Radius無線動態(tài)VLAN配置-創(chuàng)新互聯(lián)

需求：各個部門使用無線的用戶，只能連接到部門所屬的VLAN。

創(chuàng)新互聯(lián)建站始終堅持【策劃先行，效果至上】的經(jīng)營理念，通過多達十年累計超上千家客戶的網(wǎng)站建設總結了一套系統(tǒng)有效的全網(wǎng)營銷推廣解決方案，現(xiàn)已廣泛運用于各行各業(yè)的客戶，其中包括：花箱等企業(yè)，備受客戶稱贊。

環(huán)境：

網(wǎng)絡設備：核心交換H3C S5500（192.168.10.254），接入層POE H3C S5130（192.168.10.253）， AC為H3C WX2560H（192.168.10.252），AP為WA4320；

服務器：域/DHCP服務器（192.168.20.1），NPS服務器(192.168.20.2)

VLAN分為10、20、30、40、50、60，其中10為網(wǎng)絡設備網(wǎng)段，20為Windows服務器網(wǎng)段，30為AP網(wǎng)段，40\50\60為用戶所屬生產(chǎn)網(wǎng)段；10\20\30由核心交換機分配地址，40\50\60由核心交換中繼到Windows DHCP服務器進行分配IP地址。

一、交換機配置：

核心交換S5500：

dis?cur #??version?7.1.045,?Release?3116 #??sysname?S5500 #??clock?timezone?Lisbon?add?00:00:00??clock?protocol?none #??telnet?server?enable #??irf?mac-address?persistent?timer??irf?auto-update?enable??undo?irf?link-delay??irf?member?1?priority?1 #??dhcp?enable??dhcp?server?forbidden-ip?192.168.10.1?192.168.10.10??dhcp?server?forbidden-ip?192.168.20.1?192.168.20.10 #??lldp?global?enable #??password-recovery?enable # vlan?1??????????# vlan?10 # vlan?20 # vlan?30 # vlan?40 # vlan?50 # vlan?60 #10??stp?global?enable # dhcp?server?ip-pool?10??gateway-list?192.168.10.254??network?192.168.10.0?mask?255.255.255.0??dns-list?192.168.20.1 # dhcp?server?ip-pool?20??gateway-list?192.168.20.254??network?192.168.20.0?mask?255.255.255.0??dns-list?192.168.20.1 # dhcp?server?ip-pool?30??????????????gateway-list?192.168.30.254??network?192.168.30.0?mask?255.255.255.0??dns-list?192.168.20.1??option?43?hex?8007000001c0a80afc????????????#AP網(wǎng)段為30，AC網(wǎng)段為10，AP跨網(wǎng)段注冊時在DHCP上要配置optin43選項，即AC的16進制地址 # interface?NULL0 # interface?Vlan-interface1??ip?address?192.168.0.233?255.255.255.0 # interface?Vlan-interface10??ip?address?192.168.10.254?255.255.255.0 # interface?Vlan-interface20??ip?address?192.168.20.254?255.255.255.0 # interface?Vlan-interface30??ip?address?192.168.30.254?255.255.255.0 # interface?Vlan-interface40??ip?address?192.168.40.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?Vlan-interface50??ip?address?192.168.50.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?Vlan-interface60??ip?address?192.168.60.254?255.255.255.0??dhcp?select?relay??dhcp?relay?server-address?192.168.20.1 # interface?GigabitEthernet1/0/1 # interface?GigabitEthernet1/0/2 # interface?GigabitEthernet1/0/3 # interface?GigabitEthernet1/0/4 # interface?GigabitEthernet1/0/5 # interface?GigabitEthernet1/0/6 # interface?GigabitEthernet1/0/7 # interface?GigabitEthernet1/0/8 # interface?GigabitEthernet1/0/9 # interface?GigabitEthernet1/0/10 # interface?GigabitEthernet1/0/11 # interface?GigabitEthernet1/0/12 # interface?GigabitEthernet1/0/13 # interface?GigabitEthernet1/0/14 # interface?GigabitEthernet1/0/15 # interface?GigabitEthernet1/0/16 #???????????????interface?GigabitEthernet1/0/17 #下聯(lián)S5130??port?link-type?trunk??port?trunk?permit?vlan?all??combo?enable?copper # interface?GigabitEthernet1/0/18 #下聯(lián)AC?WX2560H??port?link-type?trunk??port?trunk?permit?vlan?all??combo?enable?copper # interface?GigabitEthernet1/0/19??combo?enable?copper # interface?GigabitEthernet1/0/20??combo?enable?copper # interface?GigabitEthernet1/0/21??combo?enable?copper # interface?GigabitEthernet1/0/22??combo?enable?copper # interface?GigabitEthernet1/0/23??port?access?vlan?10??combo?enable?copper # interface?GigabitEthernet1/0/24??port?access?vlan?20??combo?enable?copper # interface?GigabitEthernet1/0/25 # interface?GigabitEthernet1/0/26 # interface?GigabitEthernet1/0/27 # interface?GigabitEthernet1/0/28 #??scheduler?logfile?size?16 # line?class?aux??user-role?network-admin # line?class?vty??user-role?network-operator #???????????????line?aux?0??user-role?network-admin # line?vty?0?63??authentication-mode?scheme??user-role?network-admin??user-role?network-operator??idle-timeout?0?0 #??snmp-agent??snmp-agent?local-engineid?800063A2803CF5CC29A26100000001??snmp-agent?community?write?private??snmp-agent?community?read?public??snmp-agent?sys-info?version?all??# domain?system #??aaa?session-limit?http?6??aaa?session-limit?https?6??domain?default?enable?system # role?name?level-0??description?Predefined?level-0?role # role?name?level-1??description?Predefined?level-1?role # role?name?level-2??description?Predefined?level-2?role # role?name?level-3??description?Predefined?level-3?role # role?name?level-4??description?Predefined?level-4?role # role?name?level-5??description?Predefined?level-5?role # role?name?level-6??description?Predefined?level-6?role # role?name?level-7??description?Predefined?level-7?role # role?name?level-8??description?Predefined?level-8?role # role?name?level-9??description?Predefined?level-9?role # role?name?level-10??description?Predefined?level-10?role # role?name?level-11??description?Predefined?level-11?role # role?name?level-12??description?Predefined?level-12?role # role?name?level-13??description?Predefined?level-13?role # role?name?level-14??description?Predefined?level-14?role # user-group?system # local-user?admin?class?manage??password?hash?$h$6$m6G0XrvVo3KCxzlo$ZiSUweumlOHswdjZOF9eac28c8rKCP4001GBXyfQp444n0ETJiRF6TJJNHE9Sh+eEChM11nlVTbZ5v6c8juKyA==??service-type?telnet?terminal?http?https??authorization-attribute?user-role?network-admin??authorization-attribute?user-role?network-operator #??netconf?soap?http?enable??netconf?soap?https?enable #??ip?http?enable??ip?https?enable # return

POE S5130：

具體配置省略，關鍵信息為： 1、開啟端口POE功能； 2、由于要配置AP自動上線，所以此交換機連接AP的端口模式均配置為access模式，VLAN為AP所屬VLAN30；

AC WX2560H:

dis?cur #??version?7.1.064,?Release?5215P01 #??sysname?WX2560H #??telnet?server?enable #??dot1x #啟用dot1x,配置802.1x系統(tǒng)認證方位為EAP??dot1x?authentication-method?eap #??password-recovery?enable # vlan?1 # vlan?10 # vlan?20 # vlan?30 # vlan?40 # vlan?50 #???????????????wlan?service-template?1 #無線模版配置??ssid?service1??akm?mode?dot1x??cipher-suite?ccmp??security-ie?rsn??client-security?authentication-mode?dot1x??dot1x?domain?dm01??service-template?enable # interface?NULL0 # interface?Vlan-interface1??ip?address?192.168.0.100?255.255.255.0 # interface?Vlan-interface10??ip?address?192.168.10.252?255.255.255.0 # interface?GigabitEthernet1/0/7??port?link-mode?route # interface?GigabitEthernet1/0/8??port?link-mode?route #???????????????interface?GigabitEthernet1/0/1 #AC上聯(lián)端口??port?link-mode?bridge??port?link-type?trunk??port?trunk?permit?vlan?all # interface?GigabitEthernet1/0/2??port?link-mode?bridge # interface?GigabitEthernet1/0/3??port?link-mode?bridge # interface?GigabitEthernet1/0/4??port?link-mode?bridge # interface?GigabitEthernet1/0/5??port?link-mode?bridge # interface?GigabitEthernet1/0/6??port?link-mode?bridge #??scheduler?logfile?size?16 # line?class?console??user-role?network-admin # line?class?vty??user-role?network-operator # line?con?0??user-role?network-admin # line?vty?0?31??authentication-mode?scheme??user-role?network-operator #??ip?route-static?192.168.10.0?24?192.168.10.254 #靜態(tài)路由??ip?route-static?192.168.20.0?24?192.168.10.254?????????#添加靜態(tài)路由，否則驗證無法通過??ip?route-static?192.168.30.0?24?192.168.10.254?????????#添加靜態(tài)路由，否則AP無法注冊至AC #??undo?info-center?logfile?enable #??radius?session-control?enable #使能radius?session-control功能 # radius?scheme?rd01 #新建radius服務，授權及認證服務器和密鑰??primary?authentication?192.168.20.2?key?cipher?$c$3$H/oG+QiqvYDHlrCjYQtLXoWoKXbOf9mSuU1N??primary?accounting?192.168.20.2?key?cipher?$c$3$4/xA5b5wob1GLTAt+J4pxJJf8NuaSzQOiYn2??key?authentication?cipher?$c$3$bCmB/bA01ZFxZnpa1xxpBCLeIZnQ2uhhp4Ee??key?accounting?cipher?$c$3$NXsfRNwLjlhQw0YMKdmAgf2L2oQFVFGGIGpp??nas-ip?192.168.10.252 #指定Nas-ip，即AC地址 # radius?dynamic-author?server??#開啟并配置Radius?DAE??client?ip?192.168.20.2?key?cipher?$c$3$GRXfDjXnWehlelAEC7r8/UOIFw9OYwzfwvZd # domain?dm01 #新建本地isp??authentication?lan-access?radius-scheme?rd01??authorization?lan-access?radius-scheme?rd01??accounting?lan-access?radius-scheme?rd01 # domain?system #??domain?default?enable?system # role?name?level-0??description?Predefined?level-0?role # role?name?level-1??description?Predefined?level-1?role # role?name?level-2??description?Predefined?level-2?role # role?name?level-3??description?Predefined?level-3?role # role?name?level-4??description?Predefined?level-4?role # role?name?level-5??description?Predefined?level-5?role # role?name?level-6??description?Predefined?level-6?role # role?name?level-7??description?Predefined?level-7?role # role?name?level-8??description?Predefined?level-8?role # role?name?level-9??description?Predefined?level-9?role # role?name?level-10??description?Predefined?level-10?role # role?name?level-11??description?Predefined?level-11?role # role?name?level-12??description?Predefined?level-12?role # role?name?level-13??description?Predefined?level-13?role # role?name?level-14??description?Predefined?level-14?role # user-group?system # local-user?admin?class?manage??password?hash?$h$6$D5QsfpSiuEZF2/U4$8Q1ajQ+0kHYMJjx5sJESu48zPA+O9o+txSM7JQP3MJP6o4DXCQ+PeGwqXGX39NRJZX8HsGSCC1YdCZJCtzUYsg==??service-type?telnet?http?https??authorization-attribute?user-role?network-admin #??ip?http?enable??ip?https?enable #??wlan?auto-ap?enable??wlan?auto-persistent?enable # wlan?global-configuration # wlan?ap-group?default-group??vlan?1 # wlan?ap?38ad-be58-d860?model?WA4320H???serial-id?219801A0YG8178E08438??radio?1??radio?2 # wlan?ap?38ad-be58-d6a0?model?WA4320H???serial-id?219801A0YG8178E08424??radio?1???radio?enable???service-template?1??radio?2????????#??cloud-management?server?domain?oasis.h4c.com # return

二、服務器配置

1、域服務器配置省略

常規(guī)安裝完畢域服務器后，安裝證書服務。

在AD服務器上配置證書服務：

Radius無線動態(tài)VLAN配置

添加證書頒發(fā)幾個和證書web注冊

Radius無線動態(tài)VLAN配置

證書服務安裝成功

Radius無線動態(tài)VLAN配置

在Radius服務器上申請證書

Radius無線動態(tài)VLAN配置

有效期為365天

Radius無線動態(tài)VLAN配置

2、Radius服務器配置

Radius服務器配置，分為四個部分。

2.1、新建共享模版

Radius無線動態(tài)VLAN配置

2.2、新建Radius客戶端。

Radius客戶端通常即為AC的地址，部分品牌使用軟AC的無線AP，Radius客戶端為所有AP的IP地址（此種情況下，需要把AP的地址設置為固定IP）

Radius無線動態(tài)VLAN配置

2.3、連接請求策略

連接請求策略和網(wǎng)絡策略互相對應的，通常情況下是一個部門（或一個VLAN）對應一條策略

Radius無線動態(tài)VLAN配置

2.3、網(wǎng)絡策略

網(wǎng)絡策略中，主要設置以下幾個重要的參數(shù)：

對應的安全組：此條策略對應的Windows組，通常為一個部門的安全組；

Radius無線動態(tài)VLAN配置

身份驗證方式：EAP類型

Radius無線動態(tài)VLAN配置

framed-protocol：PPP

service-type :framed

tunnel-medium-type：隧道承載媒介類型為802

tunnel-pvt-group-id：定義所屬的vlan

Radius無線動態(tài)VLAN配置

至此，Radius實現(xiàn)無線用戶動態(tài)VLAN配置完成。

另外有需要云服務器可以了解下創(chuàng)新互聯(lián)cdcxhl.cn，海內外云服務器15元起步，三天無理由+7*72小時售后在線，公司持有idc許可證，提供“云服務器、裸金屬服務器、高防服務器、香港服務器、美國服務器、虛擬主機、免備案服務器”等云主機租用服務以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡單易用、服務可用性高、性價比高”等特點與優(yōu)勢，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應用場景需求。

分享標題：Radius無線動態(tài)VLAN配置-創(chuàng)新互聯(lián)
新聞來源：http://weahome.cn/article/dggjho.html

真实的国产乱ⅩXXX66竹夫人,五月香六月婷婷激情综合,亚洲日本VA一区二区三区,亚洲精品一区二区三区麻豆

Radius無線動態(tài)VLAN配置-創(chuàng)新互聯(lián)

其他資訊

網(wǎng)站制作

企業(yè)服務

網(wǎng)站建設

服務器托管