.254: 56. g n i n. data bytes, press CTRL_C to break. Reply from 10.1.10.254: bytes=56 Sequence=1 ttl=64 time=2 ms Reply from 10.1.10.254: bytes=56 Sequence=2 ttl=64 time=11 ms. r a e. o M. L e r. Reply from 10.1.10.254: bytes=56 Sequence=3 ttl=64 time=11 ms Reply from 10.1.10.254: bytes=56 Sequence=4 ttl=64 time=11 ms Reply from 10.1.10.254: bytes=56 Sequence=5 ttl=64 time=11 ms. But we have not configured the AP authentication list yet, so run command display ap all there will be no AP displayed. [AC1-wlan-view]display ap all All AP information(Normal-0,UnNormal-0): -----------------------------------------------------------------------------AP. AP. AP. ID. Type. MAC. Profile ID. Region ID. AP State. ----------------------------------------------------------------------------------------------------------------------------------------------------------Total number: 0.
(30) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap. Configure the WLAN source interface and AP authentication: [AC1]wlan [AC1-wlan-view]wlan ac source interface Vlanif 10 [AC1-wlan-view]ap-auth-mode ? mac-auth. MAC authenticated mode, default authenticated mode. no-auth. No authenticated mode. sn-auth. SN authenticated mode. AP support three types authentication mode, by default, the AP authentication mode is MAC address authentication. But before we add the AP to the authentication list manually, we need to know the AP type and MAC address of the AP, V2R5 can support 12 types of AP currently, we can run command display ap-type all to view it:. n e /. [AC1-wlan-view]dis ap-type all All AP types information:. i e w a u .h. m o .c. -----------------------------------------------------------------------------ID. Type. -----------------------------------------------------------------------------17. AP6010SN-GN. 19. AP6010DN-AGN. 21. AP6310SN-GN. 23. AP6510DN-AGN. 25. AP6610DN-AGN. 27. AP7110SN-GN. 28. AP7110DN-AGN. 29. AP5010SN-GN. 30. AP5010DN-AGN. 31. AP3010DN-AGN. 33. AP6510DN-AGN-US. 34. AP6610DN-AGN-US. 35. AP5030DN. 36. AP5130DN. s e c r ou. g n i n 38. t t :h. // : p. g n i n r lea. s e R. AP2010DN. ------------------------------------------------------------------------------. or M. eL. r a e. Total number: 15. For our practice, the AP type is 6010DN, type ID is 19, the MAC address of AP for group 1 is cccc-8110-2260, so the command should be: [AC1-wlan-view]ap id 0 type-id 19 mac cccc-8110-2260. After we add the AP to the MAC address authentication list, the status of the AP will change from fault to config and final to the normal status, we need to wait for several minutes, if the status could not change to normal status, pls re-check your configuration. [AC1]dis ap all All AP information(Normal-1,UnNormal-0): -----------------------------------------------------------------------------AP. AP. AP. Profile. AP. AP. State. Sysname. /Region ID. Type. MAC. ID.
(31) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap -----------------------------------------------------------------------------0. AP6010DN-AGN. cccc-8110-2260. 0/0. normal. ap-0. ------------------------------------------------------------------------------. 3.3.5 Configuring AP Radio Configure the WMM profile: [AC1-wlan-view]wmm-profile name wmm-prof-1. Configure 2.4G radio profile, binding to the WMM profile.. n e /. [AC1-wlan-view]radio-profile name radio2-prof-1 [AC1-wlan-radio-prof-radio2-prof-1]wmm-profile name wmm-prof-1. Configure 5G radio profile, binding to the WMM profile. [AC1-wlan-view]radio-profile name radio5-prof-1. i e w a u .h. [AC1-wlan-radio-prof-radio5-prof-1]wmm-profile name wmm-prof-1. Run command display radio-profile all to check the radio ID: [AC1]display radio-profile all. g n i n r lea. ---------------------------------------------------ID. Name. ---------------------------------------------------0. radio2-prof-1. 1. radio5-prof-1. // : p. ----------------------------------------------------. t t :h. Total: 2. Binding the radio profile to the AP:. s e c r ou. [AC1-wlan-view]ap 0 radio 0. [AC1-wlan-radio-0/0]radio-profile id 0 [AC1-wlan-view]ap 0 radio 1. s e R. [AC1-wlan-radio-0/1]radio-profile id 1. 3.3.6 Configuring WLAN-ESS Interface. or M. eL. r a e. g n i n. The WLAN-ESS interface can’t be configured to trunk mode: [AC1]interface Wlan-Ess 0 [AC1-Wlan-Ess0]port hybrid pvid vlan 13 [AC1-Wlan-Ess0]port hybrid untagged vlan 13. 3.3.7 Configuring Security Profile/Traffic Profile/WLAN Service-set [AC1-wlan-view]traffic-profile id 0 name traffic-prof-1 [AC1-wlan-traffic-prof-traffic-prof-1]quit [AC1-wlan-view]security-profile id 0 name security-prof-1 [AC1-wlan-sec-prof-security-prof-1]quit [AC1-wlan-view]service-set name Huawei-guest1 [AC1-wlan-service-set-huawei-wlan1]ssid Huawei-guest1 [AC1-wlan-service-set-huawei-wlan1]service-vlan 13 [AC1-wlan-service-set-Huawei-guest1]wlan-ess 0. m o .c.
(32) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap [AC1-wlan-service-set-Huawei-guest1]security-profile id 0 [AC1-wlan-service-set-Huawei-guest1]traffic-profile id 0 [AC1-wlan-service-set-Huawei-guest1]forward-mode direct [AC1-wlan-service-set-Huawei-guest1]undo user-isolate [AC1-wlan-service-set-Huawei-guest1]quit. 3.3.8 Configuring Service-set to AP [AC1-wlan-view]ap 0 radio 0 [AC1-wlan-radio-0/0]service-set id 0. n e /. [AC1-wlan-radio-0/0]ap 0 radio 1 [AC1-wlan-radio-0/1]service-set id 0 [AC1-wlan-radio-0/1]quit [AC1-wlan-view]commit ap 0. i e w a u .h. m o .c. Warning: Committing configuration may cause service interruption,continue?[Y/N ]Y. After commit the AP, AP will emit singal for service-set huawei-guestX, the authentication mode is open system authentication, the wireless station, for example PC and mobile phone, will detect the signal and get IP address 192.168.X.0/24, and can ping to the AC and Switch. Take laptop for example to connect to the AP:. t t :h. s e c r ou. r a e. o M. L e r. g n i n. s e R. // : p. g n i n r lea.
(33) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap. n e /. t t :h. // : p. g n i n r lea. i e w a u .h. m o .c. C:\Users\zWX>ping 100.100.100.100. s e c r ou. Pinging 100.100.100.100 with 32 bytes of data: Reply from 100.100.100.100: bytes=32 time=57ms TTL=255 Reply from 100.100.100.100: bytes=32 time=169ms TTL=255. s e R. Reply from 100.100.100.100: bytes=32 time=7ms TTL=255 Reply from 100.100.100.100: bytes=32 time=9ms TTL=255. g n i n. Ping statistics for 100.100.100.100: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),. r a e the Configuration 3.3.9 Verify L e r o M. Approximate round trip times in milli-seconds: Minimum = 7ms, Maximum = 169ms, Average = 60ms. Checking the service-set:. <AC1>dis service-set all. ---------------------------------------------------------------------------ID. Name. 0. Huawei-guest1. SSID Huawei-guest1. ---------------------------------------------------------------------------Total: 1 [AC1]dis service-set id 0 ---------------------------------------------------------------------------Service-set ID Service-Set name SSID. : 0 : Huawei-guest1 : Huawei-guest1.
(34) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap Hide SSID. : disable. User isolate. : disable. Type. : service. Maximum number of user. : 32. Association timeout(min). : 5. Traffic profile name. : traffic-prof-1. Security profile name. : security-prof-1. User profile name. : -. Wlan-ess interface Igmp mode. : Wlan-ess0 : off. Forward mode. : direct-forward. Service-vlan. : 13. DHCP snooping. : disable. IPSG switch. : disable. DHCP trust port. : disable. DAI switch. : disable. ARP attack threshold(pps) Protocol flag. : 15 : all. Offline-management switch Sta access-mode. : disable : disable. Sta blacklist profile. : -. g n i n r lea. Sta whitelist profile. : -. Dhcp option82 Insert. : Disable. Dhcp option82 Format. : Insert Ap-mac. Broadcast suppression(pps). : -. Multicast suppression(pps) Unicast. n e /. : -. suppression(pps). Traffic-filter inbound. : -. t t :h. acl : -. Traffic-filter outbound acl : -. s e c r ou. Service mode status. AutoOff service ess status. // : p. i e w a u .h. m o .c. : enable : disable. AutoOff service starttime. : 00:00:00. AutoOff service endtime. : 00:00:00. s e R. ----------------------------------------------------------------------------. Run command display ap all to view the information of APs:. g n i n. <AC1>dis ap all. All AP information(Normal-1,UnNormal-0):. r a e. o M. L e r. -----------------------------------------------------------------------------AP. AP. AP. Profile. AP. AP. State. Sysname. /Region ID. Type. MAC. ID. -----------------------------------------------------------------------------0. AP6010DN-AGN. cccc-8110-2260. 0/0. normal. ap-0. ----------------------------------------------------------------------------[AC1]dis ap-run-info id 0 AP 0 run information: -----------------------------------------------------------------------------Software version: V200R003C00SPC200 Hardware version: Ver.C BIOS version: 078 Domain: CN CPU type: AR9344.
(35) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap CPU frequency: 500 MHZ Memory type: H5PS5162GFR-S6C&1 AP System software description: AP6010DN-AGN:Ver.C AP System hardware description: AP6010DN-AGN:Ver.C AP manufacture: Huawei Technologies Co., Ltd. AP software name: Huawei Access Point Software AP software vendor: Huawei Technologies Co., Ltd. AP online time: 2948 S AP bom code: 000 Ip address: 10.1.10.254. n e /. Ip mask: 255.255.255.0 Gateway ip: 0.0.0.0 DNS server: 10.254.1.100 Memory size: 128 MB Flash size: 32 MB Run time: 22606 S Up ethernet port speed: 1000 Mbps Up ethernet port speed mode: auto Up ethernet port duplex: full Up ethernet port duplex mode: auto. g n i n r lea. i e w a u .h. m o .c. ------------------------------------------------------------------------------. Using the display access-user command, you can view information about the sessions that meet the specified conditions: <AC1>display access-user. // : p. ------------------------------------------------------------------------------. t t :h. UserID Username. IP address. MAC. -----------------------------------------------------------------------------1171. 74e50bd553b4. 1172. f83dffb5a4f2. s e c r ou. 192.168.1.254. 74e5-0bd5-53b4. 192.168.1.248. f83d-ffb5-a4f2. ------------------------------------------------------------------------------. s e R. Total 2,2 printed. <AC1>display station assoc-info ap 0. g n i n. ------------------------------------------------------------------------------. or M. eL. r a e. STA MAC. AP-ID. RADIO-ID. SS-ID. SSID. -----------------------------------------------------------------------------f83d-ffb5-a4f2. 0. 0. 0. Huawei-guest1. 74e5-0bd5-53b4. 0. 0. 0. Huawei-guest1. -----------------------------------------------------------------------------Total stations: 2. The display station assoc-info command displays status of an STA, including the SSID of the WLAN to which the STA connects, online duration, uplink signal noise ratio, and uplink receiving power of the STA. [AC1]dis station assoc-info sta 5c0a-5b36-4a71 -----------------------------------------------------------------------------Station mac-address Station ip-address. : 5c0a-5b36-4a71 : 0.0.0.0.
(36) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap Station gateway. : 0.0.0.0. Associated SSID. : Huawei-guest1. Station online time(ddd:hh:mm:ss). : 000:00:01:30. The upstream SNR(dB). : 51.0. The upstream aggregate receive power(dBm) : -62.0 Station connect rate(Mbps). : 44. Station connect channel. : 153. Station inactivity time(ddd:hh:mm:ss). : 000:00:00:00. Station current state Authorized for data transfer. : YES. ERP enabled. : No. HT rates enabled. : YES. Auth reference held. : No. uAPSD enabled. : No. uAPSD triggerable. : No. uAPSD SP in progress. : No. This is an ATH node. : No. WDS workaround req. : No. WDS link Station's HT capability. : AWP. Station ERP element(dBm). : 0. Station capabilities. ://. : 33. Station's Noise(dBm). tp t :h. Station's radio mode Station's AP ID Station's Radio ID. s e c r ou. Station's Authentication Method. : -113 : 11n. : 0 : 1 : OPEN : NO CIPHER. Station's User Name. : 5c0a5b364a71. Station's Vlan ID. : 13. s e R. Station's Channel Band-width Station's asso BSSID Station's state. g n i n. i e w a u .h. m o .c. : E. Station's RSSI(dB). L e r. g n i n r lea. : No. Station's Cipher Type. n e /. : YES. Power save mode enabled. r a e. : YES. Qos enabled. : 20MHz : cccc-8110-2270 : Asso with auth. Station's Qos Mode. : NULL. Station's HT Mode. : HT40. Station's MCS value. : 7. Station's Short GI. : nonsupport. Station's roam state. : No. ------------------------------------------------------------------------------. o. M3.4 Configuration Reference 3.4.1 Configuration of AC # sysname AC1 # http server enable http secure-server ssl-policy default_policy http secure-server enable.
(37) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap # vlan batch 10 to 13 # dhcp enable # diffserv domain default # pki realm default enrollment self-signed #. n e /. ssl policy default_policy type server pki-realm default # ip pool vlan10 gateway-list 10.1.10.1 network 10.1.10.0 mask 255.255.255.0 excluded-ip-address 10.1.10.100 dns-list 10.254.1.100 option 43 sub-option 3 ascii 10.1.10.100 # aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin. // : p. g n i n r lea. local-user admin password cipher [email protected]. t t :h. local-user admin privilege level 15. local-user admin service-type telnet http. s e c r ou. local-user huawei password cipher huawei123 local-user huawei privilege level 15 local-user huawei service-type telnet ssh #. s e R. interface Vlanif10. ip address 10.1.10.100 255.255.255.0 dhcp select global. g n i n #. interface Vlanif11. or M. eL. r a e. ip address 10.1.11.100 255.255.255.0. #. interface Vlanif12 ip address 10.1.12.100 255.255.255.0 # interface Vlanif13 ip address 192.168.1.1 255.255.255.0 dhcp select interface dhcp server dns-list 8.8.8.8 # interface MEth0/0/1 ip address 192.168.100.200 255.255.255.0 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 10 port trunk allow-pass vlan 10 to 13. i e w a u .h. m o .c.
(38) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap # interface GigabitEthernet0/0/2 # interface GigabitEthernet0/0/3 # ………… interface GigabitEthernet0/0/23 # interface GigabitEthernet0/0/24 port link-type trunk. n e /. port trunk allow-pass vlan 10 to 12 # interface XGigabitEthernet0/0/1 # interface XGigabitEthernet0/0/2 # interface Wlan-Ess0 port hybrid pvid vlan 13 port hybrid untagged vlan 13 # interface NULL0 # stelnet server enable #. // : p. ip route-static 0.0.0.0 0.0.0.0 10.1.10.1 # user-interface con 0. t t :h. authentication-mode password. g n i n r lea. i e w a u .h. set authentication password cipher huawei123. s e c r ou. user-interface vty 0 4. authentication-mode aaa user privilege level 15 protocol inbound all. s e R. user-interface vty 16 20 # wlan. g n i n. wlan ac source interface vlanif10 ap id 0 type-id 19 mac cccc-8110-2260 sn 210235448310C9000012. or M. eL. r a e. wmm-profile name radio-prof-1 id 0 traffic-profile name traffic-prof-1 id 0 security-profile name security-prof-1 id 0 service-set name Huawei-guest1 id 0 wlan-ess 0 ssid Huawei-guest1 traffic-profile id 0 security-profile id 0 service-vlan 13. radio-profile name radio2-prof-1 id 0 wmm-profile id 0 radio-profile name radio5-prof-1 id 1 radio-type 80211an wmm-profile id 0 ap 0 radio 0 radio-profile id 0 service-set id 0 wlan 1. m o .c.
(39) HCNA-WLAN. 3AP Authentication and WLAN Configuration Roadmap ap 0 radio 1 radio-profile id 1 service-set id 0 wlan 1 # return. You have finished practice 3!. n e /. t t :h. s e c r ou. r a e. o M. L e r. g n i n. s e R. // : p. g n i n r lea. i e w a u .h. m o .c.
(40) HCNA-WLAN. 4WLAN Security Configuration. 4. WLAN Security Configuration. n e /. 4.1 Objectives Upon completion of this task, you will be able to: . Configure WLAN security profile. . Configure WEP authentication. . Configure WPA/WPA2 PSK authentication. . Configure WPA/WPA2 EAP authentication. . Configure VAP. g n i n r a 4.2 Networking Deployment Description e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M. i e w a u .h. m o .c. Figure 4-1 WLAN security configuration parameters description Suppose the student belongs to group X (X=1, 2, 3 … 10). Network Topology Security Profile. Service-set. Chain Networking + Layer 2 Networking. Security-prof-wepX. ID:1 WEP password: guest. Security-prof-wpapskX. ID:2 WPA PSK password: Huaweipsk. Security-prof-wpaeapX. ID:3 Account: huawei, password: huawei. Huawei-guestX. Security profile: Security-prof-wepX. Huawei-voiceX. SSID：Huawei-voiceX Service VLAN:vlan12. Forwarding mode: direct forwarding Traffic profile: traffic-prof-X Security profile: Security-prof-wpapskX Wlan-ess interface 1.
(41) HCNA-WLAN. 4WLAN Security Configuration. User isolate: closed Huawei-employeeX. SSID：Huawei-employeeX Service VLAN:vlan11 Forwarding mode: direct forwarding Traffice profile: traffic-prof-X Security profile: Security-prof-wpaeapX Wlan-ess interface 2. i e w a u .h. User isolate: closed. 4.3 Configuration Procedure. g n i 4.3.1 Configuring WEP Authentication n r a e l // : tp t h : s e c r u o s e R g n i rn a e L e r o M. n e /. m o .c. The AC6605 supports five access security policies: Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), WPA2,WPA-WPA2, and WLAN Authentication and Privacy Infrastructure (WAPI). [AC1-wlan-view]security-profile id 5 name test. [AC1-wlan-sec-prof-security-prof-1]security-policy ? wapi. WLAN authentication and privacy infrastructure. wep. Wired equivalent privacy. wpa. Wi-Fi protected access. wpa-wpa2 wpa2. Wi-Fi protected access version 1&2. Wi-Fi protected access version 2. The service-set Huawei-guestX used open system authentication, in this practice will change the authentication type to WEP share-key, set WEP key to WEP-40, password: guest. Create security profile Security-prof-wep1, encrypt key: guest.. We can set a WEP key with three types: WEP-40, WEP-104,WEP-128. If WEP-40 is used, the WEP key is 10 hexadecimal characters or 5 ASCII characters. If WEP-104 is used, the WEP key is 26 hexadecimal characters or 13 ASCII characters.. If WEP-128 is used, the WEP key is 32 hexadecimal characters or 16 ASCII characters. [AC1]wlan. [AC1-wlan-view]security-profile id 1 name Security-prof-wep1 [AC1-wlan-sec-prof-Security-prof-wep1]security-policy wep [AC1-wlan-sec-prof-Security-prof-wep1]wep authentication-method share-key [AC1-wlan-sec-prof-Security-prof-wep1]wep key wep-40 pass-phrase 0 cipher guest [AC1-wlan-sec-prof-Security-prof-wep1]quit. Configure security profile Huawei-guest1, and reset in the AP: [AC1-wlan-view]dis security-profile all.
(42) HCNA-WLAN. 4WLAN Security Configuration -----------------------------------------------------------ID. Name. 0. security-prof-1. 1. Security-prof-wep1. -----------------------------------------------------------[AC1-wlan-view]dis service-set all ---------------------------------------------------------------------------ID. Name. 0. Huawei-guest1. SSID Huawei-guest1. ----------------------------------------------------------------------------. n e /. Total: 1 [AC1-wlan-view]service-set id 0 [AC1-wlan-service-set-Huawei-guest1]security-profile id 1 [AC1-wlan-service-set-Huawei-guest1]quit [AC1-wlan-view]commit ap 0. i e w a u .h. m o .c. Warning: Committing configuration may cause service interruption,continue?[Y/N ]Y. g n i n r lea. Using the display security-profile command, you can view configurations of security profiles. [AC1]display security-profile id 1. ------------------------------------------------------------. // : p. Profile name. : Security-prof-wep1. Profile ID. : 1. t t :h. Authentication. : Share key. Encryption. : WEP-40. ------------------------------------------------------------. es. Service-set ID. c r ou. 0. SSID. Huawei-guest1. -----------------------------------------------------------Bridge-profile ID. s e R. Bridge Name. ------------------------------------------------------------. Run command display access-user ssid xxxx to check the users with specified SSID.. ing. [AC1]display access-user. rn a e. ssid Huawei-guest1. ------------------------------------------------------------------------------. UserID Username. o M. L e r. IP address. MAC. ------------------------------------------------------------------------------. 1188. 5c0a5b364a71. 192.168.1.252. 5c0a-5b36-4a71. -----------------------------------------------------------------------------Total 1,1 printed. The display station assoc-info command displays status of an STA, including the SSID of the WLAN to which the STA connects, online duration, uplink signal noise ratio, and uplink receiving power of the STA. Below display result shows the STA 5c0a-5b36-4a71 cipher type is WEP-40: [AC1-wlan-view]dis station assoc-info sta. 5c0a-5b36-4a71. -----------------------------------------------------------------------------Station mac-address. : 5c0a-5b36-4a71. Station ip-address. : 0.0.0.0. Station gateway. : 0.0.0.0.
(43) HCNA-WLAN. 4WLAN Security Configuration Associated SSID. : Huawei-guest1. Station online time(ddd:hh:mm:ss). : 000:00:01:03. The upstream SNR(dB). : 54.0. The upstream aggregate receive power(dBm) : -59.0 Station connect rate(Mbps). : 26. Station connect channel. : 153. Station inactivity time(ddd:hh:mm:ss). : 000:00:02:15. Station current state Authorized for data transfer. : YES. Qos enabled. : YES. ERP enabled. : No. HT rates enabled Power save mode enabled. : YES. Auth reference held. : No. uAPSD enabled. : No. uAPSD triggerable. : No. uAPSD SP in progress. : No. This is an ATH node. : No. WDS workaround req. : No. WDS link. : No. Station's HT capability. : 0. Station capabilities. : EP. Station's RSSI(dB). : 36. Station's Noise(dBm). tp t :h. Station's AP ID. Station's Radio ID Station's Authentication Method. s e c r ou. Station's Cipher Type Station's User Name Station's Vlan ID. Station's Channel Band-width. s e R. Station's asso BSSID Station's state. Station's Qos Mode Station's HT Mode. L e r. ://. i e w a u .h. m o .c. : -113. Station's radio mode. r a e. g n i n r lea. : Q. Station ERP element(dBm). g n i n. n e /. : No. : 11a. : 0. : 1 : SHARE-KEY : WEP-40 : 5c0a5b364a71. : 13 : 20MHz : cccc-8110-2270 : Asso with auth : NULL : -. Station's MCS value. : 0. Station's Short GI. : nonsupport. Station's roam state. : No. ------------------------------------------------------------------------------. 4.3.2 Configuring WPA PSK Authentication. o M. Configure the authentication type for service-set Huawei-voiceX to WPA1-PSK. Huawei AC supports below WPA configuration option: WPA Type. Encryption Method. Authentication Method. WPA/WPA2/WPA1-2 Personal. CCMP or TKIP. PSK(password 8-64 characters). WPA/WPA2/WPA1-2 Enterprise. CCMP or TKIP. Dot1x.
(44) HCNA-WLAN. 4WLAN Security Configuration. Configure security profile Security-prof-wpapsk1, encryption mode TKIP, password of PSK is huawei. [AC1-wlan-view]security-profile id 2 name Security-prof-wpapsk1 [AC1-wlan-sec-prof-Security-prof-wpapsk1]security-policy wpa [AC1-wlan-sec-prof-Security-prof-wpapsk1]wpa authentication-method psk pass-phra se cipher Huaweipsk encryption-method tkip [AC1-wlan-sec-prof-Security-prof-wpapsk1]quit [AC1-wlan-view]quit. n e /. Configure WLAN-ESS interface which need to be used by service-set Huawei-voiceX: [AC1]interface Wlan-Ess 1 [AC1-Wlan-Ess1]port hybrid pvid vlan 12 [AC1-Wlan-Ess1]port hybrid untagged vlan 12 [AC1-Wlan-Ess1]quit. i e w a u .h. Create service-set Huawei-voiceX, set the parameters and binding the profiles: [AC1]wlan [AC1-wlan-view]service-set id 1 name Huawei-voice1. g n i n r lea. [AC1-wlan-service-set-Huawei-voice1]ssid Huawei-voice1 [AC1-wlan-service-set-Huawei-voice1]service-vlan 12. m o .c. [AC1-wlan-service-set-Huawei-voice1]wlan-ess 1. [AC1-wlan-service-set-Huawei-voice1]security-profile id 2 [AC1-wlan-service-set-Huawei-voice1]traffic-profile id 0. // : p. [AC1-wlan-service-set-Huawei-voice1]forward-mode direct-forward [AC1-wlan-service-set-Huawei-voice1]undo user-isolate. t t :h. [AC1-wlan-service-set-Huawei-voice1]quit. Using the batch command, you can create multiple virtual access points (VAPs) at a time.. s e c r ou. [AC1-wlan-view]batch ap 0 to 0 radio 0 to 1 service-set 1 Info: Command is being executed, please wait. Success: 2 Failure: 0. s e R. Using the commit command, you can commit configurations of one or all access points (APs).. g n i n. [AC1-wlan-view]commit all Warning: Committing configuration may cause service interruption,continue?[Y/N. r a e. o M. L e r. ]Y. Then the configuration of WPA-PSK has been finished, we can test the connection:.
(45) HCNA-WLAN. 4WLAN Security Configuration. n e /. C:\Users\zWX>ipconfig. g n i n r lea. i e w a u .h. m o .c. Wireless LAN adapter Wireless Network Connection:. // : p. Connection-specific DNS Suffix. . :. Link-local IPv6 Address . . . . . : fe80::2c32:9714:1276:b45b%14. t t :h. IPv4 Address. . . . . . . . . . . : 10.1.12.253 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.1.12.1. s e c r ou. C:\Users\zWX>ping 100.100.100.100 Pinging 100.100.100.100 with 32 bytes of data:. s e R. Reply from 100.100.100.100: bytes=32 time=36ms TTL=255 Reply from 100.100.100.100: bytes=32 time=6ms TTL=255 Reply from 100.100.100.100: bytes=32 time=7ms TTL=255. g n i n. Reply from 100.100.100.100: bytes=32 time=6ms TTL=255. or M. eL. r a e. Ping statistics for 100.100.100.100: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),. Approximate round trip times in milli-seconds: Minimum = 6ms, Maximum = 36ms, Average = 13ms. Run command display station assoc-info sta to check the STA status: <AC1>display station assoc-info sta 74e5-0bd5-53b4 -----------------------------------------------------------------------------Station mac-address. : 74e5-0bd5-53b4. Station ip-address. : 0.0.0.0. Associated SSID Station online time(ddd:hh:mm:ss) The upstream SNR(dB). : Huawei-voice1 : 000:00:01:04 : 85.0. The upstream aggregate receive power(dBm) : -44.0 Station connect rate(Mbps). : 37. Station connect channel. : 1.
(46) HCNA-WLAN. 4WLAN Security Configuration Station inactivity time(ddd:hh:mm:ss). : 000:00:00:00. Station current state Authorized for data transfer. : YES. ………… Station's Authentication Method. : WPA1-PSK. Station's Cipher Type. : TKIP. Station's User Name. : 74e50bd553b4. Station's Vlan ID. : 12. Station's Channel Band-width. : 20MHz. n e /. 4.3.3 Configuring WPA EAP Authentication. m o .c. The authentication architecture of EAP consists of three parts: clients, authenticator and authentication server.. // : p. g n i n r lea. i e w a u .h. The authentication server of this practice had set an IP address 10.254.1.100, password: huawei, the authentication server was ready and test account: huawei, password: huawei.. t t :h. s e c r ou. Configure radius service in the AC:. [AC] radius-server template radius_huawei. s e R. [AC-radius-radius_huawei] radius-server authentication 10.254.1.100 1812 [AC-radius-radius_huawei] radius-server shared-key cipher huawei [AC1-radius-radius_huawei]undo radius-server user-name domain-included. g n i n. [AC-radius-radius_huawei] quit. or M. eL. r a e. Configure AAA: [AC] aaa [AC-aaa] authentication-scheme radius_huawei [AC-aaa-authen-radius_huawei] authentication-mode radius local [AC-aaa-authen-radius_huawei] quit [AC1-aaa]domain default [AC1-aaa-domain-default]authentication-scheme radius_huawei [AC1-aaa-domain-default]radius-server. radius_huawei. [AC] test-aaa huawei huawei radius-template radius_huawei Info: Account test succeed.. If the account test failed please ignore it first, and keep on configuring it. Configure security profile Security-prof-wpaeap1, encryption mode CCMP, authentication mode Dot1x PEAP:.
(47) HCNA-WLAN. 4WLAN Security Configuration [AC1-wlan-view]security-profile id 3 name Security-prof-wpaeap1 [AC1-wlan-sec-prof-Security-prof-wpaeap1]security-policy wpa2 [AC1-wlan-sec-prof-Security-prof-wpaeap1]wpa2 authentication-method dot1x e ncryption-method ccmp [AC1-wlan-sec-prof-Security-prof-wpaeap1]quit. Create WLAN-ESS interface, and enable Dot1x authentication: [AC1]interface Wlan-Ess 2 [AC1-Wlan-Ess2]port hybrid pvid vlan 11. n e /. [AC1-Wlan-Ess2]port hybrid untagged vlan 11 [AC1-Wlan-Ess2]dot1x enable [AC1-Wlan-Ess2]dot1x authentication-method eap [AC1-Wlan-Ess2]quit. i e w a u .h. m o .c. Create service-set Huawei-employeeX, set the parameters and binding the profiles. [AC1-wlan-view]service-set id 2 name Huawei-employee1. [AC1-wlan-service-set-Huawei-employee1]ssid Huawei-employee1 [AC1-wlan-service-set-Huawei-employee1]service-vlan 11 [AC1-wlan-service-set-Huawei-employee1]wlan-ess 2. g n i n r lea. [AC1-wlan-service-set-Huawei-employee1]security-profile id 3 [AC1-wlan-service-set-Huawei-employee1]traffic-profile id 0. [AC1-wlan-service-set-Huawei-employee1]forward-mode direct-forward [AC1-wlan-service-set-Huawei-employee1]tunnel-forward protocol dot1x [AC1-wlan-service-set-Huawei-employee1]undo user-isolate. // : p. [AC1-wlan-service-set-Huawei-employee1]quit. t t :h. Using the batch command, you can create multiple virtual access points (VAPs) at a time. [AC1-wlan-view]batch ap 0 to 0 radio 0 to 1 service-set 2. s e c r ou. Info: Command is being executed, please wait. Success: 2 Failure: 0. Using the commit command, you can commit configurations of one or all access points (APs).. s e R. [AC1-wlan-view]commit all. Warning: Committing configuration may cause service interruption,continue?[Y/N. g n i n ]Y. or M. eL. r a e. Right now, the WPA-PSK configuration has been finshed, run command display current-configuration interface Wlan-Ess 2 to verify the configuration: [AC1]display current-configuration interface Wlan-Ess 2 # interface Wlan-Ess2 port hybrid pvid vlan 11 port hybrid untagged vlan 11 dot1x enable dot1x authentication-method eap. # [AC1]display security-profile id 2 -----------------------------------------------------------Profile name. : Security-prof-wpapsk1. Profile ID. : 2. Authentication Encryption. : WPA. PSK. : TKIP. ------------------------------------------------------------.
(48) HCNA-WLAN. 4WLAN Security Configuration Service-set ID. SSID. 1. Huawei-voice1. -----------------------------------------------------------Bridge-profile ID. Bridge Name. -----------------------------------------------------------Mesh-profile ID. Mesh Id. -----------------------------------------------------------[AC1]dis service-set all ---------------------------------------------------------------------------ID. Name. 0. Huawei-guest1. 1. Huawei-voice1. Huawei-voice1. 2. Huawei-employee1. Huawei-employee1. Huawei-guest1. i e w a u .h. m o .c. ---------------------------------------------------------------------------[AC1]display access-user. -----------------------------------------------------------------------------UserID Username. IP address. MAC. -----------------------------------------------------------------------------1593. huawei. 10.1.11.254. g n i n r lea. 5c0a-5b36-4a71. -----------------------------------------------------------------------------Total 1,1 printed. 4.3.4 Configuring EAP Client. t t :h. // : p. Set the wireless configuration in the PC manually, no need to download CA certificate.. r a e. o M. L e r. 1.. Click the icon sharing center“. 2.. Click“manage wireless network“. in the lower right corner of the PC and open“open network and. 3.. Click“add“. 4.. Click“manually create a network proflie“. 5.. Set the parameters as shown in below figure, and click next:. s e c r ou. g n i n. n e /. SSID. s e R.
(49) HCNA-WLAN. 4WLAN Security Configuration. n e /. 6.. // : p. g n i n r lea. i e w a u .h. m o .c. Then click“change connection settings“, change the setting.. t t :h. s e c r ou. r a e. g n i n. s e R. L e r. o M. 7.. Then the authentication window will popup, enter account: huawei and password: huawei..
(50) HCNA-WLAN. 4WLAN Security Configuration. n e /. 8.. g n i n r lea. Then the user authenticate is successed, and will obtain the IP address.. t t :h. // : p. s e c r ou. r a e. g n i n. s e R. L e r. o M. 9.. i e w a u .h. Then the PC can get the IP address, can ping to the switch C:\Users\zWX>. ipconfig. Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix. . :. m o .c.
Related documents
Using lead retrieval to capture sales leads in your booth enables you to qualify leads with follow-up action codes, eliminates hand-keying leads into your database for quicker
Once the annual probability of exceedance, the hazard value for the site, the sub-soil conditions and the building height are known, the required design effort can be determined
Employees who are getting a daily average wages up to ________ are exempted from contributing employees’ share of ESI contribution.. An employee whose salary at the time
Example to enable stacking with switch identifier 3 as back up master using xg1 and xg2 as stacking ports. SMIS# stack priority BM switchid 3 ports
Firstly, the photovoltaic inverter power is used to adjust the control voltage, and the inverter utilization rate is taken as the consistent goal to make the output of
Module analysis for multiple-choice responses (MAMCR) was applied to a large sample of Force Concept Inventory (FCI) pretest and post-test responses (N pre ¼ 4509 and N post ¼ 4716)
• PENM is a Danish private equity fund that invests in Vietnam via its local office. • The investment strategy of PENM focuses on minority stakes in both private and public
Spyware detection technique based on reinforcement learning operates with m specified research object’s states – the set of variants of the API functions, that per- form
