cisco controller 4400完全配置手册

1、 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id1无线控制器配置基础无线控制器配置基础完全配置手册完全配置手册 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id2基本配置任务及过程基本配置任务及过程准备工作1. 控制器启动配置和升级控制器软件版本控制器启动配置和升级控制器软件版本2. 熟悉控制器配置界面熟悉控制器配置界面3. 连接连接ap到控制器上到控制器上配置任务1. 思科思科

2、cssc无线客户端的安装和简单配置无线客户端的安装和简单配置2. 构建一个构建一个open和一个和一个wep的无线网络的无线网络3. 构建一个简单构建一个简单web认证的无线网络认证的无线网络4. 构建一个支持本地构建一个支持本地eap认证的无线网络认证的无线网络5. 构建一个用构建一个用acs做做aaa认证的无线网络认证的无线网络 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id3presentation title size 30ptoption 2: live准备工作 2006 c

3、isco systems, inc. all rights reserved.cisco confidentialpresentation_id4基本设备基本设备 控制器 4400或者2100系列 ap：1130或者1240系列 交换机： 最好是3560 poe交换机 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id52100系列无线控制器系列无线控制器 支持支持802.11a/b/g/n 支持支持pci认证认证 wlc2100 硬件硬件8个fe口，2个上联口，6个下联口其中2个fe口有

4、以太网供电 未使用端口未使用端口2个usb端口和一个扩展槽留作将来扩展用*2106和2006不能作为guest access的anchor controller*不支持link aggregation*不能通过软件升级ap容量air-wlc2125-k92100 series wlan controller for up to 25 lightweight aps$18,890air-wlc2112-k92100 series wlan controller for up to 12 lightweight aps$10,070air-wlc2106-k92100 series wlan co

5、ntroller for up to 6 lightweight aps$4,875 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id64400系列无线控制器系列无线控制器 1 ru 高度2口 或者 4口千兆上联 支持 12, 25, 50 or 100 ap 支持 5000 mac地址转发表 10/100base-tx 以太网 service port 9 pin 串口console口 2 扩展槽和1个utility port目前未使用 2 热插拔电源模块插槽44xx wlan con

6、troller 型号 4402 支持 12, 25, 和50 ap 型号 4404支持100 aps*不能通过软件升级ap容量*4400系列使用sfp光纤模块*4400系列每port支持50个ap 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id7准备工作准备工作 网线和console线。如果是4400，需要两头是db9接口的线，如果是2106或者isr，需要db9+rj45的线 如果是4400，需要glc光纤模块和光纤 确认控制器版本是否需要升级 (用命令show sysinfo查看系

7、统版本) 是否需要将胖ap升级到瘦ap1200/1100/1300需要upgrade tool做升级，1250不需要工具，直接在图形化界面上升级 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id8实验拓扑示例实验拓扑示例trunkvlan1/20/30/40fa0/1port 1sscwlc说明：说明：1、vlan1用于连接控制器、ap和acs；2、vlan20用于wpa/wpa2认证，认证服务器用acs。3、vlan30用作open/wep/guest客户接入3、vlan40用作wpa

8、/wpa2认证，认证用本地eapsscssid:vlan20ssid:vlan30pc/aaa服务器服务器vlan1所有3层网关设置在3层交换机上，地址254 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id9启动选项启动选项the controller boot sequence will always have these option available since this is set in prom to ensure controller recovery options按

9、5清空配置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id10系统启动界面和配置系统启动界面和配置 (os 5.1)would you like to terminate autoinstall? yes: system name cisco_51:2b:60 (31 characters max): 2106-demoauto-install: process terminated - no configuration loadedenter administrative user

10、name (24 characters max): ciscoenter administrative password (24 characters max): ciscore-enter administrative password : ciscomanagement interface ip address: management interface netmask: management interface default router: 54management interface vlan identifi

11、er (0 = untagged): management interface port num 1 to 8: 1management interface dhcp server ip address: 54ap manager interface ip address: ap-manager is on management subnet, using same valuesap manager interface dhcp server (54): virtual gateway ip address: 1.1.1.

12、1mobility/rf group name: demo 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id11系统启动界面（续）系统启动界面（续）enable symmetric mobility tunneling yesno: yesnetwork name (ssid): open allow static ip addresses yesno: configure a radius server now? yesno: nowarning! the default wlan s

13、ecurity policy requires a radius server.please see documentation for more details.enter country code list (enter help for a list of countries) us: cnenable 802.11b network yesno: enable 802.11a network yesno: enable 802.11g network yesno: enable auto-rf yesno: configure a ntp server now? yesno: noco

14、nfigure the system time now? yesno: enter the date in mm/dd/yy format: 09/28/08enter the time in hh:mm:ss format: 17:11:00configuration correct? if yes, system will save it and reset. yesno: yesconfiguration saved!resetting system with new configuration.非常重要，非常重要，controller的的wireless的的domain要和要和ap一致

15、。一致。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id12配置配置3层交换机层交换机p dhcp excluded-address ip dhcp excluded-address 54ip dhcp excluded-address !ip dhcp pool ap network default-router 54 !interfa

16、ce fastethernet0/1 switchport trunk encapsulation dot1q switchport mode trunkinterface vlan1 ip address 54 !interface vlan20 ip address 54 ! interface vlan30 ip address 54 !interface vlan40 ip address 54 255.255.2

17、55.0line vty 0 4 privilege level 15 password cisco login 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id13配置配置web访问访问1、使用直通网线，连接交换机的trunk接口到控制器端口12、配置pc机的ip地址 00/24或者dhcp，网关543、测试pc能否ping 通controller的地址：3、用访问控制器，如果

18、要开启http访问，需要在系统里打开。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id14使用使用ie浏览器进行浏览器进行web访问访问 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id15如果要升级控制器系统软件如果要升级控制器系统软件 tftp 服务器推荐tftpd32 支持64m以上文件传输 2006 cisco systems, inc. all rights reser

19、ved.cisco confidentialpresentation_id16在在cco上下载新版本上下载新版本支持室内室外 mesh 版本支持802.11n和其他新功能的普通版本http:/ 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id17upgrade path to controller software release or abovecurrent software release upgrade path to software 3

20、.2.78.0 or later 3.2 release upgrade to a 4.1 release before upgrading to . or later 4.0 release upgrade to a 4.1 or 4.2 release before upgrading to or later 4.1 release you can upgrade directly to . or later 4.2 release you can upgrade direct

21、ly to . 注意：由于配置存储格式不同，从3.x-4.x 升级到5.x后，原来的部分配置可能丢失 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id18upgrade path to controller software release current software release upgrade path to software upgrade to or a later 4.0 r

22、elease before upgrading to . 1 0 if your controller is configured with the new j3 country code, upgrade to 0 or a later 3.2 release. if your controller is not configured for the new j3 country code, you can upgrade to 0 or a later 3.2

23、release or to or a later 4.0 release. 0 or later 3.2 release you can upgrade directly to . upgrade to or a later 4.0 release before upgrading to . 1 or later 4.0 release you can upgrade directly to . 2006 cisco syst

24、ems, inc. all rights reserved.cisco confidentialpresentation_id19控制器软件升级控制器软件升级 命令行方式命令行方式 step1. ping server-ip-address 测试控制器与tftp server的连通性 step2. transfer download mode tftp 设置传输使用的协议：tftp step3. transfer download datatype code 设置传输的数据类型 step4. transfer download serverip server-ip-address 指定tftp

25、 server的ip地址 step5. transfer download filename filename 制定image的文件名 step6. transfer download start 开始传输文件，确认时如果回答no,则显示tftp的参数设置 step7. reset system wlc的系统重新启动注：tftp服务器软件推荐tftpd32，可以在网上免费下载，支持64m以上大文件传输 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id20控制器软件升级控制器软件升级 图形

26、界面图形界面电脑上设置好tftp软件；填入tftp地址和文件名后，选择右侧的 download 按钮开始。完成后按提示reboot。 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id21presentation title size 30ptoption 2: live熟悉无线控制器controller配置界面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id22命令行命令行 (c

27、li)基本命令基本命令cisco 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id23命令行命令行 (cli) “clear” commands 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id24命令行命令行 (cli) “config” commands and more 2006 cisco systems, inc. all rights reserved.cisco co

28、nfidentialpresentation_id25命令行命令行 (cli) “debug” command 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id26命令行命令行 (cli) “help” commands 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id27命令行命令行 (cli) “show” commands 2006 cisco systems, inc. a

29、ll rights reserved.cisco confidentialpresentation_id28命令行命令行 (cli) “transfer” commands 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id29使用使用ie浏览器进行浏览器进行web访问访问 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id30控制器上查看和设置无线网络控制器上查看和设置无线网络ssi

30、d 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id31控制器配置页面控制器配置页面配置接口配置接口配置控制器配置控制器做做dhcp服务服务器器定义无线组定义无线组参看和配置参看和配置端口端口 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id32配置接口页面配置接口页面 2006 cisco systems, inc. all rights reserved.cisco confi

31、dentialpresentation_id33设置控制器做设置控制器做dhcp服务器服务器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id34定义移动组定义移动组 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id35设置端口页面设置端口页面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresen

32、tation_id36多个控制器时，设定主控制器多个控制器时，设定主控制器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id37点击点击wireless/all aps 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id38安全页面安全页面radius服务器配置服务器配置本地用户数据库本地用户数据库mac地址过滤地址过滤web认证相关认证相关配置配置本地本地eap 2006 cisc

33、o systems, inc. all rights reserved.cisco confidentialpresentation_id39管理界面管理界面定义能够进行定义能够进行controller管管理的管理用户理的管理用户 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id40控制器维护管理界面控制器维护管理界面系统和配置文系统和配置文件的上传、下件的上传、下载配置载配置控制器软重启控制器软重启 2006 cisco systems, inc. all rights reserve

34、d.cisco confidentialpresentation_id41ap射频模块配置界面射频模块配置界面 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id42ap发射功率调节发射功率调节(ap1131) tx power num of supported power levels . 6 tx power level 1 . 14 dbm tx power level 2 . 11 dbm tx power level 3 . 8 dbm tx power level 4 . 5

35、dbm tx power level 5 . 2 dbm tx power level 6 . -1 dbmap1242的level 1 是 17dbm 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id435.1版本对版本对ha的增强的增强failover等级全局ha配置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id44presentation title size 30pto

36、ption 2: live连接ap到控制器 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id45controller里的里的port还有还有vlan以及以及interface的对应关系的对应关系 controller必需配置的接口带内管理接口“management interface”lwapp tunnel 终结接口“ap manager interface”桥接的无线客户端接口“dynamic interfaces”. 二三层漫游而设的虚拟接口“virtual interface”

37、可选接口:服务接口带外管理接口带外管理接口*2100系列和wlcm没有service port 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id46确认控制器国家版本与确认控制器国家版本与ap一致一致目前版本支持同时支持多国家 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id47确认时间配置无误确认时间配置无误 2006 cisco systems, inc. all rights

38、 reserved.cisco confidentialpresentation_id48在路由器或者在路由器或者3层交换机设置层交换机设置dhcp在在ap和控制器不在同一网段的情况下，建立和控制器不在同一网段的情况下，建立ap能够获取能够获取ip address 的地址池，加上的地址池，加上option 43wlc-router(config)#ip dhcp pool lwapp-apwlc-router(dhcp-config)#network wlc-router(dhcp-config)#default-router 192.168

39、.0.254wlc-router(dhcp-config)#option 43 ascii “/很重要！通过很重要！通过option 43 可以让可以让ap在获取和控制器不同网段在获取和控制器不同网段ip address的时候，能够知道的时候，能够知道controller的所在。的所在。如果如果ap和控制器在一个网段和广播域，则可以不配置和控制器在一个网段和广播域，则可以不配置option 43wlc-router(dhcp-config)#exitwlc-router(config)#ip dhcp excluded-address 54 200

40、6 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id49在在ios设备配置设备配置option 43 对于1000/1500系列，直接写option 43 ascii “,0“ 对于1100和1200，需要写option 60和option 43 假设要连接1240，控制器地址为和0ip dhcp pool apnetwork /24default-router 192.168

41、.10.254dns-server 00option 60 ascii “cisco ap c1240 “option 43 hex f108c0a80a05c0a80a14 option 43的配置详见http:/ string1130的是cisco ap c1130 类型= f1长度 = 2 x 4 = 080 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id50可以在可以在console上打开上打开debug观

42、察观察ap加入情况加入情况(cisco controller) debug lwapp events enable (cisco controller) *oct 04 19:20:19.154: 00:1a:e3:d0:19:50 received lwapp discovery request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:60 on port 8*oct 04 19:20:19.154: received a packet which is a (type = discovery_request) with session id

43、0*oct 04 19:20:19.154: join priority processing status = 0, incoming aps priority 1, maxlrads = 6,joined aps =0*oct 04 19:20:19.155: 00:1a:e3:d0:19:50 successful transmission of lwapp discovery response to ap 00:1a:e3:d0:19:50 on port 8*oct 04 19:20:19.156: 00:1a:e3:d0:19:50 received lwapp discovery

44、 request from ap 00:1a:e3:d0:19:50 to ff:ff:ff:ff:ff:ff on port 8*oct 04 19:20:19.156: received a packet which is a (type = discovery_request) with session id 0*oct 04 19:20:19.156: join priority processing status = 0, incoming aps priority 1, maxlrads = 6,joined aps =0*oct 04 19:20:19.156: 00:1a:e3

45、:d0:19:50 successful transmission of lwapp discovery response to ap 00:1a:e3:d0:19:50 on port 8*oct 04 19:20:31.162: 00:1a:e3:d0:19:50 received lwapp join request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67 on port 8*oct 04 19:20:31.162: received a packet which is a (type = join_request) with ses

46、sion id 0*oct 04 19:20:31.177: 00:1a:e3:d0:19:50 ap ap001b.5302.28f8: txnonce 00:1e:13:51:2b:60 rxnonce 00:1a:e3:d0:19:50 *oct 04 19:20:31.177: 00:1a:e3:d0:19:50 lwapp join request mtu path from ap 00:1a:e3:d0:19:50 is 1500, remote debug mode is 0*oct 04 19:20:31.177: dtl adding ap 1 - 0

47、*oct 04 19:20:31.177: 00:1a:e3:d0:19:50 successfully added npu entry for ap 00:1a:e3:d0:19:50 (index 1)switch ip: , switch port: 12223, intifnum 8, vlanid 0ap ip: 0, ap port: 8847, nex*oct 04 19:20:31.911: 00:1a:e3:d0:19:50 successful transmission of lwapp join reply to ap 00

48、:1a:e3:d0:19:50*oct 04 19:20:31.912: 00:1a:e3:d0:19:50 spam_lrad.c:1589 - operation state 0 = 4*oct 04 19:20:31.913: 00:1a:e3:d0:19:50 register lwapp event for ap 00:1a:e3:d0:19:50 slot 0*oct 04 19:20:31.914: 00:1a:e3:d0:19:50 register lwapp event for ap 00:1a:e3:d0:19:50 slot 1*oct 04 19:20:33.192:

49、 00:1a:e3:d0:19:50 received lwapp configure request from ap 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67*oct 04 19:20:33.194: 00:1a:e3:d0:19:50 updating ip info for ap 00:1a:e3:d0:19:50 - static 0, 0/, gtw 54*oct 04 19:20:33.194: 00:1a:e3:d0:19:50 updating ip 192.168.1

50、0.10 = 0 for ap 00:1a:e3:d0:19:50*oct 04 19:20:33.194: 00:1b:53:02:28:f8 building config response msg for 00:1b:53:02:28:f8 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id51确认确认ap连接到控制器连接到控制器图形界面命令行 2006 cisco systems, inc. all rights reserved.cisco confide

51、ntialpresentation_id52presentation title size 30ptoption 2: livecssc无线客户端 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id53802.11 无线客户端概述无线客户端概述wlan 特性csscmicrosoftcisco acu/adu多 wlan profile（不同的ssid，不同的安去策略）支持yesyesyesactive probe (hidden ssid support)yesnoyes部署工具yesn

52、oyeswpa/wpa2yesyespartialwpa2 pmk cachingyesyespartialeap-fastyesnopartialwpa-pskyesyespartialstatic wep (40/128 bit)yesyesyesnac/cta（网络准入支持）yesnono 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id54无线客户端建议无线客户端建议 由于企业内笔记本电脑牌子比较多，建议客户端使用由于企业内笔记本电脑牌子比较多，建议客户端使用cisco cssc

53、软件，使用软件，使用cssc软件的软件的好处如下：好处如下： 1.整个公司笔记本电脑统一的平台，方便管理和下发策略。cssc带有部署工具，制订好策略后容易部署（如果是windows平台的话，还要配置相关的参数） 3. cssc软件支持cisco nac网络准入控制技术. 4. 建议新购买的笔记本电脑采用统一的品牌（方便管理），旧的笔记本电脑如果没有无线网卡的话，建议统一使用cisco的cb21ag（支持aes强加密）,cisco还提供专门为台式机使用的无线网卡：air-pi21ag。 5.cisco倡导了ccx（各厂家笔记本电脑和cisco ap兼容性测试）计划，可以从下面的链接知道哪些笔记本

54、电脑的型号是ccx计划里面的成员。http:/ 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id55cisco ssc客户端软件的安装客户端软件的安装 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id56cssc连接的简单设置连接的简单设置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresenta

55、tion_id57presentation title size 30ptoption 2: live构建一个构建一个open和一和一个个wep的无线网络的无线网络 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id58配置一个无线业务的基本步骤配置一个无线业务的基本步骤配置无线客户端的dhcp服务器配置一个无线网络接口 dynamic interface配置一个无线业务 wlan 2006 cisco systems, inc. all rights reserved.cisco con

56、fidentialpresentation_id59ap的初始化的初始化在在wlc上可以通过使用上可以通过使用ctrl + shift + 6的组合键，切换到的组合键，切换到isr路由器的界面路由器的界面把把ap连接在连接在interswitch 模块上模块上wlc-router(config)#int vlan 1wlc-router(config-if)#no shutwlc-router(config-if)#ip add 54 wlc-router(config-if)#exitwlc-router(config)#int range f

57、astwlc-router(config)#int range fastethernet 0/1/0 8wlc-router(config-if-range)#switchport wlc-router(config-if-range)#switchport access vlan 1wlc-router(config-if-range)#no shut 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id601、为客户端建立、为客户端建立dhcp服务器服务器 2006 cisco syst

58、ems, inc. all rights reserved.cisco confidentialpresentation_id612、为无线客户端建立一个无线接口、为无线客户端建立一个无线接口点击点击apply 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id622、建立、建立guest无线接口无线接口:vlan20 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id63查看建立的接

59、口查看建立的接口点击可以进行vlan20接口的参数修改如果想建立更多的接口，可以继续点击new设置新接口点击可以删除 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id643、建立一个、建立一个open的访客的访客 wlan 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id653、建立一个、建立一个open的访客的访客 wlan很重要！很容易被忘记 2006 cisco system

60、s, inc. all rights reserved.cisco confidentialpresentation_id663、建立一个、建立一个open的访客的访客 wlan选择none，不对无线网络有任何加密和限制 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id67wlan增强特性配置增强特性配置 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id68无线客户端连接测试无线客