Configuring the Free Mobility Function

Procedure

1. Configure routes between the device and controller.

   You are advised to configure static routes or OSPF dynamic routes to implement communication between the device and controller. For details, see "Static Route Configuration" and "OSPF Configuration" in the S2720, S5700, and S6700 V200R019C10 Configuration Guide - IP Unicast Routing.

2. Perform the following configurations based on the controller type:
   • When Agile Controller-Campus is used, run the following command in the system view:

     Run group-policy controller ip-address1 [ port-number1 ] [ backup ip-address2 [ port-number2 ] ] password password [ src-ip ip-address3 ] [ vpn-instance vpn-instance-name ]

     The free mobility function is enabled.

     By default, the free mobility function is disabled.

   • When iMaster NCE-Campus is used, run the following commands in the system view:
     1. Run ip-group service ip-address ip-address [ port port-number ] pki-realm-name pki-realm-name

        The IP address of the controller is configured.

        By default, no controller IP address is configured.

     2. Run ip-group service timer heart-beat interval

        The interval for sending IP-GROUP channel heartbeat packets is configured.

        By default, IP-GROUP channel heartbeat packets are sent at an interval of 5 minutes.

     3. Run ip-group service timer reconnection interval

        The IP-GROUP channel reconnection interval is configured.

        By default, the IP-GROUP channel reconnection interval is 1 minute.

     4. Run ip-group service timer down-delay interval

        A delay in responding to the IP-GROUP channel interruption event is configured.

        By default, the delay in responding to the IP-GROUP channel interruption event is 30 seconds.

     5. Run ip-group service timer up-delay interval

        A delay in responding to the IP-GROUP channel Up event is configured.

        By default, the delay in responding to the IP-GROUP channel Up event is 30 seconds.

3. Configure a security group on the controller.
   

   When the controller delivers a UCL group name that is not supported by the switch, for example, this group name contains Chinese characters or special characters, the switch cannot parse the group name. A UCL group name that can be supported by the switch must be consistent with the value of group-name in the ucl-group group-index [ name group-name ] command, cannot be -, --, a, an, or any, and cannot contain any of the following characters: / \ : * ? " < > | @ ' %. Therefore, when configuring a UCL group name on the controller, do not use Chinese characters or special characters.

4. Configure group policies on the controller.
5. Save the configuration on the controller.
   

   Saving the configuration on a controller is similar to running the save command on the device, which saves all the device configurations (including security groups, access control policies, and QoS policies deployed on the controller) to the configuration file.

   If security groups, access control policies, and QoS policies are saved to the device's configuration file, these configurations can be directly restored from the configuration file after the device restarts, and do not need to be requested from the controller. Otherwise, user authentication fails after the device restarts because security groups, access control policies, and QoS policies are not deployed on the device.