WX6000E系列AC板卡板间隔离及基于SSID二层隔离功能配合使用配置案例

WX6000E系列AC板间隔离及基于SSID二层功能配合使用配置案例

 

一、 组网需求：

WX6000E系列AC、FIT AP、交换机、便携机（安装有无线网卡）

 

二、 组网图：

 

三、 特性介绍：

随着运营商对WLAN网络的大规模建设，我司WLAN产品性能日益提升，目前WX6000E系列AC单块板卡支持AP最大数量达到1024，整机性能极大地得到了提升。但是在后续的使用中，问题日益明显，由于AC使用的是集中转发模式，如果不对这些广播、多播报文加以控制势必引起一些列恶劣的后果。为了更好地控制这些广播、组播报文，本文提供一种基于SSID开启二层隔离并在WX6000E交换板开启板间隔离的方案，该方案不要手动放通网关MAC，实施起来更加方便。

四、 配置信息：

 

1.   AC板卡配置： 

dis cur

#

 version 5.20, Release 2308P01

#

 sysname AC

#

 domain default enable system

#

 telnet server enable

#

 port-security enable

#

vlan 1

#

vlan 184

#

vlan 1001

#

dhcp server ip-pool ap

 network 10.0.1.0 mask 255.255.255.0

 gateway-list 10.0.1.1

#

dhcp server ip-pool client

 network 10.0.2.0 mask 255.255.255.0

 gateway-list 10.0.2.1

#

local-user admin

 password cipher I84AY)\`*'#])%E:#"3&!A!!

 authorization-attribute level 3

 service-type telnet

#              

wlan rrm

 dot11a mandatory-rate 6 12 24

 dot11a supported-rate 9 18 36 48 54

 dot11b mandatory-rate 1 2

 dot11b supported-rate 5.5 11

 dot11g mandatory-rate 5.5 11

 dot11g supported-rate 12 18 24 36 48 54

dot11n mandatory maximum-mcs 15

 dot11n support maximum-mcs 15

#

wlan service-template 1 clear

 ssid test

 bind WLAN-ESS 1

 user-isolation enable

 service-template enable

#

interface Bridge-Aggregation1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

#

interface NULL0

#

interface Vlan-interface184

 ip address 10.207.1.1 255.255.255.0

#

interface Vlan-interface1001

 ip address 10.207.2.1 255.255.255.0

#

interface M-GigabitEthernet1/0/0

 ip address 192.168.1.1 255.255.255.0

#

interface Ten-GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

interface Ten-GigabitEthernet1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

interface WLAN-ESS1

port access vlan 1001

#

wlan ap ap model WA2100

 serial-id 210235A22WC117004854

 radio 1

  service-template 1

  radio enable

#

 dhcp enable

#

 load xml-configuration

#

user-interface aux 0 1

user-interface vty 0 4

#

Return

 

2.   WX6000E交换板配置：

dis cur

#

 version 5.20, Feature 6632

#

 sysname WX6108-1

#

 irf priority 0

#

 domain default enable system

#

 telnet server enable

#

switch-mode standard

switch-mode normal slot 3

switch-mode normal slot 4

switch-mode normal slot 5

switch-mode normal slot 6

switch-mode normal slot 7

slot-isolate enable slot 3 4 5 6

#

vlan 1

#

vlan 184

#

vlan 1001

#

radius scheme system

#

domain system  

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#              

local-user gaowei

 password cipher %2VL6A+GV=(KI!_H#S>*5A!!

 authorization-attribute level 3

 service-type ssh telnet

#

interface Bridge-Aggregation1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

#

interface Vlan-interface184

 ip address 10.207.4.2 255.255.255.0

#

interface Vlan-interface4030

 port link-mode bridge

#

interface GigabitEthernet7/0/1

 port link-mode bridge

#

interface GigabitEthernet7/0/2

 port link-mode bridge

#

interface GigabitEthernet7/0/3

 port link-mode bridge

#

interface GigabitEthernet7/0/4

 port link-mode bridge

#

interface GigabitEthernet7/0/5

 port link-mode bridge

#              

interface GigabitEthernet7/0/6

 port link-mode bridge

#

interface GigabitEthernet7/0/7

 port link-mode bridge

#

interface GigabitEthernet7/0/8

 port link-mode bridge

#

interface GigabitEthernet7/0/9

 port link-mode bridge

#

interface GigabitEthernet7/0/10

 port link-mode bridge

#

interface GigabitEthernet7/0/11

 port link-mode bridge

#

interface GigabitEthernet7/0/12

 port link-mode bridge

#

interface GigabitEthernet7/0/13

 port link-mode bridge

#

interface GigabitEthernet7/0/14

 port link-mode bridge

#

interface GigabitEthernet7/0/15

 port link-mode bridge

#

interface GigabitEthernet7/0/16

 port link-mode bridge

#

interface GigabitEthernet7/0/17

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/18

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/19

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/20

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/21

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/22

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/23

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/24

 port link-mode bridge

 shutdown

#

interface GigabitEthernet7/0/25

 port link-mode bridge

#              

interface GigabitEthernet7/0/26

 port link-mode bridge

#

interface GigabitEthernet7/0/27

 port link-mode bridge

#

interface GigabitEthernet7/0/28

 port link-mode bridge

#

interface GigabitEthernet7/0/29

 port link-mode bridge

#              

interface GigabitEthernet7/0/30

 port link-mode bridge

#

interface GigabitEthernet7/0/31

 port link-mode bridge

#

interface GigabitEthernet7/0/32

 port link-mode bridge

#

interface M-Ethernet0/0/0

 ip address 192.168.0.1 255.255.255.0

#

interface Ten-GigabitEthernet3/0/1

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

interface Ten-GigabitEthernet3/0/2

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

 dhcp enable

#

 load xml-configuration

#

 load tr069-configuration

#

user-interface aux 0 1

user-interface vty 0 4

#

return

五、 主要配置步骤：

1.   WX6000E主要配置

# 在W6000E交换板卡配置板间隔离

slot-isolate enable slot 3 4 5 6

# 创建聚合组并将相应接口添加其中

interface Bridge-Aggregation1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

#

interface Ten-GigabitEthernet3/0/1

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

interface Ten-GigabitEthernet3/0/2

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

2.   AC板卡主要配置

# 创建ESS接口

interface WLAN-ESS1

port access vlan 1001

# 创建服务模板并在服务模板下开启二层隔离功能

wlan service-template 1 clear

 ssid H3C

 bind WLAN-ESS 1

 user-isolation enable

 service-template enable

# 创建AP并应用服务模板

wlan ap ap model WA2100

 serial-id 210235A22WC117004854

 radio 1

  service-template 1

  radio enable

# 创建聚合组并将相应接口添加其中

interface Bridge-Aggregation1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

#

interface Ten-GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

#

interface Ten-GigabitEthernet1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 184 1001

 port link-aggregation group 1

 

六、 结果验证：

1.   在同一AC下的两台终端属于相同VLAN，终端1开启组播、广播源，终端2通过抓包比对开启隔离功能前后接收报文情况，开启隔离功能后将不会再收到终端1的广播、组播报文。

2.   在两台AC下的两台终端，其中终端1属于AC1，终端3属于AC2，且两个终端都是相同VLAN。终端1开启组播、广播源，终端3通过抓包比对开启隔离功能前后接收报文情况，开启隔离功能后将不会再收到终端1的广播、组播报文。