Huawei WLAN Certification Training

HCIA-WALN
Experiment Guide for WLAN /en
o m
Engineers i . c
e w
a
.hu
ISSUE:2.0
in g
arn
//le
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
or
M HUAWEI TECHNOLOGIES CO., LTD.

1
 Huawei WLAN Certification Training Experiment Guide

Copyright © Huawei Technologies Co., Ltd. 2017. All rights reserved.

No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Huawei Technologies Co., Ltd.

Trademarks and Permissions

n
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.

/
All other trademarks and trade names mentioned in this document are the property of their respective
e
om
holders.

Notice
i . c
we
The purchased products, services and features are stipulated by the contract made between Huawei and

a
the customer. All or part of the products, services and features described in this document may not be

hu
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,

or representations of any kind, either express or implied.

g .
information, and recommendations in this document are provided "AS IS" without warranties, guarantees

in
rn
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and

le a
recommendations in this document do not constitute a warranty of any kind, express or implied.

: //
t t p
: h
es
r c
ou
e s
RHuawei Technologies Co., Ltd.
i n g
n
ar
Address: Huawei Industrial Base

L e Bantian, Longgang
Shenzhen 518129
e
or
People's Republic of China

M
Website: http://e.huawei.com

华为专有和保密信息
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Huawei Certificate System

Relying on the strong technical strength and professional training system, Huawei provides
a practical and professional four-level certificate system to meet various customer requirements
on different WLAN technologies.
Huawei Certified ICT Associate-Wireless Local Area Network (HCIA-WLAN) is designed for
Huawei local offices, online engineers in representative offices, and readers who want to
understand Huawei WLAN products and technology. HCIA-WLAN covers WLAN basics,
Control and Provisioning of Wireless Access Points (CAPWAP) protocol, WLAN networking,
Huawei WLAN product features, security configuration, WLAN advanced technology,
antennas, WLAN network planning and optimization, and WLAN fault troubleshooting.
e n
/
The HCIA-WLAN certificate system introduces you to the industry and market, helps you in
o m
innovation, and enables you to stand atop the WLAN frontiers.
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 1
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

About This Document

Overview
This document is applicable to the candidates who are preparing for the HCIA-WLAN
exam and the readers who want to understand the WLAN basics, the CAPWAP protocol,
WLAN networking, Huawei WLAN product features, security configuration, WLAN
advanced technology, antennas, WLAN network planning and optimization, and WLAN
e n
fault troubleshooting.
/
o m
Description e i.c
aw
u
This experiment guide introduces the following six experiments, covering basic

h
configurations, and configurations and implementation of Layer 2 networking, security,
.
g
Layer 3 networking, and the network management software eSight.
 Experiment 1: AC configuration initialization
n in
r
lea
This experiment involves basis operations and configurations on an AC, helping you
know the AC6005 and its basic functions.


: //
Experiment 2: AP authentication and WLAN configuration process

t p
This experiment lets you know basic WLAN network capabilities through basic WLAN
configurations.
t

: h
Experiment 3: WLAN security configuration

e s
This experiment mainly introduces 802.1x authentication, helping you know WLAN

r c
security and the configuration process.


o u
Experiment 4: WLAN configuration on eSight

s
This experiment involves how to add WLAN devices to the eSight and deliver WLAN

Re
services using the configuration wizard.

g
 Experiment 5: Bypass Layer 3 networking

n i n This experiment uses the AC6005 and Layer 3 networking. The Layer 3 network

r
configuration helps you comprehensively know WLAN networking modes.

e a  Experiment 6: Configuration file backup and AC configuration clearance

e L This experiment describes how to back up configuration files through File Transfer
Protocol (FTP).

or
M

华为专有和保密信息 3
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Background Knowledge Required

 The intended audience should know basic WLAN knowledge, Huawei switching
devices, and basic datacom knowledge.

Common Icons

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 4
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Experiment Environment Overview

Networking Introduction
This experiment environment is prepared for WLAN engineers who are preparing for
the HCIA-WLAN exam.
Each suite of experiment environment includes 2-6 ACs, 2-12 APs, 1 core switch, and 1
Remote Authentication Dial In User Service (RADIUS) or eSight server. Each suite of
experiment environment is applicable to 4 to 12 candidates.

Device Introduction
e n
he following table lists devices recommended for HCIA-WLAN experiments and the /
mappings between the device name, model, and software version.
o m
Device name Model
e
Software Version
i.c
Core Switch
S3700-28TP-PWR-EI or
w
Version 5.70 (S3700 V100R005C01SPC100)
a
S5700-28C-PWR-EI
u
Version 5.130 (S5700 V200R003C00SPC300)
h
AC AC6005-8-PWR
g .
AC6005 V200R007C10SPC100
AP AP4030DN
in
AP4030DN V200R007C10SPC100
n
r
lea
NMS eSight Network eSight Network V300R006C00SPC505

: //
t t p
: h
e s
r c
o u
s
Re
i n g
r n
e a
e L
or
M

华为专有和保密信息 5
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Experiment Environment Preparation

Checking Whether All Devices Are Available
Before starting the experiment, check whether all required devices are ready. The
following table lists the required devices.

Device Quantity Remarks

eSight 1 Shared by all groups

Radius Server 1 Shared by all groups

e n
/
Huawei 3700PoE/
o m
i.c
1 Shared by all groups
Huawei 5700PoE Switch

One for each

w e
AC6005
group
u a
. h
AP4030DN
Two for each
group
in g
r n
lea
One for each A desktop computer requires a
Laptop or desktop computer
group network adapter

: //
Twisted pair
t t
group p
Four for each The twisted pair must be at least
2 meters long

: h
Console cable
e s One for each

c
group

u r
o
Each group must check whether the following devices are ready:
s
 One AC6005Re
i n g
 Two AP4030DN

rn
 One laptop or desktop computer

e a Four twisted pairs

e L  One console cable

or
M

华为专有和保密信息 6
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Experiment topology

e n
/
o m
e i.c
aw
hu
g .
n in
r
//lea
p :
Key points of bypass topology establishment:

t t
This course uses a layer 3 bypass topology. Devices are connected as follows:

: h
e s
For group 1, port 8 of AC1 is connected to port 1 of the switch. AP1 is connected to port
10 of the switch. AP2 is connected to port 11 of the switch.

r c
o u
For group 2, port 8 of AC2 is connected to port 2 of the switch. AP3 is connected to port
12 of the switch. AP4 is connected to port 13 of the switch.
s
Re
For group 3, port 8 of AC3 is connected to port 3 of the switch. AP5 is connected to port
14 of the switch. AP6 is connected to port 15 of the switch.

i n g
The same rule applies to all other groups.

n
ar
For group 6, port 8 of AC6 is connected to port 6 of the switch. AP11 is connected to

e
port 20 of the switch. AP12 is connected to port 21 of the switch.

e L
or
M

华为专有和保密信息 7
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Login
Use a console cable to connect the PC to the device, run a terminal emulation program on
the PC (such as a HyperTerminal running the Windows OS), and log in to the device
through the COM port.

AC Configuration Removal
Trainees must remove previously saved configurations after the experiment is complete
and before devices are turned off, to avoid any impact of the configurations on the next
experiment. In addition, trainees must confirm that the device is not configured before an
experiment starts. If it is not, remove the configurations and then restart the device.
You need a password to log in to the router. The login password is Admin@123 in this
e n
experiment.
/
Login authentication

o m
i.c
Password:Admin@123
<AC6005>reset saved-configuration
This will delete the configuration in the flash memory.
The device configurations will be erased to reconfigure.
w e
Are you sure? (y/n)[n]:y
u a
Clear the configuration in the device successfully.

. h
To restart the controller, run the following command:
<AC6005>reboot
in g
r n
Info: The system is comparing the configuration, please wait.

lea
Warning: All the configuration will be saved to the next startup

//
configuration.
Continue ? [y/n]:n

p :
t
System will reboot! Continue ? [y/n]:y

t
Info: system is rebooting ,please wait...

h
:
After the controller is restarted, carry out experiments.
s
r c e
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 8
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Contents

About This Document ..................................................................................................................... 3

Overview ..............................................................................................................................................................3
Description ...........................................................................................................................................................3
Background Knowledge Required .........................................................................................................................4
Common Icons .....................................................................................................................................................4

e n
Experiment Environment Preparation .....................................................................................................................6

1 Experiment 1:AC configuration initialization ......................................................................./12

o m
i . c
1.1 About This Course .........................................................................................................................................12

w e
1.1.1 Objectives ..................................................................................................................................................12
1.1.2 Topology ....................................................................................................................................................12

u a
1.1.3 Plan ...........................................................................................................................................................13

. h
1.2 Experiment Task ............................................................................................................................................14

in g
1.2.1 Configuration Procedure .............................................................................................................................14

n
1.3 Verification ...................................................................................................................................................17
r
l e a
1.3.1 Telnet AC ...................................................................................................................................................17

/
1.4 Reference Configuration ................................................................................................................................18

:/
p
1.4.1 S5700 Configuration ..................................................................................................................................18

t t
1.4.2 AC Configuration ........................................................................................................................................20

2 Experiment 2: AP Authentication and hWLAN Configuration Roadmap .................... 24

s :
c e
2.1 About This Course .........................................................................................................................................24

r
u
2.1.1 Objectives ..................................................................................................................................................24

o
s
2.1.2 Topology ....................................................................................................................................................24

Re
2.1.3 Plan ...........................................................................................................................................................25

g
2.2 Experiment Task ............................................................................................................................................27

i n
2.2.1 Configuration Procedure .............................................................................................................................27

n
r
2.3 Verification ...................................................................................................................................................30

a
Le
2.3.1 Checking the VAP Status .............................................................................................................................30
2.3.2 Terminal Connection Test ............................................................................................................................31

r e
2.4 Reference Configuration ................................................................................................................................32
o 2.4.1 S5700 Configuration ..................................................................................................................................32
M 2.4.2 AC Configuration ........................................................................................................................................34

3 Experiment 3: WLAN Security Configuration....................................................................... 39

3.1 About This Course .........................................................................................................................................39
3.1.1 Objectives ..................................................................................................................................................39
3.1.2 Topology ....................................................................................................................................................39

华为专有和保密信息 9
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

3.1.3 Plan ...........................................................................................................................................................40

3.2 Experiment Task ............................................................................................................................................41
3.2.1 Configuration Procedure .............................................................................................................................41
3.3 Verification ...................................................................................................................................................50
3.3.1 Connect an STA to the WLAN .....................................................................................................................50
3.3.2 Checking the Users Status ...........................................................................................................................51
3.4 Reference Configuration ................................................................................................................................54
3.4.1 S5700 Configuration ..................................................................................................................................54
3.4.2 AC Configuration ........................................................................................................................................56

4 Experiment 4: eSight WLAN Management ............................................................................ 62

e n
4.1 About This Course .........................................................................................................................................62
/
m
4.1.1 Objectives ..................................................................................................................................................62
o
i.c
4.1.2 Topology ....................................................................................................................................................62

w e
4.1.3 Plan ...........................................................................................................................................................63
4.2 Experiment Task ............................................................................................................................................64

u a
4.2.1 Configuration Procedure .............................................................................................................................64

. h
4.3 Verification ...................................................................................................................................................81

in g
4.3.1 Connect an STA to the WLAN .....................................................................................................................81

n
4.4 Reference Configuration ................................................................................................................................82
r
lea
4.4.1 S5700 Configuration ..................................................................................................................................82

//
4.4.2 AC Configuration ........................................................................................................................................85

p :
t
5 Experiment 5: Layer 3 Networking Experiment .................................................................... 91
t
h
5.1 About This Course .........................................................................................................................................91

:
s
5.1.1 Objectives ..................................................................................................................................................91

e
c
5.1.2 Topology ....................................................................................................................................................91
r
u
5.1.3 Plan ...........................................................................................................................................................92

o
s
5.2 Experiment Task ............................................................................................................................................93

Re
5.2.1 Configuration Procedure .............................................................................................................................93

i n g
5.3 Verification ...................................................................................................................................................94
5.3.1 Verifiy the L3 Network Status ......................................................................................................................94

r n
5.4 Reference Configuration ................................................................................................................................95

e a
5.4.1 S5700 Configuration ..................................................................................................................................95
L
5.4.2 AC Configuration ........................................................................................................................................97
e
or
6 Experiment 6: Backup the Configuration and Reset the Device ...................................... 103

M
6.1 About This Course .......................................................................................................................................103
6.1.1 Objectives ................................................................................................................................................103
6.1.2 Plan .........................................................................................................................................................103
6.2 Experiment Task ..........................................................................................................................................104
6.2.1 Configuration Procedure ...........................................................................................................................104
6.3 Verification .................................................................................................................................................106

华为专有和保密信息 10
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

6.3.1 Checking the Device Configuration ...........................................................................................................106

6.4 Reference Configuration ..............................................................................................................................109
6.4.1 Key Configuration .....................................................................................................................................109

7 Appendix .................................................................................................................................... 110

7.1 Configuration of Core Switch.......................................................................................................................110

e n
/
o m
e i.c
aw
h u
g .
n in
r
// lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
r n
e a
e L
or
M

华为专有和保密信息 11
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

1 Experiment 1:AC configuration initialization

1.1 About This Course

1.1.1 Objectives e n
/
Configure the initialization password
o m
i.c


 Configure VLAN and routing in the AC

 Configure telnet service of the AC
w e
 Save the configuration in the AC
u a
1.1.2 Topology . h
in g
r n
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 12
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

1.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.

Group
AC-Switch Port AP-Switch Port
No

AP1-G0/0/10
n

1 AC1—G0/0/1
 AP2-G0/0/11
/ e
 AP3-G0/0/12
o m
i.c
2 AC2—G0/0/2
 AP4-G0/0/13

w e
a
 AP5-G0/0/14
3 AC3—G0/0/3
 AP6-G0/0/15
hu
g .
in
 AP7-G0/0/15
4 AC4—G0/0/4
 AP8-G0/0/16
r n
5 AC5—G0/0/5
 AP9-G0/0/17

//lea


p :
AP10-G0/0/18

t t
hAP11-G0/0/19


s:
6 AC6—G0/0/6
 AP12-G0/0/20

r c e
The following table describes an AC parameter configuration template.

o u
es
Trainee GroupX AC Configuration

R
i n g
Console Password
Device
Admin@123
ACX

r n
e a AP Management
VLAN：X0 IP：10.1.X0.100
L
VLAN

e
or
Service VLAN
VLAN：X1 IP：10.1.X1.100
(Employee)

M Service VLAN (Voice) VLAN：X2 IP：10.1.X2.100

Service VLAN (Guest) VLAN：X3 IP：10.1.X3.100

AC Port Connecting GE0/0/8 VLANs X0 through X3 can pass the

to the Switch trunk interface

华为专有和保密信息 13
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Topology: layer2 and layer 3 bypass topology

1.2 Experiment Task

1.2.1 Configuration Procedure

Step1 Configuring Initialization Password
The Software Version of AC6005 is V2R7, You need a password
to log in to the AC at first time. The login password is
e n
Admin@123 in this experiment.
/
Please configure the login password (maximum length 16)

o m
i.c
Enter password:Admin@123
Confirm password:Admin@123
<AC6005>

w e
Step2 Configuring a Switch
u a
. h
Configure the access switch S5700. Add GE0/0/10 and GE0/0/11 to VLANX0

X0 through X3(Connect to AC).

in g
(management VLAN) and set the port VLAN ID (PVID) to VLANX0. Add GE0/0/8 to VLANs

<Huawei>system-view
r n
lea
[Huawei]sysname S5700

//
[S5700]vlan batch 10 to 13

:
[S5700]interface GigabitEthernet0/0/10

t t p
[S5700-GigabitEthernet0/0/10]port link-type trunk
[S5700-GigabitEthernet0/0/10]port trunk pvid vlan 10

h
[S5700-GigabitEthernet0/0/10]port trunk allow-pass vlan 10 to 13

:
s
[S5700-GigabitEthernet0/0/10]quit

r c e
[S5700]interface GigabitEthernet0/0/11
[S5700-GigabitEthernet0/0/11]port link-type trunk

u
[S5700-GigabitEthernet0/0/11]port trunk pvid vlan 10

o
s
[S5700-GigabitEthernet0/0/11]port trunk allow-pass vlan 10 to 13

Re
[S5700-GigabitEthernet0/0/11]quit
[S5700]interface GigabitEthernet 0/0/1

i n g
[S5700-GigabitEthernet0/0/1]port link-type trunk
[S5700-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 to 13

r n [S5700-GigabitEthernet0/0/1]quit

e a Create a LoopbackX interface, and set its IP address to 10X.10X.10X.10X to simulate a

e L public network interface. Create VLANIF interfaces to function as gateways of service

VLANs.

or [S5700]interface LoopBack 1

M
[S5700- LoopBack1]ip address 101.101.101.101 32
[S5700- LoopBack1]quit
[S5700]interface Vlanif 10
[S5700-Vlanif10]ip address 10.1.10.1 24
[S5700-Vlanif10]quit
[S5700]interface Vlanif 11
[S5700-Vlanif11]ip address 10.1.11.1 24
[S5700-Vlanif11]quit

华为专有和保密信息 14
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[S5700]interface Vlanif 12
[S5700-Vlanif12]ip address 10.1.12.1 24
[S5700-Vlanif12]quit
[S5700]interface Vlanif 13
[S5700-Vlanif13]ip address 10.1.13.1 24
[S5700-Vlanif13]quit

Step3 Configuring Basic AC Parameters

<AC6005>system-view
[AC6005]sysname AC1

Create VLANs X0 through X3.

[AC1]vlan batch 10 to 13

e n
/
Configure GE0/0/8 to connect to the S5700.

m
[AC1]interface g0/0/8
[AC1-GigabitEthernet0/0/8]port link-type trunk
o
i.c
[AC1-GigabitEthernet0/0/8]port trunk allow-pass vlan 10 to 13

e
[AC1-GigabitEthernet0/0/8]quit

w
After the configuration is complete, run the display port vlan command to check whether
a
u
the configuration is correct.
[AC1]display port vlan
. h
Port Link Type PVID Trunk VLAN List

in g
-------------------------------------------------------------------------
GigabitEthernet0/0/1 hybrid 1 -
r n
lea
GigabitEthernet0/0/2 hybrid 1 -
GigabitEthernet0/0/3 hybrid 1 -
GigabitEthernet0/0/4 hybrid 1

: //
-

p
GigabitEthernet0/0/5 hybrid 1 -
GigabitEthernet0/0/6 hybrid
t t 1 -
GigabitEthernet0/0/7
h
access

:
4090 -

s
GigabitEthernet0/0/8 trunk 1 1 10-13

c e
Configure the IP address of the layer 3 interface corresponding to the VLAN.
r
u
[AC1]interface vlan 10

so
[AC1-Vlanif10]ip address 10.1.10.100 24

Re
[AC1-Vlanif10]quit
[AC1]interface vlan 11

g
[AC1-Vlanif11]ip address 10.1.11.100 24

n
[AC1-Vlanif11]quit

n i
[AC1]interface vlan 12

ar
[AC1-Vlanif12]ip address 10.1.12.100 24

e
[AC1-Vlanif12]quit

e L [AC1]interface Vlanif 13
[AC1-Vlanif13]ip address 10.1.13.100 24

or
[AC1-Vlanif13]quit

M Check whether the interface status is up.

[AC1]display ip interface brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down

华为专有和保密信息 15
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

The number of interface that is UP in Physical is 7

The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 7
The number of interface that is DOWN in Protocol is 0

Interface IP Address/Mask Physical Protocol

NULL0 unassigned up up(s)
Vlanif1 169.254.1.1/16 up up
Vlanif10 10.1.10.100/24 up up
Vlanif11 10.1.11.100/24 up up
Vlanif12 10.1.12.100/24 up up
Vlanif13 10.1.13.100/24 up up
Vlanif4090 172.21.11.3/16 up up

Check whether the route between the AC and the layer 3 switch is reachable. The
e n
following command output indicates that 10X.10X.10X.10X (the simulated public
/
network interface on the switch) cannot be pinged.
o m
i.c
[AC1]ping 101.101.101.101

e
PING 101.101.101.101: 56 data bytes, press CTRL_C to break
Request time out
Request time out
aw
Request time out

h u
.
Request time out
Request time out

in g
--- 101.101.101.101 ping statistics ---
r n
lea
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss

: //
t
Configure a static route for the switch.
t p
h
[AC1]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1

s :
IP address 10X.10X.10X.10X can be pinged.

r c
[AC1]ping 101.101.101.101 e
o u
PING 101.101.101.101: 56 data bytes, press CTRL_C to break
Reply from 101.101.101.101: bytes=56 Sequence=1 ttl=254 time=1 ms

s
Re
Reply from 101.101.101.101: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 101.101.101.101: bytes=56 Sequence=3 ttl=254 time=1 ms

g
Reply from 101.101.101.101: bytes=56 Sequence=4 ttl=254 time=1 ms

n i n Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=254 time=1 ms

ar
--- 101.101.101.101 ping statistics ---

Le 5 packet(s) transmitted
5 packet(s) received

e
or
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms

M Step4 Configuring and Testing the Telnet/SSH Service (AAA Authentication)

Enable and configure telnet service in the AC, add account huawei for AAA
authentication.
[AC1]telnet server enable
Info: TELNET server has been enabled.
[AC1]aaa
[AC1-aaa] local-user huawei password irreversible-cipher Admin@123

华为专有和保密信息 16
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1-aaa] local-user huawei service-type telnet

[AC1-aaa] local-user huawei privilege level 3
Warning: This operation may affect online users, are you sure to change
the user privilege level ?[Y/N]y
[AC1-aaa]quit
[AC1]user-interface vty 0 4
[AC1-ui-vty0-4]authentication-mode aaa
Current Password: -------------------- Input Login password Admin@123

Step5 Save the Configuration

<AC1>save
The current configuration will be written to the device.
Are you sure to continue? (y/n)[n]:y
It will take several minutes to save configuration file, please
e n
wait........
/
m
Configuration file has been saved successfully
Note: The configuration file will take effect after being activated
o
e i.c
1.3 Verification aw
hu
1.3.1 Telnet AC g .
n in
r
lea
After Configure telnet, test the telnet service on S5700。

//
<S5700>telnet 10.1.10.100
Trying 10.1.10.100 ...

p :
t
Press CTRL+K to abort
Connected to 10.1.10.100 ...

h t
:
Warning: Telnet is not a secure protocol, and it is recommended to use
Stelnet.

e s
r
Login authentication
c
o u
s
Re
Username:huawei
Password:

i n g
-----------------------------------------------------------------------
User last login information:

r n -----------------------------------------------------------------------

e a Access Type: Telnet

L
IP-Address : 172.21.5.155
Time : 2016-11-11 19:50:02+08:00

e
or
-----------------------------------------------------------------------
<AC1>

M Login AC successfully.

华为专有和保密信息 17
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

1.4 Reference Configuration

1.4.1 S5700 Configuration

#
sysname S5700
#
vlan batch 10 to 13
#
lldp enable
#
undo http server enable
e n
undo http secure-server enable
/
#

o m
i.c
undo nap slave enable
#
aaa
authentication-scheme default
w e
authorization-scheme default

u a
h
accounting-scheme default
domain default

g .
in
domain default_admin

n
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@
local-user admin service-type http
r
lea
#

//
interface Vlanif1
#

p :
t
interface Vlanif10

t
ip address 10.1.10.1 255.255.255.0

h
:
#
interface Vlanif11

e s
c
ip address 10.1.11.1 255.255.255.0
#

u r
o
interface Vlanif12

s
ip address 10.1.12.1 255.255.255.0

Re
#
interface Vlanif13

i#
n g
ip address 10.1.13.1 255.255.255.0

rn interface MEth0/0/1

e a ip address 172.21.11.1 255.255.0.0

L
#

e
interface GigabitEthernet0/0/1

or
port link-type trunk
port trunk allow-pass vlan 10 to 13

M #
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#

华为专有和保密信息 18
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13

e n
#
/
m
interface GigabitEthernet0/0/11
port link-type trunk
o
i.c
port trunk pvid vlan 10

e
port trunk allow-pass vlan 10 to 13

w
#
interface GigabitEthernet0/0/12
#
u a
interface GigabitEthernet0/0/13
. h
#
interface GigabitEthernet0/0/14
in g
#
r n
lea
interface GigabitEthernet0/0/15
#
interface GigabitEthernet0/0/16
: //
#
interface GigabitEthernet0/0/17
t t p
#

: h
s
interface GigabitEthernet0/0/18
#

r c e
interface GigabitEthernet0/0/19
#

o u
s
interface GigabitEthernet0/0/20

Re
#
interface GigabitEthernet0/0/21

i
#

n g
interface GigabitEthernet0/0/22

rn #

e a interface GigabitEthernet0/0/23
#

e L interface GigabitEthernet0/0/24

or
#
interface NULL0

M
#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
user-interface con 0
authentication-mode password
set authentication password
cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@

华为专有和保密信息 19
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

user-interface vty 0 4
authentication-mode password
user privilege level 3
set authentication password
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@
protocol inbound all
user-interface vty 16 20
#
return

1.4.2 AC Configuration
#
sysname AC1
e n
#
/
http secure-server ssl-policy default_policy

o m
i.c
http server enable
#
undo portal url-encode enable
#
w e
ssl renegotiation-rate 1
u a
h
#
vlan batch 10 to 13 4090
g .
in
#

n
authentication-profile name default_authen_profile

r
authentication-profile name dot1x_authen_profile

lea
authentication-profile name mac_authen_profile

//
authentication-profile name portal_authen_profile

:
authentication-profile name macportal_authen_profile

p
#

t t
h
lldp enable

:
#
diffserv domain default

e s
#

r c
radius-server template default
#
o u
s
pki realm default

Re
rsa local-key-pair default
enrollment self-signed

i
#
n g
ssl policy default_policy type server

rn pki-realm default

e a version tls1.0 tls1.1

e L #
ciphersuite rsa_aes_128_cbc_sha

or
ike proposal default
encryption-algorithm aes-256

M dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
free-rule-template name default_free_rule

华为专有和保密信息 20
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
portal-access-profile name portal_access_profile
#
aaa
authentication-scheme default
authentication-scheme radius
authentication-mode radius
authorization-scheme default
accounting-scheme default
domain default
authentication-scheme default
domain default_admin
authentication-scheme default
local-user admin password irreversible-

e n
/
cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K%^
%#
local-user admin privilege level 15
o m
i.c
local-user admin service-type ssh http
local-user huawei password irreversible-cipher
$1a$Rdtw.<{XxT$m[E}YnfM9<l9]\T7EhW67M~m$u/u6<PP~C$O&*bV$
local-user huawei privilege level 3
w e
local-user huawei service-type telnet
u a
#

. h
g
interface Vlanif1

in
ip address 169.254.1.1 255.255.0.0

n
#
interface Vlanif10
r
lea
ip address 10.1.10.100 255.255.255.0

//
#
interface Vlanif11

p :
t
ip address 10.1.11.100 255.255.255.0

t
h
#
interface Vlanif12

s :
ip address 10.1.12.100 255.255.255.0
#

r c e
u
interface Vlanif13

o
ip address 10.1.13.100 255.255.255.0
#
s
Re
interface Vlanif4090
ip address 172.21.11.3 255.255.0.0

i
#
n g
n
interface GigabitEthernet0/0/1

a r #

e
interface GigabitEthernet0/0/2

e L #
interface GigabitEthernet0/0/3

or
#
interface GigabitEthernet0/0/4

M #
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
port link-type access

华为专有和保密信息 21
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

port default vlan 4090

stp disable
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 13
#
interface NULL0
#
undo snmp-agent
#
stelnet server enable
undo telnet ipv6 server enable
ssh server secure-algorithms cipher aes256_ctr aes128_ctr

e n
ssh server secure-algorithms hmac sha2_256
/
m
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
o
i.c
ssh client secure-algorithms hmac sha2_256

e
ssh client key-exchange dh_group14_sha1

w
#
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
#
u a
user-interface con 0
. h
authentication-mode password
set authentication password
in g
r n
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"%^

lea
%#
user-interface vty 0 4

//
authentication-mode aaa
user privilege level 3
p :
protocol inbound all
t t
h
user-interface vty 16 20
protocol inbound all

s :
e
#
wlan
r c
u
traffic-profile name default

o
security-profile name default

s
Re
security-profile name default-wds
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
qK%aTJ_0%^%# aes

i n g
security-profile name default-mesh

n
security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-

a r GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
ssid-profile name default

Le vap-profile name default

e
mesh-handover-profile name default

or
mesh-profile name default
wds-profile name default

M regulatory-domain-profile name default

air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default

华为专有和保密信息 22
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

ap-system-profile name default

port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name default
provision-ap
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
#
undo ntp-service enable
#
return

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 23
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

2 Experiment 2: AP Authentication and

WLAN Configuration Roadmap

2.1 About This Course e n

/
o m
2.1.1 Objectives
ei.c
 Configure AP authentication
aw
 Understand WLAN configuration profile

hu
 Understand WLAN configuration roadmap
g .
in
 Configure open system authentication

2.1.2 Topology r n
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 24
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

2.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.

Group
AC-Switch Port AP-Switch Port
No.

 AP1-G0/0/10
1 AC1—G0/0/1
AP2-G0/0/11
e n
/


 AP3-G0/0/12
o m
i.c
2 AC2—G0/0/2
 AP4-G0/0/13

AP5-G0/0/14
w e
a

3 AC3—G0/0/3
 AP6-G0/0/15
hu
AP7-G0/0/15
g .
in

4 AC4—G0/0/4
AP8-G0/0/16
n


r
AP9-G0/0/17
lea


//
5 AC5—G0/0/5


p :
AP10-G0/0/18

t t
h
 AP11-G0/0/19
6 AC6—G0/0/6

s:
 AP12-G0/0/20

r c e
The following table describes an AC parameter configuration template.

o u
es
AC Information
Country code: CN

R WLAN source: VLAN X0

i n g AP authentication mode: mac-auth

n
AP Authentication

ar
AP MAC address

Le Name: ap-groupX

e VAP ID 1: VAP profile: guestX

or AP Group
regulatory domain profile: domainX

M VAP ID 2: VAP profile: voiceX

regulatory domain profile: domainX
VAP ID 3: VAP profile: employeeX
regulatory domain profile: domainX
Name: employeeX SSID Profile: employeeX
SSID Profile
Name: voiceX SSID Profile: voiceX

华为专有和保密信息 25
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Name: guestX SSID Profile: guestX

Name: employeeX
Forwarding mode: direct forwarding
Service VLAN: 11
Referenced profile: SSID profile employeeX
Name: voiceX
Forwarding mode: direct forwarding
VAP Profile
Service VLAN: 12
Referenced profile: SSID profile voiceX
Name: guestX
Forwarding mode: tunnel forwarding
e n
Service VLAN: 13
/
Referenced profile: SSID profile guestX
o m
Topology: layer2 and layer 3 bypass topology

ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 26
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

2.2 Experiment Task

2.2.1 Configuration Procedure

Step1 Overall Procedure

1. Configure the Enable layer 2 or layer 3 interconnection

access switch. between the AP and AC.

e n
2. Create an AP
/
m
group. Create an AP group.

o
i.c
Configure the DHCP server function of the AC.

e
Create a regulatory domain profile.
Configure the country code of the AC.
Configure AC

w
3. Configure the Configure the authentication mode for the AP .
management on Configure the AC source port (for establishing
AP going online.

a
fit APs. a tunnel with the AP).

h u
g.
Configure the Configure the
security profile. SSID profile.

in
4/5. Configure Being
WLAN service referred to

n
parameters.

ar
4. Configure the
Configure the
VAP profile.

le
VAP profile.

://
Being referred to

t tp
h
Bind the regulatory domain profile
and VAP profile to the AP group.

s :
e
5. Bind the profile

c
to the AP group.

u r
o
Step2 Configuring a Switch
s
Re
Continue the configuration from experiment 1, the configuration of the switch has
been ready.

i n g
Step3 Configuring Basic AC Parameters
n
ar
Continue the configuration from experiment 1, the configuration of the switch has been

e
ready.

e LStep4 Creating an AP Group

or Create AP group ap-groupX.

M [AC1]wlan
[AC1-wlan-view]ap-group name ap-group1
[AC1-wlan-ap-group- ap-group1]quit

Step5 Configuring AP Online Parameters

Enable DHCP on the AC. Assign IP addresses to the STA and AP, Configure the Option43
Parameters.

华为专有和保密信息 27
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1]dhcp enable
[AC1]ip pool ap
[AC1-ip-pool-ap]network 10.1.10.0 mask 24
[AC1-ip-pool-ap]gateway-list 10.1.10.1
[AC1-ip-pool-ap]option 43 sub-option 3 ascii 10.1.10.100
[AC1-ip-pool-ap]quit
[AC1]ip pool employee
[AC1-ip-pool- employee]network 10.1.11.0 mask 24
[AC1-ip-pool- employee]gateway-list 10.1.11.1
[AC1-ip-pool- employee]quit
[AC1]ip pool voice
[AC1-ip-pool- voice]network 10.1.12.0 mask 24
[AC1-ip-pool- voice]gateway-list 10.1.12.1
[AC1-ip-pool- voice]quit

e n
[AC1]ip pool guest
/
m
[AC1-ip-pool- guest]network 10.1.13.0 mask 24
[AC1-ip-pool- guest]gateway-list 10.1.13.1
o
i.c
[AC1-ip-pool- guest]quit

Enable DHCP over all VLANIF interfaces on the AC.

w e
a
[AC1]interface Vlanif 10
[AC1-Vlanif10]dhcp select global

hu
.
[AC1-Vlanif10]quit
[AC1]interface Vlanif 11
[AC1-Vlanif11]dhcp select global
in g
[AC1-Vlanif11]quit
r n
lea
[AC1]interface Vlanif 12
[AC1-Vlanif12]dhcp select global
[AC1-Vlanif12]quit
: //
p
[AC1]interface Vlanif 13
[AC1-Vlanif13]dhcp select
t t
global
[AC1-Vlanif13]quit

: h
s
Configure regulatory domain profile domainX.
e
[AC1]wlan
r c
u
[AC1-wlan-view]regulatory-domain-profile name domain1

o
[AC1-wlan-regulatory-domain-prof-domain1]country-code CN

s
Re
[AC1-wlan-regulatory-domain-prof-domain1]quit
[AC1-wlan-view]quit

i n g
Configure the AC source interface.
[AC1]capwap source interface vlanif 10

rn
e a Configure AP authentication.
AP authentication has three modes. By default, MAC authentication is used. Manually add

e L APs based on MAC addresses.

or
[AC1]wlan
[AC1-wlan-view]ap auth-mode mac-auth

M Import the AP offline to the AC and add two APs to AP group ap-groupX. Name the two
APs AP1 and AP2.
[AC1-wlan-view]ap-mac 4cfa-cabe-eb60 ap-id 0
[AC1-wlan-ap-0]ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes,
it will clear channel, power and antenna gain configurations of the
radio, Whether to continue? [Y/N]:y

华为专有和保密信息 28
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1-wlan-ap-0]ap-name ap1
[AC1-wlan-ap-0]quit
[AC1-wlan-view]ap-mac 4cfa-cabf-d0c0 ap-id 1
[AC1-wlan-ap-1]ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes,
it will clear channel, power and antenna gain configurations of the
radio, Whether to continue? [Y/N]:y
[AC1-wlan-ap-1]ap-name ap2

After APs are added, their status will change from fault to config, and then to normal. If
the AP status does not change to normal several minutes after the AP is added, check the
configuration of VLAN, DHCP, and AP authentication.
<AC1>display ap all
Info: This operation may take a few seconds. Please wait for a
moment.done.
e n
Total AP information:
/
nor : normal [2]
-------------------------------------------------------------------------
o m
i.c
ID MAC Name Group IP Type State STA Uptime
-------------------------------------------------------------------------
0 4cfa-cabe-eb60 ap1 ap-group1 10.1.10.253 AP4030DN nor 0 31S
w e
1 4cfa-cabf-d0c0 ap2 ap-group1 10.1.10.254 AP4030DN nor 0

u a
58S

h
-------------------------------------------------------------------------
Total: 2

g .
Step6 Configuring WLAN Service Parameters
n in
Configure SSID Profile.
r
lea
Create SSID profiles employeeX, voiceX and guestX, and set SSIDs to employeeX, voiceX
and guestX, respectively.
: //
[AC1]wlan

t t p
[AC1-wlan-view]ssid-profile name employee1

h
[AC1-wlan-ssid-prof-employee1]ssid employee1

:
s
Warning: This action may cause service interruption. Continue?[Y/N]y

r c e
[AC1-wlan-ssid-prof-employee1]quit
[AC1-wlan-view]ssid-profile name voice1

u
[AC1-wlan-ssid-prof-employee1]ssid voice1

o
s
Warning: This action may cause service interruption. Continue?[Y/N]y

Re
[AC1-wlan-ssid-prof-employee1]quit
[AC1-wlan-view]ssid-profile name guest1

i n g
[AC1-wlan-ssid-prof-employee1]ssid guest1
Warning: This action may cause service interruption. Continue?[Y/N]y

r n [AC1-wlan-ssid-prof-employee1]quit

e a Create VAP profiles employeeX, voiceX and guestX. Set the data forwarding mode for

e L employeeX and voiceX to direct forwarding, and that for guestX to tunnel forwarding.
Configure the service VLAN and bind the profile to the SSID profile.

or
[AC1-wlan-view]vap-profile name employee1
[AC1-wlan-vap-prof-employee1]forward-mode direct-forward
M [AC1-wlan-vap-prof-employee1]service-vlan vlan-id 11
[AC1-wlan-vap-prof-employee1]ssid-profile employee1
[AC1-wlan-vap-prof-employee1]quit
[AC1-wlan-view]vap-profile name voice1
[AC1-wlan-vap-prof-voice1]forward-mode direct-forward
[AC1-wlan-vap-prof-voice1]service-vlan vlan-id 12
[AC1-wlan-vap-prof-voice1]ssid-profile voice1

华为专有和保密信息 29
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1-wlan-vap-prof-voice1]quit
[AC1-wlan-view]vap-profile name guest1
[AC1-wlan-vap-prof-guest1]forward-mode tunnel
[AC1-wlan-vap-prof-guest1]service-vlan vlan-id 13
[AC1-wlan-vap-prof-guest1]ssid-profile guest1
[AC1-wlan-vap-prof-guest1]quit

Configure AP groups to use the regulatory domain profile and VAP profile. When AP
group ap-groupX uses VAP profile employeeX, set VAP ID to 1. When AP group ap-
groupX uses VAP profile voiceX, set VAP ID to 2. When AP group ap-groupX uses VAP
profile guestX, set VAP ID to 3. Radios 0 and 1 on the AP use the configuration of the VAP
profile.
[AC1-wlan-view]ap-group name ap-group1

n
[AC1-wlan-ap-group-ap-group1]vap-profile employee1 wlan 1 radio all
[AC1-wlan-ap-group-ap-group1]vap-profile voice1 wlan 2 radio all
[AC1-wlan-ap-group-ap-group1]vap-profile guest1 wlan 3 radio all / e
[AC1-wlan-ap-group-ap-group1]regulatory-domain-profile domain1
o m
i.c
[AC1-wlan-ap-group-ap-group1]quit

w e
2.3 Verification u a
. h
2.3.1 Checking the VAP Status in g
r n
lea
The AC automatically delivers WLAN service configurations to APs. After the service

//
configuration is complete, run the display vap ssid guestX and display vap ssid employeeX

:
commands. If the value of Status in the command output is ON, the VAPs have been
p
created on AP radios.
t t
h
[AC1]display vap ssid employee1

:
Info: This operation may take a few seconds, please wait.

s
e
WID : WLAN ID

c
-------------------------------------------------------------------------
r
u
AP ID AP name RfID WID BSSID Status Auth type STA SSID

o
-------------------------------------------------------------------------

s
Re
0 ap1 0 1 4CFA-CABE-EB60 ON Open 0 employee1
0 ap1 1 1 4CFA-CABE-EB70 ON Open 0 employee1

g
1 ap2 0 1 4CFA-CABF-D0C0 ON Open 0 employee1

n i
1
n ap2 1 1 4CFA-CABF-D0D0 ON Open 0 employee1
-------------------------------------------------------------------------

a r Total: 4

e
[AC1]display vap ssid voice1

e L Info: This operation may take a few seconds, please wait.

WID : WLAN ID

or
-------------------------------------------------------------------------
AP ID AP name RfID WID BSSID Status Auth type STA SSID

M -------------------------------------------------------------------------
0 ap1 0 2 4CFA-CABE-EB61 ON Open 0 voice1
0 ap1 1 2 4CFA-CABE-EB71 ON Open 0 voice1
1 ap2 0 2 4CFA-CABF-D0C1 ON Open 0 voice1
1 ap2 1 2 4CFA-CABF-D0D1 ON Open 1 voice1
-------------------------------------------------------------------------
Total: 4

华为专有和保密信息 30
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1]display vap ssid guest1

Info: This operation may take a few seconds, please wait.
WID : WLAN ID
-------------------------------------------------------------------------
AP ID AP name RfID WID BSSID Status Auth type STA SSID
-------------------------------------------------------------------------
--
0 ap1 0 3 4CFA-CABE-EB62 ON Open 0 guest1
0 ap1 1 3 4CFA-CABE-EB72 ON Open 0 guest1
1 ap2 0 3 4CFA-CABF-D0C2 ON Open 0 guest1
1 ap2 1 3 4CFA-CABF-D0D2 ON Open 0 guest1

n
-------------------------------------------------------------------------
Total: 4
/ e
2.3.2 Terminal Connection Test o m
e i.c
Connect STAs to the WLANs with SSIDs employeeX, voiceX and guestX. Run the display

connected to the WLANs.

aw
station all commands on the AC. The command output shows that the STAs are

hu
.
[AC1]display station all
Rf/WLAN: Radio ID/WLAN ID
Rx/Tx: link receive rate/link transmit rate(Mbps)
in g
r n
-------------------------------------------------------------------------

lea
STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP

//
address SSID

:
-------------------------------------------------------------------------

p
tt
1041-7f67-01b1 1 ap2 0/2 2.4G 11n 65/52 -70 12

h
10.1.12.254 voice1

:
-------------------------------------------------------------------------
s
Total: 1 2.4G: 1 5G: 0

r c e
On the wireless terminal, ping the IP address of the simulated public network interface on
the switch.
o u
es
C:\Users\zWX>ping 101.101.101.101

R
PING 101.101.101.101: 56 data bytes, press CTRL_C to break

ing
Reply from 101.101.101.101: bytes=56 Sequence=1 ttl=255 time=7 ms
Reply from 101.101.101.101: bytes=56 Sequence=2 ttl=255 time=10 ms

r n Reply from 101.101.101.101: bytes=56 Sequence=3 ttl=255 time=10 ms

e a Reply from 101.101.101.101: bytes=56 Sequence=4 ttl=255 time=10 ms

e L Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=255 time=10 ms

or --- 101.101.101.101 ping statistics ---

M 5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 7/9/10 ms

华为专有和保密信息 31
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

2.4 Reference Configuration

2.4.1 S5700 Configuration

#
sysname S5700
#
vlan batch 10 to 13
#
lldp enable
#
undo http server enable
e n
undo http secure-server enable
/
#

o m
i.c
undo nap slave enable
#
aaa
authentication-scheme default
w e
authorization-scheme default

u a
h
accounting-scheme default
domain default

g .
in
domain default_admin

n
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@
local-user admin service-type http
r
lea
#

//
interface Vlanif1
#

p :
t
interface Vlanif10

t
ip address 10.1.10.1 255.255.255.0

h
:
#
interface Vlanif11

e s
c
ip address 10.1.11.1 255.255.255.0
#

u r
o
interface Vlanif12

s
ip address 10.1.12.1 255.255.255.0

Re
#
interface Vlanif13

i#
n g
ip address 10.1.13.1 255.255.255.0

rn interface MEth0/0/1

e a ip address 172.21.11.1 255.255.0.0

L
#

e
interface GigabitEthernet0/0/1

or
port link-type trunk
port trunk allow-pass vlan 10 to 13

M #
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#

华为专有和保密信息 32
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13

e n
#
/
m
interface GigabitEthernet0/0/11
port link-type trunk
o
i.c
port trunk pvid vlan 10

e
port trunk allow-pass vlan 10 to 13

w
#
interface GigabitEthernet0/0/12
#
u a
interface GigabitEthernet0/0/13
. h
#
interface GigabitEthernet0/0/14
in g
#
r n
lea
interface GigabitEthernet0/0/15
#
interface GigabitEthernet0/0/16
: //
#
interface GigabitEthernet0/0/17
t t p
#

: h
s
interface GigabitEthernet0/0/18
#

r c e
interface GigabitEthernet0/0/19
#

o u
s
interface GigabitEthernet0/0/20

Re
#
interface GigabitEthernet0/0/21

i
#

n g
interface GigabitEthernet0/0/22

rn #

e a interface GigabitEthernet0/0/23
#

e L interface GigabitEthernet0/0/24

or
#
interface NULL0

M
#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
user-interface con 0
authentication-mode password
set authentication password
cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@

华为专有和保密信息 33
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

user-interface vty 0 4
authentication-mode password
user privilege level 3
set authentication password
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@
protocol inbound all
user-interface vty 16 20
#
return

2.4.2 AC Configuration
#
sysname AC1
e n
#
/
http secure-server ssl-policy default_policy

o m
i.c
http server enable
#
undo portal url-encode enable
#
w e
ssl renegotiation-rate 1
u a
h
#
vlan batch 10 to 13 4090
g .
in
#

n
authentication-profile name default_authen_profile

r
authentication-profile name dot1x_authen_profile

lea
authentication-profile name mac_authen_profile

//
authentication-profile name portal_authen_profile

:
authentication-profile name macportal_authen_profile

p
#

t t
h
lldp enable

:
#
dhcp enable

e s
#

r c
diffserv domain default
#
o u
s
radius-server template default

Re
#
pki realm default

i n g
rsa local-key-pair default
enrollment self-signed

rn #

e a ssl policy default_policy type server

e L pki-realm default
version tls1.0 tls1.1

or
ciphersuite rsa_aes_128_cbc_sha
#

M ike proposal default

encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256

华为专有和保密信息 34
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
#
ip pool ap
gateway-list 10.1.10.1
network 10.1.10.0 mask 255.255.255.0
option 43 sub-option 3 ascii 10.1.10.100
#
ip pool employee
gateway-list 10.1.11.1
network 10.1.11.0 mask 255.255.255.0
#

e n
ip pool voice
/
m
gateway-list 10.1.12.1
network 10.1.12.0 mask 255.255.255.0
o
i.c
#

e
ip pool guest

w
gateway-list 10.1.13.1

#
network 10.1.13.0 mask 255.255.255.0

u a
aaa
. h
authentication-scheme default
authentication-scheme radius
in g
authentication-mode radius
r n
lea
authorization-scheme default
accounting-scheme default
domain default
: //
authentication-scheme default
domain default_admin
t t p
h
authentication-scheme default

:
s
local-user admin password irreversible-

%^%#
r c e
cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K

u
local-user admin privilege level 15

o
local-user admin service-type ssh http

s
Re
local-user huawei password irreversible-cipher
$1a$Rdtw.<{XxT$m[E}YnfM9<l9]\T7EhW67M~m$u/u6<PP~C$O&*bV$
local-user huawei privilege level 3

i n g
local-user huawei service-type telnet

n
#

a r interface Vlanif1

e
ip address 169.254.1.1 255.255.0.0

e L #
interface Vlanif10

or
ip address 10.1.10.100 255.255.255.0
dhcp select global

M #
interface Vlanif11
ip address 10.1.11.100 255.255.255.0
dhcp select global
#
interface Vlanif12
ip address 10.1.12.100 255.255.255.0

华为专有和保密信息 35
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

dhcp select global

#
interface Vlanif13
ip address 10.1.13.100 255.255.255.0
dhcp select global
#
interface Vlanif4090
ip address 172.21.11.3 255.255.0.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3

e n
#
/
m
interface GigabitEthernet0/0/4
#
o
i.c
interface GigabitEthernet0/0/5

e
#

w
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
u a
port link-type access
. h
port default vlan 4090
stp disable
in g
#
r n
lea
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 13
: //
#
interface NULL0
t t p
#

: h
s
undo snmp-agent
#

r c
stelnet server enablee
u
undo telnet ipv6 server enable

o
s
ssh server secure-algorithms cipher aes256_ctr aes128_ctr

Re
ssh server secure-algorithms hmac sha2_256
ssh server key-exchange dh_group14_sha1

i n g
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256

rn ssh client key-exchange dh_group14_sha1

e a #
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1

e L #

or
capwap source interface vlanif10
#

M
user-interface con 0
authentication-mode password
set authentication password
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"
%^%#
user-interface vty 0 4
authentication-mode aaa
user privilege level 3

华为专有和保密信息 36
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

protocol inbound all

user-interface vty 16 20
protocol inbound all
#
wlan
traffic-profile name default
security-profile name default
security-profile name employee1
security-profile name default-wds
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
qK%aTJ_0%^%# aes
security-profile name default-mesh
security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-

n
GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
ssid-profile name guest1
ssid guest1
/ e
ssid-profile name voice1
o m
i.c
ssid voice1
ssid-profile name default
ssid-profile name employee1

w e
a
ssid employee1

u
vap-profile name guest1
forward-mode tunnel
. h
g
service-vlan vlan-id 13

in
ssid-profile guest1
vap-profile name voice1

r n
lea
service-vlan vlan-id 12
ssid-profile voice1

//
vap-profile name default
vap-profile name employee1
p :
service-vlan vlan-id 11
t t
h
ssid-profile employee1

:
security-profile employee1

s
e
mesh-handover-profile name default

r c
mesh-profile name default

u
wds-profile name default

o
regulatory-domain-profile name default

s
Re
regulatory-domain-profile name domain1
air-scan-profile name default

g
rrm-profile name default

n i n
radio-2g-profile name default
radio-5g-profile name default

a r wids-spoof-profile name default

e
wids-profile name default

e L ap-system-profile name default

port-link-profile name default

or
wired-port-profile name default
serial-profile name preset-enjoyor-toeap

M ap-group name default

ap-group name ap-group1
regulatory-domain-profile domain1
radio 0
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3

华为专有和保密信息 37
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

radio 1
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3
radio 2
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3
ap-id 0 type-id 43 ap-mac 4cfa-cabe-eb60 ap-sn 21500826412SG8918066
ap-name ap1
ap-group ap-group1
ap-id 1 type-id 43 ap-mac 4cfa-cabf-d0c0 ap-sn 21500826412SG8919901
ap-name ap2
ap-group ap-group1

e n
provision-ap
/
m
#
dot1x-access-profile name dot1x_access_profile
o
i.c
#

e
mac-access-profile name mac_access_profile

w
#

#
undo ntp-service enable

u a
return
. h
in g
r n
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 38
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

3 Experiment 3: WLAN Security Configuration

3.1 About This Course

3.1.1 Objectives e n
/
 Configure WLAN security profile
o m


Configure WEP authentication
Configure WPA/WPA2 PSK authentication ei.c
 Configure WPA/WPA2 EAP authentication
aw
hu
3.1.2 Topology
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 39
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

3.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.

Group
AC-Switch Port AP-Switch Port
No.

 AP1-G0/0/10
1 AC1—G0/0/1
AP2-G0/0/11
e n
/


 AP3-G0/0/12
o m
i.c
2 AC2—G0/0/2
 AP4-G0/0/13

AP5-G0/0/14
w e
a

3 AC3—G0/0/3
 AP6-G0/0/15
hu
AP7-G0/0/15
g .
in

4 AC4—G0/0/4
AP8-G0/0/16
n


r
AP9-G0/0/17
lea


//
5 AC5—G0/0/5


p :
AP10-G0/0/18

t t
h
 AP11-G0/0/19
6 AC6—G0/0/6

s:
 AP12-G0/0/20

r c e
The following table describes an AC parameter configuration template.

o u
es Name: ap-groupX

R
VAP ID 1: VAP profile: guestX
regulatory domain profile: domainX

i n g
AP Group VAP ID 2: VAP profile: voiceX

r n regulatory domain profile: domain

e a VAP ID 3: VAP profile: employeeX

regulatory domain profile: domainX

e L RADIUS Server Name: huawei Key: huawei

or Profile

M Dot1x Profile Name: employeeX

Name: employeeX
Authentication
Apply: Radius Server Profile: huawei
Scheme
dot1x Profile: employeeX
SSID Profile Name: employeeX SSID name: employeeX

华为专有和保密信息 40
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Name: voiceX SSID name: voiceX

Name: guestX SSID name: guestX
Name: employeeX SSID name: employeeX
Security Profile Name: voiceX SSID name: voiceX
Name: guestX SSID name: guestX
Name: employeeX
Forwarding mode: direct forwarding
Service VLAN: 11
Referenced profile: SSID profile employeeX

e n
/
Security Profile employeeX
Name: voiceX
Forwarding mode: direct forwarding
o m
VAP Profile Service VLAN: 12
Referenced profile: SSID profile voiceX e i.c
Security Profile voiceX
aw
Name: guestX
hu
Forwarding mode: tunnel forwarding
g .
in
Service VLAN: 13

r n
Referenced profile: SSID profile guestX

lea
Security Profile guestX

: //
Topology: layer2 and layer 3 bypass topology

t t p
: h
e s
3.2 Experiment Task r c
o u
s
3.2.1 ConfigurationeProcedure
R
Step1
i n g
Configuring WEP Authentication

r n
Huawei AC supports six access security policies, every VAP Profile can apply each of

e a policies.

e L Security Policy Policy Explain

or open Open system Authentication

M wapi WLAN Authentication and Privacy Infrastructure (WAPI)

wep Wired equivalent privacy
wpa Wi-Fi protected access
wpa2 Wi-Fi protected access version 2

华为专有和保密信息 41
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

wpa-wpa2 Wi-Fi protected access version 1&2

[AC1]wlan
[AC1-wlan-view]security-profile name test
[AC1-wlan-sec-prof-test]security ?
open Open system
wapi WLAN authentication and privacy infrastructure
wep Wired equivalent privacy
wpa Wi-Fi protected access
wpa-wpa2 Wi-Fi protected access version 1&2
wpa2 Wi-Fi protected access version 2

The SSID guestX used authentication type WEP share-key, set WEP key to WEP-40, and
e n
password guest.
/
m
Create security profile guestX with encrypt key: guest. We can set a WEP key with three
o
i.c
types: WEP-40, WEP-104,WEP-128.
If WEP-40 is used, the WEP key is 10 hexadecimal characters or 5 ASCII characters.
e
If WEP-104 is used, the WEP key is 26 hexadecimal characters or 13 ASCII characters.
w
a
If WEP-128 is used, the WEP key is 32 hexadecimal characters or 16 ASCII characters.
u
[AC1]wlan
. h
g
[AC1-wlan-view]security-profile name guest1

in
[AC1-wlan-sec-prof-guest1]security wep
[AC1-wlan-sec-prof-guest1]security wep share-key

r n
lea
[AC1-wlan-sec-prof-guest1]wep key 0 wep-40 pass-phrase guest
Warning: The current password is too simple. For the sake of security,

//
you are advised to set a password containing at least two of the

and special characters. Continue? [Y/N]:y

p :
following: lowercase letters a to z, uppercase letters A to Z, digits,

t t
Warning: This action may cause service interruption. Continue?[Y/N]y

h
Info: This operation may take a few seconds, please wait.done.

:
e s
Bind the Security profile guestX to the VAP profile guestX.
[AC1]wlan
r c
u
[AC1-wlan-view]vap-profile name guest1

o
s
[AC1-wlan-vap-prof-guest1]security-profile guest1

Re
[AC1-wlan-vap-prof-guest1]quit

Checking the security profile configuration for WEP.

i n g
[AC1-wlan-view]display security-profile name guest1

n
------------------------------------------------------------

a r Security policy : Share key

Le Encryption : WEP-40
------------------------------------------------------------

e
or
WEP's configuration
Key 0 : *****
Key 1 : *****
M Key 2
Key 3
: *****
: *****
Default key ID : 0
------------------------------------------------------------
WPA/WPA2's configuration
PTK update : disable
PTK update interval(s) : 43200

华为专有和保密信息 42
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

------------------------------------------------------------
WAPI's configuration
CA certificate filename : -
ASU certificate filename : -
AC certificate filename : -
AC private key filename : -
WAPI source interface : -
Authentication server IP : -
WAI timeout(s) : 60
BK update interval(s) : 43200
BK lifetime threshold(%) : 70
USK update method : Time-based
USK update interval(s) : 86400
MSK update method : Time-based

e n
MSK update interval(s) : 86400
/
m
Cert auth retrans count : 3
USK negotiate retrans count : 3
o
i.c
MSK negotiate retrans count : 3

e
------------------------------------------------------------

w
Run the display access-user ssid guest1 commands on the AC. The command output
a
u
shows that the STAs are connected to the SSID.
[AC1-wlan-view]display access-user ssid guest1
. h
UserID Username IP address MAC g
----------------------------------------------------------------------

in
Status

n
----------------------------------------------------------------------
r
lea
51 48437c4b8f16 10.1.13.252 4843-7c4b-8f16 Open
----------------------------------------------------------------------
Total: 1, printed: 1

: //
p
[AC1-wlan-view]display access-user ssid guest1

t t
-----------------------------------------------------------------------
UserID Username

: h
IP address MAC Status
----------------------------------------------------------------------
54 10417f6701b1
e s 10.1.13.254 1041-7f67-01b1 Open

r c
----------------------------------------------------------------------

u
Total: 1, printed: 1

o
s
Run the display station sta-mac XX commands on the AC, displays status of an STA,

Re
including the SSID of the WLAN to which the STA connects, online duration,
authentication type, and vlan. Below display result shows the STA 1041-7f67-01b1

i n g
cipher type is WEP-40.

n
[AC1-wlan-view]display station sta-mac 1041-7f67-01b1

a r -----------------------------------------------------------------------

e
Station MAC-address : 1041-7f67-01b1

e L Station IP-address
Station gateway
: 10.1.13.254
: 10.1.13.1

or
Associated SSID : guest1
Station online time(ddd:hh:mm:ss) : 000:00:18:26

M The upstream SNR(dB) : 25.0

The upstream aggregate receive power(dBm) : -70.0
Station connect rate(Mbps) : 54
Station connect channel : 165
Station inactivity time(ddd:hh:mm:ss) : 000:00:00:00
Station current state
Authorized for data transfer : YES

华为专有和保密信息 43
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

QoS enabled : YES

ERP enabled : No
HT rates enabled : No
Power save mode enabled : YES
Auth reference held : No
UAPSD enabled : No
UAPSD triggerable : No
UAPSD SP in progress : No
This is an ATH node : No
WDS workaround req : No
WDS link : No
PMF negotiation : No
Station's HT capability : Q
Station ERP element : 0

e n
Station capabilities : EP
/
m
Station PMF capabilities : PMFC=0,PMFR=0
Station VHT capabilities
o
i.c
256QAM capabilities : No

e
VHT explicit beamforming capabilities : No

w
MU-MIMO capabilities : No
Station's RSSI(dBm)
Station's radio mode
: -70
: 11a
u a
Station's AP Name : ap2
. h
Station's Radio ID
Station's Authentication Method
: 1
: WEP+Share
in g
Station's Cipher Type
r
: WEP-40
n
lea
Station's User Name : 10417f6701b1
Station's Vlan ID : 13
Station's Channel Band-width
: //
: 20MHz
Station's asso BSSID
Station's state
t t p : 4cfa-cabf-d0d2
: Asso with auth
Station's QoS Mode

: h : WMM

s
Station's HT Mode : -
Station's MCS value

r
Station's Short GI
c e : 0
: nonsupport

o u
Station's roam state : Yes

s
Station supported band : 2.4G/5G

Re
Station support 802.11k : Yes
Station support 802.11r : No

i n g
Station support 802.11v
Available to trigger roam
: No
: Yes

rn Is sticky client now : No

e a Trigger aimless roam while sticky

Neighbor list:
: Yes

e L ------------------------------------------

or
AP name RfID SNR RCPI
------------------------------------------

M
------------------------------------------
Total: 0
U-APSD list:
-------------------------------------------------------
AC-VI AC-VO AC-BE AC-BK
-------------------------------------------------------
not-support not-support not-support not-support
-------------------------------------------------------

华为专有和保密信息 44
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Step2 Configuring WPA PSK Authentication

Configure the authentication type for SSID voiceX to WPA1-PSK. Huawei AC supports
below WPA configuration option:

WPA Type Encryption Method Authentication Method

PSK(password 8-64
WPA/WPA2/WPA1-2 Personal CCMP or TKIP
characters)
WPA/WPA2/WPA1-2 Enterprise CCMP or TKIP Dot1x

Configure security profile security-profile name voice1, encryption mode TKIP, password of
PSK is voicevoice.
[AC1-wlan-view]security-profile name voice1

e n
[AC1-wlan-sec-prof-voice1]security wpa psk pass-phrase voicevoice tkip
/
Warning: The current password is too simple. For the sake of security,
you are advised to set a password containing at least two of the
o m
i.c
following: lowercase letters a to z, uppercase letters A to Z, digits,
and special characters. Continue? [Y/N]:y
[AC1-wlan-sec-prof-voice1]quit
w e
Configure VAP Profile voiceX bind to security profile voiceX.
u a
[AC1-wlan-view]vap-profile name voice1
. h
[AC1-wlan-vap-prof-voice1]security-profile voice1
in g
n
Warning: This action may cause service interruption. Continue?[Y/N]y

r
lea
[AC1-wlan-vap-prof-voice1]quit

//
Then the Configuration of WPA-PSK has been finished, we can test the connection.

p :
t t
: h
e s
r c
o u
s
Re
i n g
r n
e a
e L
or
M
C:\Users\zWX>ping 101.101.101.101
PING 101.101.101.101: 56 data bytes, press CTRL_C to break
Reply from 101.101.101.101: bytes=56 Sequence=1 ttl=255 time=7 ms

华为专有和保密信息 45
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Reply from 101.101.101.101: bytes=56 Sequence=2 ttl=255 time=10 ms

Reply from 101.101.101.101: bytes=56 Sequence=3 ttl=255 time=10 ms
Reply from 101.101.101.101: bytes=56 Sequence=4 ttl=255 time=10 ms
Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=255 time=10 ms

--- 101.101.101.101 ping statistics ---

5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 7/9/10 ms

Checking the security profile configuration for WPA PSK.

[AC1-wlan-view]display security-profile name voice1
e n
------------------------------------------------------------
/
Security policy : WPA PSK
o m
i.c
Encryption : TKIP

e
------------------------------------------------------------

w
WEP's configuration
Key 0 : *****

u a
h
Key 1 : *****
Key 2 : *****
g .
in
Key 3 : *****
Default key ID : 0
r n
lea
------------------------------------------------------------

//
WPA/WPA2's configuration
PTK update
:
: disable

p
tt
PTK update interval(s) : 43200

h
------------------------------------------------------------
WAPI's configuration
s :
CA certificate filename

r c e
ASU certificate filename
: -
: -

o u
AC certificate filename : -

es
AC private key filename : -

R
WAPI source interface : -

g
Authentication server IP : -

n i n
WAI timeout(s) : 60

r
BK update interval(s) : 43200

e a BK lifetime threshold(%) : 70

L
USK update method : Time-based

e
USK update interval(s) : 86400

or
MSK update method : Time-based
MSK update interval(s) : 86400
M Cert auth retrans count
USK negotiate retrans count
: 3
: 3
MSK negotiate retrans count : 3
------------------------------------------------------------

Run the display access-user ssid voice1 commands on the AC. The command output
shows that the STAs are connected to the SSID.

华为专有和保密信息 46
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1-wlan-view]display access-user ssid voice1

------------------------------------------------------------------------
UserID Username IP address MAC Status
------------------------------------------------------------------------
55 10417f6701b1 10.1.12.254 1041-7f67-01b1 Open
------------------------------------------------------------------------
Total: 1, printed: 1

Run the display station sta-mac XX commands on the AC, displays status of an STA,
including the SSID of the WLAN to which the STA connects, online duration,
authentication type, and vlan.
[AC1-wlan-view]display station sta-mac 1041-7f67-01b1
-------------------------------------------------------------------------

e n
Station MAC-address : 1041-7f67-01b1
/
Station IP-address : 10.1.12.254

o m
i.c
Station gateway : 10.1.12.1
Associated SSID : voice1
Station online time(ddd:hh:mm:ss) : 000:00:09:21
w e
The upstream SNR(dB)
The upstream aggregate receive power(dBm) : -63.0
: 32.0

u a
Station connect rate(Mbps) : 54
. h
Station connect channel : 165

in g
n
Station inactivity time(ddd:hh:mm:ss) : 000:00:00:00

r
lea
Station current state
Authorized for data transfer : YES
QoS enabled
: // : YES
ERP enabled
HT rates enabled
t t p : No
: No

h
s:
Power save mode enabled : YES

e
Auth reference held : No
UAPSD enabled
r c : No

o u
UAPSD triggerable : No

s
UAPSD SP in progress : No

R e
This is an ATH node
WDS workaround req
: No
: No

i n g
WDS link : No

n
PMF negotiation : No

ar
Station's HT capability : Q

Le Station ERP element

Station capabilities
: 0
: EP

e
or
Station PMF capabilities : PMFC=0,PMFR=0
Station VHT capabilities

M 256QAM capabilities
VHT explicit beamforming capabilities
: No
: No
MU-MIMO capabilities : No
Station's RSSI(dBm) : -63
Station's radio mode : 11a
Station's AP Name : ap2

华为专有和保密信息 47
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Station's Radio ID : 1
Station's Authentication Method : WPA-PSK
Station's Cipher Type : TKIP
Station's User Name : 10417f6701b1
Station's Vlan ID : 12
Station's Channel Band-width : 20MHz
Station's asso BSSID : 4cfa-cabf-d0d1
Station's state : Asso with auth
Station's QoS Mode : WMM
Station's HT Mode : -
Station's MCS value : 0

n
Station's Short GI : nonsupport
Station's roam state : Yes
/ e
m
Station supported band : 2.4G/5G
Station support 802.11k : Yes
o
Station support 802.11r
Station support 802.11v
: No
: No
e i.c
Available to trigger roam : Yes
aw
Is sticky client now : No

hu
Trigger aimless roam while sticky
Neighbor list:
: Yes

g .
------------------------------------------

n in
AP name RfID SNR RCPI
r
lea
------------------------------------------

//
------------------------------------------
Total: 0
p :
U-APSD list:
t t
h
-------------------------------------------------------

:
AC-VI AC-VO

e s AC-BE AC-BK

c
-------------------------------------------------------

r
u
not-support not-support not-support not-support

o
-------------------------------------------------------

s
Re
Step3 Configuring WPA EAP Authentication

i n g
The authentication architecture of EAP consists of three parts: clients, authenticator and
authentication server.

r n
e a
e L
or
M
The authentication server of this experiment had set an IP address 10.254.1.100,
password: huawei, the authentication server was ready and test account: huawei,
password: Huawei@123.
Configure radius service gateway in the S5700.
[S5700] vlan batch 200

华为专有和保密信息 48
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[S5700] interface GigabitEthernet0/0/24

[S5700-GigabitEthernet0/0/24]port link-type access
[S5700-GigabitEthernet0/0/24]port default vlan 200
[S5700-GigabitEthernet0/0/24]quit
[S5700] interface Vlanif200
[S5700-Vlanif200] ip address 10.254.1.1 24
[S5700-Vlanif200]quit

Configure radius service and accounting scheme in the AC.

[AC1]radius-server template huawei
[AC1-radius-huawei]radius-server authentication 10.254.1.100 1812 source
ip-address 10.1.10.100
[AC1-radius-huawei]radius-server accounting 10.254.1.100 1813 source ip-
e n
address 10.1.10.100
/
[AC1-radius-huawei]radius-server shared-key cipher huawei

o m
i.c
[AC1-radius-huawei]undo radius-server user-name domain-included
[AC1-radius-huawei]quit

Configure and test AAA.

w e
[AC1-aaa]authentication-scheme radius
u a
[AC1-aaa-authen-radius]authentication-mode radius
. h
[AC1-aaa-authen-radius]quit
[AC-aaa] accounting-scheme radius
in g
[AC-aaa-accounting-radius] accounting-mode radius
r n
lea
[AC-aaa-accounting- radius] accounting realtime 15

//
[AC-aaa-accounting- radius] quit
[AC1-aaa]domain default
p :
t t
[AC1-aaa-domain-default]authentication-scheme radius

h
[AC1-aaa-domain-default]radius-server huawei

:
e s
[AC1]test-aaa huawei Huawei@123 radius-template huawei
[AC1]
r c
u
Info: Account test succeed.

o
s
If the account test failed please ignore it first, and keep on configuring it.

Re
Configure access profile dot1x-access-profile name employeeX。

i n g
[AC1]dot1x-access-profile name employee1
[AC1-dot1x-access-profile-employee1]quit

rn
e a Configure Authentication profile authentication-profile name employeeX。

e L Bind the access profile, authentication scheme, accounting scheme and radius server to
authentication profile.

or
[AC1]authentication-profile name employee1

M
[AC1-authentication-profile-auth_dot1x]dot1x-access-profile employee1
[AC1-authentication-profile-auth_dot1x]authentication-scheme radius
[AC1-authentication-profile-auth_dot1x]accounting-scheme radius
[AC1-authentication-profile-auth_dot1x]radius-server huawei
[AC1-authentication-profile-auth_dot1x]quit

Configure security profile security-profile name employee, encryption mode CCMP,

authentication mode Dot1x EAP.

华为专有和保密信息 49
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1]wlan
[AC1-wlan-view]security-profile name employee1
[AC1-wlan-sec-prof-employee1]security wpa2 dot1x aes
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC1-wlan-sec-prof-employee1]quit

Configure VAP profile employee to bind the security profile and authentication profile.
[AC1]wlan
[AC1-wlan-view]vap-profile name employee1
[AC1-wlan-vap-prof-employee1]security-profile employee1
[AC1-wlan-vap-prof-employee1]authentication-profile employee1
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC1-wlan-vap-prof-employee1]quit
e n
/
o m
3.3 Verification
e i.c
3.3.1 Connect an STA to the WLAN aw
hu
Connect iphone to the WLANs with SSIDs employeeX.
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 50
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
3.3.2 Checking the Users Status
p :
t t
h
Check the security profile configuration.

:
s
<AC1>display security-profile name employee1

e
c
------------------------------------------------------------
Security policy

u r : WPA2 802.1x

o
Encryption : AES

s
Re
PMF : disable
------------------------------------------------------------

i g
WEP's configuration

n
Key 0 : *****

rn Key 1 : *****

e a Key 2 : *****

e L Key 3 : *****

or
Default key ID : 0
------------------------------------------------------------

M
WPA/WPA2's configuration
PTK update : disable
PTK update interval(s) : 43200
------------------------------------------------------------
WAPI's configuration
CA certificate filename : -
ASU certificate filename : -

华为专有和保密信息 51
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

AC certificate filename : -
AC private key filename : -
WAPI source interface : -
Authentication server IP : -
WAI timeout(s) : 60
BK update interval(s) : 43200
BK lifetime threshold(%) : 70
USK update method : Time-based
USK update interval(s) : 86400
MSK update method : Time-based
MSK update interval(s) : 86400

n
Cert auth retrans count : 3
USK negotiate retrans count : 3
/ e
m
MSK negotiate retrans count : 3
------------------------------------------------------------
o
that the STAs are connected to the SSID. e i.c
Run the display access-user ssid XX commands on the AC. The command output shows

<AC1>display access-user ssid employee1

aw
h u
------------------------------------------------------------------------

g.
UserID Username IP address MAC Status

in
------------------------------------------------------------------------
31 huawei1 10.1.11.254

r n 1041-7f67-01b1 Success

a
------------------------------------------------------------------------

le
//
Total: 1, printed: 1

:
Run the display station sta-mac XX commands on the AC, displays status of an STA,
p
t
including the SSID of the WLAN to which the STA connects, online duration,
t
h
authentication type, and vlan.

s :
<AC1>display station sta-mac 1041-7f67-01b1

Station MAC-address
r e
-------------------------------------------------------------------------
c : 1041-7f67-01b1

o
Station IP-address
u : 10.1.12.254

s
Re
Station gateway : 10.1.12.1
Associated SSID : voice1

i n g
Station online time(ddd:hh:mm:ss)
The upstream SNR(dB)
: 000:00:00:01
: 27.0

rn The upstream aggregate receive power(dBm) : -68.0

e a Station connect rate(Mbps) : 54

e L Station connect channel

Station inactivity time(ddd:hh:mm:ss)
: 149
: 000:00:00:00

or
Station current state

M
Authorized for data transfer : YES
QoS enabled : YES
ERP enabled : No
HT rates enabled : No
Power save mode enabled : No
Auth reference held : No
UAPSD enabled : No

华为专有和保密信息 52
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

UAPSD triggerable : No
UAPSD SP in progress : No
This is an ATH node : No
WDS workaround req : No
WDS link : No
PMF negotiation : No
Station's HT capability : Q
Station ERP element : 0
Station capabilities : EP
Station PMF capabilities : PMFC=0,PMFR=0
Station VHT capabilities

n
256QAM capabilities : No
VHT explicit beamforming capabilities : No
/ e
m
MU-MIMO capabilities : No
Station's RSSI(dBm) : -68
o
Station's radio mode
Station's AP Name
: 11a
: ap1
ei.c
Station's Radio ID : 1
aw
Station's Authentication Method : WPA-PSK

hu
Station's Cipher Type
Station's User Name
: TKIP

g .
: 10417f6701b1
Station's Vlan ID : 12

n in
Station's Channel Band-width
r : 20MHz

lea
Station's asso BSSID : 4cfa-cabe-eb71

://
Station's state : Asso with auth

ttp
Station's QoS Mode : WMM
Station's HT Mode : -

:h
Station's MCS value : 0
Station's Short GI

e s : nonsupport

rc
Station's roam state : No

u
Station supported band : 2.4G/5G

so
Station support 802.11k : Yes

R e
Station support 802.11r
Station support 802.11v
: No
: No

ing
Available to trigger roam : Yes
Is sticky client now : No

r n
Trigger aimless roam while sticky : Yes

e a Neighbor list:

e L ------------------------------------------

or
AP name RfID SNR RCPI
------------------------------------------

M ------------------------------------------
Total: 0
U-APSD list:
-------------------------------------------------------
AC-VI AC-VO AC-BE AC-BK
-------------------------------------------------------
not-support not-support not-support not-support

华为专有和保密信息 53
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

3.4 Reference Configuration

3.4.1 S5700 Configuration

#
sysname S5700
#
vlan batch 10 to 13 200
#
lldp enable
#
undo http server enable
e n
undo http secure-server enable
/
#

o m
i.c
undo nap slave enable
#
aaa
authentication-scheme default
w e
authorization-scheme default

u a
h
accounting-scheme default
domain default

g .
in
domain default_admin

n
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@
local-user admin service-type http
r
lea
#

//
interface Vlanif1
#

p :
t
interface Vlanif10

t
ip address 10.1.10.1 255.255.255.0

h
:
#
interface Vlanif11

e s
c
ip address 10.1.11.1 255.255.255.0
#

u r
o
interface Vlanif12

s
ip address 10.1.12.1 255.255.255.0

Re
#
interface Vlanif13

i#
n g
ip address 10.1.13.1 255.255.255.0

rn interface Vlanif200

e a ip address 10.254.1.1 255.255.255.0

L
#

e
interface MEth0/0/1

or
ip address 172.21.11.1 255.255.0.0
#

M interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3

华为专有和保密信息 54
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10

e n
port link-type trunk
/
m
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13
o
i.c
#

e
interface GigabitEthernet0/0/11

w
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13
u a
#
. h
interface GigabitEthernet0/0/12
#
in g
interface GigabitEthernet0/0/13
r n
lea
#
interface GigabitEthernet0/0/14
#
: //
interface GigabitEthernet0/0/15
#
t t p
h
interface GigabitEthernet0/0/16

:
s
#

#
r c e
interface GigabitEthernet0/0/17

u
interface GigabitEthernet0/0/18

o
s
#

Re
interface GigabitEthernet0/0/19
#

i#
n g
interface GigabitEthernet0/0/20

rn interface GigabitEthernet0/0/21

e a #
interface GigabitEthernet0/0/22

e L #

or
interface GigabitEthernet0/0/23
#

M
interface GigabitEthernet0/0/24
port link-type trunk
port default vlan 200
#
interface NULL0
#
interface LoopBack1
ip address 101.101.101.101 255.255.24255.255

华为专有和保密信息 55
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
user-interface con 0
authentication-mode password
set authentication password
cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@
user-interface vty 0 4
authentication-mode password
user privilege level 3
set authentication password
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@
protocol inbound all
user-interface vty 16 20
#

n
return

3.4.2 AC Configuration / e
o m
i.c
#

#
sysname AC1

w e
http secure-server ssl-policy default_policy

u a
h
http server enable
#

g .
in
undo portal url-encode enable
#
ssl renegotiation-rate 1
r n
lea
#

//
vlan batch 10 to 13 4090
#

p :
t
authentication-profile name default_authen_profile

t
authentication-profile name dot1x_authen_profile

h
:
authentication-profile name mac_authen_profile

s
authentication-profile name portal_authen_profile

e
c
authentication-profile name macportal_authen_profile

r
authentication-profile name employee1

u
o
dot1x-access-profile employee1

s
authentication-scheme radius

Re
accounting-scheme radius
radius-server huawei

i
#

n g
lldp enable

rn #

e a dhcp enable

L
#

e
diffserv domain default

or
#
radius-server template default

M radius-server template huawei

radius-server authentication 10.254.1.100 1812 source ip-address
10.1.10.100 weight 80
radius-server accounting 10.254.1.100 1813 source ip-address
10.1.10.100 weight 80
undo radius-server user-name domain-included
#
pki realm default

华为专有和保密信息 56
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

rsa local-key-pair default

enrollment self-signed
#
ssl policy default_policy type server
pki-realm default
version tls1.0 tls1.1
ciphersuite rsa_aes_128_cbc_sha
#
ike proposal default
encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256

e n
prf hmac-sha2-256
/
m
#
free-rule-template name default_free_rule
o
i.c
#

e
portal-access-profile name portal_access_profile

w
#
ip pool ap
gateway-list 10.1.10.1
u a
network 10.1.10.0 mask 255.255.255.0
. h
#
option 43 sub-option 3 ascii 10.1.10.100

in g
ip pool employee
r n
lea
gateway-list 10.1.11.1
network 10.1.11.0 mask 255.255.255.0
#
: //
ip pool voice
gateway-list 10.1.12.1
t t p
h
network 10.1.12.0 mask 255.255.255.0

:
s
#
ip pool guest

r c e
gateway-list 10.1.13.1

u
network 10.1.13.0 mask 255.255.255.0

o
s
#

Re
aaa
authentication-scheme default

i n g
authentication-scheme radius
authentication-mode radius

rn authorization-scheme default

e a accounting-scheme default
accounting-scheme radius

e L accounting-mode radius

or
accounting realtime 15
domain default

M
authentication-scheme radius
radius-server huawei
domain default_admin
authentication-scheme default
local-user admin password irreversible-
cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K
%^%#
local-user admin privilege level 15

华为专有和保密信息 57
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

local-user admin service-type ssh http

local-user huawei password irreversible-cipher
$1a$Rdtw.<{XxT$m[E}YnfM9<l9]\T7EhW67M~m$u/u6<PP~C$O&*bV$
local-user huawei privilege level 3
local-user huawei service-type telnet ssh
#
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
#
interface Vlanif10
ip address 10.1.10.100 255.255.255.0
dhcp select global
#
interface Vlanif11

e n
/
ip address 10.1.11.100 255.255.255.0
dhcp select global
#
o m
i.c
interface Vlanif12

e
ip address 10.1.12.100 255.255.255.0
dhcp select global
#
aw
interface Vlanif13

hu
.
ip address 10.1.13.100 255.255.255.0

#
dhcp select global

in g
interface Vlanif4090
r n
lea
ip address 172.21.11.3 255.255.0.0
#
interface GigabitEthernet0/0/1
: //
p
#
interface GigabitEthernet0/0/2
t t
#

: h
s
interface GigabitEthernet0/0/3
#

r c e
interface GigabitEthernet0/0/4
#

o u
s
interface GigabitEthernet0/0/5

Re
#
interface GigabitEthernet0/0/6

i
#

n g
interface GigabitEthernet0/0/7

rn port link-type access

a
port default vlan 4090

Le #
stp disable

e
or
interface GigabitEthernet0/0/8
port link-type trunk

M
port trunk allow-pass vlan 10 to 13
#
interface NULL0
#
snmp-agent local-engineid 800007DB03845B12566919
snmp-agent community
read %^%#zx5kPs")cO.^IG;R6J^5nd^JU_|q",$FD,E.s%@9CaEk5yD*QDiGKR&$73e;T^
(&JH\gl'IkR|DmZ=0C%^%#

华为专有和保密信息 58
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

snmp-agent community
write %^%#bSWeA`C;H5A98pQDivZ4mR\LSzVDEHibs|Gln%zJW[vB~(`4KElv:@:;H:BMM
=5^F$Ab1,k4LJ;xbEb=%^%#
snmp-agent sys-info version v2c
snmp-agent
#
ssh client first-time enable
stelnet server enable
undo telnet ipv6 server enable
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server secure-algorithms hmac sha2_256
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr

n
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1
#
/ e
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
o m
i.c
#
capwap source interface vlanif10
#

w e
a
user-interface con 0

u
authentication-mode password
set authentication password
. h
g
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"

in
%^%#

n
user-interface vty 0 4
authentication-mode aaa
r
lea
user privilege level 3

//
protocol inbound all
user-interface vty 16 20

p :
t
protocol inbound all
#

h t
:
wlan

s
traffic-profile name default

e
c
security-profile name test

r
security-profile name guest1

u
o
security wep share-key

s
wep key 0 wep-40 pass-phrase %^%#)~{E64X##X|h6647iii5.y8.)yr"2@":|):-

Re
T.B/%^%#
security-profile name voice1

i n g
security wpa psk pass-
phrase %^%#'B_NS~.4,Fh#8YX{gfeV}Ekj=<[Gi){`xT>QmnG>%^%# tkip

rn security-profile name default

e a security-profile name employee1

security wpa2 dot1x aes

e L security-profile name default-wds

or
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
qK%aTJ_0%^%# aes

M
security-profile name default-mesh
security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-
GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
ssid-profile name guest1
ssid guest1
ssid-profile name voice1
ssid voice1
ssid-profile name default

华为专有和保密信息 59
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

ssid-profile name employee1

ssid employee1
vap-profile name guest1
forward-mode tunnel
service-vlan vlan-id 13
ssid-profile guest1
security-profile guest1
vap-profile name voice1
service-vlan vlan-id 12
ssid-profile voice1
security-profile voice1
vap-profile name default
vap-profile name employee1
service-vlan vlan-id 11

e n
ssid-profile employee1
/
m
security-profile employee1
authentication-profile employee1
o
i.c
mesh-handover-profile name default

e
mesh-profile name default

w
wds-profile name default
regulatory-domain-profile name default
regulatory-domain-profile name domain1
u a
air-scan-profile name default
. h
rrm-profile name default
radio-2g-profile name default
in g
radio-5g-profile name default
r n
lea
wids-spoof-profile name default
wids-profile name default
ap-system-profile name default
: //
port-link-profile name default
wired-port-profile name default
t t p
h
serial-profile name preset-enjoyor-toeap

:
s
ap-group name default

r c e
ap-group name ap-group1
regulatory-domain-profile domain1
radio 0

o u
s
vap-profile employee1 wlan 1

Re
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3

i n g
radio 1
vap-profile employee1 wlan 1

rn vap-profile voice1 wlan 2

e a vap-profile guest1 wlan 3

radio 2

e L vap-profile employee1 wlan 1

or
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3

M
ap-id 0 type-id 43 ap-mac 4cfa-cabe-eb60 ap-sn 21500826412SG8918066
ap-name ap1
ap-group ap-group1
ap-id 1 type-id 43 ap-mac 4cfa-cabf-d0c0 ap-sn 21500826412SG8919901
ap-name ap2
ap-group ap-group1
provision-ap
#

华为专有和保密信息 60
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

dot1x-access-profile name dot1x_access_profile

dot1x-access-profile name employee1
#
mac-access-profile name mac_access_profile
#
undo ntp-service enable
#
return

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 61
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

4 Experiment 4: eSight WLAN Management

4.1 About This Course

4.1.1 Objectives e n
/
Configure SNMP in AC
o m
i.c


 Understand the method of eSight discover AC

 Configure WLAN with eSight wizard
w e
4.1.2 Topology u a
. h
in g
r n
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 62
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

4.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.

Group
AC-Switch Port AP-Switch Port
No.

 AP1-G0/0/10
1 AC1—G0/0/1
AP2-G0/0/11
e n
/


 AP3-G0/0/12
o m
i.c
2 AC2—G0/0/2
 AP4-G0/0/13

AP5-G0/0/14
w e
a

3 AC3—G0/0/3
 AP6-G0/0/15
hu
AP7-G0/0/15
g .
in

4 AC4—G0/0/4
AP8-G0/0/16
n


r
AP9-G0/0/17
lea


//
5 AC5—G0/0/5


p :
AP10-G0/0/18

t t
h
 AP11-G0/0/19
6 AC6—G0/0/6

s:
 AP12-G0/0/20

r c e
o u
s
eSight Server IP
e
172.21.11.20

R
ing
eSight Server password Name: admin Password: Huawei@123

r n
e aSNMP read only community publicRO

e L SNMP read and write

privateRW

or
community

华为专有和保密信息 63
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

4.2 Experiment Task

4.2.1 Configuration Procedure

Step1 Configuring a Switch
Continue the configuration from experiment 1, the configuration of the switch has
been ready.

Step2 Configuring SNMP Parameters

Configure AC SNMP Community and static route.

e n
/
[AC1]snmp-agent community read publicRO
[AC1]snmp-agent community write privateRW
[AC1]snmp-agent sys-info version v2c
o m
i.c
[AC1]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1

Step3 Configuring eSight Discover AC

w e
u a
After the PC connect to the WLAN, enter URL http://172.21.11.20:8080 to access eSight
Server, user name: admin, password: Huawei@123 (The initialized user name and

. h
password are: admin/Changeme123, you need change the initial password when you first
login eSight). Should use google chrome or firefox browser.

in g
r n
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
r n After login in to eSight, select the pull-down menu“Resource”，and click “Add

e a Device”, reference below parameters.

e L IP Address 172.21.11.X+2

or
Name ACX

M SNMP Version

Read Only Community

V2C
publicRO
Write Community privateRW
Telnet Authentication mode Password
Password Admin@123

华为专有和保密信息 64
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn Click”OK” when you finished, if displayed “Success”then means the configuring is

e a successed.

e L
or
M

华为专有和保密信息 65
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Step4 Configuring Basic AC Parameters

，and click “Network Device”.
Select the pull-down menu“Resource”

e n
/
o m
ei.c
aw
hu
g .
n in
r
lea
Click “WLAN Feature > AP”, enter the Create Manually interface and add aps.

: //
t t p
: h
e s
r c
o u
s
Re
i n g
r n
e a
e L
or
M

华为专有和保密信息 66
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Configure interface Group huaweiX.

Select the pull-down menu“Resource> Resources Group> Group Management”
Click “Interface group > User Defined > ”, and the name for this experiment is
“huawei1”.

e n
/
o m
e i.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 67
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 68
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
Configure VLANIF and DHCP Server
hu
.
Select the pull-down menu“Business> WLAN Management> Configuration and
g
in
Deployment”

r n
//lea
p :
t t
: h
e s
r c
o u
s
Add devices on base configuration.

Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 69
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 70
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M Configure Channel. Click “Base configuration > Channel Configuration ”, set the allow
pass VLANs and PVID for interface group”.

华为专有和保密信息 71
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 72
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
Step1 Configuring AP Online
o m
Configure AP Authentication mode and AC Source Address.
ei.c
Click “Global AC Configuration > AC > ”, select Resouce AC1”.
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 73
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 74
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Step2 Configure WLAN Service Parameters

Create Profiles employeeX, Click “AP Configuration > Profile Management > VAP Profile >
SSID Profile ”, select Create”. Configure the security policy for employeeX to WPA2, with
the password employee.

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
r n
e a
e L
or
M

华为专有和保密信息 75
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
Create VAP profiles employeeX. Set the data forwarding mode for employeeX to tunnel
u
forwarding. Configure the service VLAN and bind the profile to the security profile and
h
SSID profile.
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
rn
e a
e L
or
M

华为专有和保密信息 76
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
o m
ei.c
aw
hu
g .
n in
r
//lea
p :
t t
: h
e s
r c
o u
s
Re
i n g
Configure AP groups ap-groupX to use the VAP profile.

rn
e a
e L
or
M

华为专有和保密信息 77
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
. com
e i
a w
. hu
in g
r n
//lea
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
or
M

华为专有和保密信息 78
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

After finish above, ap still not online. Configure the function of ssh for AC, and test the
SFTP for eSight. Username: admin, password: Changeme123.
[AC6005]ssh client first-time enable
[AC6005]sftp 172.21.0.11 31922
Please input the username:admin
Trying 172.21.0.11 ...
Press CTRL+K to abort
The server is not authenticated. Continue to access it? (y/n)[n]:y
Save the server's public key? (y/n)[n]:y

e n
/
The server's public key will be saved with the name 172.21.0.11. Please
wait...

Enter password:
. c om
sftp-client>
e i
interval, make the AP online.
a w
Click “System > Network Management Settings > Polling Settings”. Configure Polling

. hu
in g
r n
//lea
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
or
M

华为专有和保密信息 79
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
. com
e i
a w
. hu
in g
r n
//lea
p :
t t
: h
es
c
Check the AP Status and two Aps are online.
r
ou
es
R
i n g
n
e ar
e L
or
M

华为专有和保密信息 80
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
. com
e i
a w
. hu
in g
r n
//lea
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
orVerification
4.3
M
4.3.1 Connect an STA to the WLAN
Connect STAs to the WLANs with SSIDs employeeX.

华为专有和保密信息 81
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

e n
/
. com
e i
a w
. hu
in g
r n
C:\Users\zWX>ping 101.101.101.101
//lea
p :
PING 101.101.101.101: 56 data bytes, press CTRL_C to break

t t
Reply from 101.101.101.101: bytes=56 Sequence=1 ttl=255 time=7 ms

: h
Reply from 101.101.101.101: bytes=56 Sequence=2 ttl=255 time=10 ms

s
Reply from 101.101.101.101: bytes=56 Sequence=3 ttl=255 time=10 ms

e
c
Reply from 101.101.101.101: bytes=56 Sequence=4 ttl=255 time=10 ms

r
u
Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=255 time=10 ms

s o
R e
--- 101.101.101.101 ping statistics ---
5 packet(s) transmitted

i n g
5 packet(s) received
0.00% packet loss
n
ar
round-trip min/avg/max = 7/9/10 ms

L e
e
4.4rReference Configuration
o
M4.4.1 S5700 Configuration
#
sysname S5700
#
vlan batch 10 to 13 200
#
lldp enable
#

华为专有和保密信息 82
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

undo http server enable

undo http secure-server enable
#
undo nap slave enable
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin

e n
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@
/
om
local-user admin service-type http
#
interface Vlanif1
i . c
#
interface Vlanif10
we
ip address 10.1.10.1 255.255.255.0
a
hu
#
interface Vlanif11
ip address 10.1.11.1 255.255.255.0
g .
#

n in
interface Vlanif12
r
lea
ip address 10.1.12.1 255.255.255.0

//
#
interface Vlanif13

p :
t
ip address 10.1.13.1 255.255.255.0
#
interface Vlanif200
h t
s :
ip address 10.254.1.1 255.255.255.0
#
interface MEth0/0/1
r c e
u
ip address 172.21.11.1 255.255.0.0

o
#

es
interface GigabitEthernet0/0/1

R
port link-type trunk

#
i n g
port trunk allow-pass vlan 10 to 13

n
ar
interface GigabitEthernet0/0/2
#

L e interface GigabitEthernet0/0/3
#
e
or
interface GigabitEthernet0/0/4
#

M interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10

华为专有和保密信息 83
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

port link-type trunk

port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/11
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/12
#

e n
interface GigabitEthernet0/0/13
/
om
#
interface GigabitEthernet0/0/14
#
i . c
interface GigabitEthernet0/0/15
#
we
interface GigabitEthernet0/0/16
a
hu
#
interface GigabitEthernet0/0/17
#
g .
interface GigabitEthernet0/0/18

n in
#
r
lea
interface GigabitEthernet0/0/19

//
#
interface GigabitEthernet0/0/20

p :
t
#
interface GigabitEthernet0/0/21
#
h t
s :
interface GigabitEthernet0/0/22
#

r c e
interface GigabitEthernet0/0/23
#

ou
es
interface GigabitEthernet0/0/24
port link-type trunk

R
port default vlan 200
#

i n g
interface NULL0

n
ar
#
interface LoopBack1

L e #
ip address 101.101.101.101 255.255.255.255

e
or
user-interface con 0
authentication-mode password

M set authentication password

cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@
user-interface vty 0 4
authentication-mode password
user privilege level 3
set authentication password
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@
protocol inbound all
user-interface vty 16 20
#
return

华为专有和保密信息 84
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

4.4.2 AC Configuration
#
sysname AC1
#
http secure-server ssl-policy default_policy
http server enable
#
portal local-server ip 10.1.10.100

e n
portal local-server https ssl-policy default_policy port 2000
/
om
#
undo portal url-encode enable
#
i . c
ssl renegotiation-rate 1
we
#
a
hu
vlan batch 10 to 13 4090
#

g .
in
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile

r n
lea
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
portal-access-profile guest1
: //
t p
authentication-profile name macportal_authen_profile
authentication-profile name guest1
t
portal-access-profile guest1
: h
es
authentication-profile name employee1

r c
dot1x-access-profile employee1

u
authentication-scheme radius

o
#
es
radius-server huawei

R
lldp enable
#

i n g
n
dhcp enable

ar
#

Le
diffserv domain default
#

r e radius-server template default

o radius-server template huawei

M radius-server authentication 10.254.1.100 1812 source ip-address

10.1.10.100 weight 80
undo radius-server user-name domain-included
#
pki realm default
rsa local-key-pair default
enrollment self-signed
#
ssl policy default_policy type server

华为专有和保密信息 85
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

pki-realm default
version tls1.0 tls1.1
ciphersuite rsa_aes_128_cbc_sha
#
ike proposal default
encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
e n
prf hmac-sha2-256 /
#

. com
i
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
we
a
hu
portal local-server enable

.
#
portal-access-profile name guest1
portal local-server enable
in g
#
r n
lea
ip pool ap

//
gateway-list 10.1.10.1
network 10.1.10.0 mask 255.255.255.0

p :
t t
option 43 sub-option 3 ascii 10.1.10.100
#

: h
s
ip pool employee1
gateway-list 10.1.11.1

r c e
network 10.1.11.0 mask 255.255.255.0

ou
dns-list 114.114.114.114
#
es
R
ip pool voice1

i n g
gateway-list 10.1.12.1
network 10.1.12.0 mask 255.255.255.0

n
ar
#
ip pool guest1

L e gateway-list 10.1.13.1

e network 10.1.13.0 mask 255.255.255.0

or #

M
aaa
authentication-scheme default
authentication-scheme radius
authentication-mode radius
authorization-scheme default
accounting-scheme default
domain default
authentication-scheme default
domain default_admin
authentication-scheme default

华为专有和保密信息 86
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

local-user admin password irreversible-cipher $1a$VNcE$6oR"2$aASkVyCl-

~~qx^~!e+:.S|>BJto>%VV[WvDxK./G$
local-user admin privilege level 15
local-user admin service-type ssh http
local-user huawei password irreversible-cipher
$1a$6@(!=HT_IP$A=lvP*~iu+0<..Y&4`Y6+j4$Xkcf=#aMU=5[4wEP$
local-user huawei privilege level 1
local-user huawei service-type telnet ssh http
local-user guest01 password cipher %^%#h)q(D@"^~3lbX|<lHk1L#bj]RY3-
pAYq#XEVAp>~%^%#

e n
local-user guest01 privilege level 0
/
om
local-user guest01 service-type web
#
interface Vlanif1
i . c
ip address 169.254.1.1 255.255.0.0
we
#
a
hu
interface Vlanif10
ip address 10.1.10.100 255.255.255.0

g .
in
dhcp select global
#

r n
lea
interface Vlanif11
ip address 10.1.11.100 255.255.255.0
dhcp select global
: //
#
interface Vlanif12
t t p
: h
ip address 10.1.12.100 255.255.255.0
dhcp select global
es
#
r c
u
interface Vlanif13

o
es
ip address 10.1.13.100 255.255.255.0
dhcp select global
# R
n g
interface Vlanif4090

i
n
ip address 172.21.11.3 255.255.0.0

ar
#

Le
interface GigabitEthernet0/0/1
#

r e interface GigabitEthernet0/0/2

o #

M interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7

华为专有和保密信息 87
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

port link-type access

port default vlan 4090
stp disable
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 13
#
interface NULL0
#
e n
info-center timestamp log format-date /
#

. com
i
snmp-agent local-engineid 800007DB03845B12566919
snmp-agent community
read %^%#En_g+AWfX>adWz&5.!G~E^)4&/r]vCScEB~w~u%Zje-
we
$@`GH0BN7e"$A8PF(_n~lC9qvT)O*{4!I+:yR%^%#
a
hu
snmp-agent community write %^%#atYiX7&TjG<o\Y/.2Y-

.
V/8bVI&sGJOTB4$0Y@{"2$306$`dp;=7cULM)*$.3Q!lXY<}!y7jZ,7BS"NNY%^%#

g
in
snmp-agent sys-info version v2c
snmp-agent

r n
lea
#
undo telnet ipv6 server enable

: //
ssh server secure-algorithms cipher aes256_ctr aes128_ctr aes256_cbc
aes128 3des

t t p
ssh server secure-algorithms hmac sha2_256 sha2_256_96 sha1 sha1_96 md5
md5_96
: h
s
ssh server key-exchange dh_group14_sha1

e
c
ssh client secure-algorithms cipher aes256_ctr aes128_ctr aes256_cbc

r
u
aes128 3des

o
ssh client secure-algorithms hmac sha2_256 sha2_256_96 sha1 sha1_96 md5

s
e
md5_96

R
ssh client key-exchange dh_group14_sha1
#

i n g
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1

n
ar
#
capwap source interface vlanif10

L e #

e user-interface con 0

or authentication-mode password

M
set authentication password
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"%^
%#
user-interface vty 0 4
authentication-mode aaa
user privilege level 3
protocol inbound telnet
user-interface vty 16 20
protocol inbound all
#

华为专有和保密信息 88
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

wlan
traffic-profile name default
security-profile name guest1
security-profile name voice1
security wpa psk pass-
phrase %^%#0)RfPJm>L58cY+4*K);#E~]V)7`\406bJM4syy*%%^%# tkip
security-profile name default
security-profile name employee1
security wpa2 dot1x aes
security-profile name default-wds
e n
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
/
om
qK%aTJ_0%^%# aes
security-profile name default-mesh

i . c
e
security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-
GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
ssid-profile name guest1
a w
hu
ssid guest1
ssid-profile name voice1

g .
in
ssid voice1
ssid-profile name default

r n
lea
ssid-profile name employee1
ssid employee1
vap-profile name guest1
: //
forward-mode tunnel
service-vlan vlan-id 13
t t p
ssid-profile guest1
: h
security-profile guest1
es
r c
authentication-profile portal_authen_profile

u
vap-profile name voice1

o
es
service-vlan vlan-id 12
ssid-profile voice1

R
security-profile voice1

n g
vap-profile name default

i
n
vap-profile name employee1

ar
service-vlan vlan-id 11

L e ssid-profile employee1
security-profile employee1
e
or
authentication-profile employee1
mesh-handover-profile name default

M mesh-profile name default

wds-profile name default
regulatory-domain-profile name default
regulatory-domain-profile name domain1
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
radio-5g-profile name default
wids-spoof-profile name default

华为专有和保密信息 89
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

wids-profile name default

ap-system-profile name default
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name default
ap-group name ap-group1
regulatory-domain-profile domain1
radio 0
vap-profile employee1 wlan 1
e n
vap-profile voice1 wlan 2 /
vap-profile guest1 wlan 3

. com
i
radio 1
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
we
a
hu
vap-profile guest1 wlan 3

.
radio 2
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
in g
vap-profile guest1 wlan 3
r n
lea
ap-id 0 type-id 43 ap-mac 4cfa-cabe-eb60 ap-sn 21500826412SG8918066

//
ap-group ap-group1

:
ap-id 1 type-id 43 ap-mac 4cfa-cabf-d0c0 ap-sn 21500826412SG8919901

p
ap-group ap-group1
t t
provision-ap

: h
s
#

c e
dot1x-access-profile name dot1x_access_profile

r
dot1x-access-profile name employee1
#
ou
es
mac-access-profile name mac_access_profile
#
R
#
i n g
undo ntp-service enable

n
ar
return

L e
e
or
M

华为专有和保密信息 90
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

5 Experiment 5: Layer 3 Networking Experiment

5.1 About This Course e n

/
5.1.1 Objectives
. com
e i
 Understand the L3 networking structure
a w
hu
 Configure L3 networking device
 Configure tunnel forwarding
g .
in
 Verify the configuration

5.1.2 Topology r n
//lea
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
or
M

华为专有和保密信息 91
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

5.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.

Group
n
AC-Switch Port AP-Switch Port
No.

/ e
om
 AP1-G0/0/10
1 AC1—G0/0/1
 AP2-G0/0/11
i . c
 AP3-G0/0/12
we
a
2 AC2—G0/0/2
AP4-G0/0/13

hu


 AP5-G0/0/14
g .
in
3 AC3—G0/0/3
 AP6-G0/0/15

r n
lea
 AP7-G0/0/15
4 AC4—G0/0/4
AP8-G0/0/16
//


p :

t t
AP9-G0/0/17
5 AC5—G0/0/5

:

h
AP10-G0/0/18

es
6 AC6—G0/0/6
r c  AP11-G0/0/19

ou  AP12-G0/0/20

es
The following table describes an AC parameter configuration template.
R
n g
Trainee Group X
i
AC Configuration

n
ar
Console Port Login
Admin@123

L e Password

e Device ACX

or AP Management
VLAN：X0 IP：10.1.X0.100
M VLAN
Service VLAN
VLAN：X1 IP：10.1.X1.100
(Employee)

Service VLAN (Voice) VLAN：X2 IP：10.1.X2.100

Service VLAN (Guest) VLAN：X3 IP：10.1.X3.100

AC Source interface
VLANif 80X IP：10.1.20X.100
（L3 Networking）

华为专有和保密信息 92
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Topology: layer2 and layer 3 bypass topology

5.2 Experiment Task

5.2.1 Configuration Procedure

e n
Step1 Configuring a Switch
/
om
Configure the VLAN and Trunk on switch S5700, set the VLANIF80X ip address.
[S5700]vlan batch 801
[S5700]int GigabitEthernet 0/0/1
i . c
[S5700-GigabitEthernet0/0/1]port trunk allow-pass vlan 801

we
a
[S5700-GigabitEthernet0/0/1]quit

hu
[S5700]int Vlanif 801
[S5700-Vlanif801]ip address 10.1.201.1 24

g .
in
[S5700-Vlanif801]quit

Step2 Configuring Basic AC Parameters

r n
lea
Update the VLAN and Trunk Configuration, and set the VLANIF80X ip address.
[AC1]vlan 801

: //
p
[AC1]interface GigabitEthernet 0/0/8

t t
[AC1-GigabitEthernet0/0/8]port trunk allow-pass vlan 801
[AC1-GigabitEthernet0/0/8]quit

: h
[AC1]int Vlanif 801

es
c
[AC1-Vlanif801]ip address 10.1.201.100 24
[AC1-Vlanif801]quit
u r
s o
Modify the DHCP Option43 address to 10.1.201.100.

R e
[AC1]ip pool ap
[AC1-ip-pool-ap]display this
#
i n g
nip pool ap

ar gateway-list 10.1.10.1

Le
network 10.1.10.0 mask 255.255.255.0

e
option 43 sub-option 3 ascii 10.1.10.100

o r #
[AC1-ip-pool-ap]undo option 43

M [AC1-ip-pool-ap]option 43 sub-option 3 ascii 10.1.20X.100

Modify the AC Source interface.

[AC1]undo capwap source interface Vlanif 10
Warning: This operation will disconnect the device on the source
interface. Continue? [Y/N]:y
[AC1]capwap source interface Vlanif 801

Modify VAP Profile employeeX and voiceX forwarding mode to tunnel forwarding.
[AC1]wlan

华为专有和保密信息 93
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

[AC1-wlan-view]vap-profile name employee1

[AC1-wlan-vap-prof-employee1]forward-mode tunnel
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC1-wlan-vap-prof-employee1]quit
[AC1-wlan-vap-prof-voice1]forward-mode tunnel
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC1-wlan-vap-prof-voice1]quit

e n
5.3 Verification /
. c om
5.3.1 Verifiy the L3 Network Status
e i
a w
Then the Configuration of L3 Network has been finished, all Aps are online.

hu
[AC1]display ap all
Info: This operation may take a few seconds. Please wait for a
g .
in
moment.done.

n
Total AP information:

r
lea
nor : normal [2]
-------------------------------------------------------------------------

://
ID MAC Name Group IP Type State STA Uptime

tp
-------------------------------------------------------------------------
0

h t
4cfa-cabe-eb60 ap1 ap-group1 10.1.10.253 AP4030DN nor 0 6S

:
1 4cfa-cabf-d0c0 ap2 ap-group1 10.1.10.254 AP4030DN nor 1 26S

es
-------------------------------------------------------------------------
Total: 2
r c
ou
Check the station information.

es
[AC1]display station all

R
Rf/WLAN: Radio ID/WLAN ID

i n g
Rx/Tx: link receive rate/link transmit rate(Mbps)
-------------------------------------------------------------------------

n
ar
STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP
address SSID

Le -------------------------------------------------------------------------

re
1041-7f67-01b1 0 ap1 0/2 2.4G 11g 35/46 -64 12

o
10.1.12.254 voice1
-------------------------------------------------------------------------

M Total: 1 2.4G: 1 5G: 0

华为专有和保密信息 94
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

5.4 Reference Configuration

5.4.1 S5700 Configuration

#
sysname S5700
#
vlan batch 10 to 13 200 801
#
e n
lldp enable
/
om
#

c
undo http server enable
undo http secure-server enable
#
e i .
undo nap slave enable

a w
hu
#
aaa
authentication-scheme default
g .
in
authorization-scheme default

n
accounting-scheme default
domain default
r
lea
domain default_admin

//
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@
local-user admin service-type http

p :
#

t t
h
interface Vlanif1
#

s :
e
interface Vlanif10

c
ip address 10.1.10.1 255.255.255.0

r
u
#

o
interface Vlanif11

s
ip address 10.1.11.1 255.255.255.0
e
R
#
interface Vlanif12

n g
ip address 10.1.12.1 255.255.255.0

i
n
#

ar
interface Vlanif13

e
ip address 10.1.13.1 255.255.255.0

e L #
interface Vlanif200

or
ip address 10.254.1.1 255.255.255.0
#

M interface Vlanif801
ip address 10.1.201.1 255.255.255.0
#
interface MEth0/0/1
ip address 172.21.11.1 255.255.0.0
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 13 801
#

华为专有和保密信息 95
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7

e n
#
/
om
interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
i . c
#
interface GigabitEthernet0/0/10
we
port link-type trunk
a
hu
port trunk pvid vlan 10

#
port trunk allow-pass vlan 10 to 13

g .
interface GigabitEthernet0/0/11

n in
port link-type trunk
r
lea
port trunk pvid vlan 10

//
port trunk allow-pass vlan 10 to 13
#

p :
t
interface GigabitEthernet0/0/12
#
interface GigabitEthernet0/0/13
h t
#
s :
c e
interface GigabitEthernet0/0/14
#
r
u
interface GigabitEthernet0/0/15

o
#

es
interface GigabitEthernet0/0/16
#
R
#
i n g
interface GigabitEthernet0/0/17

n
ar
interface GigabitEthernet0/0/18
#

L e interface GigabitEthernet0/0/19
#
e
or
interface GigabitEthernet0/0/20
#

M interface GigabitEthernet0/0/21
#
interface GigabitEthernet0/0/22
#
interface GigabitEthernet0/0/23
#
interface GigabitEthernet0/0/24
port link-type trunk
port default vlan 200
#
interface NULL0

华为专有和保密信息 96
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
user-interface con 0
authentication-mode password
set authentication password
cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@
user-interface vty 0 4
authentication-mode password
user privilege level 3

e n
set authentication password
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@ /
om
protocol inbound all
user-interface vty 16 20

i . c
e
#
return

a w
5.4.2 AC Configuration
. hu
#

in g
n
sysname AC1
#
r
lea
http secure-server ssl-policy default_policy

//
http server enable
#

p :
undo portal url-encode enable

t t
h
#

:
ssl renegotiation-rate 1
#

es
c
vlan batch 10 to 13 801 4090

r
u
#

o
authentication-profile name default_authen_profile

s
authentication-profile name dot1x_authen_profile

e
R
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile

n g
authentication-profile name macportal_authen_profile

i
authentication-profile name employee1
n
ar
dot1x-access-profile employee1

e
authentication-scheme radius

e L accounting-scheme radius
radius-server huawei

or
#
lldp enable

M #
dhcp enable
#
diffserv domain default
#
radius-server template default
radius-server template huawei
radius-server authentication 10.254.1.100 1812 source ip-address
10.1.10.100 weight 80
radius-server accounting 10.254.1.100 1813 source ip-address
10.1.10.100 weight 80

华为专有和保密信息 97
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

undo radius-server user-name domain-included

#
pki realm default
rsa local-key-pair default
enrollment self-signed
#
ssl policy default_policy type server
pki-realm default
version tls1.0 tls1.1
ciphersuite rsa_aes_128_cbc_sha
#

e n
ike proposal default
/
om
encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
i . c
authentication-method pre-share
integrity-algorithm hmac-sha2-256
we
prf hmac-sha2-256
a
hu
#
free-rule-template name default_free_rule
#
g .
portal-access-profile name portal_access_profile

n in
#
r
lea
ip pool ap

//
gateway-list 10.1.10.1
network 10.1.10.0 mask 255.255.255.0

p :
t
option 43 sub-option 3 ascii 10.1.201.100
#
ip pool employee
h t
gateway-list 10.1.11.1
s :
#
c e
network 10.1.11.0 mask 255.255.255.0

r
ip pool voice

ou
es
gateway-list 10.1.12.1
network 10.1.12.0 mask 255.255.255.0
#
R
i n g
ip pool guest
gateway-list 10.1.13.1

n
ar
network 10.1.13.0 mask 255.255.255.0
#

L e aaa
authentication-scheme default
e
or
authentication-scheme radius
authentication-mode radius

M authorization-scheme default
accounting-scheme default
accounting-scheme radius
accounting-mode radius
accounting realtime 15
domain default
authentication-scheme radius
radius-server huawei
domain default_admin
authentication-scheme default

华为专有和保密信息 98
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

local-user admin password irreversible-

cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K
%^%#
local-user admin privilege level 15
local-user admin service-type ssh http
local-user huawei password irreversible-cipher
$1a$Rdtw.<{XxT$m[E}YnfM9<l9]\T7EhW67M~m$u/u6<PP~C$O&*bV$
local-user huawei privilege level 3
local-user huawei service-type telnet ssh
#

n
interface Vlanif1

#
ip address 169.254.1.1 255.255.0.0
/ e
om
interface Vlanif10
ip address 10.1.10.100 255.255.255.0
dhcp select global
i . c
#

we
a
interface Vlanif11

hu
ip address 10.1.11.100 255.255.255.0

.
dhcp select global

g
#

in
interface Vlanif12
ip address 10.1.12.100 255.255.255.0

r n
lea
dhcp select global
#

//
interface Vlanif13
ip address 10.1.13.100 255.255.255.0
p :
dhcp select global
t t
h
#
interface Vlanif801

s :
e
ip address 10.1.201.100 255.255.255.0
#
r c
u
interface Vlanif4090

o
ip address 172.21.11.3 255.255.0.0

s
e
#

R
interface GigabitEthernet0/0/1

g
#

n i n
interface GigabitEthernet0/0/2
#

ar
interface GigabitEthernet0/0/3

L e #
interface GigabitEthernet0/0/4

e
or
#
interface GigabitEthernet0/0/5
#

M interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
port link-type access
port default vlan 4090
stp disable
#
interface GigabitEthernet0/0/8
port link-type trunk
port trunk allow-pass vlan 10 to 13 801

华为专有和保密信息 99
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
interface NULL0
#
snmp-agent local-engineid 800007DB03845B12566919
snmp-agent community
read %^%#zx5kPs")cO.^IG;R6J^5nd^JU_|q",$FD,E.s%@9CaEk5yD*QDiGKR&$73e;T^
(&JH\gl'IkR|DmZ=0C%^%#
snmp-agent community
write %^%#bSWeA`C;H5A98pQDivZ4mR\LSzVDEHibs|Gln%zJW[vB~(`4KElv:@:;H:BMM
=5^F$Ab1,k4LJ;xbEb=%^%#

n
snmp-agent sys-info version v2c

#
snmp-agent

/ e
om
ssh client first-time enable

c
stelnet server enable
undo telnet ipv6 server enable
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
e i .
ssh server secure-algorithms hmac sha2_256

a w
hu
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
g .
in
ssh client key-exchange dh_group14_sha1

n
#
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
r
lea
#

//
capwap source interface vlanif801
#

p :
user-interface con 0

t t
h
authentication-mode password

s :
set authentication password
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"
%^%#

r
user-interface vty 0 4
c e
u
authentication-mode aaa

o
es
user privilege level 3
protocol inbound all

R
user-interface vty 16 20

#
i n g
protocol inbound all

n
ar
wlan
traffic-profile name default

L e security-profile name test

security-profile name guest1
e
or
security wep share-key
wep key 0 wep-40 pass-phrase %^%#)~{E64X##X|h6647iii5.y8.)yr"2@":|):-

M
T.B/%^%#
security-profile name voice1
security wpa psk pass-
phrase %^%#'B_NS~.4,Fh#8YX{gfeV}Ekj=<[Gi){`xT>QmnG>%^%# tkip
security-profile name default
security-profile name employee1
security wpa2 dot1x aes
security-profile name default-wds
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
qK%aTJ_0%^%# aes
security-profile name default-mesh

华为专有和保密信息 100
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-

GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
ssid-profile name guest1
ssid guest1
ssid-profile name voice1
ssid voice1
ssid-profile name default
ssid-profile name employee1
ssid employee1
vap-profile name guest1
forward-mode tunnel

e n
service-vlan vlan-id 13
/
om
ssid-profile guest1
security-profile guest1
vap-profile name voice1
i . c
e
forward-mode tunnel

w
service-vlan vlan-id 12
ssid-profile voice1
a
hu
security-profile voice1
vap-profile name default
vap-profile name employee1
g .
service-vlan vlan-id 11

n in
r
ssid-profile employee1

lea
security-profile employee1
authentication-profile employee1
mesh-handover-profile name default
: //
mesh-profile name default
wds-profile name default
t t p
h
regulatory-domain-profile name default

:
s
regulatory-domain-profile name domain1

r c e
air-scan-profile name default
rrm-profile name default

u
radio-2g-profile name default

o
s
radio-5g-profile name default

R e
wids-spoof-profile name default
wids-profile name default

i n g
ap-system-profile name default
port-link-profile name default

n
ar
wired-port-profile name default
serial-profile name preset-enjoyor-toeap

L e ap-group name default

ap-group name ap-group1

e
or
regulatory-domain-profile domain1
radio 0

M
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3
radio 1
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3
radio 2
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3

华为专有和保密信息 101
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

ap-id 0 type-id 43 ap-mac 4cfa-cabe-eb60 ap-sn 21500826412SG8918066

ap-name ap1
ap-group ap-group1
ap-id 1 type-id 43 ap-mac 4cfa-cabf-d0c0 ap-sn 21500826412SG8919901
ap-name ap2
ap-group ap-group1
provision-ap
#
dot1x-access-profile name dot1x_access_profile
dot1x-access-profile name employee1
#

e n
mac-access-profile name mac_access_profile
/
om
#
undo ntp-service enable
#
i . c
Return

we
a
. hu
in g
r n
//lea
p :
t t
: h
es
r c
ou
es
R
i n g
n
e ar
e L
or
M

华为专有和保密信息 102
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

6 Experiment 6: Backup the Configuration and

Reset the Device
e n
/
6.1 About This Course . c om
e i
6.1.1 Objectives a w
. hu
Save the configuration of AC
g

 Configure FTP service in AC
n in
 Backup the configuration of AC
r
lea
 Reset the configuration of AC

6.1.2 Plan : //
t t p
: h
You must configure devices according to the plan to avoid errors. This experiment uses

s
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
e
c
Trunk.

u r
The following table describes device connections.

s o
Group
No.
R e
AC-Switch Port AP-Switch Port

i n g
n
 AP1-G0/0/10

ar
1 AC1—G0/0/1
 AP2-G0/0/11

L e AP3-G0/0/12
e


or
2 AC2—G0/0/2
 AP4-G0/0/13

M 3 AC3—G0/0/3



AP5-G0/0/14
AP6-G0/0/15

 AP7-G0/0/15
4 AC4—G0/0/4
 AP8-G0/0/16

 AP9-G0/0/17
5 AC5—G0/0/5
 AP10-G0/0/18

华为专有和保密信息 103
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

 AP11-G0/0/19
6 AC6—G0/0/6
 AP12-G0/0/20

Item Parameter

Management IP 172.21.11.X+2
Backup Configuration
e n
File name
acvrpcfg.zip
/
FTP account Name: ftp Password: Huawei@123

. c om
FTP Directory Flash:/
e i
a w
. hu
6.2 Experiment Task in g
r n
6.2.1 Configuration Procedure
//lea
p :
Step1 Save the Configuration
t t
: h
We can use save command to save the current configuration to the storage device.
<AC1>save acvrpcfg.zip
es
r c
Are you sure to save the configuration to acvrpcfg.zip? (y/n)[n]:y

wait........
ou
It will take several minutes to save configuration file, please

es
Configuration file has been saved successfully

R
Note: The configuration file will take effect after being activated

i n g
Using the dir command, you can view information about the files and directories on the
storage device.
n
ar
<AC1>dir

e
Directory of sdcard:/

e L Idx Attr Size(Byte) Date Time(LMT) FileName

or
0 -rw- 1,883 May 13 2016 16:19:42 002f_sftpsync_53.xml
1 -rw- 3,266 Nov 11 2016 15:16:11 AC6005-1.cfg

M 2 -rw- 61,456 Jun 20 2015 07:33:20

AC6005V200R005C10SPH301.pat
3 -rw- 53,286,116 Oct 26 2015 19:55:55
AC6005V200R006C10SPC100.cc
4 -rw- 67,503,156 Nov 11 2016 14:11:48
AC6005V200R007C10SPC100.cc
5 -rw- 2,610 Nov 17 2016 10:14:27 acvrpcfg.zip
6 -rw- 1,318 Nov 11 2016 14:37:26 ca.cer
7 -rw- 149 Nov 11 2016 14:39:00 ca_config.ini
8 -rw- 7,211 Nov 16 2016 20:28:47 config.cfg
9 drw- - Jun 20 2015 07:29:43 corefile

华为专有和保密信息 104
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

10 -rw- 1,055 Nov 12 2016 18:11:10 daemon.log

11 -rw- 2,100 Oct 31 2016 15:34:40 daemon.log.bak
12 drw- - Nov 12 2016 18:12:33 default-sdb
13 -rw- 793 Jun 20 2015 08:05:59 default_local.cer
14 -rw- 1,775 Nov 11 2016 14:39:00
default_local_privkey.pem
15 drw- - Jul 30 2016 12:43:59 dhcp
16 -rw- 12,606,028 Nov 11 2016 14:17:12
FitAP4X30XN_V200R007C10SPC100.bin
17 -rw- 11,707,428 Oct 26 2015 19:58:48

n
FitAP6X10XN_V200R006C10SPC100.bin
18 -rw- 1,575 Jun 20 2015 08:06:29
LICQPZQ6F614HF_210235681310F6000040.dat
/ e
om
19 -rw- 1,253 Nov 11 2016 14:37:26 local.cer

c
20 drw- - Nov 11 2016 19:36:33 localuser
21 drw-
22 drw-
- Oct 11 2016 18:22:34
- Jan 01 2013 09:49:36
logfile
lost+found
e i .
23 -rw- 59,025 Nov 12 2016 18:13:15
w
mon_file.txt

a
hu
24 drw- - Nov 12 2016 18:13:14 pmdata
25 -rw- 855 Aug 23 2016 15:24:27 private-data.txt
26 -rw- 1,260 Nov 11 2016 19:38:25
g .
rsa_host_key.efs

in
27 -rw- 540 Nov 11 2016 19:38:25 rsa_server_key.efs

n
28 -rw- 1,807,526 Oct 21 2015 22:54:16 sacrule.dat
29 drw- - Jun 20 2015 07:32:17
r security

lea
30 drw- - Nov 11 2016 14:36:45 update

//
31 -rw- 1,395 Nov 11 2016 15:08:22 vrpcfg.zip

p :
t
1,882,652 KB total (1,531,204 KB free)

t
Step2 Configuring FTP Service on AC
: h
[AC1]ftp server enable
es
[AC1]aaa
r c
ou
[AC1-aaa]local-user ftp password irreversible-cipher Huawei@123 ftp-
directory sdcard:/

es
[AC1-aaa]local-user ftp service-type ftp

R
[AC1-aaa]local-user ftp privilege level 15

g
Warning: This operation may affect online users, are you sure to change

n
the user privilege level ?[Y/N]y

n i
Step3 Backup the Configuration to PC
ar
Le
D:\>ftp 192.168.100.200
connect 192.168.100.200。

r e 220 FTP service ready.

o User(192.168.100.200:(none)): ftp

M 331 Password required for ftp.

password:ftp001
230 User logged in.
ftp> get acvrpcfg.zip
200 Port command okay.
150 Opening ASCII mode data connection for acvrpcfg.zip.
226 Transfer complete.
ftp: 1373 bytes received in 0.00Seconds 1373000.00Kbytes/sec.
ftp>

华为专有和保密信息 105
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Then the configuration file is backuped in the PC, find the file in D:/ and then can opent it
by notepad or wordpad.

e n
/
. c om
e i
a w
. hu
in g
r n
//lea
p :
t t
Step4 Reset the Configuration
: h
es
After your practice finished, We need to reset the configuration of the devices before the

c
practice, so as to avoid the impacting to the practice, please following below procedures
r
u
to reset the configuration and reboot the device.

o
s
<AC1>reset saved-configuration

R e
This will delete the configuration in the flash memory.
The device configurations will be erased to reconfigure.

n g
Are you sure? (y/n)[n]:y

i
n
ar
#

e
<AC1>reboot

e L Info: The system is comparing the configuration, please wait......

or
Warning: All the configuration will be saved to the next startup
configuration. Continue ? [y/n]:n

M
System will reboot! Continue ? [y/n]:y

6.3 Verification

6.3.1 Checking the Device Configuration

It required set a new password When you login the device after reboot.

华为专有和保密信息 106
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

Please configure the login password:

Info: A plain text password is a string of 8 to 16 case-sensitive
characters and must be a combination of at least two of the following:
uppercase letters A to Z, lowercase letters a to z, digits, and special
characters. A cipher text password contains 68 characters.
Enter password:
Confirm password:

Only the default configuration exist.

<AC6005>display current-configuration
#
http secure-server ssl-policy default_policy
e n
http server enable
/
om
#

c
ssl renegotiation-rate 1
#
authentication-profile name default_authen_profile
e i .
authentication-profile name dot1x_authen_profile

a w
hu
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile
g .
in
#

n
diffserv domain default
#
r
lea
radius-server template default

//
#
pki realm default

p :
rsa local-key-pair default

t t
h
enrollment self-signed
#

s :
ssl policy default_policy type server
pki-realm default

r c e
u
version tls1.0 tls1.1 tls1.2

o
ciphersuite rsa_aes_128_cbc_sha
#

es
R
ike proposal default
encryption-algorithm aes-256

n g
dh group2

i
n
authentication-algorithm sha2-256

ar
authentication-method pre-share

e
integrity-algorithm hmac-sha2-256

e L #
prf hmac-sha2-256

or
free-rule-template name default_free_rule
#

M portal-access-profile name portal_access_profile

#
aaa
authentication-scheme default
authentication-scheme radius
authentication-mode radius
authorization-scheme default
accounting-scheme default
domain default
authentication-scheme default

华为专有和保密信息 107
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

domain default_admin
authentication-scheme default
local-user admin password irreversible-
cipher %^%#M`4JPQpOV5o%dg<#chz:0uQcV}F#{FY6"T-
UeF>YO[l0C!OPI-!:hyJLvcXC%^%#
local-user admin privilege level 15
local-user admin service-type ssh http
#
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
#

e n
/
interface GigabitEthernet0/0/1
#

om
interface GigabitEthernet0/0/2
#

i . c
e
interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/4
a w
hu
#

.
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
in g
#
r n
lea
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
: //
p
#
interface NULL0
t t
#

: h
s
undo snmp-agent
#

r
stelnet server enable
c e
u
undo telnet server enable

o
s
undo telnet ipv6 server enable

R e
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server secure-algorithms hmac sha2_256

i n g
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr

nssh client secure-algorithms hmac sha2_256

ar
ssh client key-exchange dh_group14_sha1

L e #
user-interface con 0

e
or
authentication-mode password
set authentication password
cipher %^%#h'O5Y|4b&.=,loK4{<@Qo0h6R~Q>oT[2{<X+y^:,Sg*tSthkTO("UiYv~tN<

M %^%#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
user-interface vty 16 20
protocol inbound all
#
wlan
traffic-profile name default
security-profile name default

华为专有和保密信息 108
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

security-profile name default-wds

security wpa2 psk pass-
phrase %^%#qNfI(V#y8:b/W|/(mY81#Z\D8~!8Y*#IO1RwV);+%^%# aes
security-profile name default-mesh
security wpa2 psk pass-phrase %^%#o[7"I"t]\4xd-
e7_BV:3&kdR~nCGO!El4DSuB>~E%^%# aes
ssid-profile name default
vap-profile name default
mesh-handover-profile name default
mesh-profile name default
wds-profile name default

e n
/
regulatory-domain-profile name default
air-scan-profile name default

om
rrm-profile name default
radio-2g-profile name default

i . c
e
radio-5g-profile name default
wids-spoof-profile name default
wids-profile name default
a w
hu
ap-system-profile name default

.
port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
in g
ap-group name default
r n
lea
provision-ap
#

: //
dot1x-access-profile name dot1x_access_profile

p
#

t t
mac-access-profile name mac_access_profile
#

: h
s
undo ntp-service enable
#
return
r c e
ou
es
R
6.4 Reference Configuration
i n g
rn
6.4.1 Key Configuration
a
L e [AC1]ftp server enable

r e [AC1]aaa
[AC1-aaa]local-user ftp password irreversible-cipher Huawei@123 ftp-
o directory sdcard:/

M [AC1-aaa]local-user ftp service-type ftp

[AC1-aaa]local-user ftp privilege level 15
Warning: This operation may affect online users, are you sure to change
the user privilege level ?[Y/N]y

华为专有和保密信息 109
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

7 Appendix

7.1 Configuration of Core Switch e n

/
#

. com
i
sysname S5700
#
vlan batch 10 to 13 20 to 23 30 to 33 40 to 43 50 to 53 60 to 63 200
we
801 to 806
a
hu
#
undo http server enable
undo http secure-server enable
g .
#

n in
aaa
r
lea
authentication-scheme default

//
authorization-scheme default
accounting-scheme default
domain default
p :
domain default_admin
t t
h
local-user admin password cipher %@%@5d~9:M^ipCfL\iB)EQd>3Uwe%@%@

:
#
es
local-user admin service-type http

interface Vlanif1
r c
#

ou
es
interface Vlanif10
ip address 10.1.10.1 255.255.255.0
#
R
i n g
interface Vlanif11
ip address 10.1.11.1 255.255.255.0

n
ar
#
interface Vlanif12

L e #
ip address 10.1.12.1 255.255.255.0

e
or
interface Vlanif13
ip address 10.1.13.1 255.255.255.0

M #
interface Vlanif20
ip address 10.1.20.1 255.255.255.0
#
interface Vlanif21
ip address 10.1.21.1 255.255.255.0
#
interface Vlanif22
ip address 10.1.22.1 255.255.255.0
#
interface Vlanif23

华为专有和保密信息 110
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

ip address 10.1.23.1 255.255.255.0

#
interface Vlanif30
ip address 10.1.30.1 255.255.255.0
#
interface Vlanif31
ip address 10.1.31.1 255.255.255.0
#
interface Vlanif32
ip address 10.1.32.1 255.255.255.0
#

e n
interface Vlanif33
/
om
ip address 10.1.33.1 255.255.255.0
#
interface Vlanif40
i . c
#
ip address 10.1.40.1 255.255.255.0

we
interface Vlanif41
a
hu
ip address 10.1.41.1 255.255.255.0
#
interface Vlanif42
g .
ip address 10.1.42.1 255.255.255.0

n in
#
r
lea
interface Vlanif43

//
ip address 10.1.43.1 255.255.255.0
#

p :
t
interface Vlanif50

#
h t
ip address 10.1.50.1 255.255.255.0

interface Vlanif51
s :
#
c e
ip address 10.1.51.1 255.255.255.0

r
u
interface Vlanif52

o
#
es
ip address 10.1.52.1 255.255.255.0

R
interface Vlanif53

#
i n g
ip address 10.1.53.1 255.255.255.0

n
ar
interface Vlanif60
ip address 10.1.60.1 255.255.255.0

L e #
interface Vlanif61
e
or
ip address 10.1.61.1 255.255.255.0
#

M interface Vlanif62

#
ip address 10.1.62.1 255.255.255.0

interface Vlanif63
ip address 10.1.63.1 255.255.255.0
#
interface Vlanif200
ip address 10.254.1.1 255.255.255.0
#
interface Vlanif801
ip address 10.1.201.1 255.255.255.0

华为专有和保密信息 111
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

#
interface Vlanif802
ip address 10.1.202.1 255.255.255.0
#
interface Vlanif803
ip address 10.1.203.1 255.255.255.0
#
interface Vlanif804
ip address 10.1.204.1 255.255.255.0
#
interface Vlanif805

e n
ip address 10.1.205.1 255.255.255.0
/
om
#
interface Vlanif806
ip address 10.1.206.1 255.255.255.0
i . c
#
interface MEth0/0/1
we
#
a
hu
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 13 801
g .
#

n in
interface GigabitEthernet0/0/2
r
lea
port link-type trunk

//
port trunk allow-pass vlan 20 to 23 802
#

p :
t
interface GigabitEthernet0/0/3
port link-type trunk

h t
port trunk allow-pass vlan 30 to 33 803
#
s :
c e
interface GigabitEthernet0/0/4

r
port link-type trunk

ou
port trunk allow-pass vlan 40 to 43 804
#

es
interface GigabitEthernet0/0/5

R
port link-type trunk

ing
port trunk allow-pass vlan 50 to 53 805
#

rn
interface GigabitEthernet0/0/6

e a port link-type trunk

L
port trunk allow-pass vlan 60 to 63 806
#

r e interface GigabitEthernet0/0/7

o #

M interface GigabitEthernet0/0/8
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/11
port link-type trunk

华为专有和保密信息 112
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

port trunk pvid vlan 10

port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/12
port link-type trunk
port trunk pvid vlan 20
port trunk allow-pass vlan 20 to 23
#
interface GigabitEthernet0/0/13
port link-type trunk
port trunk pvid vlan 20

e n
port trunk allow-pass vlan 20 to 23
/
om
#
interface GigabitEthernet0/0/14
port link-type trunk
i . c
port trunk pvid vlan 30
port trunk allow-pass vlan 30 to 33
we
#
a
hu
interface GigabitEthernet0/0/15
port link-type trunk
port trunk pvid vlan 30
g .
port trunk allow-pass vlan 30 to 33

n in
#
r
lea
interface GigabitEthernet0/0/16

//
port link-type trunk
port trunk pvid vlan 40

p :
t
port trunk allow-pass vlan 40 to 43
#
interface GigabitEthernet0/0/17
h t
port link-type trunk
s :
r c
port trunk pvid vlan 40
e
port trunk allow-pass vlan 40 to 43
#

ou
es
interface GigabitEthernet0/0/18
port link-type trunk

R
port trunk pvid vlan 50

ing
port trunk allow-pass vlan 50 to 53
#

rn
interface GigabitEthernet0/0/19

e a port link-type trunk

eL
port trunk pvid vlan 50
port trunk allow-pass vlan 50 to 53

or
#
interface GigabitEthernet0/0/20

M port link-type trunk

port trunk pvid vlan 60
port trunk allow-pass vlan 60 to 63
#
interface GigabitEthernet0/0/21
port link-type trunk
port trunk pvid vlan 60
port trunk allow-pass vlan 60 to 63
#
interface GigabitEthernet0/0/22
#

华为专有和保密信息 113
版权所有 © 华为技术有限公司
 Huawei WLAN Certification Training Experiment Guide

interface GigabitEthernet0/0/23
port link-type access
port default vlan 200
#
interface GigabitEthernet0/0/24
port link-type access
port default vlan 200
#
interface NULL0
#
interface LoopBack1

e n
ip address 101.101.101.101 255.255.255.255
/
om
#
interface LoopBack2
ip address 102.102.102.102 255.255.255.255
i . c
#
interface LoopBack3
we
ip address 103.103.103.103 255.255.255.255
a
hu
#
interface LoopBack4
ip address 104.104.104.104 255.255.255.255
g .
#

n in
interface LoopBack5
r
lea
ip address 105.105.105.105 255.255.255.255

//
#
interface LoopBack6

p :
t
ip address 106.106.106.106 255.255.255.255
#
user-interface con 0
h t
s :
authentication-mode password

c e
set authentication password

r
cipher %@%@;($MM!"!U<_DW.Z.H!4L,$49.>!z*#!\EX>M5e+/7j&#$4<,%@%@

u
user-interface vty 0 4

o
s
user-interface vty 16 20
#
return
R e
i n g
n
e ar
e L
or
M

华为专有和保密信息 114
版权所有 © 华为技术有限公司