华为综合案例-普通WLAN全覆盖配置（2）

知孤云出岫2024-03-21 9:07

组网图

结果验证

javascript 复制代码 
在AC_1和AC_2上执行display ap all命令，检查当前AP的状态，显示以下信息表示AP上线成功。


[AC_1] display ap all
Total AP information:
nor  : normal          [1]
ExtraInfo : Extra information
P  : insufficient power supply
----------------------------------------------------------------------------------------------------
ID   MAC            Name   Group     IP              Type            State STA Uptime      ExtraInfo
----------------------------------------------------------------------------------------------------
0    60de-4476-e360 AP_1   wlan_net    10.128.1.254    AP6050DN        nor   0   10S         -
----------------------------------------------------------------------------------------------------
Total: 1


在AC_1和AC_2上执行display hsb-service 0命令，查看主备服务的建立情况，可以看到Service State字段的显示为Connected，说明主备服务通道已经成功建立。


[AC_1] display hsb-service 0
Hot Standby Service Information:
----------------------------------------------------------
  Local IP Address       : 10.1.1.253
  Peer IP Address        : 10.1.1.254
  Source Port            : 10241
  Destination Port       : 10241
  Keep Alive Times       : 5
  Keep Alive Interval    : 3
  Service State          : Connected
  Service Batch Modules  : Access-user
  Shared-key             : -
----------------------------------------------------------
[AC_2] display hsb-service 0 
Hot Standby Service Information:
----------------------------------------------------------
  Local IP Address       : 10.1.1.254
  Peer IP Address        : 10.1.1.253
  Source Port            : 10241
  Destination Port       : 10241
  Keep Alive Times       : 5
  Keep Alive Interval    : 3
  Service State          : Connected
  Service Batch Modules  : Access-user
  Shared-key             : -
----------------------------------------------------------


在AC_1和AC_2上执行display hsb-group 0命令，查看HSB备份组的运行情况。


[AC_1] display hsb-group 0 
Hot Standby Group Information:
----------------------------------------------------------
  HSB-group ID                : 0
  Vrrp Group ID               : 1
  Vrrp Interface              : Vlanif800
  Service Index               : 0
  Group Vrrp Status           : Master
  Group Status                : Active
  Group Backup Process        : Realtime
  Peer Group Device Name      : AC6805
  Peer Group Software Version : V200R010C00
  Group Backup Modules        : Access-user
                                AP
                                DHCP
----------------------------------------------------------
[AC_2] display hsb-group 0 
Hot Standby Group Information:
----------------------------------------------------------
  HSB-group ID                : 0
  Vrrp Group ID               : 1
  Vrrp Interface              : Vlanif800
  Service Index               : 0
  Group Vrrp Status           : Backup
  Group Status                : Inactive
  Group Backup Process        : Realtime
  Peer Group Device Name      : AC6805
  Peer Group Software Version : V200R010C00
  Group Backup Modules        : Access-user
                                AP
                                DHCP
----------------------------------------------------------


用户是否能够通过RADIUS模板的认证。（已在RADIUS服务器上配置了测试用户test@huawei.com，用户密码123456）。


[AC_1] test-aaa test@huawei.com 123456 radius-template radius_huawei 
Info: Account test succeed.
  1. 完成配置后，用户可通过无线终端搜索到SSID为wlan_net的无线网络，用户关联到无线网络上后，无线终端能够被分配相应的IP地址。STA上打开浏览器访问Internet，自动跳转到Portal服务器提供的页面，在页面上输入正确的用户名(test@huawei.com)和密码(123456)，认证通过后可以正常访问Internet。
  2. 用户使用手机可以正常使用漫游业务。

配置脚本

javascript 复制代码 
AC_1和AC_2的配置文件对比（加粗内容为AC_1和AC_2上的双机备份配置和无线配置同步配置，斜体内容为AC_1自动同步到AC_2的公有配置）

AC_1

AC_2

#
 sysname AC_1
#
radius-server source ip-address 172.16.1.1
#
vrrp recover-delay 60
#
vlan batch 700 to 701 800 810 820
#
authentication-profile name wlan_net_dot1x_auth
 dot1x-access-profile huawei
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
authentication-profile name wlan_net_portal_auth
 mac-access-profile mac
 portal-access-profile wlan_net
 free-rule-template default_free_rule
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
#
web-auth-server source-ip 172.16.1.1
#
dhcp enable
#
dhcp snooping enable
#
vlan 700
 description wlan_net
 dhcp snooping enable
vlan 701
 description wlan_net
 dhcp snooping enable
vlan 800
 description AP-management-vlan
#
radius-server template radius_huawei
 radius-server shared-key cipher %^%#b@)bNet)(Z)!N9T>p8kM(8w/N&3\>!KKg=DO<!R+%^%#
 radius-server authentication 172.16.1.254 1812 weight 80
 radius-server accounting 172.16.1.254 1813 weight 80
 radius-server timeout 1
radius-server authorization 172.16.1.254 shared-key cipher %^%#M"yY$,}"a8U12iTP4:u6nI-;9G/!eH`FJ:UePsB,%^%# 
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.253 mask 255.255.255.255
#
url-template name huawei
 url http://172.16.1.254:8080/portal
 url-parameter ssid ssid redirect-url url
#
web-auth-server huawei
 server-ip 172.16.1.254
 port 50200
 shared-key cipher %^%#6/j36uiW:M7dx'"L*2M*TN~P7t*K0(w9'=ER4bZ"%^%#
 url-template huawei
#
portal-access-profile name wlan_net
 web-auth-server huawei direct
#
aaa
 authentication-scheme radius_huawei
  authentication-mode radius
 accounting-scheme radius_huawei
  accounting-mode radius
  accounting realtime 15
#
interface Vlanif800
 ip address 10.128.1.2 255.255.255.0
 vrrp vrid 1 virtual-ip 10.128.1.1
 admin-vrrp vrid 1
 vrrp vrid 1 priority 120
 vrrp vrid 1 preempt-mode timer delay 1200
 dhcp select interface
 dhcp server excluded-ip-address 10.128.1.1 10.128.1.3 
#
interface Vlanif810
 ip address 10.1.1.253 255.255.255.252
#
interface Vlanif820
 ip address 172.16.1.2 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.1
 vrrp vrid 2 track admin-vrrp interface Vlanif800 vrid 1 unflowdown
#
interface GigabitEthernet0/0/23
 description Connect to AC_2_0/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 800 810 820
#
interface GigabitEthernet0/0/24
 description Connect to S12700_A_1/1/0/20
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 700 to 701 800 820
#
capwap source ip-address 10.128.1.1
#
hsb-service 0
 service-ip-port local-ip 10.1.1.253 peer-ip 10.1.1.254 local-data-port 10241 peer-data-port 10241
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif800
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
wlan
 traffic-profile name wlan_net
  user-isolate l2
 security-profile name open
  security open
 security-profile name dot1x
  security wpa2 dot1x aes
 ssid-profile name wlan_net_portal_auth
  ssid wlan_net_portal_auth
 ssid-profile name wlan_net_dot1x_auth
  ssid wlan_net_dot1x_auth
  dot11r enable
 vap-profile name wlan_net_portal_auth
  service-vlan vlan-id 700
  ssid-profile wlan_net_portal_auth
  security-profile open
  traffic-profile wlan_net
  authentication-profile wlan_net_portal_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 vap-profile name wlan_net_dot1x_auth
  service-vlan vlan-id 701
  ssid-profile wlan_net_dot1x_auth
  security-profile dot1x
  traffic-profile wlan_net
  authentication-profile wlan_net_dot1x_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 radio-2g-profile name 2G
 radio-5g-profile name 5G
 port-link-profile name default
 ap-group name wlan_net
  radio 0
   radio-2g-profile 2G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 1
   radio-5g-profile 5G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 2
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
 ap-id 1 ap-mac 60de-4476-e360
  ap-name AP_1
  ap-group wlan_net
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif800
  master-redundancy peer-ip ip-address 10.1.1.254 local-ip ip-address 10.1.1.253 psk %^%#HdgY%JtWL>H[k@Rs~<-)6,u4A&I1e5mO%jVwv~*N%^%#
#
dot1x-access-profile name huawei
#
mac-access-profile name mac
#
return
#
 sysname AC_2
#
radius-server source ip-address 172.16.1.1
#
vrrp recover-delay 60
#
vlan batch 700 to 701 800 810 820
#
authentication-profile name wlan_net_dot1x_auth
 dot1x-access-profile huawei
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
authentication-profile name wlan_net_portal_auth
 mac-access-profile mac
 portal-access-profile wlan_net
 free-rule-template default_free_rule
 authentication-scheme radius_huawei
 accounting-scheme radius_huawei
 radius-server radius_huawei
#
web-auth-server source-ip 172.16.1.1
#
dhcp enable
#
dhcp snooping enable
#
vlan 700
 description wlan_net
 dhcp snooping enable
vlan 701
 description wlan_net
 dhcp snooping enable
vlan 800
 description AP-management-vlan
#
radius-server template radius_huawei
 radius-server shared-key cipher %^%#b@)bNet)(Z)!N9T>p8kM(8w/N&3\>!KKg=DO<!R+%^%#
 radius-server authentication 172.16.1.254 1812 weight 80
 radius-server accounting 172.16.1.254 1813 weight 80
 radius-server timeout 1
radius-server authorization 172.16.1.254 shared-key cipher %^%#M"yY$,}"a8U12iTP4:u6nI-;9G/!eH`FJ:UePsB,%^%# 
#
free-rule-template name default_free_rule
 free-rule 1 destination ip 172.16.1.253 mask 255.255.255.255
#
url-template name huawei
 url http://172.16.1.254:8080/portal
 url-parameter ssid ssid redirect-url url
#
web-auth-server huawei
 server-ip 172.16.1.254
 port 50200
 shared-key cipher %^%#6/j36uiW:M7dx'"L*2M*TN~P7t*K0(w9'=ER4bZ"%^%#
 url-template huawei
#
portal-access-profile name wlan_net
 web-auth-server huawei direct
#
aaa
 authentication-scheme radius_huawei
  authentication-mode radius
 accounting-scheme radius_huawei
  accounting-mode radius
  accounting realtime 15
#
interface Vlanif800
 ip address 10.128.1.3 255.255.255.0
 vrrp vrid 1 virtual-ip 10.128.1.1
 admin-vrrp vrid 1


 dhcp select interface
 dhcp server excluded-ip-address 10.128.1.1 10.128.1.3 
#
interface Vlanif810
 ip address 10.1.1.254 255.255.255.252
#
interface Vlanif820
 ip address 172.16.1.3 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.1
 vrrp vrid 2 track admin-vrrp interface Vlanif800 vrid 1 unflowdown
#
interface GigabitEthernet0/0/23
 description Connect to AC_1_0/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 800 810 820
#
interface GigabitEthernet0/0/24
 description Connect to S12700_B_2/1/0/23
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 700 to 701 800 820
#
capwap source ip-address 10.128.1.1
#
hsb-service 0
 service-ip-port local-ip 10.1.1.254 peer-ip 10.1.1.253 local-data-port 10241 peer-data-port 10241
#
hsb-group 0
 track vrrp vrid 1 interface Vlanif800
 bind-service 0
 hsb enable
#
hsb-service-type access-user hsb-group 0
#
hsb-service-type dhcp hsb-group 0
#
hsb-service-type ap hsb-group 0
#
wlan
 traffic-profile name wlan_net
  user-isolate l2
 security-profile name open
  security open
 security-profile name dot1x
  security wpa2 dot1x aes
 ssid-profile name wlan_net_portal_auth
  ssid wlan_net_portal_auth
 ssid-profile name wlan_net_dot1x_auth
  ssid wlan_net_dot1x_auth
  dot11r enable
 vap-profile name wlan_net_portal_auth
  service-vlan vlan-id 700
  ssid-profile wlan_net_portal_auth
  security-profile open
  traffic-profile wlan_net
  authentication-profile wlan_net_portal_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 vap-profile name wlan_net_dot1x_auth
  service-vlan vlan-id 701
  ssid-profile wlan_net_dot1x_auth
  security-profile dot1x
  traffic-profile wlan_net
  authentication-profile wlan_net_dot1x_auth
  ip source check user-bind enable
  arp anti-attack check user-bind enable
  learn-client-address dhcp-strict
 radio-2g-profile name 2G
 radio-5g-profile name 5G
 port-link-profile name default
 ap-group name wlan_net
  radio 0
   radio-2g-profile 2G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 1
   radio-5g-profile 5G
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
  radio 2
   vap-profile wlan_net_portal_auth wlan 1
   vap-profile wlan_net_dot1x_auth wlan 2
 ap-id 1 ap-mac 60de-4476-e360
  ap-name AP_1
  ap-group wlan_net
 master controller
  master-redundancy track-vrrp vrid 1 interface Vlanif800
  master-redundancy peer-ip ip-address 10.1.1.253 local-ip ip-address 10.1.1.254 psk %^%#>j6VS_;z=54_*oRNpd<<'_-8DRj,,Y!T~_,Z$4yI%^%#
#
dot1x-access-profile name huawei
#
mac-access-profile name mac
#
return
集群系统

#
sysname CSS
#
vlan batch 730 800 820
#
interface Eth-Trunk1                                                                                           
 description Connect to S7700_Eth-Trunk1
 port link-type trunk  
 undo port trunk allow-pass vlan 1  
 port trunk allow-pass vlan 730 800
#
interface GigabitEthernet1/1/0/19
 eth-trunk 1
#
interface GigabitEthernet1/1/0/20
 description Connect to AC_1_0/0/24
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800 820
#
interface GigabitEthernet1/1/0/21
 description Connect to Router_0/0/29
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 820
#
interface GigabitEthernet1/1/1/7
 mad detect mode direct
#
interface GigabitEthernet2/1/0/18
 description Connect to Router_0/0/30
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 820
#
interface GigabitEthernet2/1/0/22
 eth-trunk 1
#
interface GigabitEthernet2/1/0/23
 description Connect to AC_2_0/0/24
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800 820
#
interface GigabitEthernet2/1/1/7
  mad detect mode direct
#
return
S7700

#
sysname S7700
#
vlan batch 730 800
#
interface Eth-Trunk1
 description Connect to S12700_Eth-Trunk1                                              
 port link-type trunk                                                            
 undo port trunk allow-pass vlan 1                                               
 port trunk allow-pass vlan 730 800 
#
interface Vlanif730
 ip address 10.173.1.1 255.255.252.0
 dhcp select relay
 dhcp relay server-ip 172.16.1.252
#
interface GigabitEthernet1/0/3
 description Connect to S5700_A_0/0/3
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
#
interface GigabitEthernet1/0/17
 eth-trunk 1
#
interface GigabitEthernet2/0/18
 eth-trunk 1
#
return
S5700_A

#
sysname S5700_A
#
vlan batch 730 800
#
traffic classifier huawei 
if-match destination-mac 0100-5e00-0000 mac-address-mask ffff-ff00-0000
#
traffic behavior huawei 
statistic enable
car cir 100 
#
traffic policy huawei
classifier huawei behavior huawei
#
lldp enable
#
interface GigabitEthernet0/0/1
 description Connect to AP_1
 port link-type trunk
 port trunk pvid vlan 800 
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
 port-isolate enable group 1 
 stp edged-port enable 
 traffic-policy huawei inbound
 traffic-policy huawei outbound
#
interface GigabitEthernet0/0/2
 description Connect to AP_2
 port link-type trunk
 port trunk pvid vlan 800
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
 port-isolate enable group 1 
 stp edged-port enable 
 traffic-policy huawei inbound
 traffic-policy huawei outbound
#
interface GigabitEthernet0/0/3
 description Connect to S7700_1/0/3
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 730 800
#
return
父主题： 综合案例-普通WLAN覆盖
版权所有 © 华为技术有限公司
< 上一节下一节 >

场景化推荐配置

大广播域场景下的流量优化

在企业与园区场景中，通常采用单个大型子网的设计。单个大型子网简化了VLAN的配置、没有繁杂的漫游配置、故障定位简单。但是，单个大型子网使用大广播域，带来了大量报文复制发送、CPU使用率过高等问题。

通过将广播报文转单播处理、抑制未知单播、对AP多播报文进行限速等方法降低CPU处理量，以支撑大广播域场景。

打开mDNS单播应答功能。AC作为mDNS网关，对于mDNS服务请求报文，由AC进行服务单播代答。进而减少AC的复制流程。（缺省关闭，推荐开启）

复制代码 
<AC6805> system-view
[AC6805] mdns unicast-reply enable

打开IGMP Snooping功能和丢弃VLAN内收到的未知组播流功能。当主机和上游三层设备之间传递的IGMP协议报文通过二层组播设备时，IGMP Snooping分析报文携带的信息，根据这些信息建立和维护二层组播转发表，从而指导组播数据在数据链路层按需转发。（缺省关闭，推荐开启）

javascript 复制代码 
<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] igmp-snooping enable
[AC6805-wlan-traffic-prof-default] quit
[AC6805-wlan-view] quit
[AC6805] vlan 10 
[AC6805-vlan10] multicast drop-unknown
# 打开ARP/ND/DHCP报文转单播处理功能。（缺省开启，推荐开启）

<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] traffic-optimize bcmc unicast-send arp nd dhcp
# 打开ARP/ND/DHCP抑制功能。当空口广播或组播协议报文转为单播报文失败时，丢弃这些报文。（缺省开启，推荐开启）

<AC6805> system-view
[AC6805] wlan
[AC6805-wlan-view] traffic-profile name default
[AC6805-wlan-traffic-prof-default] traffic-optimize bcmc unicast-send mismatch-action drop
VR场景下的流量优化
AP对接VR设备场景下，由于丢包重传对用户体验影响较大，用户可将业务保障功能模式设置为可靠性优先，即在满足VR吞吐量要求下，通过空口适当降速，减小丢包、重传引起的抖动、延迟，提升用户体验。建议用户在VR游戏场景下，配置业务保障功能模式为可靠性优先，在VR视频场景下，建议配置为性能优先。

# 配置业务保障功能模式为可靠性优先。（缺省为性能优先）

<AC6805> system-view 
[AC6805] wlan  
[AC6805-wlan-view] ssid-profile name ssid1 
[AC6805-wlan-ssid-prof-ssid1] service-guarantee reliability-first

开掘常见问题

AP上线失败

问题描述

AP上线失败。

可能原因
  • 前期PoE交换机PoE参数配置错误
  • AC和AP间的链路没打通
  • 施工人员网线没做好

以上原因占据平时排查工作大部分时间。更多原因和解决处理方法请参考故障启示录中的AP上线失败。

处理过程

处理过程如下：

  • 对照AP设备《产品描述》中指定的PoE供电协议标准，检查PoE供电设备是否满足。如果不符，则需要更换为满足要求的PoE供电设备。 对于华为PoE交换机，在系统视图下执行display poe powe r命令，根据回显信息中的USMPW（mW）值可以确定其供电协议标准：15400表示该交换机支持的PoE供电协议是IEEE 802.3af标准，30000表示该交换机支持的PoE供电协议是IEEE 802.3at标准。

  • 检查AP与AC之间网络是否互通。如果不通，请检查对应配置是否正确。

  • 尝试更换连接AP的物理线路。

相关推荐
Y淑滢潇潇41 分钟前
RHCE 防火墙实验
linux·运维·rhce
wadesir1 小时前
当前位置：首页 ＞ 服务器技术 ＞ 正文Linux网络HSRP协议（实现路由器热备份与高可用性的实用指南）
linux·服务器·网络
稻谷君W1 小时前
Ubuntu 远程访问 Win11 WSL2 并固定访问教程
linux·运维·ubuntu
泡沫·1 小时前
4.iSCSI 服务器
运维·服务器·数据库
胡八一1 小时前
解决PHP未检测到您服务器环境的sqlite3数据库扩展报错
服务器·数据库·php
不解不惑1 小时前
OpenAI whisper 语音识别服务器搭建
服务器·whisper·语音识别
gaize12132 小时前
适合业务规模较大的场景的服务器测评
服务器
带土12 小时前
4. 两台win11 笔记本局域网内文件传输
网络
wdfk_prog2 小时前
[Linux]学习笔记系列 -- [kernel]workqueue
linux·笔记·学习
wdfk_prog2 小时前
[Linux]学习笔记系列 -- [kernel]usermode_helper
linux·笔记·学习
热门推荐
01GitHub 镜像站点02【保姆级教程】免费使用Gemini3的5种方法！免翻墙/国内直连03BongoCat - 跨平台键盘猫动画工具04UV安装并设置国内源05安娜的档案(Anna’s Archive) 镜像网站/国内最新可访问入口（持续更新）06Google Antigravity：无法登录？早期错误、登录修复和用户反馈指南07Linux下V2Ray安装配置指南08全球最强模型Grok4，国内已可免费使用！（附教程）09Spring Boot 4.0 发布总结：新特性、依赖变更与升级指南10Labelme从安装到标注：零基础完整指南