CISCO无线控制器配置基础.ppt

Slide Title,2006 Cisco Systems,Inc.All rights reserved.,Cisco Confidential,Presentation_ID,*,Body Text,Second Level,Third Level,Fourth Level,Fifth Level,Segue and Q&A,Subtitle,2006 Cisco Systems,Inc.All rights reserved.,Cisco Confidential,Presentation_ID,*,无线控制器配置基础,Xiaogang Wu,2008.10,基本配置任务及过程,准备工作,控制器启动配置和升级控制器软件版本,熟悉控制器配置界面,3.,连接,AP,到控制器上,配置任务,思科,CSSC,无线客户端的安装和简单配置,构建一个,OPEN,和一个,WEP,的无线网络,构建一个简单,WEB,认证的无线网络,构建一个支持本地,EAP,认证的无线网络,构建一个用,ACS,做,AAA,认证的无线网络,Presentation Title Size 30PT,Option 2:Live,准备工作,基本设备,控制器,4400,或者,2100,系列,AP,：,1130,或者,1240,系列,交换机：最好是,3560 POE,交换机,2100,系列无线控制器,支持,802.11a/b/g/n,支持,PCI,认证,WLC2100,硬件,8,个,FE,口，,2,个上联口，,6,个下联口,其中,2,个,FE,口有以太网供电,未使用端口,2,个,USB,端口和一个扩展槽留作将来扩展用,*2106,和,2006,不能作为,guest access,的,anchor controller,*,不支持,Link Aggregation,*,不能通过软件升级,AP,容量,AIR-WLC2125-K9,2100 Series WLAN Controller for up to 25 Lightweight,APs,$18,890,AIR-WLC2112-K9,2100 Series WLAN Controller for up to 12 Lightweight,APs,$10,070,AIR-WLC2106-K9,2100 Series WLAN Controller for up to 6 Lightweight,APs,$4,875,NEW!,4400,系列无线控制器,1 RU,高度,2,口,或者,4,口,千兆上联,支持,12,25,50 or 100 AP,支持,5000 MAC,地址,转发表,10/100Base-TX,以太网,Service Port,9 pi,n,串口,Console,口,2,扩展槽,和,1,个,utility port,目前未使用,2,热插拔,电源模块插槽,44xx WLAN Controller,型号,4402,支持,12,25,和,50 AP,型号,4404,支持,100 APs,*,不能通过软件升级,AP,容量,*4400,系列使用,SFP,光纤模块,*,4400,系列每,port,支持,50,个,AP,准备工作,网线和,Console,线。如果是,4400,，需要两头是,DB9,接口的线，如果是,2106,或者,ISR,，需要,DB9+RJ45,的线,如果是,4400,，需要,GLC,光纤模块和光纤,确认控制器版本是否需要升级,(,用命令,show,sysinfo,查看系统版本,),是否需要将胖,AP,升级到瘦,AP,1200/1100/1300,需要,upgrade tool,做升级，,1250,不需要工具，直接在图形化界面上升级,实验拓扑示例,TRUNK,VLAN,1/20/30/40,fa0/1,port 1,WLC,说明：,1,、,VLAN1,用于连接控制器、,AP,和,ACS,；,2,、,VLAN20,用于,WPA/WPA2,认证，认证服务器用,ACS,。,3,、,VLAN30,用作,OPEN/WEP/GUEST,客户接入,3,、,VLAN40,用作,WPA/WPA2,认证，认证用本地,EAP,SSID:VLAN20,SSID:VLAN30,PC/AAA,服务器,VLAN1,所有,3,层网关设置在,3,层交换机上，地址,254,启动选项,The controller boot sequence will always have these option available since this is set in PROM to ensure controller recovery options,按,5,清空配置,系统启动界面和配置,(OS 5.1),Would you like to terminate,autoinstall,?yes:,System Name Cisco_51:2b:60(31 characters max):,2106-demo,AUTO-INSTALL:process terminated-no configuration loaded,Enter Administrative User Name(24 characters max):,cisco,Enter Administrative Password(24 characters max):,cisco,Re-enter Administrative Password :,cisco,Management Interface IP Address:192.168.10.1,Management Interface,Netmask,:255.255.255.0,Management Interface Default Router:192.168.10.254,Management Interface VLAN Identifier(0=untagged):,Management Interface Port Num 1 to 8:1,Management Interface DHCP Server IP Address:192.168.10.254,AP Manager Interface IP Address:192.168.10.2,AP-Manager is on Management subnet,using same values,AP Manager Interface DHCP Server(192.168.10.254):,Virtual Gateway IP Address:1.1.1.1,Mobility/RF Group Name:demo,系统启动界面（续）,Enable Symmetric Mobility Tunneling,yesNO,:yes,Network Name(SSID):open,Allow Static IP Addresses,YESno,:,Configure a RADIUS Server now?,YESno,:no,Warning!The default WLAN security policy requires a RADIUS server.,Please see documentation for more details.,Enter Country Code list(enter help for a list of countries)US:CN,Enable 802.11b Network,YESno,:,Enable 802.11a Network,YESno,:,Enable 802.11g Network,YESno,:,Enable Auto-RF,YESno,:,Configure a NTP server now?,YESno,:no,Configure the system time now?,YESno,:,Enter the date in MM/DD/YY format:09/28/08,Enter the time in HH:MM:SS format:17:11:00,Configuration correct?If yes,system will save it and reset.,yesNO,:yes,Configuration saved!,Resetting system with new configuration.,非常重要，,Controller,的,wireless,的,domain,要和,AP,一致。,配置,3,层交换机,p,dhcp,excluded-address 192.168.10.1,ip,dhcp,excluded-address 192.168.10.254,ip,dhcp,excluded-address 192.168.10.2,!,ip,dhcp,pool AP,network 192.168.10.0 255.255.255.0,default-router 192.168.10.254,!,interface FastEthernet0/1,switchport,trunk encapsulation dot1q,switchport,mode trunk,interface Vlan1,ip,address 192.168.10.254 255.255.255.0,!,interface Vlan20,ip,address 192.168.20.254 255.255.255.0,!,interface Vlan30,ip,address 192.168.30.254 255.255.255.0,!,interface Vlan40,ip,address 192.168.40.254 255.255.255.0,line,vty,0 4,privilege level 15,password,cisco,login,配置,WEB,访问,1,、使用直通网线，连接交换机的,trunk,接口到控制器端口,1,2,、配置,PC,机的,IP,地址,192.168.10.100/24,或者,DHCP,，网关,192.168.10.254,3,、测试,PC,能否,Ping,通,Controller,的地址：,192.168.10.1,3,、用,https:/192.168.10.1,访问控制器，如果要开启,http,访问，需要在系统里打开。,使用,IE,浏览器进行,WEB,访问,如果要升级控制器系统软件,tftp,服务器推荐,tftpd32,tftpd32,支持,64M,以上文件传输,在,CCO,上下载新版本,支持室内室外,mesh,版本,支持,802.11n,和其他新功能的普通版本,Path to Controller Software Release 5.0.148.0,or above,Current Software Release,Upgrade Path to 5.0.148.0 Software,3.2.78.0 or later 3.2 release,Upgrade to a 4.1 release before upgrading to 5.0.148.0.,4.0.155.5 or later 4.0 release,Upgrade to a 4.1 or 4.2 release before upgrading to 5.0.148.0,4.1.171.0 or later 4.1 release,You can upgrade directly to 5.0.148.0.,4.2.61.0 or later 4.2 release,You can upgrade directly to 5.0.148.0.,注意：由于配置存储格式不同，从,3.x-4.x,升级到,5.x,后，原来的部分配置可能丢失,Upgrade Path to Controller Software Release 4.1.171.0,Current Software Release,Upgrade Path to 4.1.171.0 Software,3.2.78.0,Upgrade to 4.0.206.0 or a later 4.0 release before upgrading to 4.1.171.0.,3.2.116.21,3.2.150.10,3.2.171.6,3.2.193.5,If your controller is configured with the new J3 country code,upgrade to 3.2.195.10 or a later 3.2 release.If your controller is not configured for the new J3 country code,you can upgrade to 3.2.195.10 or a later 3.2 release or to 4.0.206.0 or a later 4.0 release.,3.2.195.10 or later 3.2 release,You can upgrade directly to 4.1.171.0.,4.0.155.5,Upgrade to 4.0.206.0 or a later 4.0 release before upgrading to 4.1.171.0.,4.0.179.11,4.0.206.0 or later 4.0 release,You can upgrade directly to 4.1.171.0.,控制器软件升级,命令行方式,Step1.,ping,server-,ip,-address,测试控制器与,TFTP server,的连通性,Step2.,transfer download mode,tftp,设置传输使用的协议：,tftp,Step3.,transfer download,datatype,code,设置传输的数据类型,Step4.,transfer download,serverip,server-,ip,-address,指定,tftp,server,的,IP,地址,Step5.,transfer download filename,filename,制定,Image,的文件名,Step6.,transfer download start,开始传输文件，确认时如果回答,No,则显示,TFTP,的参数设置,Step7.,reset system,WLC,的系统重新启动,注：,TFTP,服务器软件推荐,tftpd32,，可以在网上免费下载，支持,64M,以上大文件传输,控制器软件升级,图形界面,电脑上设置好,Tftp,软件；,填入,Tftp,地址和文件名后，选择右侧的,download,按钮开始。,完成后按提示,reboot,。,Presentation Title Size 30PT,Option 2:Live,熟悉无线控制器,Controller,配置界面,命令行,(CLI),基本命令,cisco,命令行,(CLI),“clear”Commands,命令行,(CLI),“,config,”Commands,and more,命令行,(CLI),“debug”Command,命令行,(CLI)“help”Commands,命令行,(CLI),“show”Commands,命令行,(CLI),“transfer”Commands,使用,IE,浏览器进行,WEB,访问,控制器上查看和设置无线网络,SSID,控制器配置页面,配置接口,配置控制器做,DHCP,服务器,定义无线组,参看和配置端口,配置接口页面,设置控制器做,DHCP,服务器,定义移动组,设置端口页面,多个控制器时，设定主控制器,点击,WIRELESS/ALL,APs,安全页面,Radius,服务器配置,本地用户数据库,MAC,地址过滤,WEB,认证相关配置,本地,EAP,管理界面,定义能够进行,Controller,管理的管理用户,控制器维护管理界面,系统和配置文件的上传、下载配置,控制器软重启,AP,射频模块配置界面,AP,发射功率调节,(AP1131),Tx,Power,Num Of Supported Power Levels.6,Tx,Power Level 1.14,dBm,Tx,Power Level 2.11,dBm,Tx,Power Level 3.8,dBm,Tx,Power Level 4.5,dBm,Tx,Power Level 5.2,dBm,Tx,Power Level 6.-1,dBm,AP1242,的,level 1,是,17dBm,5.1,版本对,HA,的增强,Failover,等级,全局,HA,配置,Presentation Title Size 30PT,Option 2:Live,连接,AP,到控制器,Controller,里的,Port,还有,Vlan,以及,Interface,的对应关系,Controller,必需配置的接口,带内管理接口,“,Management Interface,”,LWAPP Tunnel,终结接口,“,AP Manager Interface,”,桥接的无线客户端接口,“,Dynamic Interfaces,”.,二三层漫游而设的虚拟接口,“,Virtual Interface,”,可选接口,:,服务接口,带外管理接口,*,2100,系列和,WLCM,没有,service port,确认控制器国家版本与,AP,一致,目前版本支持同时支持多国家,确认时间配置无误,在路由器或者,3,层交换机设置,DHCP,在,AP,和控制器不在同一网段的情况下，建立,AP,能够获取,IP Address,的地址池，加上,Option 43,WLC-,router(config)#ip,dhcp,pool LWAPP-AP,WLC-,router(dhcp-config)#network,192.168.10.0,255.255.255.0,WLC-,router(dhcp-config)#default-router,192.168.0.254,WLC-,router(dhcp-config)#,option,43,ascii,192.168.10.1“,/,很重要！通过,Option 43,可以让,AP,在获取和控制器不同网段,IP Address,的时候，能够知道,Controller,的所在。,如果,AP,和控制器在一个网段和广播域，则可以不配置,option 43,WLC-,router(dhcp-config)#exit,WLC-,router(config)#ip,dhcp,excluded-address 192.168.0.254,在,IOS,设备配置,Option 43,对于,1000/1500,系列，直接写,option 43,ascii,“192.168.10.5,129.168.10.20,“,对于,1100,和,1200,，需要写,option 60,和,option 43,假设要连接,1240,，控制器地址为,192.168.10.5,和,192.168.10.20,ip,dhcp,pool AP,network 192.168.10.0/24,default-router 192.168.10.254,dns,-server 192.168.10.100,option 60,ascii,“Cisco AP c1240“,option 43 hex f108c0a80a05c0a80a14,option 43,的配置详见,String,1130,的是,Cisco AP c1130,类型,=f1,长度,=2 x 4=08,192.168.10.5,192.168.10.20,可以在,console,上打开,debug,观察,AP,加入情况,(Cisco Controller)debug,lwapp,events enable,(Cisco Controller)*Oct 04 19:20:19.154:00:1a:e3:d0:19:50 Received LWAPP DISCOVERY REQUEST from AP 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:60 on port 8,*Oct 04 19:20:19.154:Received a packet which is a(type=DISCOVERY_REQUEST)with session id 0,*Oct 04 19:20:19.154:Join Priority Processing status=0,Incoming,Aps,Priority 1,MaxLrads,=6,joined,Aps,=0,*Oct 04 19:20:19.155:00:1a:e3:d0:19:50 Successful transmission of LWAPP Discovery Response to AP 00:1a:e3:d0:19:50 on port 8,*Oct 04 19:20:19.156:00:1a:e3:d0:19:50 Received LWAPP DISCOVERY REQUEST from AP 00:1a:e3:d0:19:50 to,ff:ff:ff:ff:ff:ff,on port 8,*Oct 04 19:20:19.156:Received a packet which is a(type=DISCOVERY_REQUEST)with session id 0,*Oct 04 19:20:19.156:Join Priority Processing status=0,Incoming,Aps,Priority 1,MaxLrads,=6,joined,Aps,=0,*Oct 04 19:20:19.156:00:1a:e3:d0:19:50 Successful transmission of LWAPP Discovery Response to AP 00:1a:e3:d0:19:50 on port 8,*Oct 04 19:20:31.162:00:1a:e3:d0:19:50 Received LWAPP JOIN REQUEST from AP 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67 on port 8,*Oct 04 19:20:31.162:Received a packet which is a(type=JOIN_REQUEST)with session id 0,*Oct 04 19:20:31.177:00:1a:e3:d0:19:50 AP AP001b.5302.28f8:,txNonce,00:1E:13:51:2B:60,rxNonce,00:1A:E3:D0:19:50,*Oct 04 19:20:31.177:00:1a:e3:d0:19:50 LWAPP Join Request MTU path from AP 00:1a:e3:d0:19:50 is 1500,remote debug mode is 0,*Oct 04 19:20:31.177:DTL Adding AP 1-192.168.10.10,*Oct 04 19:20:31.177:00:1a:e3:d0:19:50 Successfully added NPU Entry for AP 00:1a:e3:d0:19:50(index 1),Switch IP:192.168.10.2,Switch Port:12223,intIfNum,8,vlanId,0,AP IP:192.168.10.10,AP Port:8847,nex,*Oct 04 19:20:31.911:00:1a:e3:d0:19:50 Successful transmission of LWAPP Join Reply to AP 00:1a:e3:d0:19:50,*Oct 04 19:20:31.912:00:1a:e3:d0:19:50 spam_lrad.c:1589-Operation State 0=4,*Oct 04 19:20:31.913:00:1a:e3:d0:19:50 Register LWAPP event for AP 00:1a:e3:d0:19:50 slot 0,*Oct 04 19:20:31.914:00:1a:e3:d0:19:50 Register LWAPP event for AP 00:1a:e3:d0:19:50 slot 1,*Oct 04 19:20:33.192:00:1a:e3:d0:19:50 Received LWAPP CONFIGURE REQUEST from AP 00:1a:e3:d0:19:50 to 00:1e:13:51:2b:67,*Oct 04 19:20:33.194:00:1a:e3:d0:19:50 Updating IP info for AP 00:1a:e3:d0:19:50-static 0,192.168.10.10/255.255.255.0,gtw,192.168.10.254,*Oct 04 19:20:33.194:00:1a:e3:d0:19:50 Updating IP 192.168.10.10=,192.168.10.10,for AP 00:1a:e3:d0:19:50,*Oct 04 19:20:33.194:00:1b:53:02:28:f8 Building,Config,Response,Msg,for 00:1b:53:02:28:f8,确认,AP,连接到控制器,图形界面,命令行,Presentation Title Size 30PT,Option 2:Live,CSSC,无线客户端,802.11,无线客户端概述,WLAN,特性,CSSC,Microsoft,Cisco ACU/ADU,多,WLAN Profile,（不同的,SSID,，不同的安去策略）支持,Yes,Yes,Yes,Active Probe(hidden SSID support),Yes,No,Yes,部署工具,Yes,No,Yes,WPA/WPA2,Yes,Yes,Partial,WPA2 PMK caching,Yes,Yes,Partial,EAP-FAST,Yes,No,Partial,WPA-PSK,Yes,Yes,Partial,Static WEP(40/128 bit),Yes,Yes,Yes,NAC/CTA,（网络准入支持）,Yes,No,No,无线客户端建议,由于企业内笔记本电脑牌子比较多，建议客户端使用,Cisco CSSC,软件，使用,CSSC,软件的好处如下：,1.,整个公司笔记本电脑统一的平台，方便管理和下发策略。,CSSC,带有部署工具，制订好策略后容易部署（如果是,Windows,平台的话，还要配置相关的参数）,3.CSSC,软件支持,Cisco NAC,网络准入控制技术,.,4.,建议新购买的笔记本电脑采用统一的品牌（方便管理），旧的笔记本电脑如果没有无线网卡的话，建议统一使用,Cisco,的,CB21AG,（支持,AES,强加密）,Cisco,还提供专门为台式机使用的无线网卡：,AIR-PI21AG,。,5.Cisco,倡导了,CCX,（各厂家笔记本电脑和,Cisco AP,兼容性测试）计划，可以从下面的链接知道哪些笔记本电脑的型号是,CCX,计划里面的成员。,SSC,客户端软件的安装,CSSC,连接的简单设置,Presentation Title Size 30PT,Option 2:Live,构建一个,OPEN,和一个,WEP,的无线网络,配置一个无线业务的基本步骤,配置无线客户端的,DHCP,服务器,配置一个无线网络接口,dynamic interface,配置一个无线业务,WLAN,AP,的初始化,在,WLC,上可以通过使用,ctrl+Shift+6,的组合键，切换到,ISR,路由器的界面,把,AP,连接在,InterSwitch,模块上,WLC-,router(config)#int,vlan,1,WLC-,router(config-if)#no,shut,WLC-,router(config-if)#ip,add 192.168.0.254 255.255.255.0,WLC-,router(config-if)#exit,WLC-,router(config)#int,range fast,WLC-,router(config)#int,range,fastEthernet,0/1/0,8,WLC-,router(config-if-range)#switchport,WLC-,router(config-if-range)#switchport,access,vlan,1,WLC-,router(config-if-range)#no,shut,1,、为客户端建立,DHCP,服务器,2,、为无线客户端建立一个无线接口,点击,APPLY,2,、建立,Guest,无线接口,:VLAN20,查看建立的接口,点击可以进行,VLAN20,接口的参数修改,如果想建立更多的接口，可以继续点击,NEW,设置新接口,点击可以删除,3,、建立一个,open,的访客,WLAN,3,、建立一个,open,的访客,WLAN,很重要！很容易被忘记,3,、建立一个,open,的访客,WLAN,选择,None,，不对无线网络有任何加密和限制,WLAN,增强特性配置,无线客户端连接测试,更改刚才的,WLAN,为,WEP,加密,40,位,WEP,要求,5,位,ASCII,字符密码,104,位,WEP,要求,13,位,ASCII,字符密码,Cisco,Aironet,1100/1200/1300,不支持,128,位,WEP,无线连接验证,Presentation Title Size 30PT,Option 2:Live,构建一个简单,WEB,认证的无线接入网络,构建一个简单,WEB,认证的无线网络,增加一个新的地址池,增加一个新的接口,配置,web,页面认证的本地页面,增加,web,认证的,WLAN,建立本地用户认证数据库,1,、新建一个用于,WEB,认证用户的地址池,2,、控制器添加一个,VLAN30,接口,3,、配置,web,页面认证的本地页面,4,、新建一个,WLAN,4,、新建一个,WLAN,5,、定义内部认证用户数据库,验证,WEB,认证,跟前面一样，在,CSSC,的,Manage Network,中，选择并激活,web-auth,web,界面认证的验证,在浏览器里输入类似,10.10.10.10,地址（因为没有,DNS,，所以不能输入网址）,web,界面认证的验证,Presentation Title Size 30PT,Option 2:Live,构建一个支持本地,EAP,认证的无线接入网络,构建一个支持,WPA,认证的网络,增加一个新的地址池,增加一个新的动态接口,添加本地,EAP,支持或者,AAA,服务器（,Radius,服务器）,建立一个新的,WLAN SSID,配置,WPA/WPA2,认证,设置,CSSC,客户端软件,1,、新建一个地址池,2,、控制器添加一个,VLAN40,接口,3,、增加本地,EAP,支持,3,、本地,EAP,的,profile,配置,4,、新建一个,WLAN,4,、新建一个,WLAN,5,、配置,WPA/WPA2,5,、配置本地,EAP,认证支持,6,、设置,CSSC,软件，添加,SSID,Presentation Title Size 30PT,Option 2:Live,构建一个用,ACS,做,AAA,认证的无线接入网络,ACS,相关配置名词解释,Posture,ACS Access Control Server,NAP Network Access Profile,NAF Network Access Filter,NAD Network Access Device,NDG Network Device Group,PA Posture Agent,PV Posture Validation,RAC Radius Authorization Component,DACL Dynamic Access Control List,ADF Attribute Definition File,ACS,各部件逻辑关系,NAP,Authentication,Authorization,Posture,Validation,Authentication DB,Global Auth Setup,Internal DB,External DB,Rule 1,Rule N,Policy 1,Internal Posture Validation,External Posture Validation,External Posture Validation Audit,RAC,DACL,NAF,NAD+AAA,NDG,Switches,Routers,VPN GW,FW,Policy N,or,or,or,通过认证后检查状态,检查状态后指示设备配置,关联,组成,下载至设备,组成,引用,引用,添加,Radius,服务器,S,ecurity,aaa,radius authentication,EAP Authentication,C,isco,的自适应,WPA,或者,WPA2,EAP Authentication,配置,radius,ACS,配置,-,增加,AAA client,增加,AAA client,增加,AAA server,ACS,配置,-,增加,AAA server,ACS,配置,-,显示的,AAA client,和,Server,ACS,配置,-,产生证书,配置,AAA,需要返回的参数,ACS,配置,-AAA,能够返回的参数,ACS,配置,-,选择各种,EAP,ACS,配置,-EAP Fast,配置,不要选择这个,ACS,配置,-,增加一个,group,ACS,配置,-,增加一个,user,加入,group,EAP Authentication-funk software on PC,PEAP,PC,端配置,不要选,配置,CSSC,