WLAN-WEB认证-BAS配置.doc

WLAN通过web认证，以下是BAS的配置：（红色部分为必须配置的）# sysname SNYUL-MC-CMNET-BAS03-XSEC-ME60# super password level 3 cipher REN.6A.1SQ=QMAF41! super password level 15 cipher JS,51EA,%B,.#C3YB91!# router id 218.200.1.148# user-group wlan user-group sxyd#diffserv domain default#radius-server group snmcc radius-server authentication 211.137.133.3 1812 weight 0 radius-server authentication 211.137.133.4 1812 weight 10 radius-server accounting 211.137.133.3 1813 weight 0 radius-server accounting 211.137.133.4 1813 weight 10 radius-server shared-key 135-139 radius-server class-as-car radius-server source interface LoopBack0 radius-server attribute translate undo radius-server user-name domain-included# bfd# mpls lsr-id 218.200.1.148 mpls#mpls ldp#acl number 2000 description NAT-IN rule 5 permit#acl number 2100 rule 5 permit source 10.37.0.0 0.0.7.255 rule 10 permit source 10.37.8.0 0.0.7.255 rule 15 deny#acl number 3000 rule 5 deny udp destination-port eq 593 rule 10 deny udp destination-port eq 1434 rule 15 deny udp destination-port eq 136 rule 20 deny udp destination-port eq 135 rule 25 deny udp destination-port eq 5554 rule 30 deny udp destination-port eq netbios-ns rule 35 deny udp destination-port eq netbios-ssn rule 40 deny udp destination-port eq 445 rule 45 deny tcp destination-port eq 4444 rule 50 deny tcp destination-port eq 135 rule 55 deny tcp destination-port eq 9996 rule 60 deny tcp destination-port eq 137 rule 65 deny tcp destination-port eq 139 rule 70 deny tcp destination-port eq 9995 rule 75 deny tcp destination-port eq 138 rule 80 deny tcp destination-port eq 5554 rule 85 deny tcp destination-port eq 445 rule 90 deny tcp destination-port eq 5800 rule 95 deny tcp destination-port eq 5900 rule 100 deny tcp destination-port eq 593 rule 105 deny tcp destination-port eq 1720 rule 110 deny tcp destination-port eq 136 rule 500 permit ip#acl number 6000 match-order auto rule 5 permit ip source ip-address 211.137.133.5 0 destination user-group wlan rule 10 permit ip source ip-address 211.137.130.3 0 destination user-group wlan rule 15 permit ip source ip-address 211.137.130.19 0 destination user-group wlan rule 30 permit ip source user-group wlan destination ip-address 211.137.130.3 0 rule 35 permit ip source user-group wlan destination ip-address 211.137.130.19 0 rule 40 permit ip source user-group wlan destination ip-address 211.137.133.5 0 rule 55 permit ip source user-group sxyd destination ip-address 211.137.130.3 0 rule 60 permit ip source user-group sxyd destination ip-address 211.137.130.19 0#acl number 6001 match-order auto rule 5 permit ip source user-group wlan destination ip-address any rule 10 permit ip source user-group sxyd destination ip-address any#traffic classifier virus operator or if-match acl 3000traffic classifier ylwlan-deny operator or if-match acl 6001traffic classifier ylwlan-permit operator or if-match acl 6000#traffic behavior antitraffic behavior permittraffic behavior deny deny #traffic policy ylwlan_traffic classifier ylwlan-permit behavior permit classifier ylwlan-deny behavior deny classifier virus behavior antitraffic-policy ylwlan_traffic inbound# qos-profile default#session-group-profile default#isis 100 graceful-restart is-level level-2 cost-style wide timer lsp-generation 1 50 50 level-2 network-entity 39.752f.0100.0014.0000.1000.0010.2182.0000.1148.00 is-name SNYUL-MC-CMNET-BAS03-XSEC-ME60 import-route direct import-route static timer spf 1 50 50 log-peer-change set-overload on-startup wait-for-bgp#interface Aux0/0/1#interface Virtual-Template0#interface Virtual-Template1#interface NULL0#interface LoopBack0 description For Management ip address 218.200.1.148 255.255.255.255 isis enable 100 isis circuit-level level-2#firewall zone zone1 priority 100#firewall zone zone2 priority 60#l2tp-group default-lac tunnel name Quidway #l2tp-group default-lns tunnel name Quidway#bgp 64650 router-id 218.200.1.148 group RR-L2 internalpeerRR-L2description TO-SNYL-PC-CMNET-RT01-NE40E/SNYUL-MB-CMNET-RT02-7750SR7 peer RR-L2 connect-interface LoopBack0 peer RR-L2 password cipher )M+08YOA3=;Q=QMAF41! peer 218.200.1.13 as-number 64650 peer 218.200.1.13 group RR-L2 peer 218.200.1.13 description SNYL-PC-CMNET-RT01-NE40E peer 218.200.1.153 as-number 64650 peer 218.200.1.153 group RR-L2 peer 218.200.1.153 description SNYUL-MB-CMNET-RT02-7750SR7 # ipv4-family unicast undo synchronization network 120.192.235.192 255.255.255.224*（发布NAT地址池）* maximum load-balancing 6 peer RR-L2 enable peer 218.200.1.13 enable peer 218.200.1.13 group RR-L2 peer 218.200.1.153 enable peer 218.200.1.153 group RR-L2 # ipv4-family vpnv4 policy vpn-target peer RR-L2 enable peer 218.200.1.13 enable peer 218.200.1.13 group RR-L2 peer 218.200.1.153 enable peer 218.200.1.153 group RR-L2#ip pool wlan local gateway 10.37.0.1 255.255.248.0 section 0 10.37.0.2 10.37.7.255 dns-server 211.137.130.3 dns-server 211.137.130.19 secondary#iptn# dpi pts# dpi global-policy # dpi dsu-mac#dpi restricted-policy# ancp neighbor-profile default-neighbor#dot1x-template 1#aaaauthentication-scheme none authentication-mode noneauthentication-scheme wlan authentication-mode noneauthentication-scheme radiusauthentication-scheme local authentication-mode localauthentication-scheme snmccaccounting-scheme none accounting-mode noneaccounting-scheme wlan accounting-mode none accounting-scheme radiusaccounting-scheme snmccdomain default0domain default1domain default_admin authentication-scheme localdomain onu-and-switch-guanli authentication-scheme none accounting-scheme nonedomain wlan.sn authentication-scheme snmcc accounting-scheme snmcc service-type hsi radius-server group snmcc ip-pool wlan zone zone1domain wlan authentication-scheme wlan accounting-scheme wlan service-type hsi web-server 211.137.133.5 web-server redirect-key user-ip-address wlanuserip user-group wlan ip-pool wlan zone zone1#local-aaa-server user huawei password cipher $F;-;KQQ%DJL.:OE)Q! authentication-type T level 0 user huawei01 password cipher /*T%HKU;Q=QMAF41! authentication-type T level 15#interface Eth-Trunk1 description TO-SNYL-PC-CMNET-RT01-NE40E-ETH-Trunk5=4G ip address 120.192.235.46 255.255.255.252 isis enable 100 isis circuit-level level-2 isis cost 100 level-2 mpls mpls ldp zone zone2#interface Eth-Trunk2 description TO-SNYUL-MB-CMNET-RT02-7750SR7-ETH-Trunk5=4G ip address 120.192.235.50 255.255.255.252 isis enable 100 isis circuit-level level-2 isis cost 200 level-2 mpls mpls ldp zone zone2#interface GigabitEthernet0/0/0 shutdown speed auto duplex auto#interface GigabitEthernet1/0/0 description TO-SNYL-PC-CMNET-RT01-NE40E-GE6/1/8=1G undo shutdown eth-trunk 1#interface GigabitEthernet1/0/1 description TO-SNYL-PC-CMNET-RT01-NE40E-GE6/1/9=1G undo shutdown eth-trunk 1#interface GigabitEthernet1/0/2 description TO-SNYL-PC-CMNET-RT01-NE40E-GE6/1/10=1G undo shutdown eth-trunk 1#interface GigabitEthernet1/0/3 description TO-SNYL-PC-CMNET-RT01-NE40E-GE6/1/11=1G undo shutdown eth-trunk 1#interface GigabitEthernet1/0/4 undo shutdown#interface GigabitEthernet1/0/5 shutdown#interface GigabitEthernet1/0/6 shutdown#interface GigabitEthernet1/0/7 shutdown#interface GigabitEthernet1/0/8 shutdown#interface GigabitEthernet1/0/9 shutdown#interface GigabitEthernet1/0/10 shutdown#interface GigabitEthernet1/0/11 shutdown#interface GigabitEthernet1/0/12 shutdown#interface GigabitEthernet1/0/13 shutdown#interface GigabitEthernet1/0/14 shutdown#interface GigabitEthernet1/0/15 shutdown#interface GigabitEthernet1/0/16 shutdown# interface GigabitEthernet1/0/17 shutdown#interface GigabitEthernet1/0/18 shutdown#interface GigabitEthernet1/0/19 shutdown#interface GigabitEthernet1/0/20 shutdown#interface GigabitEthernet1/0/21 shutdown#interface GigabitEthernet1/0/22 shutdown#interface GigabitEthernet1/0/23 shutdown#interface GigabitEthernet2/0/0 description TO-SNYUL-MB-CMNET-RT02-7750SR7-GE3/1/0=1G undo shutdown eth-trunk 2#interface GigabitEthernet2/0/1 description TO-SNYUL-MB-CMNET-RT02-7750SR7-GE3/1/1=1G undo shutdown eth-trunk 2#interface GigabitEthernet2/0/2 description TO-SNYUL-MB-CMNET-RT02-7750SR7-GE3/1/2=1G undo shutdown eth-trunk 2#interface GigabitEthernet2/0/3 description TO-SNYUL-MB-CMNET-RT02-7750SR7-GE3/1/3=1G undo shutdown eth-trunk 2#interface GigabitEthernet2/0/4 shutdown#interface GigabitEthernet2/0/5 shutdown #interface GigabitEthernet2/0/6 shutdown#interface GigabitEthernet2/0/7 shutdown#interface GigabitEthernet2/0/8 shutdown#interface GigabitEthernet2/0/9 shutdown#interface GigabitEthernet2/0/10 shutdown#interface GigabitEthernet2/0/11 shutdown#interface GigabitEthernet2/0/12 description WLAN-AC undo shutdown# interface GigabitEthernet2/0/12.2 description Wlan user-vlan 201 207 bas access-type layer2-subscriber default-domain pre-authentication wlan authentication wlan.sn nas-port-type 802.11 authentication-method web#interface GigabitEthernet2/0/13 shutd