This section only describes how to configure agile features, and does not describe other basic configurations, such as routing connectivity.
Configure ASs to connect to the parent.
Log in to the CSS and enable the SVF function.
<HUAWEI> system-view [HUAWEI] vlan batch 11 [HUAWEI] dhcp enable //Enable the DHCP server function to allow an AS to obtain an IP address from the parent. [HUAWEI] interface vlanif 11 [HUAWEI-Vlanif11] ip address 192.168.11.1 24 [HUAWEI-Vlanif11] dhcp select interface [HUAWEI-Vlanif11] dhcp server option 43 ip-address 192.168.11.1 //Configure the parent to send the IP address to an AS so that the AS can set up a CAPWAP link with the specified IP address. [HUAWEI-Vlanif11] quit [HUAWEI] capwap source interface vlanif 11 //Set up a CAPWAP link between the parent and the AS. [HUAWEI] authentication unified-mode //Change the network admission control (NAC) configuration mode to the united mode. [HUAWEI] stp mode rstp //Set the working mode to STP or RSTP when enabling the SVF function. [HUAWEI] uni-mng //Enable the SVF function and enter the uni-mng view. Warning: This operation will enable the uni-mng mode and disconnect all ASs. STP calculation may be triggered and service traffic will be affected. Continue?[Y/N]: y
When enabling the SVF function, ensure that the current and next startup NAC configuration modes are the unified mode.
You can run the display authentication mode command to check whether the current and next startup NAC configuration modes are the unified mode. If not, set the modes to the unified mode.
After the traditional and unified modes are switched, restart the device to make the configuration take effect. By default, the NAC configuration mode is unified mode.
Configure access parameters for ASs.
# Configure ASs' names, and specify the device models and management MAC addresses for the ASs.
[HUAWEI-um] as name as1 model S5700-52X-PWR-LI-AC mac-address 0200-0000-0011 [HUAWEI-um-as-as1] quit [HUAWEI-um] as name as2 model S5700-52X-PWR-LI-AC mac-address 0200-0000-0022 [HUAWEI-um-as-as2] quit [HUAWEI-um] as name as3 model S5700-28X-PWR-LI-AC mac-address 0200-0000-0033 [HUAWEI-um-as-as3] quit
# Configure the fabric ports that connect the parent to level-1 ASs (AS_1 and AS_2). The following example configures the fabric port that connects the parent to AS_1. The configuration of the fabric port that connects the parent to AS_2 is similar and is not mentioned here.
[HUAWEI-um] interface fabric-port 1 [HUAWEI-um-fabric-port-1] port member-group interface eth-trunk 1 [HUAWEI-um-fabric-port-1] quit [HUAWEI-um] quit [HUAWEI] interface gigabitethernet 1/1/0/1 [HUAWEI-GigabitEthernet1/1/0/1] eth-trunk 1 [HUAWEI-GigabitEthernet1/1/0/1] quit [HUAWEI] interface gigabitethernet 2/1/0/1 [HUAWEI-GigabitEthernet2/1/0/1] eth-trunk 1 [HUAWEI-GigabitEthernet2/1/0/1] quit
# Configure the fabric port that connects level-1 AS (AS_1) to level-2 AS (AS_3).
[HUAWEI] uni-mng [HUAWEI-um] as name as1 [HUAWEI-um-as-as1] down-direction fabric-port 4 member-group interface eth-trunk 4 [HUAWEI-um-as-as1] port eth-trunk 4 trunkmember interface gigabitethernet 0/0/23 to 0/0/24 [HUAWEI-um-as-as1] quit [HUAWEI-um] quit
# Configure ASs to be authenticated using a whitelist when they connect to an SVF system.
[HUAWEI] as-auth [HUAWEI-as-auth] undo auth-mode [HUAWEI-as-auth] whitelist mac-address 0200-0000-0011 [HUAWEI-as-auth] whitelist mac-address 0200-0000-0022 [HUAWEI-as-auth] whitelist mac-address 0200-0000-0033 [HUAWEI-as-auth] quit [HUAWEI] quit
Before connecting an AS to the parent, ensure that the AS has no configuration file or input on the console port.
# Clear the configurations of ASs and restart the ASs. (This process takes 5 minutes. During the process, ensure that the AS has no input on the console port. If the ASs are unconfigured, you can directly connect the ASs to the parent with no need to restart the ASs.)
<HUAWEI> reset saved-configuration
Warning: The action will delete the saved configuration in the device.
The configuration will be erased to reconfigure. Continue? [Y/N]:y
# After connecting the cables, run the display as all command to check whether all ASs have connected to the SVF system successfully.
<HUAWEI> display as all ------------------------------------------------------------------------------ No. Type Mac IP State Name ------------------------------------------------------------------------------ 0 S5700-52X-PWR-LI-AC 0200-0000-0011 192.168.11.254 normal as1 1 S5700-52X-PWR-LI-AC 0200-0000-0022 192.168.11.253 normal as2 2 S5700-28X-PWR-LI-AC 0200-0000-0033 192.168.11.252 normal as3 ------------------------------------------------------------------------------ Total: 3
Configure an AP to connect to an AS. The following example describes how to connect AP_1 to AS_3, and the procedure for connecting AP_2 to AS_2 is not mentioned here.
Create a network basic profile, and specify a pass-VLAN for mobile terminals connected to AP_1.
<HUAWEI> system-view [HUAWEI] uni-mng [HUAWEI-um] network-basic-profile name profile_ap [HUAWEI-um-net-basic-profile_ap] pass-vlan 202 [HUAWEI-um-net-basic-profile_ap] quit
Add the port connecting AS_3 to AP_1 to an AP port group.
[HUAWEI-um] port-group connect-ap name group_ap
[HUAWEI-um-portgroup-group_ap] network-basic-profile profile_ap
[HUAWEI-um-portgroup-group_ap] as name as3 interface gigabitethernet 0/0/24
[HUAWEI-um-portgroup-group_ap] quit
[HUAWEI-um] commit as all
Warning: Committing the configuration will take a long time. Continue?[Y/N]:y
[HUAWEI-um] quit
Configure access parameters for AP_1.
# Configure the AP ID.
[HUAWEI] wlan [HUAWEI-wlan-view] ap-id 1 ap-type ap5010dn-agn ap-mac 00e0-0001-0005 [HUAWEI-wlan-ap-1] quit
# Configure non-authentication for AP_1 to connect to an SVF system.
[HUAWEI-wlan-view] ap auth-mode no-auth [HUAWEI-wlan-view] quit
Power on AP_1 and connect AP_1 to AS_3 using cables.
# After connecting the cables, run the display ap all command to check whether AP_1 has connected to the SVF system successfully.
[HUAWEI] display ap all Total AP information: nor : normal [1] ------------------------------------------------------------------------------------------------- ID MAC Name Group IP Type State STA Uptime ------------------------------------------------------------------------------------------------- 1 00e0-0001-0005 00e0-0001-0005 default 192.168.11.254 AP5010DN-AGN nor 0 6H:3M:40S ------------------------------------------------------------------------------------------------- Total: 1
Configure a PC to connect to an AS. The following example describes how to connect PC_1 to AS_3, and the procedure for connecting PC_2 to AS_2 is not mentioned here.
[HUAWEI] uni-mng [HUAWEI-um] network-basic-profile name profile_1 [HUAWEI-um-net-basic-profile_1] user-vlan 100 [HUAWEI-um-net-basic-profile_1] quit [HUAWEI-um] quit
[HUAWEI] dot1x-access-profile name 1 [HUAWEI-dot1x-access-profile-1] quit [HUAWEI] authentication-profile name dot1x_auth [HUAWEI-authen-profile-dot1x_auth] dot1x-access-profile 1 [HUAWEI-authen-profile-dot1x_auth] quit [HUAWEI] uni-mng [HUAWEI-um] user-access-profile name pro1 [HUAWEI-um-user-access-pro1] authentication-profile dot1x_auth
[HUAWEI-um] port-group name group1 [HUAWEI-um-portgroup-group1] network-basic-profile profile_1 [HUAWEI-um-portgroup-group1] user-access-profile pro1 [HUAWEI-um-portgroup-group1] as name as3 interface GigabitEthernet 0/0/23 [HUAWEI-um] commit as name as3 [HUAWEI-um] quit
[HUAWEI] aaa [HUAWEI-aaa] authentication-scheme sch1 [HUAWEI-aaa-authen-shc1] authentication-mode none [HUAWEI-aaa-authen-shc1] quit [HUAWEI-aaa] domain pc [HUAWEI-aaa-domain-pc] authentication-scheme sch1 [HUAWEI-aaa-domain-pc] quit [HUAWEI-aaa] quit
If the user is dynamically configured to connect to an SVF system, perform shutdown and undo shutdown operations to reconnect the wired user to the SVF system. Run the display access-user command to check whether the user has connected to the SVF system.
[HUAWEI] uni-mng [HUAWEI-um] as name as3 [HUAWEI-um-as-as3] shutdown interface gigabitethernet 0/0/23 [HUAWEI-um-as-as3] undo shutdown interface gigabitethernet 0/0/23 [HUAWEI-um-as-as3] quit [HUAWEI-um] quit
Create and configure a RADIUS server template, an AAA authentication scheme, and an authentication domain.
# Create and configure a RADIUS server template rd1.
[HUAWEI] radius-server template rd1 [HUAWEI-radius-rd1] radius-server authentication 192.168.2.31 1812 [HUAWEI-radius-rd1] radius-server shared-key cipher Huawei@123 [HUAWEI-radius-rd1] quit
# Create an AAA authentication scheme abc, and set the authentication mode to RADIUS.
[HUAWEI] aaa [HUAWEI-aaa] authentication-scheme abc [HUAWEI-aaa-authen-abc] authentication-mode radius [HUAWEI-aaa-authen-abc] quit
# Create an authentication domain isp1, and bind the AAA authentication scheme abc and RADIUS server template rd1 to the domain.
[HUAWEI-aaa] domain isp1 [HUAWEI-aaa-domain-isp1] authentication-scheme abc [HUAWEI-aaa-domain-isp1] radius-server rd1 [HUAWEI-aaa-domain-isp1] quit [HUAWEI-aaa] quit
# Configure a global default domain isp1. If a user name does not contain a domain name or contains an invalid domain name, the user is authenticated in the default domain.
[HUAWEI] domain isp1
Configure 802.1X authentication and web authentication.
# Create and configure a Portal server template abc.
[HUAWEI] web-auth-server abc [HUAWEI-web-auth-server-abc] server-ip 192.168.2.31 [HUAWEI-web-auth-server-abc] url http://192.168.2.31:50200/webagent [HUAWEI-web-auth-server-abc] shared-key cipher Huawei@123 [HUAWEI-web-auth-server-abc] quit
# Enable 802.1X authentication and web authentication on GE1/1/0/1.
[HUAWEI] interface gigabitethernet 1/1/0/1
[HUAWEI-GigabitEthernet1/1/0/1] authentication dot1x portal
[HUAWEI-GigabitEthernet1/1/0/1] web-auth-server abc direct //Bind the Portal server template to GE1/1/0/1.
[HUAWEI-GigabitEthernet1/1/0/1] quit
# Enable the free mobility function, and configure an IP address for the Agile Controller server and a password used for communicating with the Agile Controller.
[HUAWEI] group-policy controller 192.168.2.31 password Huawei@123
Perform the following configurations on the Agile Controller.
Screenshots on the Agile Controller are not provided here. For details, see the Agile Controller product documents.
Source Security Group (User) | Destination Security Group (Resource) | Access Control Policy |
---|---|---|
Common guest | Public resources (bound IP address: 10.10.1.1/32) | Permit |
Education management system (bound IP address 10.10.2.1/32) | Forbid | |
FTP resources (bound IP address: 10.10.3.1/32) | Forbid | |
Undergraduate or postgraduate | Public resources (bound IP address: 10.10.1.1/32) | Permit |
Education management system (bound IP address 10.10.2.1/32) | Forbid | |
FTP resources (bound IP address: 10.10.3.1/32) | Permit | |
Teacher | Public resources (bound IP address: 10.10.1.1/32) | Permit |
Education management system (bound IP address 10.10.2.1/32) | Permit | |
FTP resources (bound IP address: 10.10.3.1/32) | Permit |
After wired and wireless convergence is configured on an agile switch, you do not need to individually configure the switch and independent AC or ACU2; you can perform configurations on the switch directly.
Configure the S12708 to function as a DHCP server to assign IP addresses to PCs and STAs. The S12708 assigns IP addresses to APs through SVF. You do not need to configure the S12708 to assign IP addresses to APs. The following example describes how the S12708 assigns IP addresses to the PCs and STAs in teaching area 1.
# Configure the S12708 to assign an IP address to PC_1 from the global address pool.
<HUAWEI> system-view [HUAWEI] dhcp enable [HUAWEI] vlan batch 100 202 [HUAWEI] interface vlanif 100 [HUAWEI-Vlanif100] ip address 192.168.100.1 24 [HUAWEI-Vlanif100] dhcp select global [HUAWEI-Vlanif100] quit [HUAWEI] ip pool 100 [HUAWEI-ip-pool-100] gateway-list 192.168.100.1 [HUAWEI-ip-pool-100] network 192.168.100.0 mask 24 [HUAWEI-ip-pool-100] quit
# Configure the S12708 to assign IP addresses to STAs from the global address pool. The IP addresses in the address pool 202 are assigned to the STAs connected to AP_1, and the IP addresses in the address pool 204 are assigned to the STAs connected to AP_2.
The following example describes how the S12708 assigns IP addresses to the STAs connected to AP_1.
[HUAWEI] interface vlanif 202 [HUAWEI-Vlanif202] ip address 192.168.202.1 24 [HUAWEI-Vlanif202] dhcp select global [HUAWEI-Vlanif202] quit [HUAWEI] ip pool 202 [HUAWEI-ip-pool-202] gateway-list 192.168.202.1 [HUAWEI-ip-pool-202] network 192.168.202.0 mask 24 [HUAWEI-ip-pool-202] quit
Configure an AP to go online.
# Create an AP group to which the APs with the same configuration can be added.
[HUAWEI] wlan [HUAWEI-wlan-view] ap-group name ap-group1 [HUAWEI-wlan-ap-group-ap-group1] quit
# Create a regulatory domain profile, configure the AC country code in the profile, and apply the profile to the AP group.
[HUAWEI-wlan-view] regulatory-domain-profile name domain1 [HUAWEI-wlan-regulate-domain-domain1] country-code cn [HUAWEI-wlan-regulate-domain-domain1] quit [HUAWEI-wlan-view] ap-group name ap-group1 [HUAWEI-wlan-ap-group-ap-group1] regulatory-domain-profile domain1 Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continu e?[Y/N]:y [HUAWEI-wlan-ap-group-ap-group1] quit [HUAWEI-wlan-view] quit
# Configure the AC's source interface.
[HUAWEI] capwap source interface vlanif 11
# Add an AP to the AP group ap-group1. In this example, the AP's MAC address is 00e0-0001-0005.
[HUAWEI] wlan [HUAWEI-wlan-view] ap-id 1 ap-mac 00e0-0001-0005 [HUAWEI-wlan-ap-1] ap-name area_1 [HUAWEI-wlan-ap-1] ap-group ap-group1 Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y [HUAWEI-wlan-ap-1] quit
# After the AP is powered on, run the display ap all command to check the AP state. If the State field displays nor, the AP has gone online.
[HUAWEI-wlan-view] display ap all Total AP information: nor : normal [1] ------------------------------------------------------------------------------------- ID MAC Name Group IP Type State STA Uptime ------------------------------------------------------------------------------------- 1 00e0-0001-0005 area_1 ap-group1 192.168.11.254 AP5010DN-AGN nor 0 10S ------------------------------------------------------------------------------------- Total: 1
Configure WLAN service parameters.
# Create the security profile security and set the security policy in the profile.
In this example, the security policy is set to WPA2+PSK+AES and password to huawei123. In actual situations, the security policy must be configured according to service requirements.
[HUAWEI-wlan-view] security-profile name security [HUAWEI-wlan-sec-prof-security] security wpa2 psk pass-phrase huawei123 aes [HUAWEI-wlan-sec-prof-security] quit
# Create the SSID profile area1 and set the SSID name to area1.
[HUAWEI-wlan-view] ssid-profile name area1 [HUAWEI-wlan-ssid-prof-area1] ssid area1 Warning: This action may cause service interruption. Continue?[Y/N]y [HUAWEI-wlan-ssid-prof-area1] quit
# Create the VAP profile wlan-vap, set the data forwarding mode and service VLAN, and apply the security profile and SSID profile to the VAP profile.
[HUAWEI-wlan-view] vap-profile name wlan-vap [HUAWEI-wlan-vap-prof-wlan-vap] forward-mode direct-forward Warning: This action may cause service interruption. Continue?[Y/N]y [HUAWEI-wlan-vap-prof-wlan-vap] service-vlan vlan-id 202 [HUAWEI-wlan-vap-prof-wlan-vap] security-profile security [HUAWEI-wlan-vap-prof-wlan-vap] ssid-profile area1 [HUAWEI-wlan-vap-prof-wlan-vap] quit
# Bind the VAP profile wlan-vap to radio 0 and radio 1 of the AP group.
[HUAWEI-wlan-view] ap-group name ap-group1 [HUAWEI-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 0 [HUAWEI-wlan-ap-group-ap-group1] vap-profile wlan-vap wlan 1 radio 1 [HUAWEI-wlan-ap-group-ap-group1] quit
Commit the configuration.
[HUAWEI-wlan-view] commit all //From V200R011C10, WLAN configurations are automatically delivered, without the need of running the commit all command.
Warning: Committing configuration may cause service interruption, continue?[Y/N]:y
iPCA can be performed to detect packet loss on agile switches and between agile switches. If you want to detect packet loss between the main campus and branch campus networks, agile switches need to be deployed on both networks.
Configure the packet loss measurement function for a device.
Enable iPCA on each device to implement packet loss measurement so that you can know packet loss in a timely manner. Configure the packet loss alarm on each device.
[HUAWEI] iplpm global loss-measure alarm enable //Enable the packet loss alarm and clear alarm on a device. [HUAWEI] iplpm global loss-measure enable //Enable the packet loss measurement
[HUAWEI] display iplpm loss-measure statistics global Latest global loss statistics: -------------------------------------------------------------------------------- StartTime(DST) Loss Packets LossRatio ErrorInfo -------------------------------------------------------------------------------- 2015-06-12 18:47:30 344127 4.513519% OK 2015-06-12 18:47:20 381085 4.513196% OK 2015-06-12 18:47:10 381192 4.513290% OK 2015-06-12 18:47:00 381339 4.513341% OK 2015-06-12 18:46:50 381465 4.513392% OK 2015-06-12 18:46:40 381444 4.513487% OK 2015-06-12 18:46:30 381129 4.513309% OK --------------------------------------------------------------------------------
Configure the end-to-end packet loss measurement function.
Configure the core switches in the main campus.
[HUAWEI] nqa ipfpm dcp //Enable the DCP function globally. [HUAWEI-nqa-ipfpm-dcp] dcp id 1.1.1.1 //Configure the DCP ID. [HUAWEI-nqa-ipfpm-dcp] instance 1 [HUAWEI-nqa-ipfpm-dcp-instance-1] mcp 2.2.2.2 [HUAWEI-nqa-ipfpm-dcp-instance-1] flow bidirectional source 10.1.1.0 24 destination 10.2.1.0 24 //Set the target flow to a bidirectional symmetrical flow. [HUAWEI-nqa-ipfpm-dcp-instance-1] tlp 1 in-point ingress //Color the target flows that enter the network. [HUAWEI-nqa-ipfpm-dcp-instance-1] quit [HUAWEI-nqa-ipfpm-dcp] quit [HUAWEI] interface gigabitethernet 3/1/0/1 //Specify the interface connecting to the core switch in the branch campus. [HUAWEI-GigabitEthernet3/1/0/1] ipfpm tlp 1 //Bind a Target Logical Port (TLP) to the interface. [HUAWEI-GigabitEthernet3/1/0/1] quit [HUAWEI] interface gigabitethernet 3/1/0/2 //Specify the interface connecting to the core switch in the branch campus. [HUAWEI-GigabitEthernet3/1/0/2] ipfpm tlp 1 //Bind a TLP to the interface. [HUAWEI-GigabitEthernet3/1/0/2] quit [HUAWEI] nqa ipfpm dcp [HUAWEI-nqa-ipfpm-dcp] instance 1 [HUAWEI-nqa-ipfpm-dcp-instance-1] loss-measure enable continual //Enable the continual packet loss measurement function for the DCP instance. [HUAWEI-nqa-ipfpm-dcp-instance-1] quit [HUAWEI-nqa-ipfpm-dcp] quit
Configure the core switches in the branch campus.
<HUAWEI> system-view [HUAWEI] sysname Switch [Switch] nqa ipfpm dcp [Switch-nqa-ipfpm-dcp] dcp id 2.2.2.2 [Switch-nqa-ipfpm-dcp] instance 1 [Switch-nqa-ipfpm-dcp-instance-1] mcp 2.2.2.2 [Switch-nqa-ipfpm-dcp-instance-1] flow bidirectional source 10.1.1.0 24 destination 10.2.1.0 24 [Switch-nqa-ipfpm-dcp-instance-1] tlp 2 out-point egress [Switch-nqa-ipfpm-dcp-instance-1] quit [Switch-nqa-ipfpm-dcp] quit [Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] ipfpm tlp 2 [Switch-GigabitEthernet1/0/1] quit [Switch] nqa ipfpm dcp [Switch-nqa-ipfpm-dcp] instance 1 [Switch-nqa-ipfpm-dcp-instance-1] loss-measure enable continual [Switch-nqa-ipfpm-dcp-instance-1] quit [Switch-nqa-ipfpm-dcp] quit [Switch] nqa ipfpm mcp //Enable the MCP function globally. [Switch-nqa-ipfpm-mcp] mcp id 2.2.2.2 //Create a MCP. [Switch-nqa-ipfpm-mcp] instance 1 [Switch-nqa-ipfpm-mcp-instance-1] dcp 1.1.1.1 [Switch-nqa-ipfpm-mcp-instance-1] dcp 2.2.2.2 [Switch-nqa-ipfpm-mcp-instance-1] loss-measure ratio-threshold upper-limit 7 lower-limit 5 //Set the packet loss alarm threshold to 7% and clear alarm threshold to 5% for the MCP instance. [Switch-nqa-ipfpm-mcp-instance-1] quit [Switch-nqa-ipfpm-mcp] quit [Switch] quit
Verify the configurations.
# Run the display ipfpm statistic-type loss instance 1 command on the core switches in the branch campus to view the packet loss measurement results.
<Switch> display ipfpm statistic-type loss instance 1 Latest loss statistics of forward flow: Unit: p - packet, b - byte ------------------------------------------------------------------------------------------ Period Loss(p) LossRatio(p) Loss(b) LossRatio(b) ------------------------------------------------------------------------------------------ 127636768 381549 4.514649% 40444194 4.514649% 127636767 381528 4.514620% 40441968 4.514620% 127636766 381318 4.514996% 40419708 4.514996% 127636765 381192 4.514686% 40406352 4.514686% 127636764 381381 4.514679% 40426386 4.514679% 127636763 381402 4.514748% 40428612 4.514748% 127636762 381081 4.514797% 40394586 4.514797% 127636761 381324 4.514702% 40420344 4.514702% 127636760 381549 4.514870% 40444194 4.514870% 127636759 381066 4.514638% 40392996 4.514638% 127636758 381570 4.514836% 40446420 4.514836% 127636757 382452 4.514757% 40539912 4.514757% Latest loss statistics of backward flow: Unit: p - packet, b - byte ------------------------------------------------------------------------------------------ Period Loss(p) LossRatio(p) Loss(b) LossRatio(b) ------------------------------------------------------------------------------------------ 127636768 381087 4.513306% 40395222 4.513306% 127636767 381129 4.513384% 40399674 4.513384% 127636766 381465 4.513444% 40435290 4.513444% 127636765 381087 4.513222% 40395222 4.513222% 127636764 381045 4.513272% 40390770 4.513272% 127636763 381381 4.513364% 40426386 4.513364% 127636762 381276 4.513435% 40415256 4.513435% 127636761 380961 4.513280% 40381866 4.513280% 127636760 381339 4.513574% 40421934 4.513574% 127636759 381045 4.513270% 40390770 4.513270% 127636758 381088 4.513226% 40395328 4.513226% 127636757 382409 4.513464% 40535354 4.513464%