第三十一章 大型WLAN组网部署

一、三层vlan组网

• SW1的配置

  #创建vlan 100 200 
  vlan batch 100 200   #创建vlan 100 200 
  
  #在接口上放行vlan 100 200
  interface GigabitEthernet0/0/1
  port link-type trunk
  port trunk allow-pass vlan 100 200  
  
  #在接口上放行vlan 100 200
  interface GigabitEthernet0/0/2
  port link-type trunk
  port trunk allow-pass vlan 100
  
  #配置vlan200的IP地址并且200的网关向下通过dhcp分发地址  需要在全局开启dhcp功能
  interface Vlanif200
  ip address 192.168.200.1 255.255.255.0
  dhcp select interface

• SW2的基础配置

  #在接口上放行vlan 100
  interface GigabitEthernet0/0/1
  port link-type trunk
  port trunk allow-pass vlan 100
  
  #连接ap的接口需要打上100的标签 capwap隧道通过vlan 100建立
  interface GigabitEthernet0/0/2
  port link-type access
  port default vlan 100

• AC的基础配置

  #创建vlan 100 配置地址 全局开启dhcp功能并且让ap通过dhcp自动获得地址
  interface Vlanif100
  ip address 192.168.100.1 255.255.255.0
  dhcp select interface
  
  #在接口上放行vlan100 200 
  interface GigabitEthernet0/0/1
  port link-type trunk
  port trunk allow-pass vlan 100 200

• 在AC上配置WLAN

  #建立capwap隧道
  [AC6005]capwap source ip-address 192.168.100.1 
  
  #配置ap组并上线ap
  [AC6005-wlan-view]ap-group name huawei 
  [AC6005-wlan-ap-group-huawei]q
  [AC6005-wlan-view]ap-id 1 ap-mac 00e0-fca8-4520
  [AC6005-wlan-ap-1]    
  [AC6005-wlan-ap-1]ap-name ap1
  [AC6005-wlan-ap-1]ap-group huawei
  [AC6005-wlan-ap-1]q
  
  #配置ssid模版
  [AC6005-wlan-view]ssid-profile name huawei1
  [AC6005-wlan-ssid-prof-huawei1]ssid huawei
  [AC6005-wlan-ssid-prof-huawei1]q
  
  #配置安全模版
  [AC6005-wlan-view]security-profile name huawei2 
  [AC6005-wlan-sec-prof-huawei2]security wpa-wpa2 psk pass-phrase huawei123 aes
  [AC6005-wlan-sec-prof-huawei2]q
  
  #配置vap模版
  [AC6005-wlan-view]vap-profile name  huawei3   
  [AC6005-wlan-vap-prof-huawei3]forward-mode tunnel 
  [AC6005-wlan-vap-prof-huawei3]service-vlan vlan-id 200 
  [AC6005-wlan-vap-prof-huawei3]ssid-profile  huawei1
  [AC6005-wlan-vap-prof-huawei3]security-profile huawei2
  
  #调用vap模版
  [AC6005-wlan-view]ap-group name huawei
  [AC6005-wlan-ap-group-huawei]vap-profile huawei3  wlan 1 radio 0 

  
• 在上图中采用三层组网，管理vlan采用vlan150，dhcp下发还是使用vlan100

  #与ap使用150建立capwap隧道
  [AC6005]capwap source ip-address 192.168.100.1 
  
  #创建vlan150
  interface Vlanif150
  ip address 192.168.150.1 255.255.255.0
  
  #使用option43字段跨网段通信
  interface Vlanif100
  ip address 192.168.100.1 255.255.255.0
  dhcp select interface
  dhcp server option 43 sub-option 2 ip-address 192.168.150.1  

• 抓包
  

二、跨网段需要配置三层路由

• SW3的基础配置

  #配置AP的dhcp服务在SW3上
  interface Vlanif10
  ip address 10.1.1.1 255.255.255.0
  dhcp select interface
  
  #配置接口类型和放行对应的vlan
  interface GigabitEthernet0/0/1
  port link-type trunk
  port trunk allow-pass vlan 10 
  
  interface GigabitEthernet0/0/2
  port link-type trunk
  port trunk allow-pass vlan 10 20

• SW4的基础配置

  #配置接口类型和放行对应的vlan
  interface GigabitEthernet0/0/1
  port link-type trunk
  port trunk allow-pass vlan 10
  
  interface GigabitEthernet0/0/2
  port link-type trunk
  port trunk pvid vlan 10
  port trunk allow-pass vlan 10

• AC的基础配置

  #配置管理vlan 20 
  interface Vlanif20
  ip address 10.1.2.1 255.255.255.0
  
  #AC配置通过capwap上线（这里还是上不了线的）
  [AC6005-wlan-view]capwap source ip-address 10.1.2.1
  [AC6005-wlan-view]ap-group name huawei2 
  [AC6005-wlan-ap-group-huawei2]q
  [AC6005-wlan-view]ap-id 1 ap-mac 00e0-fc53-7b20   
  [AC6005-wlan-ap-1]ap-name ap2
  [AC6005-wlan-ap-1]ap-group huawei2 

• 跨网段通信

  #在 SW3上使用option43字段与vlan20通信
  interface Vlanif10
  ip address 10.1.1.1 255.255.255.0
  dhcp select interface
  dhcp server option 43 sub-option 2 ip-address 10.1.2.1
  
  #SW3配置vlan20 与AC通信
  interface Vlanif20
  ip address 10.1.2.2 255.255.255.0
  
  #配置回程路由使AC能与vlan10通信  AC通过capwap隧道管理AP
  [AC6005]ip route-static 10.1.1.1 24 10.1.2.2 

  

三、vlan pool 的配置

• 问题：无线网络终端的移动性导致特定区域IP地址请求较多
• VLAN Pool：一种把多个VLAN放在一个池中并提供分配算法的VLAN分配技术
• 顺序分配算法：把用户按上线顺序依次划分到不同的VLAN中
  • 优点：各个VLAN用户数目划分均匀
  • 缺点：重新上线VLAN容易变更、IP变化
• HASH分配算法：根据用户MAC地址HASH值分配VLAN
  • 用户多次上线可分配相同的VLAN、IP不变
  • 各个VLAN用户数划分不均衡
• 配置：

  #创建VLAN Pool并进入VLAN Pool视图
  [AC] vlan pool pool-name
  
  #将指定VLAN添加到VLAN Pool中。
  [AC-vlan-pool-pool-name] vlan { start-vlan [ to end-vlan ] } &<1-10>
  
  #配置VLAN Pool中的VLAN分配算法
  [AC-vlan-pool-pool-name] assignment { even | hash }
  
  #配置VAP的业务VLAN。
  [AC] wlan  
  [AC-wlan-view] vap-profile name profile-name
  [AC-wlan-vap-prof-profile-name] service-vlan vlan-pool pool-name