**适用场景：**高校、中学
目 录
一、VLAN 规划总表
二、Core-SW1 完整配置
三、Core-SW2 完整配置
四、汇聚交换机配置
五、接入交换机配置
六、AC6005 无线控制器配置
七、防火墙与出口配置
八、验证与测试命令汇总
拓扑图
VLAN 100（AP 管理 VLAN）特殊设计
- 用途：专为 AP 分配 IP 地址，用于建立 CAPWAP 隧道连接 AC
- 网关位置：仅配置在 Core-SW1 上（AC 物理连接在 Core-SW1）
- 路由传播：通过 OSPF 宣告到全网，Core-SW2 自动学习路由
- DHCP Option 43：指向 AC 的管理 IP 地址（192.168.100.2）
- 无需 VRRP：因为 AC 单点部署，Core-SW2 不需要配置该网段的冗余网关
无线业务设计
- AP 管理 VLAN：VLAN 100（仅供 AP 自身使用）
- 无线用户 VLAN：VLAN 101（师生手机/电脑获取的 IP）
- 接入交换机端口：连接 AP 的口必须同时放行 VLAN 101 和 VLAN 100
验证与测试命令汇总
Core Switch Verification
display vrrp brief
display ospf peer brief
display ospf routing
display ip pool name ap_mgmt_vlan used
AC Verification
display ap all
display capwap tunnel all
display station all
Firewall Verification
display security-policy rule all
display nat session all
display firewall zone all
配置命令如下已测试
防火墙
interface GigabitEthernet1/0/2
ip address 192.168.201.1 255.255.255.0
service-manage ping permit
interface GigabitEthernet1/0/0
ip address 192.168.200.1 255.255.255.0
service-manage ping permit
interface GigabitEthernet1/0/1
ip address 202.100.1.2 255.255.255.0
service-manage ping permit
firewall zone trust
add interface GigabitEthernet1/0/0
add interface GigabitEthernet1/0/2
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
firewall zone dmz
set priority 50
ip route-static 0.0.0.0 0.0.0.0 202.100.1.1
ip route-static 192.168.0.0 255.255.0.0 192.168.200.2
ip route-static 192.168.0.0 255.255.0.0 192.168.201.2 preference 70
nat address-group 1
mode no-pat global
section 0 202.100.1.2 202.100.1.22
nat server 0 protocol tcp global 202.100.1.2 domain inside 10.10.60.2 domain
nat server 1 protocol udp global 202.100.1.2 dns inside 10.10.60.2 dns
nat server 2 protocol tcp global 202.100.1.3 www inside 10.10.60.3 www
nat server 3 protocol tcp global 202.100.1.4 ftp inside 10.10.60.4 ftp
nat server 4 protocol tcp global 202.100.1.4 20 inside 10.10.60.4 20
security-policy
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action permit
rule name trust_to_server
source-zone trust
destination-zone dmz
source-address 192.168.0.0 mask 255.255.0.0
destination-address 10.10.60.0 mask 255.255.255.0
service dns
service ftp
service http
action permit
rule name local_to_any
source-zone local
action permit
rule name dmz_trust
source-zone dmz
destination-zone trust
service dns
service ftp
service http
action permit
rule name dmz_untrust
source-zone dmz
destination-zone untrust
service dns
service ftp
service http
action permit
rule name untrust_dmz
source-zone untrust
destination-zone dmz
destination-address 10.10.60.0 mask 255.255.255.0
service dns
service ftp
service http
action permit
nat-policy
rule name to_internet
source-zone trust
destination-zone untrust
action source-nat address-group 1
AC配置
Vlan batch 100 101
省略配置三层ip命令
capwap source int vlan 100
wlan
ap auth-mode mac-auth
ap-id 0 ap-mac
ap-group name wifi
quit
ap-id 0
ap-name ap1
ap-group wifi
ap-id 1
ap-name ap2
ap-group wifi
ap-id 2
ap-name ap3
ap-group wifi
ap-id 3
ap-name ap4
ap-group wifi
quit
regulatory-domain-profile name wifi
country-code cn
ap-group name wifi
regulatory-domain-profile wifi
security-profile name s-wifi
security wpa2 psk pass-phrase huawei@123 aes
ssid-profile name ss-wifi
ssid xyw
vap-profile name vap-wifi
forward-mode tunnel
service-vlan vlan 101
ssid-profile ss-wifi
security-profile s-wifi
ap-group name wifi
vap-profile vap-wifi wlan 1 radio all
核心交换机1
部分命令省略
#配置连接防火墙vlan
vlan 200
description to_fw_g1/0/0
int vlan 200
description to_fw_g1/0/0
ip address 192.168.200.2 255.255.255.0
vlan 201
description to_fw_g1/0/2
int vlan 201
description to_fw_g1/0/2
ip address 192.168.201.2 255.255.255.0
dis vrrp brief
10 Master Vlanif10 Normal 192.168.10.1
20 Master Vlanif20 Normal 192.168.20.1
30 Master Vlanif30 Normal 192.168.30.1
40 Backup Vlanif40 Normal 192.168.40.1
50 Backup Vlanif50 Normal 192.168.50.1
省略其余命令
汇聚1
port-group group-member g0/0/1 to g0/0/3
port link-ty tr
port tr al vlan 20 100 101
汇聚2
port-group group-member g0/0/1 to g0/0/3
port link-ty tr
port tr al vlan 30 100 101
汇聚3
port-group group-member g0/0/1 to g0/0/3
port link-ty tr
port tr al vlan 40 100 101
汇聚4
port-group group-member g0/0/1 to g0/0/3
port link-ty tr
port tr al vlan 50 100 101
接入交换机
SW1
undo info e
vlan batch 20 100 101
int g0/0/24
port l tr
port tr al vlan 20 100 101
int g0/0/1
p l a
p def vl 20
int g0/0/2
p l t
p t p vlan 100
p t a vl 100 101
SW2
undo info e
vlan batch 30 100 101
int g0/0/24
port l tr
port tr al vlan 30 100 101
int g0/0/1
p l a
p def vl 30
int g0/0/2
p l t
p t p vlan 100
p t a vl 100 101
SW3
sysname Access-SW3
undo info e
vlan batch 40 100 101
int g0/0/24
port l tr
port tr al vlan 40 100 101
int g0/0/1
p l a
p def vl 40
int g0/0/2
p l t
p t p vlan 100
p t a vl 100 101
SW4
sysname Access-SW4
undo info e
vlan batch 50 100 101
int g0/0/24
port l tr
port tr al vlan 50 100 101
int g0/0/1
p l a
p def vl 50
int g0/0/2
p l t
p t p vlan 100
p t a vl 100 101
测试结果
客户端2测试访问http服务器、ftp服务器
pc1测试外网能否联通
测试wifi
测试nat静态转换，外网客户端通过访问公网ip来访问内网服务器
测试地址转换
