需求：各個部門使用無線的用戶，只能連接到部門所屬的VLAN。

創(chuàng)新互聯(lián)建站始終堅持【策劃先行，效果至上】的經(jīng)營理念，通過多達(dá)十年累計超上千家客戶的網(wǎng)站建設(shè)總結(jié)了一套系統(tǒng)有效的全網(wǎng)營銷推廣解決方案，現(xiàn)已廣泛運用于各行各業(yè)的客戶，其中包括：花箱等企業(yè)，備受客戶稱贊。

環(huán)境：

網(wǎng)絡(luò)設(shè)備 ：核心交換H3C S5500（192.168.10.254），接入層POE H3C S5130（192.168.10.253）， AC為H3C WX2560H（192.168.10.252），AP為WA4320；

服務(wù)器：域/DHCP服務(wù)器（192.168.20.1），NPS服務(wù)器(192.168.20.2)

VLAN分為10、20、30、40、50、60，其中10為網(wǎng)絡(luò)設(shè)備網(wǎng)段，20為Windows服務(wù)器網(wǎng)段，30為AP網(wǎng)段，40\50\60為用戶所屬生產(chǎn)網(wǎng)段；10\20\30由核心交換機(jī)分配地址，40\50\60由核心交換中繼到Windows DHCP服務(wù)器進(jìn)行分配IP地址。

一、交換機(jī)配置：

核心交換S5500：

<S5500>dis?cur #??version?7.1.045,?Release?3116 #??sysname?S5500 #??clock?timezone?Lisbon?add?00:00:00??clock?protocol?none #??telnet?server?enable #??irf?mac-address?persistent?timer??irf?auto-update?enable??undo?irf?link-delay??irf?member?1?priority?1 #??dhcp?enable??dhcp?server?forbidden-ip?192.168.10.1?192.168.10.10??dhcp?server?forbidden-ip?192.168.20.1?192.168.20.10 #??lldp?global?enable #??password-recovery?enable # vlan?1??????????# vlan?10 # vlan?20 # vlan?30 # vlan?40 # vlan?50 # vlan?60 #10??stp?global?enable # dhcp?server?ip-pool?10??gateway-list?192.168.10.254??network?192.168.10.0?mask?255.255.255.0??dns-list?192.168.20.1 # dhcp?server?ip-pool?20??gateway-list?192.168.20.254??network?192.168.20.0?mask?255.255.255.0??dns-list?192.168.20.1 # dhcp?server?ip-pool?30??????????????gateway-list?192.168.30.254??network?192.168.30.0?mask?255.255.255.0??dns-list?192.168.20.1??option?43?hex?8007000001c0a80afc????????????#AP網(wǎng)段為30，AC網(wǎng)段為10，AP跨網(wǎng)段注冊時在DHCP上要配置optin43選項，即AC的16進(jìn)制地址 # interface?NULL0 # interface?Vlan-interface1??ip?address?192.168.0.233?255.255.255.0 # interface?Vlan-interface10??ip?address?192.168.10.254?255.255.255.0 # interface?Vlan-interface20??ip?address?192.168.20.254?255.255.255.0 # interface?Vlan-interface30??ip?address?192.168.30.254?255.255.255.0 # interface?Vlan-interface40??ip?address?192.168.40.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?Vlan-interface50??ip?address?192.168.50.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?Vlan-interface60??ip?address?192.168.60.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?GigabitEthernet1/0/1 # interface?GigabitEthernet1/0/2 # interface?GigabitEthernet1/0/3 # interface?GigabitEthernet1/0/4 # interface?GigabitEthernet1/0/5 # interface?GigabitEthernet1/0/6 # interface?GigabitEthernet1/0/7 # interface?GigabitEthernet1/0/8 # interface?GigabitEthernet1/0/9 # interface?GigabitEthernet1/0/10 # interface?GigabitEthernet1/0/11 # interface?GigabitEthernet1/0/12 # interface?GigabitEthernet1/0/13 # interface?GigabitEthernet1/0/14 # interface?GigabitEthernet1/0/15 # interface?GigabitEthernet1/0/16 #???????????????interface?GigabitEthernet1/0/17 #下聯(lián)S5130??port?link-type?trunk??port?trunk?permit?vlan?all??combo?enable?copper # interface?GigabitEthernet1/0/18 #下聯(lián)AC?WX2560H??port?link-type?trunk??port?trunk?permit?vlan?all??combo?enable?copper # interface?GigabitEthernet1/0/19??combo?enable?copper # interface?GigabitEthernet1/0/20??combo?enable?copper # interface?GigabitEthernet1/0/21??combo?enable?copper # interface?GigabitEthernet1/0/22??combo?enable?copper # interface?GigabitEthernet1/0/23??port?access?vlan?10??combo?enable?copper # interface?GigabitEthernet1/0/24??port?access?vlan?20??combo?enable?copper # interface?GigabitEthernet1/0/25 # interface?GigabitEthernet1/0/26 # interface?GigabitEthernet1/0/27 # interface?GigabitEthernet1/0/28 #??scheduler?logfile?size?16 # line?class?aux??user-role?network-admin # line?class?vty??user-role?network-operator #???????????????line?aux?0??user-role?network-admin # line?vty?0?63??authentication-mode?scheme??user-role?network-admin??user-role?network-operator??idle-timeout?0?0 #??snmp-agent??snmp-agent?local-engineid?800063A2803CF5CC29A26100000001??snmp-agent?community?write?private??snmp-agent?community?read?public??snmp-agent?sys-info?version?all??# domain?system #??aaa?session-limit?http?6??aaa?session-limit?https?6??domain?default?enable?system # role?name?level-0??description?Predefined?level-0?role # role?name?level-1??description?Predefined?level-1?role # role?name?level-2??description?Predefined?level-2?role # role?name?level-3??description?Predefined?level-3?role # role?name?level-4??description?Predefined?level-4?role # role?name?level-5??description?Predefined?level-5?role # role?name?level-6??description?Predefined?level-6?role # role?name?level-7??description?Predefined?level-7?role # role?name?level-8??description?Predefined?level-8?role # role?name?level-9??description?Predefined?level-9?role # role?name?level-10??description?Predefined?level-10?role # role?name?level-11??description?Predefined?level-11?role # role?name?level-12??description?Predefined?level-12?role # role?name?level-13??description?Predefined?level-13?role # role?name?level-14??description?Predefined?level-14?role # user-group?system # local-user?admin?class?manage??password?hash?$h$6$m6G0XrvVo3KCxzlo$ZiSUweumlOHswdjZOF9eac28c8rKCP4001GBXyfQp444n0ETJiRF6TJJNHE9Sh+eEChM11nlVTbZ5v6c8juKyA==??service-type?telnet?terminal?http?https??authorization-attribute?user-role?network-admin??authorization-attribute?user-role?network-operator #??netconf?soap?http?enable??netconf?soap?https?enable #??ip?http?enable??ip?https?enable # return <S5500>

POE S5130：

具體配置省略，關(guān)鍵信息為： 1、開啟端口POE功能； 2、由于要配置AP自動上線，所以此交換機(jī)連接AP的端口模式均配置為access模式，VLAN為AP所屬VLAN30；

AC WX2560H:

<WX2560H>dis?cur #??version?7.1.064,?Release?5215P01 #??sysname?WX2560H #??telnet?server?enable #??dot1x #啟用dot1x,配置802.1x系統(tǒng)認(rèn)證方位為EAP??dot1x?authentication-method?eap #??password-recovery?enable # vlan?1 # vlan?10 # vlan?20 # vlan?30 # vlan?40 # vlan?50 #???????????????wlan?service-template?1 #無線模版配置??ssid?service1??akm?mode?dot1x??cipher-suite?ccmp??security-ie?rsn??client-security?authentication-mode?dot1x??dot1x?domain?dm01??service-template?enable # interface?NULL0 # interface?Vlan-interface1??ip?address?192.168.0.100?255.255.255.0 # interface?Vlan-interface10??ip?address?192.168.10.252?255.255.255.0 # interface?GigabitEthernet1/0/7??port?link-mode?route # interface?GigabitEthernet1/0/8??port?link-mode?route #???????????????interface?GigabitEthernet1/0/1 #AC上聯(lián)端口??port?link-mode?bridge??port?link-type?trunk??port?trunk?permit?vlan?all # interface?GigabitEthernet1/0/2??port?link-mode?bridge # interface?GigabitEthernet1/0/3??port?link-mode?bridge # interface?GigabitEthernet1/0/4??port?link-mode?bridge # interface?GigabitEthernet1/0/5??port?link-mode?bridge # interface?GigabitEthernet1/0/6??port?link-mode?bridge #??scheduler?logfile?size?16 # line?class?console??user-role?network-admin # line?class?vty??user-role?network-operator # line?con?0??user-role?network-admin # line?vty?0?31??authentication-mode?scheme??user-role?network-operator #??ip?route-static?192.168.10.0?24?192.168.10.254 #靜態(tài)路由??ip?route-static?192.168.20.0?24?192.168.10.254?????????#添加靜態(tài)路由，否則驗證無法通過??ip?route-static?192.168.30.0?24?192.168.10.254?????????#添加靜態(tài)路由，否則AP無法注冊至AC #??undo?info-center?logfile?enable #??radius?session-control?enable #使能radius?session-control功能 # radius?scheme?rd01 #新建radius服務(wù)，授權(quán)及認(rèn)證服務(wù)器和密鑰??primary?authentication?192.168.20.2?key?cipher?$c$3$H/oG+QiqvYDHlrCjYQtLXoWoKXbOf9mSuU1N??primary?accounting?192.168.20.2?key?cipher?$c$3$4/xA5b5wob1GLTAt+J4pxJJf8NuaSzQOiYn2??key?authentication?cipher?$c$3$bCmB/bA01ZFxZnpa1xxpBCLeIZnQ2uhhp4Ee??key?accounting?cipher?$c$3$NXsfRNwLjlhQw0YMKdmAgf2L2oQFVFGGIGpp??nas-ip?192.168.10.252 #指定Nas-ip，即AC地址 # radius?dynamic-author?server??#開啟并配置Radius?DAE??client?ip?192.168.20.2?key?cipher?$c$3$GRXfDjXnWehlelAEC7r8/UOIFw9OYwzfwvZd # domain?dm01 #新建本地isp??authentication?lan-access?radius-scheme?rd01??authorization?lan-access?radius-scheme?rd01??accounting?lan-access?radius-scheme?rd01 # domain?system #??domain?default?enable?system # role?name?level-0??description?Predefined?level-0?role # role?name?level-1??description?Predefined?level-1?role # role?name?level-2??description?Predefined?level-2?role # role?name?level-3??description?Predefined?level-3?role # role?name?level-4??description?Predefined?level-4?role # role?name?level-5??description?Predefined?level-5?role # role?name?level-6??description?Predefined?level-6?role # role?name?level-7??description?Predefined?level-7?role # role?name?level-8??description?Predefined?level-8?role # role?name?level-9??description?Predefined?level-9?role # role?name?level-10??description?Predefined?level-10?role # role?name?level-11??description?Predefined?level-11?role # role?name?level-12??description?Predefined?level-12?role # role?name?level-13??description?Predefined?level-13?role # role?name?level-14??description?Predefined?level-14?role # user-group?system # local-user?admin?class?manage??password?hash?$h$6$D5QsfpSiuEZF2/U4$8Q1ajQ+0kHYMJjx5sJESu48zPA+O9o+txSM7JQP3MJP6o4DXCQ+PeGwqXGX39NRJZX8HsGSCC1YdCZJCtzUYsg==??service-type?telnet?http?https??authorization-attribute?user-role?network-admin #??ip?http?enable??ip?https?enable #??wlan?auto-ap?enable??wlan?auto-persistent?enable # wlan?global-configuration # wlan?ap-group?default-group??vlan?1 # wlan?ap?38ad-be58-d860?model?WA4320H???serial-id?219801A0YG8178E08438??radio?1??radio?2 # wlan?ap?38ad-be58-d6a0?model?WA4320H???serial-id?219801A0YG8178E08424??radio?1???radio?enable???service-template?1??radio?2????????#??cloud-management?server?domain?oasis.h4c.com # return <WX2560H>

二、服務(wù)器配置

1、域服務(wù)器配置省略

常規(guī)安裝完畢域服務(wù)器后，安裝證書服務(wù)。

在AD服務(wù)器上配置證書服務(wù)：

添加證書頒發(fā)幾個和證書web注冊

證書服務(wù)安裝成功

在Radius服務(wù)器上申請證書

有效期為365天

2、Radius服務(wù)器配置

Radius服務(wù)器配置，分為四個部分。

2.1、新建共享模版

2.2、新建Radius客戶端。

Radius客戶端通常即為AC的地址，部分品牌使用軟AC的無線AP，Radius客戶端為所有AP的IP地址（此種情況下，需要把AP的地址設(shè)置為固定IP）

2.3、連接請求策略

連接請求策略和網(wǎng)絡(luò)策略互相對應(yīng)的，通常情況下是一個部門（或一個VLAN）對應(yīng)一條策略

2.3、網(wǎng)絡(luò)策略

網(wǎng)絡(luò)策略中，主要設(shè)置以下幾個重要的參數(shù)：

對應(yīng)的安全組：此條策略對應(yīng)的Windows組，通常為一個部門的安全組；

身份驗證方式：EAP類型

framed-protocol：PPP

service-type :framed

tunnel-medium-type： 隧道承載媒介類型為802

tunnel-pvt-group-id：定義所屬的vlan

至此，Radius實現(xiàn)無線用戶動態(tài)VLAN配置完成。

另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)cdcxhl.cn，海內(nèi)外云服務(wù)器15元起步，三天無理由+7*72小時售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡單易用、服務(wù)可用性高、性價比高”等特點與優(yōu)勢，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場景需求。

文章標(biāo)題：Radius無線動態(tài)VLAN配置-創(chuàng)新互聯(lián)
轉(zhuǎn)載來于：http://chinadenli.net/article40/dggjho.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供服務(wù)器托管、手機(jī)網(wǎng)站建設(shè)、建站公司、動態(tài)網(wǎng)站、全網(wǎng)營銷推廣、標(biāo)簽優(yōu)化

廣告

聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請盡快告知，我們將會在第一時間刪除。文章觀點不代表本網(wǎng)站立場，如需處理請聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時需注明來源： 創(chuàng)新互聯(lián)