CISCO无线AP配置手册

1、 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id1 无线控制器配置基础无线控制器配置基础 xiaogang wu 2008.10 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id2 基本配置任务及过程基本配置任务及过程 准备工作 1. 控制器启动配置和升级控制器软件版本控制器启动配置和升级控制器软件版本 2. 熟悉控制器配置界面熟悉控制器配置界面 3. 连接连接ap到控制器上到控

2、制器上 配置任务 1. 思科思科cssc无线客户端的安装和简单配置无线客户端的安装和简单配置 2. 构建一个构建一个open和一个和一个wep的无线网络的无线网络 3. 构建一个简单构建一个简单web认证的无线网络认证的无线网络 4. 构建一个支持本地构建一个支持本地eap认证的无线网络认证的无线网络 5. 构建一个用构建一个用acs做做aaa认证的无线网络认证的无线网络 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id3 presentation title size 30pt opt

3、ion 2: live 准备工作 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id4 基本设备基本设备 控制器 4400或者2100系列 ap：1130或者1240系列 交换机： 最好是3560 poe交换机 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id5 2100系列无线控制器系列无线控制器 支持支持802.11a/b/g/n 支持支持pci认证认证 wlc2100 硬件硬件

4、 8个fe口， 2个上联口，6个下联口 其中2个fe口有以太网供电 未使用端口未使用端口 2个usb端口和一个扩展槽留作 将来扩展用 *2106和2006不能作为guest access的anchor controller *不支持link aggregation *不能通过软件升级ap容量 air-wlc2125-k92100 series wlan controller for up to 25 lightweight aps$18,890 air-wlc2112-k92100 series wlan controller for up to 12 lightweight aps$10,0

5、70 air-wlc2106-k92100 series wlan controller for up to 6 lightweight aps$4,875 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id6 4400系列无线控制器系列无线控制器 1 ru 高度 2口 或者 4口千兆上联 支持 12, 25, 50 or 100 ap 支持 5000 mac地址转发表 10/100base-tx 以太网 service port 9 pin 串口console口 2 扩展槽和1个util

6、ity port目前未使用 2 热插拔电源模块插槽 44xx wlan controller 型号 4402 支持 12, 25, 和50 ap 型号 4404 支持100 aps *不能通过软件升级ap容量 *4400系列使用sfp光纤模块 *4400系列每port支持50个ap 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id7 准备工作准备工作 网线和console线。如果是4400，需要两头是db9接口的线，如果 是2106或者isr，需要db9+rj45的线 如果是4400，需

7、要glc光纤模块和光纤 确认控制器版本是否需要升级 (用命令show sysinfo查看系统版本) 是否需要将胖ap升级到瘦ap 1200/1100/1300需要upgrade tool做升级，1250不需要工具，直接在图 形化界面上升级 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id8 实验拓扑示例实验拓扑示例 trunk vlan1/20/30/40 fa0/1 port 1 ssc wlc 说明：说明： 1、vlan1用于连接控制器、ap和 acs； 2、vlan20用于wpa/

8、wpa2认证，认 证服务器用acs。 3、vlan30用作open/wep/guest 客户接入 3、vlan40用作wpa/wpa2认证，认 证用本地eap ssc ssid:vlan20 ssid:vlan30 pc/aaa服务器服务器 vlan1 所有3层网关设置在3层交换机上，地址254 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id9 启动选项启动选项 the controller boot sequence will always have these option ava

9、ilable since this is set in prom to ensure controller recovery options 按5清空配置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id10 系统启动界面和配置系统启动界面和配置 (os 5.1) would you like to terminate autoinstall? yes: system name cisco_51:2b:60 (31 characters max): 2106-demo auto-inst

10、all: process terminated - no configuration loaded enter administrative user name (24 characters max): cisco enter administrative password (24 characters max): cisco re-enter administrative password : cisco management interface ip address: management interface netmask: mana

11、gement interface default router: 54 management interface vlan identifier (0 = untagged): management interface port num 1 to 8: 1 management interface dhcp server ip address: 54 ap manager interface ip address: ap-manager is on management subnet, using same values

12、 ap manager interface dhcp server (54): virtual gateway ip address: mobility/rf group name: demo 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id11 系统启动界面（续）系统启动界面（续） enable symmetric mobility tunneling yesno: yes network name (ssid): open allow stat

13、ic ip addresses yesno: configure a radius server now? yesno: no warning! the default wlan security policy requires a radius server. please see documentation for more details. enter country code list (enter help for a list of countries) us: cn enable 802.11b network yesno: enable 802.11a network yesn

14、o: enable 802.11g network yesno: enable auto-rf yesno: configure a ntp server now? yesno: no configure the system time now? yesno: enter the date in mm/dd/yy format: 09/28/08 enter the time in hh:mm:ss format: 17:11:00 configuration correct? if yes, system will save it and reset. yesno: yes configur

15、ation saved! resetting system with new configuration. 非常重要，非常重要， controller的的 wireless的的 domain要和要和ap 一致。一致。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id12 配置配置3层交换机层交换机 p dhcp excluded-address ip dhcp excluded-address 54 ip dhcp excluded-ad

16、dress ! ip dhcp pool ap network default-router 54 ! interface fastethernet0/1 switchport trunk encapsulation dot1q switchport mode trunk interface vlan1 ip address 54 ! interface vlan20 ip address 54 255.255.25

17、5.0 ! interface vlan30 ip address 54 ! interface vlan40 ip address 54 line vty 0 4 privilege level 15 password cisco login 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id13 配置配置web访问访问 1、使用直通网线，连接交换机的trunk接口到控制器端口1 2、

18、配置pc机的ip地址 00/24或者dhcp，网关54 3、测试pc能否ping 通controller的地址： 3、用访问控制器，如果要开启http访问，需要在系统里打开。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id14 使用使用ie浏览器进行浏览器进行web访问访问 2006 cisco systems, inc. all rights reserved.cisco c

19、onfidentialpresentation_id15 如果要升级控制器系统软件如果要升级控制器系统软件 tftp 服务器推荐tftpd32 支持64m以上文件传输 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id16 在在cco上下载新版本上下载新版本 支持室内室外 mesh 版本 支持802.11n和其他新功能的普通版本 http:/ 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentatio

20、n_id17 upgrade path to controller software release or above current software release upgrade path to software or later 3.2 release upgrade to a 4.1 release before upgrading to . or later 4.0 release upgrade to a 4.1 or 4.2 release before upgrading to 5

21、.0.148.0 or later 4.1 release you can upgrade directly to . or later 4.2 release you can upgrade directly to . 注意：由于配置存储格式不同，从3.x-4.x 升级到5.x后，原来的部分配置可能丢失 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id18 upgrade path to controller s

22、oftware release current software release upgrade path to software upgrade to or a later 4.0 release before upgrading to . 1 0 if your controller is configured with the new j3 country code, upgrade to 0 or

23、a later 3.2 release. if your controller is not configured for the new j3 country code, you can upgrade to 0 or a later 3.2 release or to or a later 4.0 release. 0 or later 3.2 release you can upgrade directly to . upgrade to or a later 4.0 rel

24、ease before upgrading to . 1 or later 4.0 release you can upgrade directly to . 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id19 控制器软件升级控制器软件升级 命令行方式命令行方式 step1. ping server-ip-address 测试控制器与tftp server的连通性 step2. transfer download

25、 mode tftp 设置传输使用的协议：tftp step3. transfer download datatype code 设置传输的数据类型 step4. transfer download serverip server-ip-address 指定tftp server的ip地址 step5. transfer download filename filename 制定image的文件名 step6. transfer download start 开始传输文件，确认时如果回答no,则显示tftp的参数设置 step7. reset system wlc的系统重新启动 注：tftp服

26、务器软件推荐tftpd32，可以在网上免费下载，支持64m以上大文件传输 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id20 控制器软件升级控制器软件升级 图形界面图形界面 电脑上设置好tftp软件； 填入tftp地址和文件名后，选择右侧的 download 按钮开始。 完成后按提示reboot。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id21 presentation t

27、itle size 30pt option 2: live 熟悉无线控制器 controller配置界面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id22 命令行命令行 (cli) 基本命令基本命令 cisco 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id23 命令行命令行 (cli) “clear” commands 2006 cisco systems, inc. al

28、l rights reserved.cisco confidentialpresentation_id24 命令行命令行 (cli) “config” commands and more 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id25 命令行命令行 (cli) “debug” command 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id26 命令行命令行 (cli) “h

29、elp” commands 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id27 命令行命令行 (cli) “show” commands 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id28 命令行命令行 (cli) “transfer” commands 2006 cisco systems, inc. all rights reserved.cisco confidentia

30、lpresentation_id29 使用使用ie浏览器进行浏览器进行web访问访问 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id30 控制器上查看和设置无线网络控制器上查看和设置无线网络ssid 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id31 控制器配置页面控制器配置页面 配置接口配置接口 配置控制器配置控制器 做做dhcp服务服务 器器 定义无线组定义无线组 参看和配

31、置参看和配置 端口端口 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id32 配置接口页面配置接口页面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id33 设置控制器做设置控制器做dhcp服务器服务器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id34 定义移动组定义移动

32、组 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id35 设置端口页面设置端口页面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id36 多个控制器时，设定主控制器多个控制器时，设定主控制器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id37 点击点击wireless/al

33、l aps 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id38 安全页面安全页面 radius服务器配置服务器配置 本地用户数据库本地用户数据库 mac地址过滤地址过滤 web认证相关认证相关 配置配置 本地本地eap 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id39 管理界面管理界面 定义能够进行定义能够进行 controller管管 理的管理用户理的管理用户 2006 c

34、isco systems, inc. all rights reserved.cisco confidentialpresentation_id40 控制器维护管理界面控制器维护管理界面 系统和配置文系统和配置文 件的上传、下件的上传、下 载配置载配置 控制器软重启控制器软重启 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id41 ap射频模块配置界面射频模块配置界面 2006 cisco systems, inc. all rights reserved.cisco confident

35、ialpresentation_id42 ap发射功率调节发射功率调节(ap1131) tx power num of supported power levels . 6 tx power level 1 . 14 dbm tx power level 2 . 11 dbm tx power level 3 . 8 dbm tx power level 4 . 5 dbm tx power level 5 . 2 dbm tx power level 6 . -1 dbm ap1242的level 1 是 17dbm 2006 cisco systems, inc. all rights r

36、eserved.cisco confidentialpresentation_id43 5.1版本对版本对ha的增强的增强 failover等级 全局ha配置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id44 presentation title size 30pt option 2: live 连接ap到控制器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id45 contr

37、oller里的里的port还有还有vlan以及以及interface的对应关系的对应关系 controller必需配置的接口 带内管理接口“management interface” lwapp tunnel 终结接口“ap manager interface” 桥接的无线客户端接口 “dynamic interfaces”. 二三层漫游而设的虚拟接口 “virtual interface” 可选接口: 服务接口带外管理接口带外管理接口 *2100系列和wlcm没有 service port 2006 cisco systems, inc. all rights reserved.cisco

38、confidentialpresentation_id46 确认控制器国家版本与确认控制器国家版本与ap一致一致 目前版本支持同时支持多国家 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id47 确认时间配置无误确认时间配置无误 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id48 在路由器或者在路由器或者3层交换机设置层交换机设置dhcp 在在ap和控制器不在同一网段的情况下，建

39、立和控制器不在同一网段的情况下，建立ap能够获取能够获取ip address 的地址池，加上的地址池，加上option 43 wlc-router(config)#ip dhcp pool lwapp-ap wlc-router(dhcp-config)#network wlc-router(dhcp-config)#default-router 54 wlc-router(dhcp-config)#option 43 ascii “ /很重要！通过很重要！通过option 43 可以让可以让a

40、p在获取和控制器不同网段在获取和控制器不同网段ip address的时候，能够知道的时候，能够知道controller的所在。的所在。 如果如果ap和控制器在一个网段和广播域，则可以不配置和控制器在一个网段和广播域，则可以不配置option 43 wlc-router(dhcp-config)#exit wlc-router(config)#ip dhcp excluded-address 54 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id49 在在ios设备配

41、置设备配置option 43 对于1000/1500系列，直接写 option 43 ascii “,0“ 对于1100和1200，需要写option 60和option 43 假设要连接1240，控制器地址为和0 ip dhcp pool ap network /24 default-router 54 dns-server 00 option 60 ascii “cisco ap c1240 “ option 43 hex

42、 f108c0a80a05c0a80a14 option 43的配置详见 http:/ xample09186a00808714fe.shtml vci string 1130的是cisco ap c1130 类型= f1长度 = 2 x 4 = 08 0 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id50 可以在可以在console上打开上打开debug观察观察ap加入情况加入情况 (cisco controller) debug lw

43、app events enable (cisco controller) *oct 04 19:20:19.154: 00:1a:e3:d0:19:50 received lwapp discovery request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:60 on port 8 *oct 04 19:20:19.154: received a packet which is a (type = discovery_request) with session id 0 *oct 04 19:20:19.154: join priority p

44、rocessing status = 0, incoming aps priority 1, maxlrads = 6,joined aps =0 *oct 04 19:20:19.155: 00:1a:e3:d0:19:50 successful transmission of lwapp discovery response to ap 00:1a:e3:d0:19:50 on port 8 *oct 04 19:20:19.156: 00:1a:e3:d0:19:50 received lwapp discovery request from ap 00:1a:e3:d0:19:50 t

45、o ff:ff:ff:ff:ff:ff on port 8 *oct 04 19:20:19.156: received a packet which is a (type = discovery_request) with session id 0 *oct 04 19:20:19.156: join priority processing status = 0, incoming aps priority 1, maxlrads = 6,joined aps =0 *oct 04 19:20:19.156: 00:1a:e3:d0:19:50 successful transmission

46、 of lwapp discovery response to ap 00:1a:e3:d0:19:50 on port 8 *oct 04 19:20:31.162: 00:1a:e3:d0:19:50 received lwapp join request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67 on port 8 *oct 04 19:20:31.162: received a packet which is a (type = join_request) with session id 0 *oct 04 19:20:31.177:

47、 00:1a:e3:d0:19:50 ap ap001b.5302.28f8: txnonce 00:1e:13:51:2b:60 rxnonce 00:1a:e3:d0:19:50 *oct 04 19:20:31.177: 00:1a:e3:d0:19:50 lwapp join request mtu path from ap 00:1a:e3:d0:19:50 is 1500, remote debug mode is 0 *oct 04 19:20:31.177: dtl adding ap 1 - 0 *oct 04 19:20:31.177: 00:1a:

48、e3:d0:19:50 successfully added npu entry for ap 00:1a:e3:d0:19:50 (index 1) switch ip: , switch port: 12223, intifnum 8, vlanid 0 ap ip: 0, ap port: 8847, nex *oct 04 19:20:31.911: 00:1a:e3:d0:19:50 successful transmission of lwapp join reply to ap 00:1a:e3:d0:19:50 *oct 04 1

49、9:20:31.912: 00:1a:e3:d0:19:50 spam_lrad.c:1589 - operation state 0 = 4 *oct 04 19:20:31.913: 00:1a:e3:d0:19:50 register lwapp event for ap 00:1a:e3:d0:19:50 slot 0 *oct 04 19:20:31.914: 00:1a:e3:d0:19:50 register lwapp event for ap 00:1a:e3:d0:19:50 slot 1 *oct 04 19:20:33.192: 00:1a:e3:d0:19:50 re

50、ceived lwapp configure request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67 *oct 04 19:20:33.194: 00:1a:e3:d0:19:50 updating ip info for ap 00:1a:e3:d0:19:50 - static 0, 0/, gtw 54 *oct 04 19:20:33.194: 00:1a:e3:d0:19:50 updating ip 0 =

51、0 for ap 00:1a:e3:d0:19:50 *oct 04 19:20:33.194: 00:1b:53:02:28:f8 building config response msg for 00:1b:53:02:28:f8 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id51 确认确认ap连接到控制器连接到控制器 图形界面 命令行 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentati

52、on_id52 presentation title size 30pt option 2: live cssc无线客户端 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id53 802.11 无线客户端概述无线客户端概述 wlan 特性csscmicrosoftcisco acu/adu 多 wlan profile（不同的ssid ，不同的安去策略）支持 yesyesyes active probe (hidden ssid support) yesnoyes 部署工具yesnoyes

53、 wpa/wpa2yesyespartial wpa2 pmk cachingyesyespartial eap-fastyesnopartial wpa-pskyesyespartial static wep (40/128 bit)yesyesyes nac/cta（网络准入支持）yesnono 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id54 无线客户端建议无线客户端建议 由于企业内笔记本电脑牌子比较多，建议客户端使用由于企业内笔记本电脑牌子比较多，建议客户端使用cisco c

54、ssc软件，使用软件，使用cssc软件的软件的 好处如下：好处如下： 1.整个公司笔记本电脑统一的平台，方便管理和下发策略。cssc带有部署工具，制订好策 略后容易部署（如果是windows平台的话，还要配置相关的参数） 3. cssc软件支持cisco nac网络准入控制技术. 4. 建议新购买的笔记本电脑采用统一的品牌（方便管理），旧的笔记本电脑如果没有无线网 卡的话，建议统一使用cisco的cb21ag（支持aes强加密）,cisco还提供专门为台式机使用 的无线网卡：air-pi21ag。 5.cisco倡导了ccx（各厂家笔记本电脑和cisco ap兼容性测试）计划，可以从下面的链接

55、知 道哪些笔记本电脑的型号是ccx计划里面的成员。 http:/ 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id55 cisco ssc客户端软件的安装客户端软件的安装 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id56 cssc连接的简单设置连接的简单设置 2006 cisco systems, inc. all rights reserved.cisco confident

56、ialpresentation_id57 presentation title size 30pt option 2: live 构建一个构建一个open和一和一 个个wep的无线网络的无线网络 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id58 配置一个无线业务的基本步骤配置一个无线业务的基本步骤 配置无线客户端的dhcp服务器 配置一个无线网络接口 dynamic interface 配置一个无线业务 wlan 2006 cisco systems, inc. all rights

57、 reserved.cisco confidentialpresentation_id59 ap的初始化的初始化 在在wlc上可以通过使用上可以通过使用ctrl + shift + 6的组合键，切换到的组合键，切换到isr路由器的界面路由器的界面 把把ap连接在连接在interswitch 模块上模块上 wlc-router(config)#int vlan 1 wlc-router(config-if)#no shut wlc-router(config-if)#ip add 54 wlc-router(config-if)#exit wlc

58、-router(config)#int range fast wlc-router(config)#int range fastethernet 0/1/0 8 wlc-router(config-if-range)#switchport wlc-router(config-if-range)#switchport access vlan 1 wlc-router(config-if-range)#no shut 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id60 1、为客户端建立、为

59、客户端建立dhcp服务器服务器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id61 2、为无线客户端建立一个无线接口、为无线客户端建立一个无线接口 点击点击apply 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id62 2、建立、建立guest无线接口无线接口:vlan20 2006 cisco systems, inc. all rights reserved.cisco c

60、onfidentialpresentation_id63 查看建立的接口查看建立的接口 点击可以进行 vlan20接口的 参数修改 如果想建立更多的 接口，可以继续点 击new设置新接口 点击可以删除 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id64 3、建立一个、建立一个open的访客的访客 wlan 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id65 3、建立一个、建立一