ciscoAP配置

最新推荐文章于 2024-03-22 15:01:58 发布

凯歌响起

最新推荐文章于 2024-03-22 15:01:58 发布

阅读量1.4w

点赞数 4

分类专栏： # 路由交换文章标签： ios

本文链接：https://blog.csdn.net/a13554371686/article/details/126283255

版权

路由交换专栏收录该内容

27 篇文章 10 订阅

订阅专栏

Cisco无线瘦AP配置

1.查看AP系统版本、Flash等信息

AP# show version
AP# dir
Directory of flash:/
  2  -rwx      64  Jan 18 2016 08:34:20 +00:00  sensord_CSPRNG0
  3  -rwx    58733  Jan 18 2016 08:34:25 +00:00  event.log
  4  -rwx     378  Oct 8 2016 02:44:56 +00:00  env_vars
  5  drwx      0  Mar 1 1993 00:01:05 +00:00  configs
  6  -rwx      74  Oct 8 2016 02:44:56 +00:00  capwap-saved-config
  7  drwx     2176  Jan 18 2016 08:23:01 +00:00  ap3g2-k9w8-mx.153-3.JA
  75  -rwx     965  Aug 16 2016 08:16:47 +00:00  lwapp_mm_mwar_hash.cfg
  76  -rwx      64  Sep 30 2016 10:51:40 +00:00  sensord_CSPRNG1
  77  -rwx     7192  Oct 8 2016 02:44:57 +00:00  private-multiple-fs
  78  -rwx      62  Jan 18 2016 08:27:02 +00:00  mesh_cfg.txt
  79  -rwx      85  Jan 18 2016 08:27:02 +00:00  mesh_port_cfg.txt

40900608 bytes total (21235712 bytes free)

注：这个AP使用过，重新配置前最好清空以前配置。即删除除红色字体以外的全部文件，清空AP配置。

ap# delete flash:文件名 /删除文件，清空配置信息

如果需更换IOS，需查看flash剩余空间，如空间不足，需删除现有IOS再重新导入新IOS。

查看AP的证书

MIC 厂商预安装
SSC 自签名证书

show crypto pki certificates

2.配置瘦AP

ap# lwapp ap ip address 172.17.40.69 255.255.255.0   /配置AP的IP地址
ap# lwapp ap ip default-gateway 172.17.40.1   /配置网关
ap# lwapp ap controller ip address 172.17.3.33   /配置控制器IP地址
配置完成后将AP接入网络

3.检查配置

ap# show ip interface b   /查看AP的IP地址
ap# show capwap ip config   /查看AP的配置信息

ap# ping 172.17.3.33   ping控制器地址
ap# ping 172.17.40.1   ping网关

4.总结

总的来说，瘦AP配置相当简单，只要IP，Gateway，Controller IP配置OK，AP会自动注册到控制器，然后从控制器download最新配置文件到AP本地，AP自动重启后就可以正常使用了，后续其它管理操作全部在控制器上完成即可，控制器配置在这里就不说明了。

附：Cisco3702 AP相关命令输出

AP# show version
Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JA, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Fri 15-Aug-14 12:22 by prod_rel_team
 
ROM: Bootstrap program is C3700 boot loader
BOOTLDR: C3700 Boot Loader (AP3G2-BOOT-M), Version 15.2 [mpleso-v152_4_jb_throttle_31101 103]
 
AP uptime is 1 hour, 57 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g2-k9w8-mx.153-3.JA/ap3g2-k9w8-xx.153-3.JA"
Last reload reason:
 
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
 
A summary of U.S. laws governing Cisco cryptographic products may be found at:

If you require further assistance please contact us by sending email to
export@cisco.com.
 
cisco AIR-CAP3702E-H-K9 (PowerPC) processor (revision A0) with 376810K/134656K bytes of memory.
Processor board ID FGL1941X3RQ
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.100.0
1 Gigabit Ethernet interface
2 802.11 Radios
 
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: E4:AA:5D:D9:5E:C4
Part Number                          : 73-15397-01
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC19376Y4C
Top Assembly Part Number             : 068-05055-06
Top Assembly Serial Number           : FGL1941X3RQ
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP3702E-H-K9
 
Configuration register is 0xF

AP# show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
BVI1                       172.17.40.69    YES TFTP   up                    up
Dot11Radio0                unassigned      NO  unset  up                    up
Dot11Radio1                unassigned      NO  unset  administratively down down
GigabitEthernet0           unassigned      NO  unset  up                    up

AP# show capwap ip config

LWAPP Static IP Configuration
IP Address         172.17.40.69
IP netmask         255.255.255.0
Default Gateway    172.17.40.1
Primary Controller 172.17.3.33

Cisco 胖AP桥接配置实例

桥接网络一般是解决光纤无法到达的无奈之举，Cisco的桥接链路技术比较成熟，稳定性实测还可以，用的也很普遍。

本文介绍Cisco FAT AP桥接配置实例，我使用的是3台Cisco 1532E 胖AP，软件版本是C1530 Software (ap1g3-K9W7-M), Version 15.2(4)JB3b，其它版本也应该通用。

配置实例

本文只列举了5.8G桥接的主要配置信息，2.4G桥接同理。

逻辑拓扑图

在这里插入图片描述

root AP配置

dot11 ssid TEST5G
   authentication open 
   authentication key-management wpa version 2
   wpa-psk ascii passwd5G
 
interface Dot11Radio1
 no ip address
 encryption mode ciphers aes-ccm
 ssid TEST5G
 antenna gain 0
 peakdetect
 dfs band 3 block
 packet retries 64 drop-packet
 channel 5765
 station-role root bridge
 bridge-group 1
 bridge-group 1 spanning-disabled
 
interface BVI1
 ip address 172.17.50.111 255.255.255.0
 
ip default-gateway 172.17.50.1

其它常规配置：略

以上配置的SSID，加密类型，channel，station-role 可根据需要自行修改。

station-role几种常用的选择如下：

station-role root bridge

station-role root bridge wireless-clients

station-role root access-point

station-role root ap-only

mesh1 AP配置

dot11 ssid TEST5G
   authentication open 
   authentication key-management wpa version 2
   wpa-psk ascii passwd5G
 
interface Dot11Radio1
 no ip address
 encryption mode ciphers aes-ccm 
 ssid TEST5G
 antenna gain 0
 peakdetect
 packet retries 64 drop-packet
 station-role non-root bridge
 bridge-group 1
 bridge-group 1 spanning-disabled
 
interface BVI1
 ip address 172.17.50.222 255.255.255.0
 
ip default-gateway 172.17.50.1

其它常规配置：略

以上配置的SSID，加密类型，station-role 同样也可根据需要自行修改。

station-role几种常用的选择如下：

station-role non-root bridge

station-role non-root bridge wireless-clients

station-role non-root wireless-clients

station-role workgroup-bridge

mesh2 AP配置

同mesh1 AP配置，略

桥接链路检查

配置完成后，在root AP上查看，可以看到我的两台mesh AP都已桥接到root AP上。

Root-1532E#show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, 
                  D - Remote, C - CVTA, M - Two-port Mac Relay 
 
Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
Mesh1-1532E  Vi-Dot11 1         147             T I   AIR-SAP15 Vi-Dot11 0
Mesh2-1532E   Vi-Dot11 0         167             T I   AIR-SAP15 Vi-Dot11 0

测试桥接链路信号质量

Root-1532E#show dot11 associations

802.11 Client Stations on Dot11Radio1: 
SSID [WPWGB5G] : 
MAC Address    IP address      IPV6 address                           Device        Name            Parent         State     
bc16.f59e.xxx1 0.0.0.0         ::                                     Br-client     -               bc16.f5a0.xxx1 Assoc    
bc16.f5a0.xxx2 172.17.50.107   ::                                     bridge        Mesh1-1532E  self           Assoc    
bc16.f5a1.xxx3 172.17.50.110   ::                                     bridge         Mesh2-1532E self           Assoc

Root-1532E#dot11 dot11Radio 1 linktest target bc16.f5a0.xxx2

Root-1532E#terminal monitor

Root-1532E#dot11 dot11Radio 1 linktest

Start linktest to  bc16.f5a0.xxx2, 100 512 byte packets
 
GOOD (2  % retries)  Time   Strength(dBm)   SNR      SNR          Retries
                     msec      In     Out    In      Out         In   Out
      Sent : 100, Avg   0    -  28    - 31    58       56   Tot:   0     4
Lost to Tgt:   0, Max   4    -  28    - 31    59       57   Max:   0     1
Lost to Src:   0, Min   0    -  29    - 33    58       55
Rates (Src/Tgt)     mcs4 100/100
Linktest Done in 0.084 msec

通过以上测试，就可以知道Root AP和Mesh AP的信号强度，信噪比，重传率等信息。

Cisco瘦AP转胖AP

思科瘦AP转胖AP

准备工作

1.电脑安装tftp工具，如tftpd32，3CDaemon等。

2.将胖AP ios下载后放在tftp工具设置的文件目录下。ios需要根据要求改成****.default后缀的文件名，比如1532要改为：ap1g3-k9w7-tar.default

3.PC以太网口连接AP，PC配置10.0.0.x网段的IP地址，掩码255.255.255.0，因为AP初始IP为10.0.0.1

4.Console线连接AP，保证PC能通过console管理AP。

思科瘦AP转胖AP

1.准备工作做好后，断开AP电源。

2.按住AP上的mode键，不放，接上电源，通电。

3.按住约20s左右，直到出现button is pressed, wait for button to be released...提示，继续按住至少5秒。

4.松开mode键，等待新ios上传，上传时间根据ios大小的而不同，约10min左右。瘦转胖完成后，AP会自动重启。

5.登录新的ios系统，通过show version检查系统版本，show boot检查系统启动项。

6.对于思科1242等比较老旧的AP，瘦转胖的过程中按住mode键时，console窗口不会输出任何信息，因此只能通过AP的状态灯来判断松开mode键的时间，一般有橙色变紫红色时，松开mode键即可，整个按住的时间也差不多为20s。

7.附：升级过程

button pressed for 30 seconds
process_config_recovery: set IP address and config to default 10.0.0.1
process_config_recovery: image recovery
image_recovery: Download default IOS tar image tftp://255.255.255.255/ap1g3-k9w7-tar.default

examining image...
extracting info (285 bytes)
Image info:
    Version Suffix: k9w7-.152-4.JB3b
    Image Name: ap1g3-k9w7-mx.152-4.JB3b
    Version Directory: ap1g3-k9w7-mx.152-4.JB3b
    Ios Image Size: 12227072
    Total Image Size: 13169152
    Image Feature: WIRELESS LAN
    Image Family: ap1g3
    Wireless Switch Management Version: 7.6.9a5.12
Extracting files...
ap1g3-k9w7-mx.152-4.JB3b/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/level/ (directory) 0 (bytes)
ap1g3-k9w7-mx.152-4.JB3b/html/level/1/ (directory) 0 (bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/appsui.js (563 bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/back.shtml (512 bytes)
extracting ap1g3-k9w7-mx.152-4.JB3b/html/level/1/cookies.js (5032 bytes)
....
New software image installed in flash:/ap1g3-k9w7-mx.152-4.JB3b
Configuring system to use new image...done.
Requested system reload in progress...download took about 449 seconds
Loading "flash:/ap1g3-k9w7-mx.152-4.JB3b/ap1g3-k9w7-mx.152-4.JB3b"...########################################################################################################################################################################################

ap#show version

Cisco胖AP转瘦AP

思科胖AP转瘦AP，Cisco1242胖AP转瘦AP，Cisco1532胖AP转瘦AP，Cisco3702胖AP转瘦AP，Cisco AP胖转瘦

准备工作

1.tftp工具，如tftpd32，3CDaemon等。

2.PC以太网口连接AP，PC配置10.0.0.x网段的IP地址，掩码255.255.255.0，因为AP初始IP为10.0.0.1。

3.Console线连接AP，保证PC能通过console管理AP。

思科胖AP转瘦AP

1.登录胖AP，进入特权模式，默认密码均为Cisco。

2.输入以下命令archive download-sw /overwrite /create-space tftp://10.0.0.2/ap3g2-k9w8-tar.153-3.JD.tar，上传ios。

ap#archive download-sw /overwrite /create-space  tftp://10.0.0.2/ap3g2-k9w8-tar.153-3.JD.tar     
examining image...
Loading ap3g2-k9w8-tar.153-3.JD.tar from 10.0.0.2 (via BVI1): !
extracting info (285 bytes)
Image info:
    Version Suffix: k9w8-.153-3.JD
    Image Name: ap3g2-k9w8-mx.153-3.JD
    Version Directory: ap3g2-k9w8-mx.153-3.JD
    Ios Image Size: 12861952
    Total Image Size: 15022592
    Image Feature: WIRELESS LAN|LWAPP
    Image Family: AP3G2
    Wireless Switch Management Version: 8.3.102.0
Extracting files...
ap3g2-k9w8-mx.153-3.JD/ (directory) 0 (bytes)O
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD (215867 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-tx.153-3.JD (73 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-bl-2600 (190140 bytes)!
extracting ap3g2-k9w8-mx.153-3.JD/ap3g2-bl-3600 (189183 bytes)!
ap3g2-k9w8-mx.153-3.JD/html/ (directory) 0 (bytes)
ap3g2-k9w8-mx.153-3.JD/html/level/ (directory) 0 (bytes)
ap3g2-k9w8-mx.153-3.JD/html/level/1/ (directory) 0 (bytes)
extracting ap3g2-k9w8-mx.153-3.JD/html/level/1/appsui.js (563 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/html/level/1/back.shtml (512 bytes)
.......

即可看到ios已经在上传中。

在这里插入图片描述

3.ios上传完成。

......
extracting ap3g2-k9w8-mx.153-3.JD/final_hash.sig (513 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/img_sign_rel.cert (1375 bytes)
extracting ap3g2-k9w8-mx.153-3.JD/img_sign_rel_sha2.cert (1371 bytes)
extracting info.ver (285 bytes)
[OK - 15042560 bytes]
 
Deleting current version: flash:/ap3g2-k9w7-mx.152-4.JB6...
Set booting path to recovery image: ''...done.
New software image installed in flash:/ap3g2-k9w8-mx.153-3.JD
Configuring system to use new image...done.
archive download: takes 265 seconds

4.检查系统启动项，保存，重启。

ap#show boot 
BOOT path-list:      flash:/ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD
Config file:         flash:/config.txt
Private Config file: flash:/private-config
Enable Break:        yes
Manual Boot:         no
Enable IOS Break:    no
HELPER path-list:    
NVRAM/Config file
      buffer size:   32768
      Mode Button:    on
Radio Core TFTP:

5.重启完成，查看AP版本，已成功由胖AP转换为瘦AP。

AP843d.c618.aff0#show version 
Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JD, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 29-Jul-16 04:06 by prod_rel_team

思科胖AP转瘦AP另一种方法

对于部分新的AP，默认自带了两种ios，胖瘦都有。如果初始是胖AP，需要转换成瘦AP，有简单方法。

1.进入配置模式

2.boot system flash:/******* 瘦ios路径

比如：

3702AP#configure terminal
3702AP(config)#boot system flash:/ap3g2-k9w8-mx.153-3.JD/ap3g2-k9w8-mx.153-3.JD

3.show boot检查一下。

4.保存，重启。转换完成。

Cisco胖AP配置

Cisco胖AP配置，思科胖AP配置，思科AP配置，思科AP常用配置，思科AP配置实例

主要配置命令

hostname ap   /设置AP名
dot11 ssid AP-N2  /设置SSID（AP-N2为SSID号）
authentication open  /认证开放
authentication key-management wpa version 2   /认证密钥版本为WPA版本2
guest-mode  /显示SSID，no guest-mode表示隐藏SSID
wpa-psk ascii 123456789    /SSID登陆密钥设置（123456789为密钥）
exit

interface dot11radio0    /进入2.4G接口
encryption mode ciphers aes-ccm   /加密密码AES CCM模式
ssid AP-N2    /加入SSID AP-N2
power local maximum  /设置AP信号发射功率，默认可不配置
no shutdown      /开启端口
exit


interface dot11radio1    /进入5.8G接口
encryption mode ciphers aes-ccm    /加密密码AES CCM模式
ssid AP-N2    /加入SSID AP-N2
power local maximum  /设置AP信号发射功率，默认可不配置
no shutdown      /开启端口
exit


interface BVI1  进入管理接口
ip address 192.168.0.191 255.255.255.0      /配置接口IP地址
no shutdown      /开启端口
ip default-gateway 192.168.0.1   /配置网关

配置范例

version 15.2
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname test-ap
!
logging rate-limit console 9
enable secret 5 $5$4fXI$i1Zl2wBy24uDQd2j2Tuf41
!
no aaa new-model
clock timezone BeiJing 8 0
no ip source-route
no ip cef
!
dot11 syslog
!
dot11 ssid testssid
  authentication open 
  authentication key-management wpa version 2
  guest-mode
  wpa-psk ascii 7 1443130D010939102541
!
dot11 guest
!
username myname secret 5 $4$7p8Z$yjeef33iW422J3bDrdN8Q/
!
bridge irb
!
interface Dot11Radio0
 no ip address
 no shutdown
 !
 encryption mode ciphers aes-ccm 
 !
 ssid testssid
 !
 antenna gain 0
 power local maximum
 packet retries 64 drop-packet
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1
 no ip address
 !
 encryption mode ciphers aes-ccm 
 !
 ssid testssid
 !
 no shutdown
 !
 antenna gain 0
 power local maximum
 peakdetect
 dfs band 3 block
 packet retries 64 drop-packet
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet1
 no ip address
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 192.168.0.16 255.255.255.0
 ipv6 address dhcp
 ipv6 address autoconfig
 ipv6 enable
!
ip default-gateway 192.168.0.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
snmp-server community public RO
bridge 1 route ip
!
line con 0
line vty 0 4
 login local
 transport input all
!
sntp server 192.168.0.1
end