ARUBA ACMS培训5.2 无线控制器常用的配置优化建议

1、CONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reservedCONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reserved俞世丹俞世丹Mobile: Aruba NetworksModule25：无线控制器常用的配置优化建议无线控制器常用的配置优化建议People move. Networks must follow.CONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights re

2、served2网络层优化配置建议网络层优化配置建议u 对于单臂连接拓扑，关闭spanning-treeno spanning-treeu 关闭ADP协议adp discover disableadp igmp-join disableu 关闭control-plane-securitycontrol-plane-securityno cpsec-enableu指定控制器的Controller-ip（默认为VLAN1的接口地址）controller-ip vlan u关闭系统缺省的vlan 1Interface vlan 1 no ip addressInterface vlan 1 shutd

3、ownu指定Radius Source-IP为控制器上联vlan的接口地址ip radius source-ip-address CONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reserved3防火墙全局配置优化建议防火墙全局配置优化建议u 如果没有VoWiFi应用，禁用VoIP应用层网关firewall disable-stateful-sip-processingfirewall disable-stateful-sccp-processingfirewall disable-stateful-h323-proce

4、ssingfirewall disable-stateful-ua-processingfirewall disable-stateful-vocera-processingu 如果可能的话，关闭无线用户之间的互访firewall deny-inter-user-bridgefirewall deny-inter-user-trafficu 设置validuser策略，定义可以加入用户列表的地址范围ip access-list session validuserany any svc-dhcp permitalias user-gw any any denyalias user-net any

5、 any permitCONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reserved4防火墙角色配置优化建议防火墙角色配置优化建议u 角色的命名需要尽可能便于理解u 策略的定义尽可能借助网络别名和服务别名来实现u 在所有角色中，按照实际需求实施会话数控制策略user-role corp-rolemax-session 200u 为所有角色配置一套基本策略ip access-list session basic-acluser any udp 68 denyany any svc-dhcp permituser any

6、svc-dns permitu 在所有角色中，禁止用户对控制器管理接口的访问ip access-list session controller-if-acluser alias controller-if svc-ssh denyuser alias controller-if tcp 4343 denyuser alias controller-if svc-telnet denyCONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reserved5无线网络配置优化建议无线网络配置优化建议u 在wlan ssid-prof

7、ile中优化802.11g的协商和发送速率wlan ssid-profile g-basic-rate 6 12 24wlan ssid-profile g-tx-rate 6 12 24 36 48 54u 802.11n标准明确放弃WEP和TKIP加密算法，对于需要加密的无线信号，必须采用AES加密方式u 在wlan virtual-ap中启用广播优化和频段负载均衡wlan virtual-ap broadcast-filter arpwlan virtual-ap broadcast-filter allwlan virtual-ap bandsteeringu 在wlan virtua

8、l-ap中采用vlan-name设置Wwan virtual-ap vlan u 在portal认证的初始角色中，允许访问OCSP查询站点ip access-list session ocsp-acluser alias comodaca svc-http permituser alias comodaca svc-https permitCONFIDENTIAL Copyright 2011. Aruba Networks, Inc. All rights reserved6射频参数配置优化建议射频参数配置优化建议u 在rf arm-profile中关闭40MHz频宽rf arm-profile 40MHz-allowed-bands noneu 在rf arm-profile中关闭multi-band-scanrf arm-profile no multi-band-scanu 在rf arm-profile中将发信功率的波动调节到一个合理的范围(建议为1到2级）rf arm-profile min-tx-power rf arm-profile max-tx-power u 在rf dot11g-radio-profile中关闭dot11b-protection功能rf dot11g-radio-profile no dot11b-protctio