【WLAN】华为AC使用ACL禁止业务VLAN的IP地址访问管理VLAN

前景提示

安全一直是一个很重要的话题，尤其在企业AC+AP组网的方式中。我们通常会把业务vlan和管理vlan区分开来，使用不同的VLAN，增加安全性，这二者其实可以分离的。

业务vlan：

业务vlan就是我们使用无线设备获取到的IP地址所属的vlan

管理vlan：

管理vlan就是我们的AP设备自身的IP地址

实验目的

通过此次实验，熟练掌握AP在AC上上线的过程，体会模板调用的方法。顺便理解traffic-filter和traffic-policy 用法，从而实现业务vlan的用户无法访问AP管理地址以及各个AP的IP地址的实验目的。

实验拓补

实验过程

[AC6005]sysname AC-1029 //更改设备名
[AC-1029]dhcp enable //开启dhcp服务
Info: The operation may take a few seconds. Please wait for a moment.done.
[AC-1029]undo  info-center enable //关闭信息中心提示
Info: Information center is disabled.
[AC-1029]vlan batch 10 20 //创建vlan10,20
Info: This operation may take a few seconds. Please wait for a moment...done.	
[AC-1029]port-group ap //创建“ap”组
[AC-1029-port-group-ap]group-member GigabitEthernet 0/0/1 to GigabitEthernet 0/0
/2  //组成员是G1端口和G2端口
[AC-1029-port-group-ap]port link-type trunk //设置端口为trunk
[AC-1029-port-group-ap]port trunk allow-pass vlan 10 //允许vlan10通过
[AC-1029-port-group-ap]port trunk pvid vlan 10	//设置PVID值
[AC-1029-port-group-ap]undo  port trunk allow-pass vlan 1 //禁止vlan1通过
[AC-1029-port-group-ap]quit 
[AC-1029]interface Vlanif 10
[AC-1029-Vlanif10]ip address 192.168.10.254 24
[AC-1029-Vlanif10]dhcp  select interface 
[AC-1029-Vlanif10]quit 
[AC-1029]interface Vlanif 20
[AC-1029-Vlanif20]ip address  192.168.20.254 24
[AC-1029-Vlanif20]dhcp  select interface 	
[AC-1029-Vlanif20]quit 
[AC-1029]capwap source interface Vlanif 10 //配置源接口地址
[AC-1029]wlan //进入WLAN视图
[AC-1029-wlan-view]regulatory-domain-profile name domain1 //创建域名模板，名为“domain1”
[AC-1029-wlan-regulate-domain-domain1]country-code cn //设置国家码是CN
Info: The current country code is same with the input country code.	
[AC-1029-wlan-regulate-domain-domain1]quit 	
[AC-1029-wlan-view]ap-group name hydq //创建一个组，名“hydq”
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC-1029-wlan-ap-group-hydq]regulatory-domain-profile domain1
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y
[AC-1029-wlan-ap-group-hydq]quit 
[AC-1029-wlan-view]ap auth-mode mac-auth //设置ap上线的认证方式是Mac认证
[AC-1029-wlan-view]ap-id 0 ap-mac 00e0-fcba-7e40 //设置ap ID和它的Mac地址
[AC-1029-wlan-ap-0]ap-name factory1 //命名该ap
[AC-1029-wlan-ap-0]ap-group hydq //使得该ap加入hydq这个组
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-1029-wlan-ap-0]ap-id 1  ap-mac 00e0-fc9e-0ed0 //和上面同理
[AC-1029-wlan-ap-1]ap-name factory
[AC-1029-wlan-ap-1]ap-group hydq
Warning: This operation may cause AP reset. If the country code changes, it will
 clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC-1029-wlan-ap-1]

我们用命令查看AP上线情况

[AC-1029-wlan-ap-1]display ap all
Info: This operation may take a few seconds. Please wait for a moment.done.
Total AP information:
nor  : normal          [2]
--------------------------------------------------------------------------------
------------
ID   MAC            Name     Group IP            Type            State STA Uptim
e
--------------------------------------------------------------------------------
------------
0    00e0-fcba-7e40 factory1 hydq  192.168.10.78 AP4050DN-E      nor   0   2M:49
S
1    00e0-fc9e-0ed0 factory  hydq  192.168.10.1  AP4050DN-E      nor   0   1M:53
S
--------------------------------------------------------------------------------
------------
Total: 2
[AC-1029-wlan-ap-1]

 然后我们开始配置各种模板，使得AP正常工作

[AC-1029-wlan-ap-1]quit 	
[AC-1029-wlan-view]security-profile name hydq //创建安全模板，名为“hydq”
[AC-1029-wlan-sec-prof-hydq]security wpa-wpa2 psk pass-phrase liuxunyu1314 aes //配置WiFi密码，为liuxunyu1314
[AC-1029-wlan-sec-prof-hydq]quit 
[AC-1029-wlan-view]ssid-profile name hydq //创建ssid模板，名为“LXU1314”
[AC-1029-wlan-ssid-prof-hydq]ssid LXU1314
Info: This operation may take a few seconds, please wait.done.	
[AC-1029-wlan-ssid-prof-hydq]quit 	
[AC-1029-wlan-view]vap-profile name hydq	//创建VAP模板。名为“hydq”
[AC-1029-wlan-vap-prof-hydq]forward-mode tunnel //转发模式为隧道转发
Info: This operation may take a few seconds, please wait.done.	
[AC-1029-wlan-vap-prof-hydq]service-vlan vlan-id 20 //选择业务vlan是，vlan20
Info: This operation may take a few seconds, please wait.done.
[AC-1029-wlan-vap-prof-hydq]security-profile hydq //引用security模板,hydq
Info: This operation may take a few seconds, please wait.done.
[AC-1029-wlan-vap-prof-hydq]ssid-profile hydq //引用ssid模板，hydq
Info: This operation may take a few seconds, please wait.done.
[AC-1029-wlan-vap-prof-hydq]quit 
[AC-1029-wlan-view]ap-group name hydq //进入组，hydq
[AC-1029-wlan-ap-group-hydq]vap-profile hydq wlan 1 radio all //组里调用VAP模板，并配置射频，all里面包括，2.4Ghz和5Ghz

 

有两种方式可以实现业务vlan的用户无法访问AP管理地址以及各个AP的IP地址

在此之前：

traffic-filter的前身其实是traffic-policy ，由于日益增多的访问控制需求，华为公司简化了traffic-policy，就是traffic-filter的由来。

事实上，traffic-policy的功能更全面，traffic-filter则相对简单。

本次实验发现有个有趣的地方，在ENSP模拟器上面，接口下居然没有调用traffic-filter的这个命令，但是有traffic-policy 的选项，大概是不支持？不过我没有去真机环境中测试，所以引发了在vlanif下调用策略路由的血案。

traffic-filter（流量过滤），只需要配置了ACL，然后在接口或者vlanif下调用即可

traffic-policy（流量策略），这种方式稍微麻烦，却功能丰富。总体思路，配置流分类（classifier），配置流行为（behavior），配置流策略（traffic policy），在流策略里面引用流分类和流行为，这一点和AP在AC里面VAP模板调用security和SSID模板有异曲同工之妙。

第一种:调用traffic-filter

[AC-1029]acl	
[AC-1029]acl 3000	//创建高级acl，3000
[AC-1029-acl-adv-3000]step 3 //设置步长为3
[AC-1029-acl-adv-3000]rule deny ip source 192.168.20.0 0.0.0.255 destination 192
.168.10.0 0.0.0.255	//拒绝源是192.168.20.0的网段访问192.168.10.0的网段，掩码规则可以参考之前文章
[AC-1029-acl-adv-3000]quit 
[AC-1029]interface Vlanif 20 //进入vlanif20虚拟接口
[AC-1029-Vlanif20]traffic-filter inbound acl 3000 //在入方向调用策略acl3000

我们前后测试，发现实现了实验目的。

 

第二种:调用traffic-policy 

[AC-1029]traffic classifier test	//创建流分类，名为“test”
[AC-1029-classifier-test]if-match acl 3001 //匹配规则acl3000
[AC-1029-classifier-test]quit 	
[AC-1029]traffic behavior test	 //创建流行为，名为“test”
[AC-1029-behavior-test]deny //动作是拒绝	
[AC-1029-behavior-test]quit 
[AC-1029]traffic policy test //创建流策略，名为“test”
[AC-1029-trafficpolicy-test]classifier test behavior test 	//引用流分类和流行为
[AC-1029-trafficpolicy-test]quit 
[AC-1029]interface Vlanif 20
[AC-1029-Vlanif20]traffic-policy test inbound //在入方向调用策略“test”

然后测试

然后我们看到两种方式实现了我们的实验目的