WLAN Security

Involved Network Elements

APs mentioned in this document are Huawei AP products. You are advised to use Huawei APs to connect to the AC.
You can run the display ap-type all command to check the default AP types supported by the device.
When central APs and RUs are used, ensure that their versions are the same. For example, if the central AP version is V200R007C10, the RU version must be V200R007C10.

**Table 1** Mapping between switch versions and AP versions
Product Software Version	AP Software Version
V200R019C10	V200R019C10 V200R019C00 V200R010C00 V200R009C00 V200R008C10 V200R008C00 V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R019C00	V200R019C00 V200R010C00 V200R009C00 V200R008C10 V200R008C00 V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R013C00	V200R010C00 V200R009C00 V200R008C10 V200R008C00 V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R012C00	V200R009C00 V200R008C10 V200R008C00 V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R011C10	V200R008C10 V200R008C00 V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R011C00	V200R007C20 V200R007C10 V200R006C20 V200R006C10
V200R010C00	V200R007C10 V200R006C20 V200R006C10
V200R009C00	V200R006C20 V200R006C10
V200R008C00	V200R005C30 V200R005C20 V200R005C10
V200R007	V200R005C20 V200R005C10
V200R006	V200R005C00

AAA server

Huawei servers such as the Policy Center and Agile Controller or third-party AAA servers perform authentication, accounting, and authorization on users.

Portal server

Huawei servers such as the Policy Center and Agile Controller or third-party Portal servers, receive authentication requests from Portal clients, provide free Portal services and a web authentication interface, and exchange authentication information of the authentication clients with access devices. This component is required only in Portal authentication mode.

Licensing Requirements

When the device is used as a WLAN AC, the number of online APs supported by the device is controlled by licenses. The device supports a maximum of 16 online APs. To increase the number of online APs supported by the device, apply for and purchase a license from the agent.

AP resource license-1AP for WLAN access controller
AP resource license-16AP for WLAN access controller
AP resource license-32AP for WLAN access controller
AP resource license-64AP for WLAN access controller
AP resource license-128AP for WLAN access controller
AP resource license-512AP for WLAN access controller

For details about how to apply for a license, see Obtaining Licenses in the S1720, S5700, and S6700 Series Switches License Usage Guide.

Feature Support in V200R019C10

This feature is supported only by the following models: S5720-HI, S5730-HI, S5731-H, S5731S-H, S5732-H, S6720-HI, S6730S-H, and S6730-H.

Feature Limitations

In Portal authentication scenarios, priorities of users in pre-connection state cannot be determined. These users are regarded as high-priority users and will not be disconnected when VIP users access the WLAN.
Preferential access of VIP users is applicable only to authentication users (such as Portal, MAC, and 802.1X authentication users), but not to non-authentication users (such as open and PSK authentication users) because these users cannot be identified as VIP users.
Offline APs do not support preferential access of VIP users.
Preferential access of VIP users does not take effect when the number of access users reaches the maximum.
Only downstream traffic of VIP users is preferentially scheduled.
Only 802.11ac Wave 2 APs support preferential scheduling for VIP user services.