实验拓扑
业务需求
企业用户通过WLAN接入网络,以满足移动办公的最基本需求。为了区分部门进行管理,不同部门的员工在不同的子网。且在覆盖区域内移动发生漫游时,不影响用户的业务使用。
LSW3
设置对应的vlan通过就行了,我们这里使用101和100的vlan
sys
#
sysname Switch_1
#
vlan batch 100 to 101
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100 101
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 100 101
#
return
LSW4
设置对应的vlan通过就行了,我们这里使用102和200的vlan
sys
#
sysname Switch_2
#
vlan batch 102 200
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 200
port trunk allow-pass vlan 102 200
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 102 200
#
return
AR1
sys
#
sysname Router
#
interface GigabitEthernet0/0/1
ip address 10.23.100.2 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 10.23.200.2 255.255.255.0
q
ip route-static 0.0.0.0 0 30.30.30.1
ip route-static 10.23.101.0 24 10.23.100.1
ip route-static 10.23.102.0 24 10.23.200.1
int g0/0/0
ip add 30.30.30.2 24
q
acl num 2000
rule per sou any
q
int g0/0/0
nat out 2000
!
AR2(用于模拟外网)
sys
sysn ar2
int g0/0/0
ip add 30.30.30.1 24
q
int loo 0
ip add 1.1.1.1 32
q
AC1
后续的操作需要等待ap上线后,前提是两端ac使用静态地址配通后,才可以实现跨ac的三层漫游,当然你使用其它的动态链路协议也可以,bgp,ospf都行,两端ac可以通讯就行了
sys
#
sysname AC_1
#
vlan batch 100 to 102
#
dhcp enable
#
interface Vlanif100
ip address 10.23.100.1 255.255.255.0
dhcp select interface
dhcp ser dns 114.114.114.114
dhcp ser ex 10.23.100.2
#
interface Vlanif101
ip address 10.23.101.1 255.255.255.0
dhcp select interface
dhcp ser dns 114.114.114.114
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/2
port link-type acc
port d v 100
#
ip route-static 10.23.200.0 255.255.255.0 10.23.100.2
ip route-static 0.0.0.0 0 10.23.100.2
#
capwap source interface vlanif100
#
wlan
ap auth no //这里一定要等待ap上线后才可以进行后续的操作
regulatory-domain-profile name guojia
country-code CN
ap-group name 101
regulatory-domain-profile guojia
y
q
ap-id 0
ap-group 101
y
q
ssid-profile name wifiname
ssid erceng
security-profile name passwd
security wpa2 psk pass-phrase 12345678 aes
y
vap-profile name 101
forward-mode tunnel
service-vlan vlan-id 101
ssid-profile wifiname
security-profile passwd
rrm-profile name rrm
smart-roam enable
smart-roam roam-threshold check-snr check-rate
smart-roam roam-threshold snr 30
smart-roam roam-threshold rate 30
radio-2g-profile name 2g
rrm-profile rrm
radio-5g-profile name 5g
rrm-profile rrm
ap-group name 101
radio 0
radio-2g-profile 2g
y
vap-profile 101 wlan 1
radio 1
radio-5g-profile 5g
y
vap-profile 101 wlan 1
!
mobility-group name mobility //主要靠这个ac漫游组
member ip-address 10.23.100.1
member ip-address 10.23.200.1 ac给ap上线分配地址的网关
q
AC2
后续的操作需要等待ap上线后,前提是两端ac使用静态地址配通后,才可以实现跨ac的三层漫游,当然你使用其它的动态链路协议也可以,bgp,ospf都行,两端ac可以通讯就行了
sys
#
sysname AC_2
#
vlan batch 101 to 102 200
#
dhcp enable
#
interface Vlanif200
ip address 10.23.200.1 255.255.255.0
dhcp select interface
dhcp ser dns 114.114.114.114
dhcp ser ex 10.23.200.2
#
interface Vlanif102
ip address 10.23.102.1 255.255.255.0
dhcp select interface
dhcp ser dns 114.114.114.114
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 102 200
#
interface GigabitEthernet0/0/2
port link-type acc
port def vlan 200
#
ip route-static 10.23.100.0 255.255.255.0 10.23.200.2
ip route-static 0.0.0.0 0 10.23.200.2
#
capwap source interface vlanif200
#
wlan
ap auth no
regulatory-domain-profile name guojia
country-code CN
ap-group name 102
regulatory-domain-profile guojia
y
q
ap-id 0
ap-group 102
y
q
ssid-profile name wifiname
ssid erceng
security-profile name passwd
security wpa2 psk pass-phrase 12345678 aes
y
vap-profile name 102
forward-mode tunnel
service-vlan vlan-id 102
ssid-profile wifiname
security-profile passwd
rrm-profile name rrm
smart-roam enable
smart-roam roam-threshold check-snr check-rate
smart-roam roam-threshold snr 30
smart-roam roam-threshold rate 30
radio-2g-profile name 2g
rrm-profile rrm
radio-5g-profile name 5g
rrm-profile rrm
ap-group name 102
radio 0
radio-2g-profile 2g
y
vap-profile 102 wlan 1
radio 1
radio-5g-profile 5g
y
vap-profile 102 wlan 1
!
mobility-group name mobility //主要就是靠这个ac漫游组来配置的
member ip-address 10.23.100.1 //ac给ap上线分配地址的网关
member ip-address 10.23.200.1
q
主要就是配置漫游组前提两台ac可以互相通讯
mobility-group name mobility //主要就是靠这个ac漫游组来配置的
member ip-address 10.23.100.1 //ac给ap上线分配地址的网关
member ip-address 10.23.200.1
最终效果,这里我们ping外网进行测试,wifi密码12345678