You need to configure and maintain WLAN features and functions in different profiles. These WLAN profiles include regulatory domain profile, radio profile, VAP profile, AP system profile, AP wired port profile, WIDS profile, WDS profile, and Mesh profile. When configuring WLAN services, you need to set related parameters in the WLAN profiles and bind the profiles to the AP group or APs. Then the configuration is automatically delivered to and takes effect on the APs. WLAN profiles can reference one another; therefore, you need to know the relationships among the profiles before configuring them. For details about the profile relationships and their basic configuration procedure, see WLAN Service Configuration Procedure.
Enterprise users can access the network through WLANs, which is the basic requirement of mobile office. Furthermore, users' services are not affected during roaming in the coverage area. On a traditional WLAN, users need to manually select an SSID and set authentication information to access the WLAN, causing poor user experience. To enhance user experience, Hotspot 2.0 services are deployed using a subscriber identity module (SIM) card for authentication. In this way, users can access the WLAN automatically without awareness.
Item |
Data |
---|---|
Management VLAN for APs |
VLAN 100 |
Service VLAN for STAs |
VLAN 101 |
DHCP server |
The AC functions as a DHCP server to assign IP addresses to APs and STAs. The aggregation switch (Switch_B) functions as a DHCP server to assign IP addresses to STAs. The default gateway address of STAs is 10.23.101.2. |
IP address pool for APs |
10.23.100.2-10.23.100.254/24 |
IP address pool for STAs |
10.23.101.3-10.23.101.254/24 |
AC's source interface address |
VLANIF 100: 10.23.101.1/24 |
AP group |
|
SSID profile |
|
Security profile |
|
Authentication profile |
|
Hotspot 2.0 profile |
Hotspot 2.0 profile
|
VAP profile |
|
RADIUS server |
|
For details about common WLAN configuration notes, see General Precautions for WLAN. For more deployment and configuration suggestions, see Wireless Network Deployment and Configuration Suggestions.
Configure port isolation on the interfaces of the device directly connected to APs. If port isolation is not configured and direct forwarding is used, a large number of unnecessary broadcast packets may be generated in the VLAN, blocking the network and degrading user experience.
In tunnel forwarding mode, the management VLAN and service VLAN cannot be the same. Only packets from the management VLAN are transmitted between the AC and APs. Packets from the service VLAN are not allowed between the AC and APs.
<HUAWEI> system-view [HUAWEI] authentication unified-mode
If the NAC mode is changed from traditional to unified, the unified mode takes effect after you save the configuration and restart the device.
<HUAWEI> system-view [HUAWEI] sysname SwitchA [SwitchA] vlan batch 100 101 [SwitchA] interface gigabitethernet 0/0/1 [SwitchA-GigabitEthernet0/0/1] port link-type trunk [SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100 [SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101 [SwitchA-GigabitEthernet0/0/1] port-isolate enable [SwitchA-GigabitEthernet0/0/1] quit [SwitchA] interface gigabitethernet 0/0/2 [SwitchA-GigabitEthernet0/0/2] port link-type trunk [SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101 [SwitchA-GigabitEthernet0/0/2] quit
<HUAWEI> system-view [HUAWEI] sysname SwitchB [SwitchB] vlan batch 100 101 [SwitchB] interface gigabitethernet 0/0/1 [SwitchB-GigabitEthernet0/0/1] port link-type trunk [SwitchB-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101 [SwitchB-GigabitEthernet0/0/1] quit [SwitchB] interface gigabitethernet 0/0/2 [SwitchB-GigabitEthernet0/0/2] port link-type trunk [SwitchB-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 [SwitchB-GigabitEthernet0/0/2] quit [SwitchB] interface gigabitethernet 0/0/3 [SwitchB-GigabitEthernet0/0/3] port link-type trunk [SwitchB-GigabitEthernet0/0/3] port trunk allow-pass vlan 101 [SwitchB-GigabitEthernet0/0/3] quit
<Huawei> system-view [Huawei] sysname Router [Router] vlan batch 101 [Router] interface gigabitethernet 1/0/0 [Router-GigabitEthernet1/0/0] port link-type trunk [Router-GigabitEthernet1/0/0] port trunk allow-pass vlan 101 [Router-GigabitEthernet1/0/0] quit [Router] interface vlanif 101 [Router-Vlanif101] ip address 10.23.101.2 24 [Router-Vlanif101] quit
If the AC and APs are directly connected, set the default VLAN of the interfaces connected to the APs to management VLAN 100.
<HUAWEI> system-view [HUAWEI] sysname AC [AC] vlan batch 100 101 [AC] interface gigabitethernet 0/0/1 [AC-GigabitEthernet0/0/1] port link-type trunk [AC-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 [AC-GigabitEthernet0/0/1] quit
[AC] dhcp enable [AC] interface vlanif 100 [AC-Vlanif100] ip address 10.23.100.1 24 [AC-Vlanif100] dhcp select interface [AC-Vlanif100] quit
[SwitchB] dhcp enable [SwitchB] interface vlanif 101 [SwitchB-Vlanif101] ip address 10.23.101.1 24 [SwitchB-Vlanif101] dhcp select interface [SwitchB-Vlanif101] dhcp server gateway-list 10.23.101.2 [SwitchB-Vlanif101] quit
[AC] wlan [AC-wlan-view] ap-group name ap-group1 [AC-wlan-ap-group-ap-group1] quit
[AC-wlan-view] regulatory-domain-profile name default [AC-wlan-regulate-domain-default] country-code cn [AC-wlan-regulate-domain-default] quit [AC-wlan-view] ap-group name ap-group1 [AC-wlan-ap-group-ap-group1] regulatory-domain-profile default Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y [AC-wlan-ap-group-ap-group1] quit [AC-wlan-view] quit
[AC] capwap source interface vlanif 100
The default AP authentication mode is MAC address authentication. If the default settings are retained, you do not need to run the ap auth-mode mac-auth command.
In this example, the AP5030DN is used and has two radios: radio 0 (2.4 GHz radio) and radio 1 (5 GHz radio).
[AC] wlan [AC-wlan-view] ap auth-mode mac-auth [AC-wlan-view] ap-id 0 ap-mac 60de-4476-e360 [AC-wlan-ap-0] ap-name area_1 Warning: This operation may cause AP reset. Continue? [Y/N]:y [AC-wlan-ap-0] ap-group ap-group1 Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y [AC-wlan-ap-0] quit
[AC-wlan-view] display ap all
Total AP information:
nor : normal [1]
Extrainfo : Extra information
P : insufficient power supply
--------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime ExtraInfo
--------------------------------------------------------------------------------------------------
0 60de-4476-e360 area_1 ap-group1 10.23.100.254 AP5030DN nor 0 10S -
--------------------------------------------------------------------------------------------------
Total: 1
[AC-wlan-view] security-profile name wlan-net [AC-wlan-sec-prof-wlan-net] security wpa2 dot1x aes [AC-wlan-sec-prof-wlan-net] quit
[AC-wlan-view] ssid-profile name wlan-net [AC-wlan-ssid-prof-wlan-net] ssid wlan-net [AC-wlan-ssid-prof-wlan-net] quit
[AC-wlan-view] vap-profile name wlan-net [AC-wlan-vap-prof-wlan-net] forward-mode direct-forward [AC-wlan-vap-prof-wlan-net] service-vlan vlan-id 101 [AC-wlan-vap-prof-wlan-net] security-profile wlan-net [AC-wlan-vap-prof-wlan-net] ssid-profile wlan-net [AC-wlan-vap-prof-wlan-net] quit
[AC-wlan-view] ap-group name ap-group1 [AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0 [AC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1 [AC-wlan-ap-group-ap-group1] quit
Automatic channel and power calibration functions are enabled by default. The manual channel and power configurations take effect only when these two functions are disabled. The settings of the AP channel and power in this example are for reference only. You need to configure the AP channel and power based on the actual country code and network planning.
[AC-wlan-view] ap-id 0
[AC-wlan-ap-0] radio 0
[AC-wlan-radio-0/0] calibrate auto-channel-select disable
[AC-wlan-radio-0/0] calibrate auto-txpower-select disable
[AC-wlan-radio-0/0] channel 20mhz 6
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-0/0] eirp 127
[AC-wlan-radio-0/0] quit
[AC-wlan-ap-0] radio 1
[AC-wlan-radio-0/1] calibrate auto-channel-select disable
[AC-wlan-radio-0/1] calibrate auto-txpower-select disable
[AC-wlan-radio-0/1] channel 20mhz 149
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC-wlan-radio-0/1] eirp 127
[AC-wlan-radio-0/1] quit
[AC-wlan-ap-0] quit
[AC-wlan-view] quit [AC] radius-server template wlan-radius [AC-radius-wlan-radius] radius-server authentication 10.23.102.1 1812 [AC-radius-wlan-radius] radius-server shared-key cipher Huawei@123 [AC-radius-wlan-radius] radius-server retransmit 2 [AC-radius-wlan-radius] undo radius-server user-name domain-included [AC-radius-wlan-radius] quit
[AC] aaa [AC-aaa] authentication-scheme wlan-authen [AC-aaa-authen-wlan-authen] authentication-mode radius local [AC-aaa-authen-wlan-authen] quit [AC-aaa] quit
[AC] aaa [AC-aaa] domain huawei.com [AC-aaa-domain-huawei.com] radius-server wlan-radius [AC-aaa-domain-huawei.com] authentication-scheme wlan-authen [AC-aaa-domain-huawei.com] quit [AC-aaa] quit
[AC] dot1x-access-profile name wlan-net [AC-dot1x-access-profile-wlan-net] dot1x authentication-method eap [AC-dot1x-access-profile-wlan-net] quit
[AC] authentication-profile name wlan-net [AC-authentication-profile-wlan-net] dot1x-access-profile wlan-net [AC-authentication-profile-wlan-net] access-domain huawei.com dot1x force [AC-authentication-profile-wlan-net] quit
# Configure Hotspot 2.0 profile wlan-net based on the operator's network parameters. Ensure that the WPA2-802.1X authentication profile has been bound to the VAP profile.
[AC] wlan [AC-wlan-view] cellular-network-profile name wlan-net [AC-wlan-cellular-net-wlan-net] plmn-id 46000 [AC-wlan-cellular-net-wlan-net] quit [AC-wlan-view] connection-capability-profile name wlan-net [AC-wlan-co-cap-prof-wlan-net] connection-capability tcp-http on [AC-wlan-co-cap-prof-wlan-net] quit [AC-wlan-view] operator-name-profile name wlan-net [AC-wlan-wlan-op-name-prof-wlan-net] operator-friendly-name language-code eng name mobileA [AC-wlan-wlan-op-name-prof-wlan-net] quit [AC-wlan-view] operating-class-profile name wlan-net [AC-wlan-op-class-prof-wlan-net] operating-class-indication 81 [AC-wlan-op-class-prof-wlan-net] quit [AC-wlan-view] operator-domain-profile name wlan-net [AC-wlan-op-domain-prof-wlan-net] domain-name www.mobileA.com [AC-wlan-op-domain-prof-wlan-net] quit [AC-wlan-view] nai-realm-profile name wlan-net [AC-wlan-nai-realm-prof-wlan-net] nai-realm realm-name www.mobileA.com [AC-wlan-nai-realm-prof-wlan-net] quit [AC-wlan-view] venue-name-profile name wlan-net [AC-wlan-ve-na-prof-wlan-net] venue-name language-code eng name Coffee [AC-wlan-ve-na-prof-wlan-net] quit [AC-wlan-view] roaming-consortium-profile name wlan-net [AC-wlan-ro-co-prof-wlan-net] roaming-consortium-oi 50-6f-9a in-beacon [AC-wlan-ro-co-prof-wlan-net] quit [AC-wlan-view] hotspot2-profile name wlan-net [AC-wlan-hotspot2-prof-wlan-net] network-type public-free internet-access [AC-wlan-hotspot2-prof-wlan-net] undo p2p-cross-connect disable [AC-wlan-hotspot2-prof-wlan-net] venue-type group-code 1 type-code 13 [AC-wlan-hotspot2-prof-wlan-net] hessid 60de-4476-e360 [AC-wlan-hotspot2-prof-wlan-net] ipv4-address-avail available [AC-wlan-hotspot2-prof-wlan-net] ipv6-address-avail available [AC-wlan-hotspot2-prof-wlan-net] network-authen-type acceptance [AC-wlan-hotspot2-prof-wlan-net] cellular-network-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] connection-capability-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] operator-name-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] operating-class-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] operator-domain-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] nai-realm-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] venue-name-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] roaming-consortium-profile wlan-net [AC-wlan-hotspot2-prof-wlan-net] quit
[AC-wlan-view] vap-profile name wlan-net [AC-wlan-vap-prof-wlan-net] authentication-profile wlan-net Warning: This action may cause service interruption. Continue?[Y/N]y [AC-wlan-vap-prof-wlan-net] hotspot2-profile wlan-net Warning: This action may cause service interruption. Continue?[Y/N]y [AC-wlan-vap-prof-wlan-net] quit
The AC automatically delivers WLAN service configuration to the AP. After the service configuration is complete, run the display vap ssid wlan-net command. If Status in the command output is displayed as ON, the VAPs have been successfully created on AP radios.
[AC-wlan-view] display vap ssid wlan-net WID : WLAN ID -------------------------------------------------------------------------------- AP ID AP name RfID WID BSSID Status Auth type STA SSID -------------------------------------------------------------------------------- 0 area_1 0 1 60DE-4476-E360 ON WPA/WPA2-PSK 0 wlan-net 0 area_1 1 1 60DE-4476-E370 ON WPA/WPA2-PSK 0 wlan-net ------------------------------------------------------------------------------- Total: 2
Connect STAs to the WLAN with SSID wlan-net and enter the password a1234567. Run the display station ssid wlan-net command on the AC. The command output shows that the STAs are connected to the WLAN wlan-net.
[AC-wlan-view] display station ssid wlan-net Rf/WLAN: Radio ID/WLAN ID Rx/Tx: link receive rate/link transmit rate(Mbps) --------------------------------------------------------------------------------- STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP address --------------------------------------------------------------------------------- e019-1dc7-1e08 0 area_1 1/1 5G 11n 46/59 -68 101 10.23.101.254 --------------------------------------------------------------------------------- Total: 1 2.4G: 0 5G: 1
SwitchA configuration file
# sysname SwitchA # vlan batch 100 to 101 # interface GigabitEthernet0/0/1 port link-type trunk port trunk pvid vlan 100 port trunk allow-pass vlan 100 to 101 port-isolate enable group 1 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 to 101 # return
SwitchB configuration file
# sysname SwitchB # vlan batch 100 to 101 # dhcp enable # interface Vlanif101 ip address 10.23.101.1 255.255.255.0 dhcp select interface dhcp server gateway-list 10.23.101.2 # interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 100 to 101 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 # interface GigabitEthernet0/0/3 port link-type trunk port trunk allow-pass vlan 101 # return
Router configuration file
# sysname Router # vlan batch 101 # interface Vlanif101 ip address 10.23.101.2 255.255.255.0 # interface GigabitEthernet1/0/0 port link-type trunk port trunk allow-pass vlan 101 # return
AC configuration file
#
sysname AC
#
vlan batch 100 to 101
#
authentication-profile name wlan-net
dot1x-access-profile wlan-net
access-domain huawei.com dot1x force
#
dhcp enable
#
radius-server template wlan-radius
radius-server shared-key cipher %^%#Qm'::9R&'!ybA{8_>U.,$+k!BxwPmY}YUA+Q$&@C%^%#
radius-server authentication 10.23.102.1 1812 weight 80
radius-server retransmit 2
undo radius-server user-name domain-included
#
aaa
authentication-scheme wlan-authen
authentication-mode radius local
domain huawei.com
authentication-scheme wlan-authen
radius-server wlan-radius
#
interface Vlanif100
ip address 10.23.100.1 255.255.255.0
dhcp select interface
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 100
#
capwap source interface vlanif100
#
wlan
security-profile name wlan-net
security wpa2 dot1x aes
ssid-profile name wlan-net
ssid wlan-net
roaming-consortium-profile name wlan-net
roaming-consortium-oi 50-6f-9a in-beacon
operating-class-profile name wlan-net
operating-class-indication 81
cellular-network-profile name wlan-net
plmn-id 46000
connection-capability-profile name wlan-net
connection-capability tcp-http on
operator-domain-profile name wlan-net
domain-name www.mobileA.com
operator-name-profile name wlan-net
operator-friendly-name language-code eng name mobileA
venue-name-profile name wlan-net
venue-name language-code eng name Coffee
nai-realm-profile name wlan-net
nai-realm realm-name www.mobileA.com
hotspot2-profile name wlan-net
hessid 60de-4476-e360
network-type public-free internet-access
venue-type group-code 1 type-code 13
ipv4-address-avail available
ipv6-address-avail available
network-authen-type acceptance
cellular-network-profile wlan-net
connection-capability-profile wlan-net
operator-name-profile wlan-net
operator-domain-profile wlan-net
venue-name-profile wlan-net
nai-realm-profile wlan-net
operating-class-profile wlan-net
roaming-consortium-profile wlan-net
vap-profile name wlan-net
service-vlan vlan-id 101
ssid-profile wlan-net
security-profile wlan-net
authentication-profile wlan-net
hotspot2-profile wlan-net
regulatory-domain-profile name default
ap-group name ap-group1
radio 0
vap-profile wlan-net wlan 1
radio 1
vap-profile wlan-net wlan 1
ap-id 0 type-id 35 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
ap-name area_1
ap-group ap-group1
radio 0
channel 20mhz 6
eirp 127
calibrate auto-channel-select disable
calibrate auto-txpower-select disable
radio 1
channel 20mhz 149
eirp 127
calibrate auto-channel-select disable
calibrate auto-txpower-select disable
#
dot1x-access-profile name wlan-net
#
return