AD-Campus创建安全组自动下发配置

因为是动态AC，需要接入终端才下发

如果组网中有S6520X系列或S5560X系列设备，则建议在路径[自动化>园区网络>网络参数>参数]的全局配置页签下开启静态服务实例按需生效功能，节省硬件资源。

图5-28 全局配置

开启后，只有当静态服务实例接收到业务流量时，设备才会将服务实例的转发信息下发到驱动资源，使配置生效。Leaf接口对应的静态服务实例下下发如下配置：

interface Bridge-Aggregation1024                                               

 port link-type trunk                                                          

 port trunk permit vlan 1 101 to 3000 4094                                    

 link-aggregation mode dynamic                                                 

 stp tc-restriction                                                            

 mac-based ac

dot1x                                                                          

 undo dot1x multicast-trigger                                                  

 dot1x unicast-trigger                                                         

 dot1x critical vsi vsi9                                                        

 dot1x critical eapol                                                          

 mac-authentication                                                            

 mac-authentication domain                      

 port-security free-vlan 1 3501 to 3505 4094                                   

 #                                                                             

 service-instance 3501                                                         

  encapsulation s-vid 3501                                                     

  xconnect vsi vsi3 on-demand   //按需下发                                                

  arp detection trust

#