华为综合案例-普通WLAN全覆盖配置（2）

作者：繁依Fanyi0 | 2024-03-21 06:58:53

踩

组网图

结果验证


在AC_1和AC_2上执行display ap all命令，检查当前AP的状态，显示以下信息表示AP上线成功。
 
 
[AC_1] display ap all
Total AP information:
nor  : normal          [1]
ExtraInfo : Extra information
P  : insufficient power supply
----------------------------------------------------------------------------------------------------
ID   MAC            Name   Group     IP              Type            State STA Uptime      ExtraInfo
----------------------------------------------------------------------------------------------------
0    60de-4476-e360 AP_1   wlan_net    10.128.1.254    AP6050DN        nor   0   10S         -
----------------------------------------------------------------------------------------------------
Total: 1
 
 
在AC_1和AC_2上执行display hsb-service 0命令，查看主备服务的建立情况，可以看到Service State字段的显示为Connected，说明主备服务通道已经成功建立。
 
 
[AC_1] display hsb-service 0
Hot Standby Service Information:
----------------------------------------------------------
  Local IP Address       : 10.1.1.253
  Peer IP Address        : 10.1.1.254
  Source Port            : 10241
  Destination Port       : 10241
  Keep Alive Times       : 5
  Keep Alive Interval    : 3
  Service State          : Connected
  Service Batch Modules  : Access-user
  Shared-key             : -
----------------------------------------------------------
[AC_2] display hsb-service 0 
Hot Standby Service Information:
----------------------------------------------------------
  Local IP Address       : 10.1.1.254
  Peer IP Address        : 10.1.1.253
  Source Port            : 10241
  Destination Port       : 10241
  Keep Alive Times       : 5
  Keep Alive Interval    : 3
  Service State          : Connected
  Service Batch Modules  : Access-user
  Shared-key             : -
----------------------------------------------------------
 
 
在AC_1和AC_2上执行display hsb-group 0命令，查看HSB备份组的运行情况。
 
 
[AC_1] display hsb-group 0 
Hot Standby Group Information:
----------------------------------------------------------
  HSB-group ID                : 0
  Vrrp Group ID               : 1
  Vrrp Interface              : Vlanif800
  Service Index               : 0
  Group Vrrp Status           : Master
  Group Status                : Active
  Group Backup Process        : Realtime
  Peer Group Device Name      : AC6805
  Peer Group Software Version : V200R010C00
  Group Backup Modules        : Access-user
                                AP
                                DHCP
----------------------------------------------------------
[AC_2] display hsb-group 0 
Hot Standby Group Information:
----------------------------------------------------------
  HSB-group ID                : 0
  Vrrp Group ID               : 1
  Vrrp Interface              : Vlanif800
  Service Index               : 0
  Group Vrrp Status           : Backup
  Group Status                : Inactive
  Group Backup Process        : Realtime
  Peer Group Device Name      : AC6805
  Peer Group Software Version : V200R010C00
  Group Backup Modules        : Access-user
                                AP
                                DHCP
----------------------------------------------------------
 
 
用户是否能够通过RADIUS模板的认证。（已在RADIUS服务器上配置了测试用户test@huawei.com，用户密码123456）。
 
 
[AC_1] test-aaa test@huawei.com 123456 radius-template radius_huawei 
Info: Account test succeed.

完成配置后，用户可通过无线终端搜索到SSID为wlan_net的无线网络，用户关联到无线网络上后，无线终端能够被分配相应的IP地址。STA上打开浏览器访问Internet，自动跳转到Portal服务器提供的页面，在页面上输入正确的用户名(test@huawei.com)和密码(123456)，认证通过后可以正常访问Internet。
用户使用手机可以正常使用漫游业务。

配置脚本


 
AC_1和AC_2的配置文件对比（加粗内容为AC_1和AC_2上的双机备份配置和无线配置同步配置，斜体内容为AC_1自动同步到AC_2的公有配置）
 
AC_1
 
AC_2
 
#
 sysname AC_1
#
radius-server source ip-address 172.16.1.1
#
vrrp recover-delay 60
#
vlan batch 700 to 701 800 810 820
#
authentication-profile name wlan_net_dot1x_auth
 dot1x-access-profile huawei
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
authentication-profile name wlan_net_portal_auth
 mac-access-profile mac
 portal-access-profile wlan_net
 free-rule-template default_free_rule
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
#
web-auth-server source-ip 172.16.1.1
#
dhcp enable
#
dhcp snooping enable
#
vlan 700
 description wlan_net
 dhcp snooping enable
vlan 701
 description wlan_net
 dhcp snooping enable
vlan 800
 description AP-management-vlan
#
radius-server template radius_huawei
 radius-server shared-key cipher %^%#b@)bNet)(Z)!N9T>p8kM(8w/N&3\>!KKg=DO<!R+%^%#
 radius-server authentication 172.16.1.254 1812 weight 80
 radius-server accounting 172.16.1.254 1813 weight 80
 radius-server timeout 1
radius-server authorization 172.16.1.254 shared-key cipher %^%#M"yY$,}"a8U12iTP4:u6nI-;9G/!eH`FJ:UePsB,%^%# 
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.253 mask 255.255.255.255
#
url-template name huawei
 url http://172.16.1.254:8080/portal
 url-parameter ssid ssid redirect-url url
#
web-auth-server huawei
 server-ip 172.16.1.254
 port 50200
 shared-key cipher %^%#6/j36uiW:M7dx'"L*2M*TN~P7t*K0(w9'=ER4bZ"%^%#
 url-template huawei
#
portal-access-profile name wlan_net
 web-auth-server huawei direct
#
aaa
 authentication-scheme radius_huawei
  authentication-mode radius
 accounting-scheme radius_huawei
  accounting-mode radius
  accounting realtime 15
#
interface Vlanif800
 ip address 10.128.1.2 255.255.255.0
 vrrp vrid 1 virtual-ip 10.128.1.1
 admin-vrrp vrid 1
 vrrp vrid 1 priority 120
 vrrp vrid 1 preempt-mode timer delay 1200
 dhcp select interface
 dhcp server excluded-ip-address 10.128.1.1 10.128.1.3 
#
interface Vlanif810
 ip address 10.1.1.253 255.255.255.252
#
interface Vlanif820
 ip address 172.16.1.2 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.1
 vrrp vrid 2 track admin-vrrp interface Vlanif800 vrid 1 unflowdown
#
interface GigabitEthernet0/0/23
 description Connect to AC_2_0/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 800 810 820
#
interface GigabitEthernet0/0/24
 description Connect to S12700_A_1/1/0/20
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 700 to 701 800 820
#
capwap source ip-address 10.128.1.1
#
hsb-service 0
 service-ip-port local-ip 10.1.1.253 peer-ip 10.1.1.254 local-data-port 10241 peer-data-port 10241
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif800
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
wlan
 traffic-profile name wlan_net
  user-isolate l2
 security-profile name open
  security open
 security-profile name dot1x
  security wpa2 dot1x aes
 ssid-profile name wlan_net_portal_auth
  ssid wlan_net_portal_auth
 ssid-profile name wlan_net_dot1x_auth
  ssid wlan_net_dot1x_auth
  dot11r enable
 vap-profile name wlan_net_portal_auth
  service-vlan vlan-id 700
  ssid-profile wlan_net_portal_auth
  security-profile open
  traffic-profile wlan_net
  authentication-profile wlan_net_portal_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 vap-profile name wlan_net_dot1x_auth
  service-vlan vlan-id 701
  ssid-profile wlan_net_dot1x_auth
  security-profile dot1x
  traffic-profile wlan_net
  authentication-profile wlan_net_dot1x_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 radio-2g-profile name 2G
 radio-5g-profile name 5G
 port-link-profile name default
 ap-group name wlan_net
  radio 0
   radio-2g-profile 2G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 1
   radio-5g-profile 5G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 2
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
 ap-id 1 ap-mac 60de-4476-e360
  ap-name AP_1
  ap-group wlan_net
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif800
  master-redundancy peer-ip ip-address 10.1.1.254 local-ip ip-address 10.1.1.253 psk %^%#HdgY%JtWL>H[k@Rs~<-)6,u4A&I1e5mO%jVwv~*N%^%#
#
dot1x-access-profile name huawei
#
mac-access-profile name mac
#
return
#
 sysname AC_2
#
radius-server source ip-address 172.16.1.1
#
vrrp recover-delay 60
#
vlan batch 700 to 701 800 810 820
#
authentication-profile name wlan_net_dot1x_auth
 dot1x-access-profile huawei
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
authentication-profile name wlan_net_portal_auth
 mac-access-profile mac
 portal-access-profile wlan_net
 free-rule-template default_free_rule
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
#
web-auth-server source-ip 172.16.1.1
#
dhcp enable
#
dhcp snooping enable
#
vlan 700
 description wlan_net
 dhcp snooping enable
vlan 701
 description wlan_net
 dhcp snooping enable
vlan 800
 description AP-management-vlan
#
radius-server template radius_huawei
 radius-server shared-key cipher %^%#b@)bNet)(Z)!N9T>p8kM(8w/N&3\>!KKg=DO<!R+%^%#
 radius-server authentication 172.16.1.254 1812 weight 80
 radius-server accounting 172.16.1.254 1813 weight 80
 radius-server timeout 1
radius-server authorization 172.16.1.254 shared-key cipher %^%#M"yY$,}"a8U12iTP4:u6nI-;9G/!eH`FJ:UePsB,%^%# 
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.253 mask 255.255.255.255
#
url-template name huawei
 url http://172.16.1.254:8080/portal
 url-parameter ssid ssid redirect-url url
#
web-auth-server huawei
 server-ip 172.16.1.254
 port 50200
 shared-key cipher %^%#6/j36uiW:M7dx'"L*2M*TN~P7t*K0(w9'=ER4bZ"%^%#
 url-template huawei
#
portal-access-profile name wlan_net
 web-auth-server huawei direct
#
aaa
 authentication-scheme radius_huawei
  authentication-mode radius
 accounting-scheme radius_huawei
  accounting-mode radius
  accounting realtime 15
#
interface Vlanif800
 ip address 10.128.1.3 255.255.255.0
 vrrp vrid 1 virtual-ip 10.128.1.1
 admin-vrrp vrid 1
 dhcp select interface
 dhcp server excluded-ip-address 10.128.1.1 10.128.1.3 
#
interface Vlanif810
 ip address 10.1.1.254 255.255.255.252
#
interface Vlanif820
 ip address 172.16.1.3 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.1
 vrrp vrid 2 track admin-vrrp interface Vlanif800 vrid 1 unflowdown
#
interface GigabitEthernet0/0/23
 description Connect to AC_1_0/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 800 810 820
#
interface GigabitEthernet0/0/24
 description Connect to S12700_B_2/1/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 700 to 701 800 820
#
capwap source ip-address 10.128.1.1
#
hsb-service 0
 service-ip-port local-ip 10.1.1.254 peer-ip 10.1.1.253 local-data-port 10241 peer-data-port 10241
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif800
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
wlan
 traffic-profile name wlan_net
  user-isolate l2
 security-profile name open
  security open
 security-profile name dot1x
  security wpa2 dot1x aes
 ssid-profile name wlan_net_portal_auth
  ssid wlan_net_portal_auth
 ssid-profile name wlan_net_dot1x_auth
  ssid wlan_net_dot1x_auth
  dot11r enable
 vap-profile name wlan_net_portal_auth
  service-vlan vlan-id 700
  ssid-profile wlan_net_portal_auth
  security-profile open
  traffic-profile wlan_net
  authentication-profile wlan_net_portal_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 vap-profile name wlan_net_dot1x_auth
  service-vlan vlan-id 701
  ssid-profile wlan_net_dot1x_auth
  security-profile dot1x
  traffic-profile wlan_net
  authentication-profile wlan_net_dot1x_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 radio-2g-profile name 2G
 radio-5g-profile name 5G
 port-link-profile name default
 ap-group name wlan_net
  radio 0
   radio-2g-profile 2G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 1
   radio-5g-profile 5G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 2
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
 ap-id 1 ap-mac 60de-4476-e360
  ap-name AP_1
  ap-group wlan_net
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif800
  master-redundancy peer-ip ip-address 10.1.1.253 local-ip ip-address 10.1.1.254 psk %^%#>j6VS_;z=54_*oRNpd<<'_-8DRj,,Y!T~_,Z$4yI%^%#
#
dot1x-access-profile name huawei
#
mac-access-profile name mac
#
return
集群系统
#
sysname CSS
#
vlan batch 730 800 820
#
interface Eth-Trunk1                                                                                           
 description Connect to S7700_Eth-Trunk1
 port link-type trunk  
 undo port trunk allow-pass vlan 1  
 port trunk allow-pass vlan 730 800
#
interface GigabitEthernet1/1/0/19
 eth-trunk 1
#
interface GigabitEthernet1/1/0/20
 description Connect to AC_1_0/0/24
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800 820
#
interface GigabitEthernet1/1/0/21
 description Connect to Router_0/0/29
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 820
#
interface GigabitEthernet1/1/1/7
 mad detect mode direct
#
interface GigabitEthernet2/1/0/18
 description Connect to Router_0/0/30
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 820
#
interface GigabitEthernet2/1/0/22
 eth-trunk 1
#
interface GigabitEthernet2/1/0/23
 description Connect to AC_2_0/0/24
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800 820
#
interface GigabitEthernet2/1/1/7
  mad detect mode direct
#
return
S7700
#
sysname S7700
#
vlan batch 730 800
#
interface Eth-Trunk1
 description Connect to S12700_Eth-Trunk1                                              
 port link-type trunk                                                            
 undo port trunk allow-pass vlan 1                                               
 port trunk allow-pass vlan 730 800 
#
interface Vlanif730
 ip address 10.173.1.1 255.255.252.0
 dhcp select relay
 dhcp relay server-ip 172.16.1.252
#
interface GigabitEthernet1/0/3
 description Connect to S5700_A_0/0/3
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
#
interface GigabitEthernet1/0/17
 eth-trunk 1
#
interface GigabitEthernet2/0/18
 eth-trunk 1
#
return
S5700_A
#
sysname S5700_A
#
vlan batch 730 800
#
traffic classifier huawei 
if-match destination-mac 0100-5e00-0000 mac-address-mask ffff-ff00-0000
#
traffic behavior huawei 
statistic enable
car cir 100 
#
traffic policy huawei
classifier huawei behavior huawei
#
lldp enable
#
interface GigabitEthernet0/0/1
 description Connect to AP_1
 port link-type trunk
 port trunk pvid vlan 800 
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
 port-isolate enable group 1 
 stp edged-port enable 
 traffic-policy huawei inbound
 traffic-policy huawei outbound
#
interface GigabitEthernet0/0/2
 description Connect to AP_2
 port link-type trunk
 port trunk pvid vlan 800
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
 port-isolate enable group 1 
 stp edged-port enable 
 traffic-policy huawei inbound
 traffic-policy huawei outbound
#
interface GigabitEthernet0/0/3
 description Connect to S7700_1/0/3
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
#
return
父主题： 综合案例-普通WLAN覆盖
版权所有 © 华为技术有限公司
< 上一节下一节 >

场景化推荐配置

大广播域场景下的流量优化

在企业与园区场景中，通常采用单个大型子网的设计。单个大型子网简化了VLAN的配置、没有繁杂的漫游配置、故障定位简单。但是，单个大型子网使用大广播域，带来了大量报文复制发送、CPU使用率过高等问题。

通过将广播报文转单播处理、抑制未知单播、对AP多播报文进行限速等方法降低CPU处理量，以支撑大广播域场景。

# 打开mDNS单播应答功能。AC作为mDNS网关，对于mDNS服务请求报文，由AC进行服务单播代答。进而减少AC的复制流程。（缺省关闭，推荐开启）

<AC6805> system-view
[AC6805] mdns unicast-reply enable

# 打开IGMP Snooping功能和丢弃VLAN内收到的未知组播流功能。当主机和上游三层设备之间传递的IGMP协议报文通过二层组播设备时，IGMP Snooping分析报文携带的信息，根据这些信息建立和维护二层组播转发表，从而指导组播数据在数据链路层按需转发。（缺省关闭，推荐开启）


 
<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] igmp-snooping enable
[AC6805-wlan-traffic-prof-default] quit
[AC6805-wlan-view] quit
[AC6805] vlan 10 
[AC6805-vlan10] multicast drop-unknown
# 打开ARP/ND/DHCP报文转单播处理功能。（缺省开启，推荐开启）
 
<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] traffic-optimize bcmc unicast-send arp nd dhcp
# 打开ARP/ND/DHCP抑制功能。当空口广播或组播协议报文转为单播报文失败时，丢弃这些报文。（缺省开启，推荐开启）
 
<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] traffic-optimize bcmc unicast-send mismatch-action drop
VR场景下的流量优化
AP对接VR设备场景下，由于丢包重传对用户体验影响较大，用户可将业务保障功能模式设置为可靠性优先，即在满足VR吞吐量要求下，通过空口适当降速，减小丢包、重传引起的抖动、延迟，提升用户体验。建议用户在VR游戏场景下，配置业务保障功能模式为可靠性优先，在VR视频场景下，建议配置为性能优先。
 
# 配置业务保障功能模式为可靠性优先。（缺省为性能优先）
 
<AC6805> system-view 
[AC6805] wlan  
[AC6805-wlan-view] ssid-profile name ssid1 
[AC6805-wlan-ssid-prof-ssid1] service-guarantee reliability-first

开掘常见问题

AP上线失败

问题描述

AP上线失败。

可能原因

前期PoE交换机PoE参数配置错误
AC和AP间的链路没打通
施工人员网线没做好

以上原因占据平时排查工作大部分时间。更多原因和解决处理方法请参考故障启示录中的AP上线失败。

处理过程

处理过程如下：

对照AP设备《产品描述》中指定的PoE供电协议标准，检查PoE供电设备是否满足。如果不符，则需要更换为满足要求的PoE供电设备。
对于华为PoE交换机，在系统视图下执行display poe power命令，根据回显信息中的USMPW（mW）值可以确定其供电协议标准：15400表示该交换机支持的PoE供电协议是IEEE 802.3af标准，30000表示该交换机支持的PoE供电协议是IEEE 802.3at标准。
检查AP与AC之间网络是否互通。如果不通，请检查对应配置是否正确。
尝试更换连接AP的物理线路。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/繁依Fanyi0/article/detail/279223