【华为】AC三层旁挂直接转发

实验需求

AC组网方式：旁挂三层组网。
业务数据转发方式：直接转发（缺省方式）。
DHCP部署方式：
汇聚交换机作为DHCP服务器为AP和STA分配IP地址
AC作为AP的DHCP服务器，分配管理地址

AP管理：VLAN 200，网段为192.168.200.0/24。网关为AC上的VLANIF200接口IP。

无线业务：
VLAN 100，SSID为IT，密码为a1234567，网段为192.168.100.0/24。网关为汇聚交换机上的VLANIF100接口IP。
VLAN 110，SSID为HR，密码为b1234567，网段为192.168.110.0/24。网关为汇聚交换机上的VLANIF110接口IP。

AC与AP建立管理隧道的源接口：AC上的VLANIF200。

AC与汇聚交换机三层互联的接口：VLANIF200。

汇聚交换机与出口网关三层互联的接口：VLANIF10。

实验拓扑

---

配置

---

AC和AP二层通信

AC

[AC6605]dhcp enable        ## 开启DHCP 功能
Info: The operation may take a few seconds. Please wait for a moment.done.

[AC6605]vlan 200

[AC6605]int vlan 200	  ## 配置SVI200 接口地址，使它能够与核心交换机通信
[AC6605-Vlanif200]dhcp select interface             ## 选择接口下的DHCP
[AC6605-Vlanif200]dhcp server dns-list 8.8.8.8      ## 下发的DNS
[AC6605-Vlanif200]qu

## 把与LSW1相连接的接口配置成Trunk接口，并放行管理VLAN200
[AC6605]interface GigabitEthernet0/0/1      
[AC6605-GigabitEthernet0/0/1]port link-type trunk
[AC6605-GigabitEthernet0/0/1]port trunk allow-pass vlan 200
[AC6605-GigabitEthernet0/0/1]quit

LSW1

[LSW1]vlan batch 100 110 200           ## 批量创建vlan 100 110 200 

[LSW1]interface Vlanif200              ## 创建VLANif200
[LSW1-Vlanif200]ip address 192.168.200.100 255.255.255.0  ##配置IP地址，能让LSW1与AC实现通信
[LSW1-Vlanif200]quit

## 把与AC相连接的接口配置成Trunk接口，并放行管理VLAN200
[LSW1]interface GigabitEthernet0/0/2                     
[LSW1-GigabitEthernet0/0/2] port link-type trunk
[LSW1-GigabitEthernet0/0/2] port trunk allow-pass vlan 200
[LSW1-GigabitEthernet0/0/2]quit

## 把LSW1下端的接口配置成Trunk接口，并放行VLAN 100 110 200 流量
[LSW1]interface GigabitEthernet0/0/3
[LSW1-GigabitEthernet0/0/3] port link-type trunk
[LSW1-GigabitEthernet0/0/3] port trunk allow-pass vlan 100 110 200
[LSW1-GigabitEthernet0/0/3]quit

LSW2

[LSW2]vlan batch 100 110 200
Info: This operation may take a few seconds. Please wait for a moment...done.

[LSW2]interface Ethernet0/0/1 
[LSW2-Ethernet0/0/1] port link-type trunk       
[LSW2-Ethernet0/0/1] port trunk allow-pass vlan 100 110 200
[LSW2-Ethernet0/0/1]quit

[LSW2]interface Ethernet0/0/2
[LSW2-Ethernet0/0/2] port link-type trunk
[LSW2-Ethernet0/0/2] port trunk pvid vlan 200                  ## 配置该接口的pvid为管理VLAN,使AP能够获取到管理IP地址
[LSW2-Ethernet0/0/2] port trunk allow-pass vlan 100 110 200    ## 放行vlan 100 110 200
[LSW2-Ethernet0/0/2]quit

[LSW2]interface Ethernet0/0/3
[LSW2-Ethernet0/0/3] port link-type trunk
[LSW2-Ethernet0/0/3] port trunk pvid vlan 200                  ## 配置该接口的pvid为管理VLAN,使AP能够获取到管理IP地址
[LSW2-Ethernet0/0/3] port trunk allow-pass vlan 100 110 200    ## 放行vlan 100 110 200
[LSW2-Ethernet0/0/3]quit

AP2获取到的管理地址

dispaly ip int brief

AP3获取到的管理地址

dispaly ip int brief

AP上线

[AC6605]capwap source interface Vlanif 200                  ## 指定capwap隧道源接口为VLANif200

[AC6605-wlan-view]regulatory-domain-profile name domain     ## 创建管理域名为“domain”（缺省CN）
[AC6605-wlan-regulate-domain-domain]quit

[AC6605-wlan-view]ap-group name IT                          ## 创建AP组为“IT”
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC6605-wlan-ap-group-IT]regulatory-domain-profile domain   ## 关联管理域“domain”
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y ## 重启AP
[AC6605-wlan-ap-group-IT]quit

[AC6605-wlan-view]ap-group name HR                          ## 创建AP组为“HR”
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC6605-wlan-ap-group-HR]regulatory-domain-profile domain   ## 关联管理域“domain”
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y ## 重新上线该AP
[AC6605-wlan-ap-group-HR]quit

[AC6605-wlan-view]ap auth-mode mac-auth                      ## ap认证模式为MAC认证

[AC6605-wlan-view]ap-id 1 ap-mac 00e0-fce5-38e0              ## ap编号为1，mac地址为 00e0-fce5-38e0 
[AC6605-wlan-ap-1]ap-name IT                                 ## ap的名字为 “IT”
[AC6605-wlan-ap-1]ap-group IT                                ## 关联ap组“IT”
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y                                             ## 重新上线该AP
[AC6605-wlan-ap-1]quit

[AC6605-wlan-view]ap-id 2 ap-mac 00e0-fc15-3860              ## ap编号为2，mac地址为 00e0-fc15-3860           
[AC6605-wlan-ap-2]ap-name HR                                 ## ap的名字为 “HR”
[AC6605-wlan-ap-2]ap-group HR                                ## 关联ap组“HR”
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y                                             ## 重新上线该AP
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC6605-wlan-ap-2]quit

此时执行命令 display ap all 查看到AP的“State”字段为“nor”时，表示AP正常上线，示例如下。

配置WLAN业务

AC

[AC6605-wlan-view]security-profile name IT                                 ## 创建安全模板名为“IT”
[AC6605-wlan-sec-prof-IT]security wpa-wpa2 psk pass-phrase a1234567 aes    ## 设置无线密码，方式为psk认证，密码a1234567，用aes加密
[AC6605-wlan-sec-prof-IT]quit

[AC6605-wlan-view]ssid-profile name IT                                     ## 创建SSID模板名为“IT”
[AC6605-wlan-ssid-prof-IT]ssid IT                                          ## 设置SSID名为“IT”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-ssid-prof-IT]quit

[AC6605-wlan-view]vap-profile name IT                                      ## 创建VAP模板“IT”
[AC6605-wlan-vap-prof-IT]ssid-profile IT                                   ## 关联SSID模板“IT”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-IT]security-profile IT                               ## 关联安全模板“IT”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-IT]forward-mode direct-forward                       ## 定义转发方式为直连转发（缺省）
[AC6605-wlan-vap-prof-IT]service-vlan vlan-id 100                          ## 指定VAP模板“IT”的业务流量
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-IT]quit

[AC6605-wlan-view]security-profile name HR                                 ## 创建安全模板名为“HR”
[AC6605-wlan-sec-prof-HR]security wpa-wpa2 psk pass-phrase b1234567 aes    ## 设置无线密码，方式为psk认证，密码b1234567，用aes加密
[AC6605-wlan-sec-prof-HR]qu

[AC6605-wlan-view]ssid-profile name HR                                     ## 创建SSID模板名为“HR”
[AC6605-wlan-ssid-prof-HR]ssid HR                                          ## 设置SSID名为“HR”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-ssid-prof-HR]qu

[AC6605-wlan-view]vap-profile name HR                                      ## 创建VAP模板“HR”
[AC6605-wlan-vap-prof-HR]security-profile HR                               ## 关联安全模板“HR”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-HR]ssid-profile HR                                   ## 关联SSID模板“HR”
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-HR]forward-mode direct-forward                       ## 定义转发方式为直连转发（缺省）
[AC6605-wlan-vap-prof-HR]service-vlan vlan-id 110                          ## 指定VAP模板“HR”的业务流量
Info: This operation may take a few seconds, please wait.done.
[AC6605-wlan-vap-prof-HR]qu

[AC6605-wlan-view]ap-group name IT                                         ## 进入AP组“IT”
[AC6605-wlan-ap-group-IT]vap-profile IT wlan 1 radio all                   ## 关联vap模板“IT”，wlan编号为1，射频为all（0，1,2）
Info: This operation may take a few seconds, please wait...done.
[AC6605-wlan-ap-group-IT]quit

[AC6605-wlan-view]ap-group name HR                                         ## 进入AP组“HR”
[AC6605-wlan-ap-group-HR]vap-profile HR wlan 2 radio all                   ## 关联vap模板“HR”，wlan编号为1，射频为all（0，1,2）
Info: This operation may take a few seconds, please wait...done.
[AC6605-wlan-ap-group-HR]quit

LSW1（作DHCP地址池）

作为STA的业务DHCP服务器，下发业务流量

[LSW1]dhcp enable

[LSW1]int vlan 100
[LSW1-Vlanif100]ip address 192.168.100.254 24
[LSW1-Vlanif100]dhcp select interface
[LSW1-Vlanif100]quit

[LSW1]int vlan 110
[LSW1-Vlanif110]ip address 192.168.110.254 24
[LSW1-Vlanif110]dhcp select interface 
[LSW1-Vlanif110]qu

业务成功下发

访问公网（NAT）

LSW1

[LSW1]interface Vlanif10
[LSW1-Vlanif10] ip address 192.168.10.2 255.255.255.0
[LSW1-Vlanif10]quit

## 指向AR1
[LSW1]ip route-static 0.0.0.0 0.0.0.0 192.168.10.1

AR1

## 匹配感兴趣流量（允许上网的流量）
[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2000]rule permit source 192.168.100.0 0.0.0.255
[AR1-acl-basic-2000]rule permit source 192.168.110.0 0.0.0.255

## 在外接口启用Easy IP
[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip address 202.101.1.2 24
[AR1-GigabitEthernet0/0/0]nat outbound 2000
[AR1-GigabitEthernet0/0/0]quit

## 与LSW1实现互联
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.10.1 24
[AR1-GigabitEthernet0/0/1]quit

## 默认路由通往ISP
[AR1]ip route-static 0.0.0.0 0.0.0.0 202.101.1.1
## 静态路由指回内部
[AR1]ip route-static 192.168.100.0 255.255.255.0 192.168.10.2
[AR1]ip route-static 192.168.110.0 255.255.255.0 192.168.10.2

成功上网啦

配置文档

AC

dhcp enable       
 
vlan 200

int vlan 200
ip address 192.168.200.254 24	  
dhcp select interface            
dhcp server dns-list 8.8.8.8      
qu

interface GigabitEthernet0/0/1      
port link-type trunk
port trunk allow-pass vlan 200
quit

capwap source interface Vlanif 200

wlan
regulatory-domain-profile name domain
quit

ap-group name IT
regulatory-domain-profile domain
yes
 quit

ap-group name HR
regulatory-domain-profile domain
yes
 quit

ap auth-mode mac-auth                    

ap-id 1 ap-mac 00e0-fce5-38e0(添加自己的AP MAC地址)              
ap-name IT                             
ap-group IT                             
yes                                
 quit

ap-id 2 ap-mac 00e0-fc15-3860(添加自己的AP MAC地址)          
ap-name HR                                 
ap-group HR
yes
 quit

security-profile name IT
security wpa-wpa2 psk pass-phrase a1234567 aes    
quit

ssid-profile name IT
ssid IT
quit

vap-profile name IT
ssid-profile IT
security-profile IT
forward-mode direct-forward
service-vlan vlan-id 100
quit

security-profile name HR
security wpa-wpa2 psk pass-phrase b1234567 aes
qu

ssid-profile name HR
ssid HR
qu

vap-profile name HR
security-profile HR
ssid-profile HR
forward-mode direct-forward
service-vlan vlan-id 110
qu

ap-group name IT
vap-profile IT wlan 1 radio all
quit

ap-group name HR
vap-profile HR wlan 2 radio all
quit

LSW1

#
sysname LSW1
#
undo info-center enable
#
vlan batch 10 100 110 200
#
dhcp enable
#
interface Vlanif10
 ip address 192.168.10.2 255.255.255.0
#
interface Vlanif100
 ip address 192.168.100.254 255.255.255.0
 dhcp select interface
#
interface Vlanif110
 ip address 192.168.110.254 255.255.255.0
 dhcp select interface
#
interface Vlanif200
 ip address 192.168.200.100 255.255.255.0
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 200
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 100 110 200
#
ip route-static 0.0.0.0 0.0.0.0 192.168.10.1
#

LSW2

#
sysname LSW2
#
undo info-center enable
#
vlan batch 100 110 200
#
interface Ethernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 110 200
#
interface Ethernet0/0/2
 port link-type trunk
 port trunk pvid vlan 200
 port trunk allow-pass vlan 100 110 200
#
interface Ethernet0/0/3
 port link-type trunk
 port trunk pvid vlan 200
 port trunk allow-pass vlan 100 110 200

AR1

#
 sysname AR1
 #
undo info-center enable
#
acl number 2000  
 rule 5 permit source 192.168.100.0 0.0.0.255 
 rule 10 permit source 192.168.110.0 0.0.0.255 
 rule 15 permit source 192.168.10.0 0.0.0.255 
#
interface GigabitEthernet0/0/0
 ip address 202.101.1.2 255.255.255.0 
 nat outbound 2000
#
interface GigabitEthernet0/0/1
 ip address 192.168.10.1 255.255.255.0 
#
ip route-static 0.0.0.0 0.0.0.0 202.101.1.1
ip route-static 192.168.100.0 255.255.255.0 192.168.10.2
ip route-static 192.168.110.0 255.255.255.0 192.168.10.2
#

ISP

#
sysname ISP
#
undo info-center enable
#
interface GigabitEthernet0/0/0
 ip address 202.101.1.1 255.255.255.0 
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255