H3C配置WAP2加密步驟教程

H3C配置WAP2加密步驟教程
1. 配置文件
display current-configuration
#
version 5.00, 0001
#
sysname AP
#
domain default enable system
#
port-security enable
#
vlan 1
#
radius scheme system
primary authentication 127.0.0.1
primary accounting 127.0.0.1
key authentication H3C
key accounting h3c
accounting-on enable
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
wlan service-template 2 crypto
ssid h3c-wpa2-psk
authentication-method open-system
cipher-suite ccmp
security-ie rsn
service-template enable
#
interface NULL0
#
interface Vlan-interface1
ip address 192.168.1.50 255.255.255.0
#
interface Ethernet1/0/1
#
interface Ethernet1/0/2
#
interface WLAN-BSS2
port-security port-mode psk
port-security tx-key-type 11key
port-security preshared-key pass-phrase 12345678
4
#
interface WLAN-Radio1/0/1
#
interface WLAN-Radio1/0/2
service-template 2 interface wlan-bss 2
#
ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
#
user-interface con 0
user-interface vty 0 4
#
return
################################################################
2. 配置步驟
在RSN接入端（AP）配置RSN
(1) 啟用port-security
[AP]port-security enable
(2) 配置無線接口，認證方式為PSK
[AP]interface WLAN-BSS2
# 配置無線端口WLAN-BSS2的端口安全模式為psk。
[AP-WLAN-BSS2]port-security port-mode psk
# 在接口WLAN-BSS2下使能11key類型的密鑰協商功能。
[AP-WLAN-BSS2]port-security tx-key-type 11key
# 在接口WLAN-BSS2下配置預共享密鑰為12345678。
[AP-WLAN-BSS2]port-security preshared-key pass-phrase 12345678
(3) 配置無線服務模板（下麵的RSN即WPA2）
# 創建一個crypto類型的服務模板2。
[AP-wlan-rp-rp]wlan service-template 2 crypto
# 設置服務模板2的SSID為h3c-wpa2-psk。
[AP-wlan-st-2]ssid h3c-wpa2-psk
# 使能開放式係統認證。
[AP-wlan-st-2]authentication-method open-system
# 使能CCMP加密套件。
[AP-wlan-st-2] cipher-suite ccmp
# 配置信標和探查幀攜帶RSN IE信息。
[AP-wlan-st-2] security-ie rsn
# 使能服務模板2。
[AP-wlan-st-2]service-template enable
(4) 在射頻口WLAN-Radio 1/0/2綁定無線服務模板2和無線口WLAN-BSS 2。
[AP]interface WLAN-Radio 1/0/2
[AP-WLAN-Radio1/0/2]service-template 2 interface WLAN-BSS 2
5
(5) 配置VLAN虛接口
[AP1]interface Vlan-interface1
[AP-Vlan-interface1]ip address 192.168.1.50 255.255.255.0
(6) 配置缺省路由
[AP-Vlan-interface1]ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
PS：如需要SSID與VLAN綁定，僅需要建立VLAN，配置VLAN虛接口，把SSID服務模版綁定的無線口劃到該Vlan下即可！