WX3500E

v5无线AC配置本地1x认证配置：

1、AC需要导入证书

[H3C]pki domain 520

[WX5540E]pki import-certificate ca domain 520 pem filename 2003_server.cer

The trusted CA's finger print is:

    MD5  fingerprint:7EFC 890E 3E04 543F 940A E5FF C79A EAD9

    SHA1 fingerprint:AD8F 99DC CBBE 768E 69CE C10B 8C90 1A27 51BC FBA5

Is the finger print correct?(Y/N):y

Import CA certificate successfully.

[WX5540E]pki import-certificate local domain 520 p12 filename 2003_local.pfx

Please input challenge password:1         //删除证书public-key local destroy rsa

Import local certificate successfully.

Import key pair successfully.

详细配置：

#使能端口安全

 port-security enable

#配置EAP的dot1x认证方式

 dot1x authentication-method eap

#

#创建PKI实体

pki entity 520

  common-name 520

organization 520

#创建PKI认证域，调用PKI实体520，关闭CRL检测功能

pki domain 520

  certificate request from ca

  certificate request entity 520

crl check disable

domain 522

 authentication lan-access local

 authorization lan-access local

 accounting lan-access local

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

wlan service-template 105 crypto

 ssid 1x-bendi

 bind WLAN-ESS 105

 cipher-suite tkip

 security-ie wpa  //配置在AP发送信标和探查响应帧时携带WPA IE信息

 service-template enable

#

ssl server-policy 520    //配置SSL服务策略520

 pki-domain 520   //调用PKI认证域520

 ciphersuite rsa_rc4_128_sha

 handshake timeout 180

 close-mode wait

 session  cachesize 1000

#

#创建配置EAP认证摘要

eap-profile 520

 ssl-server-policy 520   //调用SSL服务策略

 method peap-mschapv2  //配置EAP认证方法

#

interface WLAN-ESS105

 port access vlan 12 //配置用户VLAN12

 port-security port-mode userlogin-secure-ext   //配置端口安全模式为userlogin-secureExt

 port-security tx-key-type 11key   //使能11KEY类型的密钥协商功能

 undo dot1x handshake  //关闭802.1x在线用户握手功能

dot1x mandatory-domain 522

#

wlan ap room2 model WA2620i-AGN id 1

 serial-id 219801A0CMC146000765

 radio 1

  service-template 105

  radio enable

 radio 2

  channel 6

  service-template 105

  bandwidth-guarantee enable

  radio enable

#本地dot1x认证调用EAP认证摘要

 local-server authentication eap-profile 520

local-user wlan     //创建本地认证用户

 password cipher $c$3$1gbICZB/srvSuh6DkJ7kPwoKauZibeY=

 service-type lan-access