WX5002与Windows IAS、Windows无线客户端配合实现802.1x认证功能的典型配置

WX5002与Windows IAS、Windows无线客户端配合实现802.1x认证功能的典型配置

适用WX5002版本：H3C WX5002-128 Software Version V100R001B05D004

一、组网需求

WX5002、WA2110、H3C POE交换机、Windows IAS服务器、便携机（安装有11b/g无线网卡）

二、组网图

WX5002的IP地址为192.168.1.99。

Windows IAS服务器的IP地址为192.168.0.10，网关为192.168.0.254。

交换机VLAN 1的接口地址为192.168.1.254， VLAN 2的接口地址为192.168.0.254。

WA2110的序列号为210235A22W0074000003，使用的SSID的名称为h3c-wpa。

用户名为111，密码为111。

三、WX交换机的典型配置

#                                                                              

 version 5.00, ESS 1102P01                                                      

#                                                                              

 sysname H3C                                                                   

#                                                                               

 domain default enable ias                                                     

#                                                                              

 port-security enable                                                           

#                                                                              

 dot1x authentication-method eap                                               

#                                                                               

vlan 1                                                                         

#                                                                              

radius scheme ias                                                              

 primary authentication 192.168.0.10                                           

 primary accounting 192.168.0.10                                               

 key authentication h3c                                                        

 key accounting h3c                                                            

 nas-ip 192.168.1.99                                                           

#                                                                              

domain ias                                                                      

 authentication lan-access radius-scheme ias                                   

 authorization lan-access radius-scheme ias                                    

 access-limit disable                                                           

 state active                                                                  

 idle-cut disable                                                              

 self-service-url disable                                                       

domain system                                                                  

 access-limit disable                                                          

 state active                                                                   

 idle-cut disable                                                              

 self-service-url disable                                                      

#                                                                              

dhcp server ip-pool pool1                                                      

 network 192.168.1.0 mask 255.255.255.0                                        

 gateway-list 192.168.1.254                                                    

 expired day 3                                                                 

#                                                                              

wlan service-template 1 crypto                                                 

 ssid h3c-wpa                                                                   

 bind WLAN-ESS 1                                                               

 authentication-method open-system                                             

 cipher-suite tkip                                                              

 security-ie wpa                                                               

 service-template enable                                                       

#                                                                               

wlan rrm                                                                       

 11a mandatory-rate 6 12 24                                                    

 11a supported-rate 9 18 36 48 54                                               

 11b mandatory-rate 1 2                                                        

 11b supported-rate 5.5 11                                                     

 11g mandatory-rate 1 2 5.5 11                                                  

 11g supported-rate 6 9 12 18 24 36 48 54                                      

#                                                                              

interface NULL0                                                                

#                                                                               

interface Vlan-interface1                                                      

 ip address 192.168.1.99 255.255.255.0                                         

#                                                                               

interface GigabitEthernet1/0/1                                                 

#                                                                              

interface GigabitEthernet1/0/2                                                  

#                                                                              

interface M-Ethernet1/0/1                                                      

#                                                                               

interface WLAN-ESS1                                                            

 port-security port-mode userlogin-secure-ext                                  

 port-security tx-key-type 11key                                                

#                                                                              

wlan ap ap2 model WA2100                                                       

 serial-id 210235A22W0074000003                                                 

 radio 1 type 11g                                                              

  service-template 1                                                           

  radio enable                                                                 

#                                                                               

 ip route-static 0.0.0.0 0.0.0.0 192.168.1.254                                 

#                                                                              

 dhcp enable                                                                    

#                                                                              

user-interface aux 0                                                           

user-interface vty 0 4                                                          

#                                                                              

return

四、Windows IAS的相关配置

1、RADIUS客户端的相关配置

·保证IP地址的配置与WX5002中的配置一致（如本例中为192.168.1.99）。

·保证共享密钥中的配置与WX5002中的配置一致（如本例中为h3c）。

配置信息如下图所示：

2、远程访问策略的相关配置

在使用的远程访问策略中选择“授予远程访问权限”，然后点击“编辑配置文件”，如下图所示

在“编辑配置文件”的对话框中选择“EAP方法”，如下图所示：

在“EAP方法”中选择“受保护的EAP（PEAP）”，如下图所示：

并在选中EAP方法后点击“编辑”，此EAP方法应处于可编辑状态，如下图所示：

3、用户帐户设置

在Windows AD中添加用户帐户111，并将拨入属性设置为“允许访问”，如下图所示：

五、Windows无线客户端的相关配置

1、在Windows无线客户端中，通过“刷新网络列表”搜索相应的SSID，本例中的SSID为h3c-wpa，然后选择“更改高级设置”，如下图所示：

2、在弹出的对话框中，选择“无线网络配置”，在“首选网络”中选择“h3c-wpa”，然后点击“属性”，如下图所示：

3、在弹出的“h3c-wpa属性”对话框中，在“关联”项中根据SSID的配置，在“网络验证 (A)”中选择“WPA”，在“数据加密 (D)”中选择“TKIP”，如下图所示：

4、选择“验证”项，在“EAP类型 (T)”中选择“受保护的EAP (PEAP)”，然后点击“属性”，如下图所示：

5、在弹出的“受保护的EAP属性”的对话框中，如需验证服务器证书，在“验证服务器证书 (V)”选项上打勾，否则勾掉该选项。然后点击“配置”，本例中不验证服务器证书，如下图所示：

6、在弹出的“EAP MSCHAPv2 属性”对话框中，勾掉“自动使用Windows登录名和密码”选项，然后选择“确定”。

7、按照以上步骤设置完成后，选择连接SSID h3c-wpa，对弹出的对话框中输入用户名111和密码111，如下图所示：

8、认证通过后，SSID h3c-wpa上会出现“已连接上”，并且客户端可正常访问网络，如下图所示：