V5版本无线ac配置本地mac认证案例

组网图

图1-2 启动MAC地址认证对接入用户进行本地认证

3. 配置步骤

(1)      在AC上配置本地MAC地址认证

# 添加本地接入用户。用户名和密码均为接入用户的MAC地址00-e0-fc-12-34-56，服务类型为lan-access。

<AC> system-view

[AC] local-user 00-e0-fc-12-34-56

[AC-luser-00-e0-fc-12-34-56] password simple 00-e0-fc-12-34-56

[AC-luser-00-e0-fc-12-34-56] service-type lan-access

[AC-luser-00-e0-fc-12-34-56] quit

# 配置ISP域，使用本地认证方式。

[AC] domain ***.***

[AC-isp-***.***] authentication lan-access local

[AC-isp-***.***] quit

# 配置MAC地址认证用户所使用的ISP域。

[AC] mac-authentication domain ***.***

# 配置MAC地址认证的定时器。

[AC] mac-authentication timer offline-detect 180

[AC] mac-authentication timer quiet 180

# 配置MAC地址认证用户名格式：使用带连字符的MAC地址作为用户名与密码，其中字母小写。

[AC] mac-authentication user-name-format mac-address with-hyphen lowercase

# 使能端口安全。

[AC] port-security enable

# 配置无线端口安全，使用密文MAC认证。

[AC] interface WLAN-ESS 0

[AC-WLAN-ESS0] port-security port-mode mac-and-psk

[AC-WLAN-ESS0] port-security tx-key-type 11key

[AC-WLAN-ESS0] port-security preshared-key pass-phrase 12345678

[AC-WLAN-ESS0] quit

(2)      在AC上配置无线服务和AP

# 创建服务模板2（加密类型服务模板），配置SSID为mac-authentication-local，将WLAN-ESS0接口绑定到服务模板2。

[AC] wlan service-template 2 crypto

[AC-wlan-st-2] ssid mac-authentication-local

[AC-wlan-st-2] bind WLAN-ESS 0

[AC-wlan-st-2] authentication-method open-system

[AC-wlan-st-2] cipher-suite ccmp

[AC-wlan-st-2] security-ie rsn

[AC-wlan-st-2] service-template enable

[AC-wlan-st-2] quit

# 配置AP 1：创建AP 1的模板，名称为ap1，型号名称选择WA2100，并配置AP 1的序列号为210235A29G007C000020。

[AC] wlan ap ap1 model WA2100

[AC-wlan-ap-ap1] serial-id 210235A29G007C000020

# 将服务模板2绑定到AP 1的radio 1口，并启用射频。

[AC-wlan-ap-ap1] radio 1 type dot11g

[AC-wlan-ap-ap1-radio-1] service-template 2

[AC-wlan-ap-ap1-radio-1] radio enable

[AC-wlan-ap-ap1-radio-1] return

(3)      验证配置结果

# 无线用户通过本地MAC地址认证上线后，可以通过display mac-authentication interface WLAN-DBSS命令显示无线端口的MAC地址认证信息。

<AC> display mac-authentication interface WLAN-DBSS 0:0                        

MAC address authentication is enabled.                                         

 User name format is MAC address in lowercase, like xx-xx-xx-xx-xx-xx          

 Fixed username:mac                                                            

 Fixed password:not configured                                                 

          Offline detect period is 180s                                        

          Quiet period is 180s                                                 

          Server response timeout value is 100s                                

          The max allowed user number is 4096 per slot                         

          Current user number amounts to 1                                     

          Current domain is ***.***                                         

Silent MAC User info:                                                          

          MAC Addr         From Port                    Port Index             

WLAN-DBSS0:6 is link-up                                                        

  MAC address authentication is enabled                                        

  Authenticate success: 0, failed: 0                                            

 Max number of on-line users is 4096                                           

  Current online user number is 1                                              

          MAC Addr         Authenticate State           Auth Index             

          00e0-fc12-3456   MAC_AUTHENTICATOR_AUTHOR      1299

# 无线用户Client认证成功后，通过在设备上执行display connection命令可以查看到已上线用户的连接信息

<AC>display connection                                                   

Index=1299,Username=00-e0-fc-l2-34-56@***.***                               

MAC=00-E0-FC-12-34-56                                                          

IP=N/A                                                                         

IPv6=N/A                                                                       

 Total 1 connection(s) matched.