笔记
WLAN业务部署需要注意:
网关位置
业务网络的DHCP地址
转发方式
一般遵循以下规则
如果业务网关在AC上,建议使用隧道转发模式;否则建议使用直接转发。
至于业务网络的DHCP服务器位置,就看实际情况,可以在AC也可以不在AC。
DHCP服务器位置不同配置也会有差异。
VLAN场景中端口类型对数据的处理方式
vlan场景中端口类型:4种
access:
收
有tag 检查端口的vlan-id与数据携带的vlan-id是否相同,相同就接收,否则丢弃
无tag 强行添加本接口的vlan-id
发
始终剥离标签在发送
trunk
收
有tag 检查数据携带的vlan-id是否在端口下允许通过,允许就收,否则丢弃
无tag 强行添加本接口的vlan-id
发
检查数据携带的vlan-id是否在端口下允许通过:
不允许直接丢弃
允许:是否带标签出去(数据的vlan-id与端口的vlan-id是否相同)
相同:剥离数据携带的vlan-id再出去
不同:保持数据携带的vlan-id再出去
hybrid
收
有tag 检查数据携带的vlan-id是否在端口下允许通过,允许就收,否则丢弃
在该端口下无论时tagged还是untagged,都是允许
无tag 强行添加本接口的vlan-id
发
检查数据携带的vlan-id是否在端口下允许通过:
不允许直接丢弃
允许:
tagged允许 带标签再出去
untagged允许 不在标签再出去
tunnel
收
有tag 检查数据的外层vlan-id与端口的vlan-id是否相同,相同就接收,否则丢弃
无tag 强行添加本接口的vlan-id作为数据的外层vlan-id
发
剥离数据携带的外层vlan-id(只剩下携带内层vlan-id的数据)
实验
网关在SW1,DHCP在SW1,直接转发的部署
效果图如下
AC1【SSID、安全、VAP、域模板】【AP组】
wlan
ssid-profile name 5G
ssid 5G
quit
ssid-profile name 2.4G
ssid 2.4G
quit
security-profile name SECURITY_O
security wpa2 psk pass-phrase Huawei@123 aes
quit
vap-profile name VAP_5G
service-vlan vlan-id 11
ssid-profile VAP_5G
security-profile HCIE
quit
vap-profile name VAP_2.4G
service-vlan vlan-id 11
ssid-profile VAP_2.4G
security-profile HCIE
quit
regulatory-domain-profile name DOMAIN_O
country-code CN
quit
ap-group name 2.4G_GROUP
quit
ap-group name 5G_GROUP
quit
ap-id 0
ap-name AP2
ap-group 2.4g
quit
ap-id 1
ap-name AP1
ap-group 5g
quit
ap-group name 2.4G_GROUP
vap-profile 2.4g wlan 1 radio 0
quit
ap-group name 5G_GROUP
vap-profile 5g wlan 1 radio 1
quit
SW1【放通VLAN11】【DHCP开启】
SW1:
system-view
dhcp enable
vlan batch 11
interface Vlanif11
ip address 10.10.11.254 255.255.255.0
dhcp select interface
quit
interface Gigabitethernet 0/0/1
port link-type hybrid
port hybrid tagged vlan 11
quit
interface Gigabitethernet 0/0/2
port link-type hybrid
port hybrid tagged vlan 11
quit
SW2【额外放通VLAN11的业务vlan】
SW2:
system-view
vlan batch 11
interface ethernet 0/0/1
port link-type hybrid
port hybrid tagged vlan 11
quit
interface ethernet 0/0/2
port link-type hybrid
port hybrid tagged vlan 11
quit
SW3【额外放通VLAN11的业务vlan】
SW3:
system-view
vlan batch 11
interface ethernet 0/0/1
port link-type hybrid
port hybrid tagged vlan 11
quit
interface ethernet 0/0/2
port link-type hybrid
port hybrid tagged vlan 11
quit
网关在AC,DHCP在SW1,隧道转发的部署
在完成二层全网通之后再做以下配置。
AC1【创建vlanif11并添加IP】【在vlanif11创建dhcp中继,指定中继服务器】【放通vlan11】
system-view
dhcp enable
vlan batch 11
interface vlanif 11
ip address 10.10.11.254 24
dhcp select relay
dhcp relay server-ip 10.10.11.1
quit
interface Gigabitethernet 0/0/1
port hy tag vlan 11
quit
SW1【创建vlanif11并添加IP】【在vlanif11里创建全局地址池】【在IP地址池vlan11创建地址池,设置网关】【放通vlan11】
system-view
dhcp enable
vlan batch 11
int vlan 11
ip address 10.10.11.1 24
dhcp select global
quit
ip pool vlan11
network 10.10.11.0 mask 24
gateway 10.10.11.254
quit
interface Gigabitethernet 0/0/3
port hy tag vlan 11
quit
AP的业务配置(超简单)
wlan
ssid-profile name 5g
ssid 5g
quit
ssid-profile name 2.4g
ssid 2.4g
quit
security-profile name HCIE
security wpa2 psk pass-phrase Huawei@123 aes
quit
vap-profile name 5g
service-vlan vlan-id 11
ssid-profile 5g
security-profile HCIE
forward-mode tunnel
quit
vap-profile name 2.4g
service-vlan vlan-id 11
ssid-profile 2.4g
security-profile HCIE
forward-mode tunnel
quit
regulatory-domain-profile name HCIE
country-code CN
quit
ap-group name 5g
reg HCIE
quit
ap-group name 2.4g
reg HCIE
quit
ap-id 0
ap-name AP2
ap-group 2.4g
quit
ap-id 1
ap-name AP1
ap-group 5g
quit
ap-group name 2.4g
vap-profile 2.4g wlan 1 radio 0
quit
ap-group name 5g
vap-profile 5g wlan 1 radio 1
quit