AC+AP配置

AC+AP实验、

实验拓扑

公司WiFi网段192.168.2.0/24

访客WiFi网段192.168.3.0/24

SW1配置

sys
sys SW1
vlan batch 2 to 4
int Eth-Trunk 1
port link-type trunk
port trunk allow-pass vlan 2 to 4
trunkport g0/0/1
trunkport g0/0/2

int g0/0/3
port link-type trunk
port trunk allow-pass vlan 4
int g0/0/4
port link-type access
port default vlan 2

int vlanif 2
ip add 192.168.2.254 24
int vlanif 3
ip add 192.168.3.254 24

quit
dhcp enable
ip pool pool2
gateway-list 192.168.2.254
network 192.168.2.0 mask 24
excluded-ip-address 192.168.2.253
lease day 1
int vlanif 2
dhcp select global

ip pool pool3
gateway-list 192.168.3.254
network 192.168.3.0 mask 24
lease day 1
int vlanif 3
dhcp select global

SW1上配置限制公司、访客网限制互访

acl 3000
rule 5 deny ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
rule 10 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
rule 15 permit ip

int Eth-Trunk 1
traffic-filter inbound acl 3000

SW2配置

sys
sys SW2
vlan batch 2 to 4
int e0/0/1
port link-type trunk 
port trunk allow-pass vlan 2 to 4
int e0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4

int Eth-Trunk 1
port link-type trunk
port trunk allow-pass vlan 2 to 4
trunkport g0/0/1
trunkport g0/0/2

AC配置

sys
sys AC1
vlan 4
dhcp enable
ip pool pool4
gateway-list 192.168.4.254
network 192.168.4.0 mask 24
int vlanif 4
ip address 192.168.4.254 24
dhcp select global

int g0/0/1
port link-type trunk
port trunk pvid vlan 4
port trunk allow-pass vlan 4

AC核心配置

capwap source interface vlanif 4
wlan
security-profile name wlan1-security
security wpa2 psk pass-phrase 12345678 aes

security-profile name wlan2-security
security wpa2 psk pass-phrase 88888888 aes

ssid-profile name wlan1-ssid
ssid GSWIFI
ssid-profile name wlan2-ssid
ssid FKWIFI

ssid-profile name wlan3-ssid
ssid GSWIFI-2
ssid-profile name wlan4-ssid
ssid FKWIFI-2

vap-profile name wlan1-vap
service-vlan vlan-id 2
ssid-profile wlan1-ssid
security-profile wlan1-security

vap-profile name wlan2-vap
service-vlan vlan-id 3
ssid-profile wlan2-ssid
security-profile wlan2-security

vap-profile name wlan3-vap
service-vlan vlan-id 2
ssid-profile wlan3-ssid
security-profile wlan1-security

vap-profile name wlan4-vap
service-vlan vlan-id 3
ssid-profile wlan4-ssid
security-profile wlan2-security

ap-group name ap-group
radio 0
vap-profile wlan1-vap wlan 1
vap-profile wlan2-vap wlan 2
radio 1
vap-profile wlan3-vap wlan 3
vap-profile wlan4-vap wlan 4

ap-id 0 ap-mac 00E0-FC40-61A0
ap-name area1
ap-group ap-group

ap-id 1 ap-mac 00E0-FCD9-2120
ap-name area2
ap-group ap-group