无线控制器本地portal+ldap方案部署完成后， MAC-Trigger无感知不生效，
- 0关注
- 0收藏，381浏览
问题描述：
现网配置如下，现在就想知道没有AAA服务器情况下只有ldap服务器下本地portal怎样实现无感知认证！
wlan global-configuration
#
telnet server enable
#
port-security enable
#
dhcp enable
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 100
description Link-To-WIFI
#
vlan 110
description Link-To-AP_Manager
#
vlan 200
description Link-To-SW_Manager
#
vlan 4093
description WIFI_Guest
#
dhcp server ip-pool vlan100
gateway-list 172.16.0.254
network 172.16.0.0 mask 255.255.240.0
dns-list 10.110.0.80 61.134.1.4
expired day 0 hour 8
#
dhcp server ip-pool vlan110
gateway-list 172.16.254.254
network 172.16.254.0 mask 255.255.255.0
#
dhcp server ip-pool vlan4093
gateway-list 192.168.201.254
network 192.168.200.0 mask 255.255.254.0
dns-list 223.5.5.5 61.134.1.4
expired day 0 hour 5
#
wlan service-template 1
ssid JZDC
akm mode psk
preshared-key pass-phrase cipher $c$3$Ute/LE1dzOEc4WWw7UB/39mhHXU7qBzcuoeD9n9i
cipher-suite ccmp
security-ie rsn
bss transition-management enable
service-template enable
#
wlan service-template 2
ssid JZDC_Guest
akm mode psk
preshared-key pass-phrase cipher $c$3$OzKW/ccD58kBb0+g6HdMJBiiaNfkzYuRaltLAQ==
cipher-suite ccmp
security-ie rsn
bss transition-management enable
portal enable method direct
portal domain ***.***
portal apply web-server portal
portal apply mac-trigger-server localportal
service-template enable
#
interface NULL0
#
interface Vlan-interface100
ip address 172.16.0.254 255.255.240.0
#
interface Vlan-interface110
description Link-To-AP_Manager
ip address 172.16.254.254 255.255.255.0
#
interface Vlan-interface200
ip address 10.210.254.252 255.255.255.0
#
interface Vlan-interface4093
description WIFI_Guest
ip address 192.168.201.254 255.255.254.0
#
interface GigabitEthernet1/0/4
port link-mode route
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/1
port link-mode bridge
#
interface GigabitEthernet1/0/2
port link-mode bridge
#
interface GigabitEthernet1/0/3
port link-mode bridge
#
interface GigabitEthernet1/0/5
port link-mode bridge
description Link_UP_Ineternet_FW_Portal
port access vlan 100
#
interface GigabitEthernet1/0/6
port link-mode bridge
port link-type trunk
port trunk permit vlan all
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 31
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 10.210.254.254
#
undo info-center logfile enable
#
ssh server enable
sftp server enable
#
acl advanced 3010
rule 0 permit ip source 10.110.0.82 0
rule 1 permit ip source 10.210.254.254 0
#
undo password-control aging enable
undo password-control length enable
undo password-control composition enable
undo password-control history enable
password-control login-attempt 3 exceed lock-time 2
password-control update-interval 0
password-control login idle-time 0
#
ldap server ldap
login-dn cn=administrator,cn=users,dc=jzdc,dc=com
search-base-dn dc=jzdc,dc=com
ip 10.110.0.80
login-password cipher $c$3$YI062Olg3L5pA0gXUrT0Thai88Uff1m4nWgxNfD7+pk=
user-parameters user-name-attribute samaccountname
#
ldap scheme ldap
authentication-server ldap
#
domain ***.***
authentication portal ldap-scheme ldap
authorization portal none
accounting portal none
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$KTgo/UphcrQPOAMF$wP4egLSPUP+7KLaUiI70WF9Oem5Fvy0piQR3wb425OeIPzQIaug2ipemomWb8FqKLiQ3jogmzew+Jn7siUCJYQ==
service-type ftp
service-type telnet http https
authorization-attribute user-role network-admin
#
portal free-rule 1 destination ip any tcp 53
portal free-rule 2 destination ip any udp 53
portal free-rule 3 destination ip 61.134.1.4 255.255.255.255
portal free-rule 4 destination ip 218.30.19.40 255.255.255.255
portal free-rule 5 destination ip 10.110.0.80 255.255.255.255
portal free-rule 6 destination ip 223.5.5.5 255.255.255.255
portal free-rule 10 destination ip 192.168.201.254 255.255.255.255
#
portal web-server portal
url http://192.168.201.254/portal
#
portal local-web-server http
default-logon-page defaultfile.zip
#
ip http enable
ip https enable
#
portal mac-trigger-server localportal
ip 192.168.201.254
aging-time 7200
local-binding aging-time 129600
local-binding enable
#
wlan auto-ap enable
#
wlan ap-group default-group
vlan 1
radio 2.4g
radio 5g
radio 6g
ap-model WA4320-ACN-SI
radio 1
radio enable
channel band-width 40
service-template 1 vlan 100
service-template 2 vlan 4093
radio 2
rate mandatory 11
rate supported 12 18 24 36 48 54
rate disabled 1 2 5.5 6 9
radio enable
service-template 2 vlan 4093
service-template 1 vlan 100
gigabitethernet 1
#
wlan virtual-ap-group default-virtualapgroup
#
return
- 2024-08-28提问
- 举报
-
(0)
AC上需要的配置举例如下：
(1) 配置AC的接口
# 创建VLAN 100及其对应的VLAN接口，并为该接口配置IP地址。AP将获取该IP地址与AC建立CAPWAP隧道。
<AC> system-view
[AC] vlan 100
[AC-vlan100] quit
[AC] interface vlan-interface 100
[AC-Vlan-interface100] ip address 2.2.1.1 24
[AC-Vlan-interface100] quit
# 创建VLAN 200及其对应的VLAN接口，并为该接口配置IP地址。Client将使用该VLAN接入无线网络。
[AC] vlan 200
[AC-vlan200] quit
[AC] interface vlan-interface 200
[AC-Vlan-interface200] ip address 2.2.2.1 24
[AC-Vlan-interface200] quit
# 配置AC与Switch相连的接口GigabitEthernet1/0/1的属性为Trunk，允许VLAN 1、VLAN 100和VLAN 200通过。
[AC] interface gigabitethernet 1/0/1
[AC-GigabitEthernet1/0/1] port link-type trunk
[AC-GigabitEthernet1/0/1] port trunk permit vlan 1 100 200
[AC-GigabitEthernet1/0/1] quit
(2) 配置静态路由
# 配置到iMC服务器的静态路由。
[AC] ip route-static 192.168.0.0 255.255.0.0 2.2.2.100
(3) 配置无线服务
# 创建无线服务模板st1，并进入无线服务模板视图。
[AC] wlan service-template st1
# 配置SSID为service。
[AC-wlan-st-st1] ssid service
# 配置无线服务模板VLAN为200。
[AC-wlan-st-st1] vlan 200
[AC-wlan-st-st1] quit
# 创建AP，配置AP名称为office，型号名称选择WA4320i-ACN，并配置序列号219801A0CNC138011454。
[AC] wlan ap office model WA4320i-ACN
[AC-wlan-ap-office] serial-id 219801A0CNC138011454
# 进入Radio 2视图。
[AC-wlan-ap-office] radio 2
# 将无线服务模板st1绑定到radio 2，并开启射频。
[AC-wlan-ap-office-radio-2] service-template st1
[AC-wlan-ap-office-radio-2] radio enable
[AC-wlan-ap-office-radio-2] quit
[AC-wlan-ap-office] quit
# 创建名称为rs1的RADIUS方案，并进入该方案视图。
[AC] radius scheme rs1
# 配置RADIUS方案的主认证和主计费服务器及其通信密钥。
[AC-radius-rs1] primary authentication 192.168.0.111
[AC-radius-rs1] primary accounting 192.168.0.111
[AC-radius-rs1] key authentication simple radius
[AC-radius-rs1] key accounting simple radius
# 配置发送给RADIUS服务器的用户名不携带ISP域名。
[AC-radius-rs1] user-name-format without-domain
# 配置发送RADIUS报文时使用的源IP地址为2.2.2.1。
[AC-radius-rs1] nas-ip 2.2.2.1
[AC-radius-rs1] quit
# 使能RADUIS session control功能。
[AC] radius session-control enable
# 开启RADIUS DAE服务，并进入RADIUS DAE服务器视图。
[AC] radius dynamic-author server
# 设置RADIUS DAE客户端的IP地址为192.168.0.111，与RADIUS DAE客户端交互DAE报文时使用的共享密钥为明文radius。
[AC-radius-da-server] client ip 192.168.0.111 key simple radius
[AC-radius-da-server] quit
(5) 配置认证域dm2
# 创建名为dm2的ISP域并进入其视图。
[AC] domain dm2
# 为lan-access用户配置认证、授权、计费方案为RADIUS方案rs1
[AC-isp-dm2] authentication lan-access radius-scheme rs1
[AC-isp-dm2] authorization lan-access radius-scheme rs1
[AC-isp-dm2] accounting lan-access radius-scheme rs1
[AC-isp-dm2] quit
(6) 配置认证域dm1
# 创建名为dm1的ISP域并进入其视图。
[AC] domain dm1
# 为Portal用户配置AAA认证方法为RADIUS。
[AC-isp-dm1] authentication portal radius-scheme rs1
# 为Portal用户配置AAA授权方法为RADIUS。
[AC-isp-dm1] authorization portal radius-scheme rs1
# 为Portal用户配置AAA计费方法为none，不计费。
[AC-isp-dm1] accounting portal none
# 指定ISP域dm1下的用户闲置切断时间为15分钟，闲置切断时间内产生的流量为1024字节。
[AC-isp-dm1] authorization-attribute idle-cut 15 1024
[AC-isp-dm1] quit
(7) 配置Portal认证
# 配置Portal认证服务器，名称为newpt，IP地址为192.168.0.111，监听Portal报文的端口为50100。
[AC] portal server newpt
[AC-portal-server-newpt] ip 192.168.0.111 key simple portal
[AC-portal-server-newpt] port 50100
# 配置Portal认证服务器类型为CMCC。
[AC-portal-server-newpt] server-type cmcc
[AC-portal-server-newpt] quit
# 配置Portal Web服务器的URL为http://192.168.0.111:8080/portal。
[AC] portal web-server newpt
[AC-portal-websvr-newpt] url http://192.168.0.111:8080/portal
# 配置设备重定向给用户的Portal Web服务器的URL中携带参数ssid、wlanuserip和wlanacname，其值分别为AP的SSID、用户的IP地址和AC名称（这三个参数与中国移动对接时必配）。
[AC-portal-websvr-newpt] url-parameter ssid ssid
[AC-portal-websvr-newpt] url-parameter wlanuserip source-address
[AC-portal-websvr-newpt] url-parameter wlanacname value AC
# 配置Portal Web服务器类型为CMCC。
[AC-portal-websvr-newpt] server-type cmcc
[AC-portal-websvr-newpt] quit
# 配置一条基于IPv4地址的Portal免认证规则，编号为0，目的地址为192.168.0.111，以便放行访问Portal Web服务器的流量，让用户可以正常访问Portal Web服务器。
[AC] portal free-rule 0 destination ip 192.168.0.111 24
# 配置一条从聚合口到any的免认证规则，以便放行从聚合口过来的流量。
[AC] portal free-rule 1 source interface Bridge-Aggregation 1
# 开启无线Portal漫游功能。
[AC] portal roaming enable
# 关闭无线Portal客户端ARP表项固化功能。
[AC] undo portal refresh arp enable
# 开启无线Portal客户端合法性检查功能。
[AC] portal host-check enable
# 在无线服务模板st1上使能直接方式的Portal认证。
[AC] wlan service-template st1
[AC-wlan-st-st1] portal enable method direct
# 配置接入的Portal用户使用认证域为dm1。
[AC-wlan-st-st1] portal domain dm1
# 在无线服务模板st1上引用Portal Web服务器newpt。
[AC-wlan-st-st1] portal apply web-server newpt
# 在无线服务模板st1上配置portal报文发送的源地址。
[AC-wlan-st-st1] portal bas-ip 2.2.2.1
[AC-wlan-st-st1] quit
(8) 配置MAC认证
# 配置MAC认证，并配置忽略MAC地址认证结果。
[AC-wlan-st-st1] client-security authentication-mode mac
[AC-wlan-st-st1] client-security ignore-authentication
[AC-wlan-st-st1] mac-authentication domain dm2
# 开启无线服务模板。
[AC-wlan-st-st1] service-template enable
[AC-wlan-st-st1] quit
- 2024-08-28回答
- 评论(0)
- 举报
-
(0)
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论