MAC address authentication controls a user's network access rights based on their interface and MAC address. The user does not need to install any client software. The device starts authenticating a user when it first detects the user's MAC address on the interface where MAC address authentication has been enabled. During the authentication process, the user does not need to enter a user name or password.
In tunnel forwarding mode, the management VLAN and service VLAN cannot be the same. If you set the forwarding mode to direct forwarding, you are not advised to configure the management VLAN and service VLAN to be the same.
In direct forwarding mode, configure port isolation on the interface directly connected to APs. If port isolation is not configured, many broadcast packets will be transmitted in the VLANs or WLAN users on different APs can directly communicate at Layer 2.
Software Version |
Product Model |
AP Model and Version |
---|---|---|
V200R005C00 |
S7700, S9700 |
V200R005C00: AP2010DN, AP3010DN-AGN, AP5010DN-AGN, AP5010SN-GN, AP5030DN, AP5130DN, AP6010SN-GN, AP6010DN-AGN, AP6310SN-GN, AP6510DN-AGN, AP6610DN-AGN, AP7110DN-AGN, AP7110SN-GN |
V200R006C00 |
S5720-HI, S7700, S9700 |
V200R005C00: AP2010DN, AP3010DN-AGN, AP5010DN-AGN, AP5010SN-GN, AP5030DN, AP5130DN, AP6010SN-GN, AP6010DN-AGN, AP6310SN-GN, AP6510DN-AGN, AP6610DN-AGN, AP7110DN-AGN, AP7110SN-GN |
V200R007C00 |
S5720-HI, S7700, S9700 |
V200R005C10: AP2010DN, AP3010DN-AGN, AP5010DN-AGN, AP5010SN-GN, AP5030DN, AP5130DN, AP6010SN-GN, AP6010DN-AGN, AP6310SN-GN, AP6510DN-AGN, AP6610DN-AGN, AP7110DN-AGN, AP7110SN-GN, AP8030DN, AP8130DN V200R005C20: AP7030DE, AP9330DN |
V200R008C00 |
S5720-HI, S7700, S9700 |
V200R005C10: AP2010DN, AP3010DN-AGN, AP5010DN-AGN, AP5010SN-GN, AP5030DN, AP5130DN, AP6010SN-GN, AP6010DN-AGN, AP6310SN-GN, AP6510DN-AGN, AP6610DN-AGN, AP7110DN-AGN, AP7110SN-GN, AP8030DN, AP8130DN V200R005C20: AP7030DE, AP9330DN V200R005C30: AP2030DN, AP4030DN, AP4130DN |
For S7700, you are advised to deploy S7712 or S7706 switches for WLAN services. S7703 switches are not recommended.
For S9700, you are advised to deploy S9712 or S9706 switches for WLAN services. S9703 switches are not recommended.
As shown in Figure 1, the enterprise's AC connects to the egress gateway (Router) and RADIUS server, and connects to the AP through SwitchA. The WLAN with the SSID of test is available for wireless users and terminals to access network resources. The gateway also functions as a DHCP server to provide IP addresses on the 10.10.10.0/24 network segment for STAs, which are managed by the AC.
The WLAN authentication client cannot be installed on wireless devices providing public services, such as wireless printers and phones. For these devices, use MAC address authentication. The RADIUS server authenticates wireless devices using their MAC addresses. No authentication is required when STAs access the WLAN, facilitating the use of WLAN services.
Configuration Item |
Data |
---|---|
WLAN service |
Open system authentication+non-encryption |
Management VLAN |
VLAN 100 |
Service VLAN |
VLAN 101 |
Source interface on the AC |
VLANIF 100: 192.168.10.1/24 |
AC carrier ID/AC ID |
Other/1 |
AP region ID |
10 |
Service set |
|
SwitchA VLAN |
VLAN 100 |
DHCP server |
|
Gateway for the AP |
VLANIF 100: 192.168.10.1/24 |
Gateway for STAs |
VLANIF 101: 10.10.10.1/24 |
RADIUS authentication parameters |
|
MAC address of a STA |
0011-2233-4455 |
The configuration roadmap is as follows:
# Add GE0/0/1 that connects SwitchA to the AP and GE0/0/2 that connects SwitchA to the AC to the management VLAN 100.
<HUAWEI> system-view [HUAWEI] sysname SwitchA [SwitchA] vlan batch 100 [SwitchA] interface gigabitethernet 0/0/1 [SwitchA-GigabitEthernet0/0/1] port link-type trunk [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100 [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [SwitchA-GigabitEthernet0/0/1] quit [SwitchA] interface gigabitethernet 0/0/2 [SwitchA-GigabitEthernet0/0/2] port link-type trunk [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 [SwitchA-GigabitEthernet0/0/2] quit
# Add GE1/0/1 that connects the AC to SwitchA to VLAN 100.
<HUAWEI> system-view [HUAWEI] sysname AC [AC] vlan batch 100 101 [AC] interface gigabitethernet 1/0/1 [AC-GigabitEthernet1/0/1] port link-type trunk [AC-GigabitEthernet1/0/1] port trunk allow-pass vlan 100 [AC-GigabitEthernet1/0/1] quit
# Configure VLANIF 101 (service VLAN), VLANIF 102, and VLANIF 103.
[AC] vlan batch 101 102 103 [AC] interface vlanif 101 [AC-Vlanif101] ip address 10.10.10.1 24 [AC-Vlanif101] quit [AC] interface vlanif 102 [AC-Vlanif102] ip address 10.11.10.2 24 [AC-Vlanif102] quit [AC] interface vlanif 103 [AC-Vlanif103] ip address 10.12.10.2 24 [AC-Vlanif103] quit
# Add GE1/0/2 that connects the AC to the Router to VLAN 102.
[AC] interface gigabitethernet 1/0/2 [AC-GigabitEthernet1/0/2] port link-type trunk [AC-GigabitEthernet1/0/2] port trunk allow-pass vlan 102 [AC-GigabitEthernet1/0/2] quit
# Add GE1/0/2 that connects the AC to the RADIUS server to VLAN 103.
[AC] interface gigabitethernet 1/0/3 [AC-GigabitEthernet1/0/3] port link-type trunk [AC-GigabitEthernet1/0/3] port trunk allow-pass vlan 103 [AC-GigabitEthernet1/0/3] quit
# On the AC, configure a static route.
[AC] ip route-static 0.0.0.0 0.0.0.0 10.11.10.1
# Configure the AC to assign an IP address to the AP from an interface IP address pool.
[AC] dhcp enable
[AC] interface vlanif 100
[AC-Vlanif100] ip address 192.168.10.1 24
[AC-Vlanif100] dhcp select interface //Configure an interface-based address pool.
[AC-Vlanif100] quit
# Configure the AC as the DHCP relay agent and enable user entry detection on the AC.
[AC] interface vlanif 101 [AC-Vlanif101] dhcp select relay //Configure the DHCP relay function. [AC-Vlanif101] dhcp relay server-ip 10.11.10.1 //Set the DHCP server address for DHCP relay to 10.11.10.1, which resides on Router. [AC-Vlanif101] quit
# Configure the Router as a DHCP server to assign IP addresses to STAs.
<Huawei> system-view [Huawei] sysname Router [Router] dhcp enable [Router] ip pool sta //Configure the address pool to assign IP addresses to STAs. [Router-ip-pool-sta] gateway-list 10.10.10.1 [Router-ip-pool-sta] network 10.10.10.0 mask 24 [Router-ip-pool-sta] quit [Router] vlan batch 102 [Router] interface vlanif 102 [Router-Vlanif102] ip address 10.11.10.1 24 [Router-Vlanif102] dhcp select global //Configure a global address pool. [Router-Vlanif102] quit [Router] interface gigabitethernet 2/0/0 [Router-GigabitEthernet2/0/0] port link-type trunk [Router-GigabitEthernet2/0/0] port trunk allow-pass vlan 102 [Router-GigabitEthernet2/0/0] quit [Router] ip route-static 10.10.10.0 24 10.11.10.2 //Configure a route on the Router destined for the network segment 10.10.10.0/24.
# Configure the country code.
[AC] wlan ac-global country-code cn
Warning: Modify the country code may delete configuration on those AP which use
the global country code and reset them, continue?[Y/N]:y
# Configure the AC ID and carrier ID.
[AC] wlan ac-global ac id 1 carrier id other //The default AC ID is 0. Set the AC ID to 1.
# Configure the source interface.
[AC] wlan [AC-wlan-view] wlan ac source interface vlanif 100
# Check the AP type ID after obtaining the MAC address of the AP.
[AC-wlan-view] display ap-type all
All AP types information:
------------------------------------------------------------------------------
ID Type
------------------------------------------------------------------------------
17 AP6010SN-GN
19 AP6010DN-AGN
21 AP6310SN-GN
23 AP6510DN-AGN
25 AP6610DN-AGN
27 AP7110SN-GN
28 AP7110DN-AGN
29 AP5010SN-GN
30 AP5010DN-AGN
31 AP3010DN-AGN
33 AP6510DN-AGN-US
34 AP6610DN-AGN-US
35 AP5030DN
36 AP5130DN
37 AP7030DE
38 AP2010DN
39 AP8130DN
40 AP8030DN
42 AP9330DN
43 AP4030DN
44 AP4130DN
45 AP3030DN
46 AP2030DN
------------------------------------------------------------------------------
Total number: 23
# Set the AP authentication mode to MAC address authentication (default setting). Add the AP offline based on the AP type ID. Assume that the AP type is AP6010DN-AGN, and the MAC address of the AP is 60de-4476-e360.
[AC-wlan-view] ap id 0 type-id 19 mac 60de-4476-e360 [AC-wlan-ap-0] quit
# Configure an AP region and add the AP to the AP region.
[AC-wlan-view] ap-region id 10 //Create AP region 10. [AC-wlan-ap-region-10] quit [AC-wlan-view] ap id 0 [AC-wlan-ap-0] region-id 10 //Add AP to region 10. [AC-wlan-ap-0] quit
# Power on the APs and run the display ap all command on the AC to check the AP running status. The command output shows that the AP status is normal.
[AC-wlan-view] display ap all
All AP information:
Normal[1],Fault[0],Commit-failed[0],Committing[0],Config[0],Download[0]
Config-failed[0],Standby[0],Type-not-match[0],Ver-mismatch[0]
------------------------------------------------------------------------------
AP AP AP Profile AP AP
/Region
ID Type MAC ID State Sysname
------------------------------------------------------------------------------
0 AP6010DN-AGN 60de-4476-e360 0/10 normal ap-0
------------------------------------------------------------------------------
Total number: 1,printed: 1
# Create a WMM profile named wmm.
[AC-wlan-view] wmm-profile name wmm id 1 [AC-wlan-wmm-prof-wmm] quit
# Create a radio profile named radio and bind the WMM profile wmm to the radio profile.
[AC-wlan-view] radio-profile name radio id 1 [AC-wlan-radio-prof-radio] wmm-profile name wmm [AC-wlan-radio-prof-radio] quit [AC-wlan-view] quit
# Create WLAN-ESS interface 1.
[AC] interface wlan-ess 1 [AC-Wlan-Ess1] port trunk allow-pass vlan 101 [AC-Wlan-Ess1] quit
# Create a security profile named security.
[AC] wlan [AC-wlan-view] security-profile name security id 1 [AC-wlan-sec-prof-security] quit
# Create a traffic profile named traffic.
[AC-wlan-view] traffic-profile name traffic id 1 [AC-wlan-traffic-prof-traffic] quit
# Create a service set named test and bind the WLAN-ESS interface, security profile, and traffic profile to the service set.
[AC-wlan-view] service-set name test id 1 [AC-wlan-service-set-test] ssid test //Set the SSID name to test. [AC-wlan-service-set-test] wlan-ess 1 [AC-wlan-service-set-test] security-profile name security [AC-wlan-service-set-test] traffic-profile name traffic [AC-wlan-service-set-test] service-vlan 101 //Set the VLAN ID of the service set to 101. The default value is 1. [AC-wlan-service-set-test] forward-mode tunnel //Set the forwarding mode to tunnel forwarding. [AC-wlan-service-set-test] quit
[AC-wlan-view] quit [AC] interface wlan-ess 1 [AC-Wlan-Ess1] authentication mac-authen [AC-Wlan-Ess1] domain name huawei.com force [AC-Wlan-Ess1] permit-domain name huawei.com [AC-Wlan-Ess1] quit [AC] wlan
# Configure a VAP.
[AC-wlan-view] ap 0 radio 0 [AC-wlan-radio-0/0] radio-profile name radio //Bind the radio template to a radio. [AC-wlan-radio-0/0] service-set name test //Bind the service set to the radio. [AC-wlan-radio-0/0] quit
# Commit the configuration.
[AC-wlan-view] commit ap 0
Warning: Committing configuration may cause service interruption, continue?[Y/N]y
SwitchA configuration file
# sysname SwitchA # vlan batch 100 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 # return
Router configuration file
# sysname Router # vlan batch 102 # dhcp enable # ip pool sta gateway-list 10.10.10.1 network 10.10.10.0 mask 255.255.255.0 # interface Vlanif102 ip address 10.11.10.1 255.255.255.0 dhcp select global # interface GigabitEthernet2/0/0 port link-type trunk port trunk allow-pass vlan 102 # ip route-static 10.10.10.0 255.255.255.0 10.11.10.2 # return
AC configuration file
# sysname AC # vlan batch 100 to 103 # wlan ac-global carrier id other ac id 1 # dhcp enable # radius-server template radius_huawei radius-server authentication 10.12.10.1 1812 weight 80 radius-server shared-key cipher %@%@hH67%f}f8X"AE&Pw`wS~{:;0%@%@ undo radius-server user-name domain-included # aaa authentication-scheme radius_huawei authentication-mode radius domain huawei.com authentication-scheme radius_huawei radius-server radius_huawei # interface Vlanif100 ip address 192.168.10.1 255.255.255.0 dhcp select interface # interface Vlanif101 ip address 10.10.10.1 255.255.255.0 dhcp select relay dhcp relay server-ip 10.11.10.1 # interface Vlanif102 ip address 10.11.10.2 255.255.255.0 # interface Vlanif103 ip address 10.12.10.2 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 100 # interface GigabitEthernet1/0/2 port link-type trunk port trunk allow-pass vlan 102 # interface GigabitEthernet1/0/3 port link-type trunk port trunk allow-pass vlan 103 # interface WLAN-ESS1 port trunk allow-pass vlan 101 authentication mac-authen permit-domain name huawei.com domain name huawei.com force # wlan wlan ac source interface vlanif100 ap-region id 10 ap id 0 type-id 19 mac 60de-4476-e360 sn 210235419610CB002287 region-id 10 wmm-profile name wmm id 1 traffic-profile name traffic id 1 security-profile name security id 1 service-set name test id 1 forward-mode tunnel wlan-ess 1 ssid test traffic-profile id 1 security-profile id 1 service-vlan 101 radio-profile name radio id 1 wmm-profile id 1 ap 0 radio 0 radio-profile id 1 service-set id 1 wlan 1 # return