HCNA-WLAN Experiment Guide (CLI-based) V2.0 PDF

The privilege of HCNA/HCNP/HCIE:
With any Huawei Career Certification, you have the privilege on http://learning.huawei.com/en to enjoy:
n
 1、e-Learning Courses： Logon http://learning.huawei.com/en and enter Huawei Training/e-Learning
/e

o m
If you have the HCNA/HCNP certificate：You can access Huawei Career Certification and Basic Technology e-Learning
courses.
e i .c
If you have the HCIE certificate: You can access all the e-Learning courses which marked for HCIE Certification Users.
aw

Methods to get the HCIE e-Learning privilege : Please associate HCIE certificate information with your Huawei account, and
hu

email the account to Learning@huawei.com to apply for HCIE e-Learning privilege.

g .
 2、 Training Material Download
i n

arn
Content: Huawei product training material and Huawei career certification training material.

//le
Method：Logon http://learning.huawei.com/en and enter Huawei Training/Classroom Training ,then you can download
training material in the specific training introduction page.
p :
 3、 Priority to participate in Huawei Online Open Class (LVC)
t t

s :h
The Huawei career certification training and product training covering all ICT technical domains like R&S, UC&C, Security,
4、Learning Tools: rc e
Storage and so on, which are conducted by Huawei professional instructors.
u

s o
eNSP ：Simulate single Router&Switch device and large network.

R e
WLAN Planner ：Network planning tools for WLAN AP products.

n g
In addition, Huawei has built up Huawei Technical Forum which allows candidates to discuss technical issues with Huawei experts ,
ni
share exam experiences with others or be acquainted with Huawei Products.
a r
 Statement:
L e
r e
This material is for personal use only, and can not be used by any individual or organization for any commercial purposes.
o
M
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential 1
Huawei WLAN Certification Training
HCNA-WALN
Experiment Guide for WLAN /en
o m
Engineers i . c
e w
u a
ISSUE:2.0 g.h
i n
arn
//le
p :
t t
s:h
r c e
sou
Re
i n g
n
e ar
e L
or
M HUAWEI TECHNOLOGIES CO., LTD.
1
Huawei WLAN Certification Training Experiment Guide
Copyright © Huawei Technologies Co., Ltd. 2017. All rights reserved.

No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions
n
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
/
All other trademarks and trade names mentioned in this document are the property of their respective
e
m
holders.
o
Notice
e i.c
w
The purchased products, services and features are stipulated by the contract made between Huawei and
u a
the customer. All or part of the products, services and features described in this document may not be
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,
or representations of any kind, either express or implied.

g .h
information, and recommendations in this document are provided "AS IS" without warranties, guarantees
i n
rn
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
le a
recommendations in this document do not constitute a warranty of any kind, express or implied.
: //
t t p
s :h
r c e
s ou
e
RHuawei Technologies Co., Ltd.
i n g
n
ar
Address: Huawei Industrial Base
L e Bantian, Longgang
Shenzhen 518129
e
or
People's Republic of China
M
Website: http://e.huawei.com
华为专有和保密信息
版权所有 © 华为技术有限公司
Huawei Certificate System

Relying on the strong technical strength and professional training system, Huawei provides
a practical and professional four-level certificate system to meet various customer requirements
on different WLAN technologies.
Huawei Certified Network Associate-Wireless Local Area Network (HCNA-WLAN) is
designed for Huawei local offices, online engineers in representative offices, and readers who
want to understand Huawei WLAN products and technology. HCNA-WLAN covers WLAN
basics, Control and Provisioning of Wireless Access Points (CAPWAP) protocol, WLAN
e n
networking, Huawei WLAN product features, security configuration, WLAN advanced /
technology, antennas, WLAN network planning and optimization, and WLAN fault
o m
troubleshooting.
ei.c
w
The HCNA-WLAN certificate system introduces you to the industry and market, helps you in
a
innovation, and enables you to stand atop the WLAN frontiers.
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
华为专有和保密信息 1
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
About This Document
Overview
This document is applicable to the candidates who are preparing for the HCNA-WLAN
e n
exam and the readers who want to understand the WLAN basics, the CAPWAP protocol,
/
WLAN networking, Huawei WLAN product features, security configuration, WLAN
advanced technology, antennas, WLAN network planning and optimization, and WLAN
o m
i.c
fault troubleshooting.
w e
Description u a
g .h
i n
This experiment guide introduces the following six experiments, covering basic
n
configurations, and configurations and implementation of Layer 2 networking, security,
r
lea
Layer 3 networking, and the network management software eSight.
//
 Experiment 1: AC configuration initialization
p :
This experiment involves basis operations and configurations on an AC, helping you
t t
know the AC6005 and its basic functions.
:h
 Experiment 2: AP authentication and WLAN configuration process
s
This experiment lets you know basic WLAN network capabilities through basic WLAN
e
c
configurations.
r
ou
 Experiment 3: WLAN security configuration
s
This experiment mainly introduces 802.1x authentication, helping you know WLAN

Re
security and the configuration process.
Experiment 4: WLAN configuration on eSight
i n g
This experiment involves how to add WLAN devices to the eSight and deliver WLAN
n
services using the configuration wizard.
ar
 Experiment 5: Bypass Layer 3 networking
L e This experiment uses the AC6005 and Layer 3 networking. The Layer 3 network
e
configuration helps you comprehensively know WLAN networking modes.
or
 Experiment 6: Configuration file backup and AC configuration clearance
M
This experiment describes how to back up configuration files through File Transfer
Protocol (FTP).
Background Knowledge Required

 The intended audience should know basic WLAN knowledge, Huawei switching
devices, and basic datacom knowledge.
Common Icons
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
Experiment Environment Overview

Networking Introduction
This experiment environment is prepared for WLAN engineers who are preparing for the
HCNA-WLAN exam.
Each suite of experiment environment includes 2-6 ACs, 2-12 APs, 1 core switch, and 1
Remote Authentication Dial In User Service (RADIUS) or eSight server. Each suite of
e n
/
experiment environment is applicable to 4 to 12 candidates.
Device Introduction
o m
e
he following table lists devices recommended for HCNA-WLAN experiments and the i.c
w
mappings between the device name, model, and software version.
Device name Model

u a
Software Version
S3700-28TP-PWR-EI or
g .h
Version 5.70 (S3700 V100R005C01SPC100)
Core Switch
S5700-28C-PWR-EI
i n
Version 5.130 (S5700 V200R003C00SPC300)
n
r
lea
AC AC6005-8-PWR AC6005 V200R007C10SPC100
//
AP AP4030DN AP4030DN V200R007C10SPC100
NMS eSight Network
p :
t
eSight Network V300R006C00SPC505
t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
Experiment Environment Preparation

Checking Whether All Devices Are Available
Before starting the experiment, check whether all required devices are ready. The
following table lists the required devices.
Device Quantity Remarks
e n
eSight 1 Shared by all groups
/
o m
i.c
Radius Server 1 Shared by all groups
Huawei 3700PoE/
w e
a
1 Shared by all groups
u
Huawei 5700PoE Switch
AC6005
One for each
g .h
group
ni n
r
lea
Two for each
AP4030DN
group
: //
Laptop or desktop computer
t t
group p
One for each A desktop computer requires a
network adapter
:h
es
Four for each The twisted pair must be at least
Twisted pair
c
group 2 meters long
r
s
Console cable
ou One for each
group
Re
i n g
Each group must check whether the following devices are ready:
n
ar
 One AC6005
Le  Two AP4030DN
re
 One laptop or desktop computer
o  Four twisted pairs

M  One console cable
Experiment topology
e n
/
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
Key points of bypass topology establishment:
c e
This course uses a layer 3 bypass topology. Devices are connected as follows:
r
ou
For group 1, port 8 of AC1 is connected to port 1 of the switch. AP1 is connected to port
s
10 of the switch. AP2 is connected to port 11 of the switch.
e
R
i n g
n
ar
Le
The same rule applies to all other groups.
re
For group 6, port 8 of AC6 is connected to port 6 of the switch. AP11 is connected to
o port 20 of the switch. AP12 is connected to port 21 of the switch.
Login
Use a console cable to connect the PC to the device, run a terminal emulation program on
the PC (such as a HyperTerminal running the Windows OS), and log in to the device
through the COM port.
AC Configuration Removal
Trainees must remove previously saved configurations after the experiment is complete
n
and before devices are turned off, to avoid any impact of the configurations on the next
e
/
experiment. In addition, trainees must confirm that the device is not configured before an
experiment starts. If it is not, remove the configurations and then restart the device.
o m
i.c
You need a password to log in to the router. The login password is Admin@123 in this
experiment.
Login authentication
w e
a
Password:Admin@123
u
<AC6005>reset saved-configuration
.h
This will delete the configuration in the flash memory.
The device configurations will be erased to reconfigure.
Are you sure? (y/n)[n]:y
i n g
Clear the configuration in the device successfully.
r n
lea
To restart the controller, run the following command:
//
<AC6005>reboot
:
Info: The system is comparing the configuration, please wait.
p
configuration.
t t
Warning: All the configuration will be saved to the next startup
:h
Continue ? [y/n]:n
s
System will reboot! Continue ? [y/n]:y
e
c
Info: system is rebooting ,please wait...
r
ou
After the controller is restarted, carry out experiments.
es
R
i n g
n
e ar
e L
or
M
Contents
About This Document ..................................................................................................................... 3

Overview ..............................................................................................................................................................3
n
Description ...........................................................................................................................................................3
e
/
Background Knowledge Required .........................................................................................................................4
m
Common Icons .....................................................................................................................................................4
o
i . c 12
Experiment Environment Preparation .....................................................................................................................6
e
1 Experiment 1:AC configuration initialization .......................................................................
w
a
1.1 About This Course .........................................................................................................................................12
hu
1.1.1 Objectives ..................................................................................................................................................12
g .
1.1.2 Topology ....................................................................................................................................................12
i n
1.1.3 Plan ...........................................................................................................................................................13
n
r
1.2 Experiment Task ............................................................................................................................................14
a
e
1.2.1 Configuration Procedure .............................................................................................................................14
l
//
1.3 Verification ...................................................................................................................................................17
:
tp
1.3.1 Telnet AC ...................................................................................................................................................17
h t
1.4 Reference Configuration ................................................................................................................................18
s :
1.4.1 S5700 Configuration ..................................................................................................................................18
e
cand WLAN Configuration Roadmap .................... 24
1.4.2 AC Configuration ........................................................................................................................................20
r
u
2 Experiment 2: AP Authentication
o
s
e
R
2.1.1 Objectives ..................................................................................................................................................24
i n g
2.1.2 Topology ....................................................................................................................................................24
2.1.3 Plan ...........................................................................................................................................................25
a rn
2.2 Experiment Task ............................................................................................................................................27
L e
e
2.3 Verification ...................................................................................................................................................30
r
o
2.3.1 Checking the VAP Status .............................................................................................................................30
M2.3.2 Terminal Connection Test ............................................................................................................................31

2.4.1 S5700 Configuration ..................................................................................................................................32
3 Experiment 3: WLAN Security Configuration....................................................................... 39

3.1.1 Objectives ..................................................................................................................................................39
3.1.2 Topology ....................................................................................................................................................39
3.1.3 Plan ...........................................................................................................................................................40

3.2 Experiment Task ............................................................................................................................................41
3.3 Verification ...................................................................................................................................................50
3.3.1 Connect an STA to the WLAN .....................................................................................................................50
3.3.2 Checking the Users Status ...........................................................................................................................51
n
3.4.1 S5700 Configuration ..................................................................................................................................54
/ e
o m
4 Experiment 4: eSight WLAN Management ............................................................................ 62
i . c
e
4.1.1 Objectives ..................................................................................................................................................62
w
a
4.1.2 Topology ....................................................................................................................................................62
hu
4.1.3 Plan ...........................................................................................................................................................63
g .
4.2 Experiment Task ............................................................................................................................................64
i n
n
r
4.3 Verification ...................................................................................................................................................81
a
l e
4.3.1 Connect an STA to the WLAN .....................................................................................................................81
: //
tp
4.4.1 S5700 Configuration ..................................................................................................................................82
t
h .................................................................... 91
:
s
5 Experiment 5: Layer 3 Networking Experiment
e
r c
u
5.1.1 Objectives ..................................................................................................................................................91
o
s
5.1.2 Topology ....................................................................................................................................................91
e
R
5.1.3 Plan ...........................................................................................................................................................92
i n g
5.2 Experiment Task ............................................................................................................................................93
rn
a
5.3 Verification ...................................................................................................................................................94
e
e L
5.3.1 Verifiy the L3 Network Status ......................................................................................................................94
o r
5.4.1 S5700 Configuration ..................................................................................................................................95
M6 Experiment 6: Backup the Configuration and Reset the Device...................................... 103

6.1 About This Course .......................................................................................................................................103

6.1.1 Objectives ................................................................................................................................................103
6.1.2 Plan .........................................................................................................................................................103
6.2 Experiment Task ..........................................................................................................................................104
6.2.1 Configuration Procedure ...........................................................................................................................104
6.3 Verification .................................................................................................................................................106
6.3.1 Checking the Device Configuration ...........................................................................................................106

6.4 Reference Configuration ..............................................................................................................................109
6.4.1 Key Configuration .....................................................................................................................................109
7 Appendix .................................................................................................................................... 110

7.1 Configuration of Core Switch.......................................................................................................................110
e n
/
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
1 Experiment 1:AC configuration initialization
1.1 About This Course e n

/
o m
1.1.1 Objectives
ei.c
 Configure the initialization password
aw
 Configure VLAN and routing in the AC
u
 Configure telnet service of the AC
g .h
Save the configuration in the AC
n

ni
1.1.2 Topology r
//lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
1.1.3 Plan
You must configure devices according to the plan to avoid errors. This experiment uses
group 1 as an example to illustrate rules for configuring the device name, VLAN, and
Trunk.
The following table describes device connections.
Group
No
AC-Switch Port AP-Switch Port
e n
/
1 AC1—G0/0/1
 AP1-G0/0/10
o m
i.c
 AP2-G0/0/11
 AP3-G0/0/12
w e
2 AC2—G0/0/2
 AP4-G0/0/13
u a
 AP5-G0/0/14
g .h
3 AC3—G0/0/3
 AP6-G0/0/15
ni n
r
lea
 AP7-G0/0/15
//
4 AC4—G0/0/4
AP8-G0/0/16
:


t t p
AP9-G0/0/17
:h
5 AC5—G0/0/5
 AP10-G0/0/18
e s
6 AC6—G0/0/6
r c  AP11-G0/0/19
ou
 AP12-G0/0/20
es
R
The following table describes an AC parameter configuration template.
i n g
Trainee GroupX AC Configuration
n
e ar
Console Password Admin@123
e L Device ACX
or
AP Management
VLAN：X0 IP：10.1.X0.100
VLAN
M Service VLAN
(Employee)
VLAN：X1 IP：10.1.X1.100
Service VLAN (Voice) VLAN：X2 IP：10.1.X2.100
Service VLAN (Guest) VLAN：X3 IP：10.1.X3.100
AC Port Connecting GE0/0/8 VLANs X0 through X3 can pass the

to the Switch trunk interface
Topology: layer2 and layer 3 bypass topology
1.2 Experiment Task
1.2.1 Configuration Procedure
e n
Step1 Configuring Initialization Password
/
The Software Version of AC6005 is V2R7, You need a password
o m
i.c
to log in to the AC at first time. The login password is
Admin@123 in this experiment.
Please configure the login password (maximum length 16)
w e
a
Enter password:Admin@123
u
Confirm password:Admin@123
.h
<AC6005>
Step2 Configuring a Switch

i n g
r n
Configure the access switch S5700. Add GE0/0/10 and GE0/0/11 to VLANX0
lea
(management VLAN) and set the port VLAN ID (PVID) to VLANX0. Add GE0/0/8 to VLANs
X0 through X3(Connect to AC).
<Huawei>system-view
: //
[Huawei]sysname S5700
[S5700]vlan batch 10 to 13
t t p
:h
[S5700]interface GigabitEthernet0/0/10
s
[S5700-GigabitEthernet0/0/10]port link-type trunk
e
c
[S5700-GigabitEthernet0/0/10]port trunk pvid vlan 10
r
[S5700-GigabitEthernet0/0/10]port trunk allow-pass vlan 10 to 13
ou
[S5700-GigabitEthernet0/0/10]quit
es
[S5700]interface GigabitEthernet0/0/11
R
[S5700-GigabitEthernet0/0/11]port trunk pvid vlan 10
i n g
[S5700-GigabitEthernet0/0/11]port trunk allow-pass vlan 10 to 13
n
ar
[S5700]interface GigabitEthernet 0/0/1
L e [S5700-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 to 13
e
or Create a LoopbackX interface, and set its IP address to 10X.10X.10X.10X to simulate a

public network interface. Create VLANIF interfaces to function as gateways of service
M VLANs.
[S5700]interface LoopBack 1
[S5700- LoopBack1]ip address 101.101.101.101 32
[S5700- LoopBack1]quit
[S5700]interface Vlanif 10
[S5700-Vlanif10]ip address 10.1.10.1 24
[S5700-Vlanif10]quit
Step3 Configuring Basic AC Parameters

<AC6005>system-view
[AC6005]sysname AC1
e n
Create VLANs X0 through X3.
/
[AC1]vlan batch 10 to 13
o m
i.c
Configure GE0/0/8 to connect to the S5700.
[AC1]interface g0/0/8
[AC1-GigabitEthernet0/0/8]port link-type trunk
w e
[AC1-GigabitEthernet0/0/8]port trunk allow-pass vlan 10 to 13
[AC1-GigabitEthernet0/0/8]quit
u a
g .h
After the configuration is complete, run the display port vlan command to check whether
the configuration is correct.
ni n
r
[AC1]display port vlan
lea
Port Link Type PVID Trunk VLAN List
-------------------------------------------------------------------------
GigabitEthernet0/0/1 hybrid 1
: //
-
GigabitEthernet0/0/2
hybrid
hybrid
t t
1
1 p -
-
:h
GigabitEthernet0/0/4 hybrid 1 -
s
GigabitEthernet0/0/5 hybrid 1 -
r
c e hybrid
access
1
4090 -
-
ou
GigabitEthernet0/0/8 trunk 1 1 10-13
s
Configure the IP address of the layer 3 interface corresponding to the VLAN.
e
R
[AC1]interface vlan 10
g
[AC1-Vlanif10]ip address 10.1.10.100 24
n i n
[AC1-Vlanif10]quit
ar
L e [AC1-Vlanif11]quit
e
or
[AC1-Vlanif12]quit
[AC1]interface Vlanif 13
M [AC1-Vlanif13]ip address
[AC1-Vlanif13]quit
10.1.13.100 24
Check whether the interface status is up.

[AC1]display ip interface brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down
The number of interface that is UP in Physical is 7

The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 7
The number of interface that is DOWN in Protocol is 0
Interface IP Address/Mask Physical Protocol

NULL0 unassigned up up(s)
Vlanif1 169.254.1.1/16 up up
Vlanif10 10.1.10.100/24 up up
Vlanif11 10.1.11.100/24 up up
Vlanif12 10.1.12.100/24 up up
e n
Vlanif13 10.1.13.100/24 up up
/
Vlanif4090 172.21.11.3/16 up up
o m
i.c
Check whether the route between the AC and the layer 3 switch is reachable. The
following command output indicates that 10X.10X.10X.10X (the simulated public
network interface on the switch) cannot be pinged.
w e
[AC1]ping 101.101.101.101
PING 101.101.101.101: 56 data bytes, press CTRL_C to break
u a
Request time out
Request time out
g .h
Request time out
ni n
r
Request time out
lea
Request time out
--- 101.101.101.101 ping statistics ---

: //
5 packet(s) transmitted
0 packet(s) received
t t p
:h
100.00% packet loss
s
Configure a static route for the switch.
e
r c
[AC1]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
ou
IP address 10X.10X.10X.10X can be pinged.
es
[AC1]ping 101.101.101.101
R
ing
Reply from 101.101.101.101: bytes=56 Sequence=1 ttl=254 time=1 ms
rn
a
L e Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=254 time=1 ms
r e --- 101.101.101.101 ping statistics ---
o 5 packet(s) transmitted
M
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
Step4 Configuring and Testing the Telnet/SSH Service (AAA Authentication)

Enable and configure telnet service in the AC, add account huawei for AAA
authentication.
[AC1]telnet server enable
Info: TELNET server has been enabled.
[AC1]aaa
[AC1-aaa] local-user huawei password irreversible-cipher Admin@123
[AC1-aaa] local-user huawei service-type telnet

[AC1-aaa] local-user huawei privilege level 3
Warning: This operation may affect online users, are you sure to change
the user privilege level ?[Y/N]y
[AC1-aaa]quit
[AC1]user-interface vty 0 4
[AC1-ui-vty0-4]authentication-mode aaa
Current Password: -------------------- Input Login password Admin@123
Step5 Save the Configuration

<AC1>save
e n
The current configuration will be written to the device.
/
Are you sure to continue? (y/n)[n]:y
o m
i.c
It will take several minutes to save configuration file, please
wait........
Configuration file has been saved successfully
Note: The configuration file will take effect after being activated
w e
u a
1.3 Verification g .h
ni n
r
1.3.1 Telnet AC
// lea
p :
After Configure telnet, test the telnet service on S5700。
t t
:h
<S5700>telnet 10.1.10.100
Trying 10.1.10.100 ...
Press CTRL+K to abort
e s
c
Connected to 10.1.10.100 ...
r
Warning: Telnet is not a secure protocol, and it is recommended to use
ou
Stelnet.
es
Login authentication
R
i n g
Username:huawei
n
ar
Password:
-----------------------------------------------------------------------
L e User last login information:
e
-----------------------------------------------------------------------
or
Access Type: Telnet
IP-Address : 172.21.5.155
M Time : 2016-11-11 19:50:02+08:00

-----------------------------------------------------------------------
<AC1>
Login AC successfully.
1.4 Reference Configuration
1.4.1 S5700 Configuration

#
sysname S5700
#
vlan batch 10 to 13
#
e n
lldp enable
/
#
o m
i.c
undo http server enable
undo http secure-server enable
#
undo nap slave enable
w e
#
u a
.h
aaa
g
authentication-scheme default
authorization-scheme default
accounting-scheme default
ni n
domain default
r
lea
domain default_admin
//
local-user admin password cipher %@%@5d~9:MîpCfL\iB)EQd>3Uwe%@%@
local-user admin service-type http
p :
#
t t
:h
interface Vlanif1
#
interface Vlanif10
e s
c
ip address 10.1.10.1 255.255.255.0
r
ou
#
interface Vlanif11
s
ip address 10.1.11.1 255.255.255.0
e
R
#
interface Vlanif12
n g
ip address 10.1.12.1 255.255.255.0
i
n
#
ar
interface Vlanif13
e
ip address 10.1.13.1 255.255.255.0
e L #
interface MEth0/0/1
or
ip address 172.21.11.1 255.255.0.0
#
M interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 to 13
#
interface GigabitEthernet0/0/2
#
#
#
#
#
#
#
#
e n
/
port trunk pvid vlan 10
o m
i.c
#
w e
u a
#
g .h
#
ni n
r
lea
#
//
#
p :
t
#
t
:h
#
e s
c
#
r
ou
#
es
#
R
#
i n g
n
ar
#
L e interface GigabitEthernet0/0/22
#
e
or
#
#
interface NULL0
#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
user-interface con 0
authentication-mode password
set authentication password
cipher %@%@;|J%=/[d[O@L[qD[Xhh~,3[~S(Zs:\Ot8H6*x_MAW=N$3[B,%@%@
user-interface vty 0 4
user privilege level 3
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@
protocol inbound all
#
return
1.4.2 AC Configuration
e n
/
#
o m
i.c
sysname AC1
#
http secure-server ssl-policy default_policy
http server enable
w e
#
u a
.h
undo portal url-encode enable
g
#
ssl renegotiation-rate 1
#
ni n
r
lea
vlan batch 10 to 13 4090
#
//
authentication-profile name default_authen_profile
:
authentication-profile name dot1x_authen_profile
p
t
authentication-profile name mac_authen_profile
t
:h
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile
#
e s
lldp enable
r c
ou
#
diffserv domain default
#
es
R
radius-server template default
g
#
n
pki realm default
n i
rsa local-key-pair default
ar
enrollment self-signed
e
#
e L ssl policy default_policy type server

pki-realm default
or
version tls1.0 tls1.1
ciphersuite rsa_aes_128_cbc_sha
M #
ike proposal default
encryption-algorithm aes-256
dh group2
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
#
aaa
authentication-scheme radius
authentication-mode radius
domain default
e n
/
local-user admin password irreversible-
o m
i.c
cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K%^
e
%#
local-user admin privilege level 15
local-user admin service-type ssh http
aw
local-user huawei password irreversible-cipher
u
.h
$1a$Rdtw.<{XxT$m[E}YnfM9<l9]\T7EhW67M~m$u/u6<PP~C$O&*bV$
g
local-user huawei privilege level 3
#
local-user huawei service-type telnet
ni n
r
lea
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
//
#
interface Vlanif10
p :
t t
ip address 10.1.10.100 255.255.255.0
:h
#
interface Vlanif11
e s
ip address 10.1.11.100 255.255.255.0
#
r c
ou
interface Vlanif12
ip address 10.1.12.100 255.255.255.0
#
es
R
interface Vlanif13
g
ip address 10.1.13.100 255.255.255.0
n
#
i n
interface Vlanif4090
ar
ip address 172.21.11.3 255.255.0.0
L e #
e
or
#
#
#
#
#
#
port link-type access
port default vlan 4090

stp disable
#
#
interface NULL0
#
undo snmp-agent
#
e n
stelnet server enable
/
undo telnet ipv6 server enable
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
o m
i.c
ssh server secure-algorithms hmac sha2_256
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
w e
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1
u a
#
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
g .h
#
ni n
r
lea
//
:
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"%^
p
%#
t t
:h
authentication-mode aaa
s
r c e
ou
s
#
wlan
Re
traffic-profile name default
i n g
security-profile name default
security-profile name default-wds
n security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
ar
qK%aTJ_0%^%# aes
L e security-profile name default-mesh

security wpa2 psk pass-phrase %^%#]7|J"`LHnEQ=,-
e GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
or
ssid-profile name default
vap-profile name default
M mesh-handover-profile name default

mesh-profile name default
wds-profile name default
regulatory-domain-profile name default
air-scan-profile name default
rrm-profile name default
radio-2g-profile name default
wids-spoof-profile name default
wids-profile name default
ap-system-profile name default

port-link-profile name default
wired-port-profile name default
serial-profile name preset-enjoyor-toeap
ap-group name default
provision-ap
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
#
e n
undo ntp-service enable
/
#
return
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
2 Experiment 2: AP Authentication and

WLAN Configuration Roadmap
e n
/
o m
2.1 About This Course
ei.c
2.1.1 Objectives aw
u
 Configure AP authentication
g .h
 Understand WLAN configuration profile
ni n
 Understand WLAN configuration roadmap
r
lea
 Configure open system authentication
2.1.2 Topology : //
t t p
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
2.1.3 Plan
Trunk.
Group
n
No.
/ e
1 AC1—G0/0/1
 AP1-G0/0/10
o m
i.c
 AP2-G0/0/11
 AP3-G0/0/12
w e
a
2 AC2—G0/0/2
AP4-G0/0/13
u

 AP5-G0/0/14
g .h
3 AC3—G0/0/3
 AP6-G0/0/15
ni n
r
lea
 AP7-G0/0/15
4 AC4—G0/0/4
AP8-G0/0/16
//

p :

t t
AP9-G0/0/17
:h
5 AC5—G0/0/5
 AP10-G0/0/18
e s
6 AC6—G0/0/6
r c  AP11-G0/0/19
ou
 AP12-G0/0/20
es
R
ing
Country code: CN
AC Information
n
ar
WLAN source: VLAN X0
Le
AP authentication mode: mac-auth
AP Authentication
o re AP MAC address
Name: ap-groupX
M VAP ID 1: VAP profile: guestX
regulatory domain profile: domainX
AP Group VAP ID 2: VAP profile: voiceX
VAP ID 3: VAP profile: employeeX
Name: employeeX SSID Profile: employeeX
SSID Profile
Name: voiceX SSID Profile: voiceX
Name: guestX SSID Profile: guestX

Name: employeeX
Forwarding mode: direct forwarding
Service VLAN: 11
Referenced profile: SSID profile employeeX
Name: voiceX
VAP Profile
Service VLAN: 12
e n
/
Referenced profile: SSID profile voiceX
Name: guestX
Forwarding mode: tunnel forwarding
o m
Service VLAN: 13
Referenced profile: SSID profile guestX ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
2.2 Experiment Task

Step1 Overall Procedure
e n
1. Configure the Enable layer 2 or layer 3 interconnection
/
m
access switch. between the AP and AC.
o
2. Create an AP
group. Create an AP group.
e i.c
aw
Configure the DHCP server function of the AC.
Create a regulatory domain profile.
u
.h
Configure the country code of the AC.
Configure AC Configure the authentication mode for the AP .
3. Configure the
g
management on Configure the AC source port (for establishing
AP going online.
fit APs.
n
a tunnel with the AP).
ni
r
lea
Configure the Configure the
security profile. SSID profile.
4/5. Configure Being
WLAN service
//
referred to
parameters.
p : Configure the
t
4. Configure the VAP profile.
t
VAP profile.
:h
Being referred to
e s
r c Bind the regulatory domain profile
and VAP profile to the AP group.
s ou 5. Bind the profile
e
to the AP group.
R
i n g
Continue the configuration from experiment 1, the configuration of the switch has
n
ar
been ready.
e
L
e
orStep4
Continue the configuration from experiment 1, the configuration of the switch has been
ready.
M Creating an AP Group
Create AP group ap-groupX.
[AC1]wlan
[AC1-wlan-view]ap-group name ap-group1
[AC1-wlan-ap-group- ap-group1]quit
Step5 Configuring AP Online Parameters

Enable DHCP on the AC. Assign IP addresses to the STA and AP, Configure the Option43
Parameters.
[AC1]dhcp enable
[AC1]ip pool ap
[AC1-ip-pool-ap]network 10.1.10.0 mask 24
[AC1-ip-pool-ap]gateway-list 10.1.10.1
[AC1-ip-pool-ap]option 43 sub-option 3 ascii 10.1.10.100
[AC1-ip-pool-ap]quit
[AC1]ip pool employee
[AC1-ip-pool- employee]network 10.1.11.0 mask 24
[AC1-ip-pool- employee]gateway-list 10.1.11.1
[AC1-ip-pool- employee]quit
[AC1]ip pool voice
e n
[AC1-ip-pool- voice]network 10.1.12.0 mask 24
/
[AC1-ip-pool- voice]gateway-list 10.1.12.1
[AC1-ip-pool- voice]quit
o m
i.c
[AC1]ip pool guest
[AC1-ip-pool- guest]network 10.1.13.0 mask 24
[AC1-ip-pool- guest]gateway-list 10.1.13.1
w e
[AC1-ip-pool- guest]quit
u a
.h
Enable DHCP over all VLANIF interfaces on the AC.
[AC1-Vlanif10]dhcp select global
i n g
[AC1-Vlanif10]quit
r n
lea
[AC1-Vlanif11]quit
: //
[AC1-Vlanif12]dhcp select
t t
global p
:h
[AC1-Vlanif12]quit
s
[AC1-Vlanif13]quit
r c e
ou
Configure regulatory domain profile domainX.
s
e
[AC1]wlan
R
[AC1-wlan-view]regulatory-domain-profile name domain1
g
[AC1-wlan-regulatory-domain-prof-domain1]country-code CN
n i n
[AC1-wlan-regulatory-domain-prof-domain1]quit
[AC1-wlan-view]quit
e ar Configure the AC source interface.
e L [AC1]capwap source interface vlanif 10
or
Configure AP authentication.
AP authentication has three modes. By default, MAC authentication is used. Manually add
M APs based on MAC addresses.

[AC1]wlan
[AC1-wlan-view]ap auth-mode mac-auth
Import the AP offline to the AC and add two APs to AP group ap-groupX. Name the two
APs AP1 and AP2.
[AC1-wlan-view]ap-mac 4cfa-cabe-eb60 ap-id 0
[AC1-wlan-ap-0]ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes,
it will clear channel, power and antenna gain configurations of the
radio, Whether to continue? [Y/N]:y
[AC1-wlan-ap-0]ap-name ap1
[AC1-wlan-ap-0]quit
[AC1-wlan-view]ap-mac 4cfa-cabf-d0c0 ap-id 1
[AC1-wlan-ap-1]ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes,
it will clear channel, power and antenna gain configurations of the
radio, Whether to continue? [Y/N]:y
[AC1-wlan-ap-1]ap-name ap2
After APs are added, their status will change from fault to config, and then to normal. If
the AP status does not change to normal several minutes after the AP is added, check the
configuration of VLAN, DHCP, and AP authentication.
e n
<AC1>display ap all
/
Info: This operation may take a few seconds. Please wait for a
o m
i.c
moment.done.
Total AP information:
nor : normal [2]
w
------------------------------------------------------------------------- e
ID MAC Name Group IP Type State STA Uptime
u a
.h
-------------------------------------------------------------------------
g
0 4cfa-cabe-eb60 ap1 ap-group1 10.1.10.253 AP4030DN nor 0 31S
n
1 4cfa-cabf-d0c0 ap2 ap-group1 10.1.10.254 AP4030DN nor 0 58S
ni
-------------------------------------------------------------------------
Total: 2
r
Step6 Configuring WLAN Service Parameters
// lea
Configure SSID Profile.
p :
t t
Create SSID profiles employeeX, voiceX and guestX, and set SSIDs to employeeX, voiceX
:h
and guestX, respectively.
[AC1]wlan
e s
[AC1-wlan-view]ssid-profile name employee1
r c
[AC1-wlan-ssid-prof-employee1]ssid employee1
ou
Warning: This action may cause service interruption. Continue?[Y/N]y
es
[AC1-wlan-ssid-prof-employee1]quit
[AC1-wlan-view]ssid-profile name voice1
R
[AC1-wlan-ssid-prof-employee1]ssid voice1
i n g
n
ar
[AC1-wlan-view]ssid-profile name guest1
[AC1-wlan-ssid-prof-employee1]ssid guest1
L e Warning: This action may cause service interruption. Continue?[Y/N]y

e
or Create VAP profiles employeeX, voiceX and guestX. Set the data forwarding mode for
employeeX and voiceX to direct forwarding, and that for guestX to tunnel forwarding.
M Configure the service VLAN and bind the profile to the SSID profile.
[AC1-wlan-view]vap-profile name employee1
[AC1-wlan-vap-prof-employee1]forward-mode direct-forward
[AC1-wlan-vap-prof-employee1]service-vlan vlan-id 11
[AC1-wlan-vap-prof-employee1]ssid-profile employee1
[AC1-wlan-vap-prof-employee1]quit
[AC1-wlan-view]vap-profile name voice1
[AC1-wlan-vap-prof-voice1]forward-mode direct-forward
[AC1-wlan-vap-prof-voice1]service-vlan vlan-id 12
[AC1-wlan-vap-prof-voice1]ssid-profile voice1
[AC1-wlan-vap-prof-voice1]quit
[AC1-wlan-view]vap-profile name guest1
[AC1-wlan-vap-prof-guest1]forward-mode tunnel
[AC1-wlan-vap-prof-guest1]service-vlan vlan-id 13
[AC1-wlan-vap-prof-guest1]ssid-profile guest1
[AC1-wlan-vap-prof-guest1]quit
Configure AP groups to use the regulatory domain profile and VAP profile. When AP
group ap-groupX uses VAP profile employeeX, set VAP ID to 1. When AP group ap-
groupX uses VAP profile voiceX, set VAP ID to 2. When AP group ap-groupX uses VAP
profile.
e n
profile guestX, set VAP ID to 3. Radios 0 and 1 on the AP use the configuration of the VAP
/
m
[AC1-wlan-view]ap-group name ap-group1
o
[AC1-wlan-ap-group-ap-group1]vap-profile employee1 wlan 1 radio all
i.c
[AC1-wlan-ap-group-ap-group1]vap-profile voice1 wlan 2 radio all
e
[AC1-wlan-ap-group-ap-group1]vap-profile guest1 wlan 3 radio all
w
[AC1-wlan-ap-group-ap-group1]regulatory-domain-profile domain1
[AC1-wlan-ap-group-ap-group1]quit
u a
g .h
2.3 Verification
ni n
r
2.3.1 Checking the VAP Status
// lea
p :
t
The AC automatically delivers WLAN service configurations to APs. After the service
t
:h
configuration is complete, run the display vap ssid guestX and display vap ssid employeeX
commands. If the value of Status in the command output is ON, the VAPs have been
created on AP radios.
e s
r c
[AC1]display vap ssid employee1
ou
Info: This operation may take a few seconds, please wait.
WID : WLAN ID
es
-------------------------------------------------------------------------
R
AP ID AP name RfID WID BSSID Status Auth type STA SSID
g
-------------------------------------------------------------------------
n
0
0i n ap1
ap1
0
1
1
1
4CFA-CABE-EB60 ON
4CFA-CABE-EB70 ON
Open
Open
0
0
employee1
employee1
ar
1 ap2 0 1 4CFA-CABF-D0C0 ON Open 0 employee1
L e 1 ap2 1 1 4CFA-CABF-D0D0 ON Open 0 employee1

-------------------------------------------------------------------------
e
or
Total: 4
[AC1]display vap ssid voice1
M
WID : WLAN ID
-------------------------------------------------------------------------
-------------------------------------------------------------------------
0 ap1 0 2 4CFA-CABE-EB61 ON Open 0 voice1
0 ap1 1 2 4CFA-CABE-EB71 ON Open 0 voice1
1 ap2 0 2 4CFA-CABF-D0C1 ON Open 0 voice1
1 ap2 1 2 4CFA-CABF-D0D1 ON Open 1 voice1
-------------------------------------------------------------------------
Total: 4
[AC1]display vap ssid guest1

WID : WLAN ID
-------------------------------------------------------------------------
-------------------------------------------------------------------------
--
0 ap1 0 3 4CFA-CABE-EB62 ON Open 0 guest1
0 ap1 1 3 4CFA-CABE-EB72 ON Open 0 guest1
1 ap2 0 3 4CFA-CABF-D0C2 ON Open 0 guest1
e n
1 ap2 1 3 4CFA-CABF-D0D2 ON Open 0 guest1
/
-------------------------------------------------------------------------
o m
i.c
Total: 4
2.3.2 Terminal Connection Test

w e
u a
.h
Connect STAs to the WLANs with SSIDs employeeX, voiceX and guestX. Run the display
g
station all commands on the AC. The command output shows that the STAs are
connected to the WLANs.
ni n
r
[AC1]display station all
lea
Rf/WLAN: Radio ID/WLAN ID
//
Rx/Tx: link receive rate/link transmit rate(Mbps)
:
-------------------------------------------------------------------------
p
STA MAC
t t
AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP
:h
address SSID
-------------------------------------------------------------------------
1041-7f67-01b1 1
e s
ap2 0/2 2.4G 11n 65/52 -70 12
10.1.12.254 voice1
r c
ou
-------------------------------------------------------------------------
s
Total: 1 2.4G: 1 5G: 0
e
R
On the wireless terminal, ping the IP address of the simulated public network interface on
g
the switch.
n i n
C:\Users\zWX>ping 101.101.101.101
ar
L e Reply from 101.101.101.101: bytes=56 Sequence=2 ttl=255 time=10 ms
e Reply from 101.101.101.101: bytes=56 Sequence=3 ttl=255 time=10 ms
or Reply from 101.101.101.101: bytes=56 Sequence=4 ttl=255 time=10 ms
M
--- 101.101.101.101 ping statistics ---

0.00% packet loss

#
sysname S5700
#
vlan batch 10 to 13
#
e n
lldp enable
/
#
o m
i.c
#
w e
#
u a
.h
aaa
g
ni n
domain default
r
lea
//
p :
#
t t
:h
interface Vlanif1
#
interface Vlanif10
e s
c
ip address 10.1.10.1 255.255.255.0
r
ou
#
interface Vlanif11
s
ip address 10.1.11.1 255.255.255.0
e
R
#
interface Vlanif12
n g
ip address 10.1.12.1 255.255.255.0
i
n
#
ar
interface Vlanif13
e
ip address 10.1.13.1 255.255.255.0
e L #
interface MEth0/0/1
or
ip address 172.21.11.1 255.255.0.0
#
#
#
#
#
#
#
#
#
#
e n
/
o m
i.c
#
w e
u a
#
g .h
#
ni n
r
lea
#
//
#
p :
t
#
t
:h
#
e s
c
#
r
ou
#
es
#
R
#
i n g
n
ar
#
#
e
or
#
#
interface NULL0
#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
#
return
e n
/
#
o m
i.c
sysname AC1
#
http server enable
w e
#
u a
.h
g
#
#
ni n
r
lea
#
//
:
p
t
t
:h
#
e s
lldp enable
r c
ou
#
dhcp enable
#
es
R
g
#
n
n
#
i
ar
pki realm default
e
e L #
or
ssl policy default_policy type server
pki-realm default
M version tls1.0 tls1.1

#
dh group2
prf hmac-sha2-256
#
#
#
ip pool ap
gateway-list 10.1.10.1
network 10.1.10.0 mask 255.255.255.0
option 43 sub-option 3 ascii 10.1.10.100
#
ip pool employee
e n
/
#
network 10.1.11.0 mask 255.255.255.0
o m
i.c
ip pool voice
network 10.1.12.0 mask 255.255.255.0
w e
#
ip pool guest
u a
network 10.1.13.0 mask 255.255.255.0
g .h
#
ni n
aaa
r
lea
//
p :
t
t
:h
domain default
s
e
c
r
ou
s
cipher %^%#uJB_C`rL0AlCEZFlUV~XbB|i7&J2GGq8<uIqvXL!Zk%|6("6{.4Sxn>e0#.K
%^%#
Re
i n g
n
ar
L e #
local-user huawei service-type telnet
e
or
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
#
M interface Vlanif10
ip address 10.1.10.100 255.255.255.0
dhcp select global
#
interface Vlanif11
ip address 10.1.11.100 255.255.255.0
dhcp select global
#
interface Vlanif12
ip address 10.1.12.100 255.255.255.0
dhcp select global

#
interface Vlanif13
ip address 10.1.13.100 255.255.255.0
dhcp select global
#
ip address 172.21.11.3 255.255.0.0
#
#
e n
/
#
o m
i.c
#
#
w e
#
u a
#
g .h
ni n
r
lea
//
stp disable
#
p :
t
t
:h
#
e s
c
interface NULL0
#
r
ou
undo snmp-agent
#
es
R
i n g
n
ar
L e ssh client secure-algorithms hmac sha2_256

e
or
#
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
M #
capwap source interface vlanif10
#
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"
%^%#

#
wlan
security-profile name employee1
security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-
qK%aTJ_0%^%# aes
e n
security-profile name default-mesh
/
m
o
GJS[q&>M">Qsqw;9mb8$0`_=6I%^%# aes
i.c
ssid-profile name guest1
e
ssid guest1
ssid-profile name voice1
ssid voice1
aw
u
.h
ssid-profile name employee1
ssid employee1
vap-profile name guest1
i n g
forward-mode tunnel
r n
lea
service-vlan vlan-id 13
ssid-profile guest1
vap-profile name voice1
: //
p
ssid-profile voice1
t t
:h
s
vap-profile name employee1
r c e
ssid-profile employee1
ou
security-profile employee1
s
mesh-handover-profile name default
Re
i n g
regulatory-domain-profile name domain1
n air-scan-profile name default
ar
L e radio-2g-profile name default

e
or
M
ap-group name ap-group1
regulatory-domain-profile domain1
radio 0
vap-profile employee1 wlan 1
vap-profile voice1 wlan 2
vap-profile guest1 wlan 3
radio 1
radio 2
ap-id 0 type-id 43 ap-mac 4cfa-cabe-eb60 ap-sn 21500826412SG8918066
ap-name ap1
ap-group ap-group1
e n
ap-id 1 type-id 43 ap-mac 4cfa-cabf-d0c0 ap-sn 21500826412SG8919901
/
ap-name ap2
ap-group ap-group1
o m
i.c
provision-ap
#
w e
#
u a
#
g .h
#
ni n
return
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
3 Experiment 3: WLAN Security Configuration

/
o m
3.1.1 Objectives
ei.c
 Configure WLAN security profile
aw
 Configure WEP authentication
u
 Configure WPA/WPA2 PSK authentication
g .h
n
 Configure WPA/WPA2 EAP authentication
ni
3.1.2 Topology r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
3.1.3 Plan
Trunk.
Group
n
No.
/ e
1 AC1—G0/0/1
 AP1-G0/0/10
o m
i.c
 AP2-G0/0/11
 AP3-G0/0/12
w e
a
2 AC2—G0/0/2
AP4-G0/0/13
u

 AP5-G0/0/14
g .h
3 AC3—G0/0/3
 AP6-G0/0/15
ni n
r
lea
 AP7-G0/0/15
4 AC4—G0/0/4
AP8-G0/0/16
//

p :

t t
AP9-G0/0/17
:h
5 AC5—G0/0/5
 AP10-G0/0/18
e s
6 AC6—G0/0/6
r c  AP11-G0/0/19
ou
 AP12-G0/0/20
es
R
ing
Name: ap-groupX
rn
VAP ID 1: VAP profile: guestX
e a AP Group VAP ID 2: VAP profile: voiceX
e L regulatory domain profile: domain
o r VAP ID 3: VAP profile: employeeX

M RADIUS Server
Profile
Name: huawei Key: huawei
Dot1x Profile Name: employeeX

Name: employeeX
Authentication
Apply: Radius Server Profile: huawei
Scheme
dot1x Profile: employeeX
SSID Profile Name: employeeX SSID name: employeeX
Name: voiceX SSID name: voiceX

Name: guestX SSID name: guestX
Name: employeeX SSID name: employeeX
Security Profile Name: voiceX SSID name: voiceX
Name: guestX SSID name: guestX
Name: employeeX
e n
Service VLAN: 11
/
Referenced profile: SSID profile employeeX
o m
i.c
Security Profile employeeX
Name: voiceX
w e
VAP Profile Service VLAN: 12
u a
Referenced profile: SSID profile voiceX
g
Security Profile voiceX .h
Name: guestX
ni n
r
Forwarding mode: tunnel forwarding
Service VLAN: 13
// lea
:
Referenced profile: SSID profile guestX
p
t
Security Profile guestX
t
:h
e s
r c
ou
es
3.2 Experiment Task
R
i n g
n
e ar
Step1 Configuring WEP Authentication
e L Huawei AC supports six access security policies, every VAP Profile can apply each of
or
policies.
M Security Policy
open
Policy Explain
Open system Authentication

wapi WLAN Authentication and Privacy Infrastructure (WAPI)
wep Wired equivalent privacy
wpa Wi-Fi protected access
wpa2 Wi-Fi protected access version 2
wpa-wpa2 Wi-Fi protected access version 1&2
[AC1]wlan
[AC1-wlan-view]security-profile name test
[AC1-wlan-sec-prof-test]security ?
open Open system
wapi WLAN authentication and privacy infrastructure
wep Wired equivalent privacy
wpa Wi-Fi protected access
e n
wpa-wpa2 Wi-Fi protected access version 1&2
/
wpa2 Wi-Fi protected access version 2
o m
i.c
The SSID guestX used authentication type WEP share-key, set WEP key to WEP-40, and
password guest.
e
Create security profile guestX with encrypt key: guest. We can set a WEP key with three
w
a
types: WEP-40, WEP-104,WEP-128.
u
If WEP-40 is used, the WEP key is 10 hexadecimal characters or 5 ASCII characters.
g .h
[AC1]wlan
ni n
r
lea
[AC1-wlan-view]security-profile name guest1
[AC1-wlan-sec-prof-guest1]security wep
//
[AC1-wlan-sec-prof-guest1]security wep share-key
:
p
[AC1-wlan-sec-prof-guest1]wep key 0 wep-40 pass-phrase guest
t t
Warning: The current password is too simple. For the sake of security,
:h
you are advised to set a password containing at least two of the
following: lowercase letters a to z, uppercase letters A to Z, digits,
s
and special characters. Continue? [Y/N]:y
e
c
r
Info: This operation may take a few seconds, please wait.done.
ou
Bind the Security profile guestX to the VAP profile guestX.
s
[AC1]wlan
Re
[AC1-wlan-view]vap-profile name guest1
i n g
[AC1-wlan-vap-prof-guest1]security-profile guest1
[AC1-wlan-vap-prof-guest1]quit
n
ar
Checking the security profile configuration for WEP.
Le
[AC1-wlan-view]display security-profile name guest1
------------------------------------------------------------
r e Security policy : Share key
o Encryption : WEP-40
M
------------------------------------------------------------
WEP's configuration
Key 0 : *****
Key 1 : *****
Key 2 : *****
Key 3 : *****
Default key ID : 0
------------------------------------------------------------
WPA/WPA2's configuration
PTK update : disable
PTK update interval(s) : 43200
------------------------------------------------------------
WAPI's configuration
CA certificate filename : -
ASU certificate filename : -
AC certificate filename : -
AC private key filename : -
WAPI source interface : -
Authentication server IP : -
WAI timeout(s) : 60
BK update interval(s) : 43200
BK lifetime threshold(%) : 70
e n
USK update method : Time-based
/
USK update interval(s)
MSK update method
: 86400
: Time-based
o m
i.c
MSK update interval(s) : 86400
Cert auth retrans count : 3
USK negotiate retrans count : 3
w e
MSK negotiate retrans count : 3
------------------------------------------------------------
u a
g .h
Run the display access-user ssid guest1 commands on the AC. The command output
shows that the STAs are connected to the SSID.
ni n
r
[AC1-wlan-view]display access-user ssid guest1
lea
----------------------------------------------------------------------
UserID Username IP address MAC Status
: //
----------------------------------------------------------------------
51 48437c4b8f16 10.1.13.252
t t p 4843-7c4b-8f16 Open
----------------------------------------------------------------------
:h
Total: 1, printed: 1
s
[AC1-wlan-view]display access-user ssid guest1
UserID Username
r c e
-----------------------------------------------------------------------
IP address MAC Status
ou
----------------------------------------------------------------------
s
54 10417f6701b1 10.1.13.254 1041-7f67-01b1 Open
Re
----------------------------------------------------------------------
n g
Run the display station sta-mac XX commands on the AC, displays status of an STA,
i
including the SSID of the WLAN to which the STA connects, online duration,
n
ar
authentication type, and vlan. Below display result shows the STA 1041-7f67-01b1
cipher type is WEP-40.
L e [AC1-wlan-view]display station sta-mac 1041-7f67-01b1
e
or
-----------------------------------------------------------------------
Station MAC-address : 1041-7f67-01b1
Station IP-address : 10.1.13.254
M Station gateway
Associated SSID
: 10.1.13.1
: guest1
Station online time(ddd:hh:mm:ss) : 000:00:18:26
The upstream SNR(dB) : 25.0
The upstream aggregate receive power(dBm) : -70.0
Station connect rate(Mbps) : 54
Station connect channel : 165
Station inactivity time(ddd:hh:mm:ss) : 000:00:00:00
Station current state
Authorized for data transfer : YES
QoS enabled : YES

ERP enabled : No
HT rates enabled : No
Power save mode enabled : YES
Auth reference held : No
UAPSD enabled : No
UAPSD triggerable : No
UAPSD SP in progress : No
This is an ATH node : No
WDS workaround req : No
WDS link : No
e n
PMF negotiation : No
/
Station's HT capability
Station ERP element
: Q
: 0
o m
i.c
Station capabilities : EP
Station PMF capabilities
Station VHT capabilities
: PMFC=0,PMFR=0
w e
256QAM capabilities : No
VHT explicit beamforming capabilities : No
u a
MU-MIMO capabilities
Station's RSSI(dBm)
: No
: -70
g .h
Station's radio mode : 11a
ni n
Station's AP Name : ap2
r
lea
Station's Radio ID : 1
//
Station's Authentication Method : WEP+Share
Station's Cipher Type
p :
: WEP-40
t
Station's User Name : 10417f6701b1
Station's Vlan ID
t : 13
:h
Station's Channel Band-width : 20MHz
Station's asso BSSID
e s : 4cfa-cabf-d0d2
c
Station's state : Asso with auth
r
Station's QoS Mode : WMM
ou
Station's HT Mode : -
es
Station's MCS value
Station's Short GI
: 0
: nonsupport
R
Station's roam state : Yes
i n g
Station supported band
Station support 802.11k
: 2.4G/5G
: Yes
n
ar
Station support 802.11r : No
Station support 802.11v : No
L e Available to trigger roam

Is sticky client now
: Yes
: No
e
or
Trigger aimless roam while sticky : Yes
Neighbor list:
M ------------------------------------------
AP name RfID SNR RCPI
------------------------------------------
------------------------------------------
Total: 0
U-APSD list:
-------------------------------------------------------
AC-VI AC-VO AC-BE AC-BK
-------------------------------------------------------
not-support not-support not-support not-support
-------------------------------------------------------
Step2 Configuring WPA PSK Authentication

Configure the authentication type for SSID voiceX to WPA1-PSK. Huawei AC supports
below WPA configuration option:
WPA Type Encryption Method Authentication Method

PSK(password 8-64
WPA/WPA2/WPA1-2 Personal CCMP or TKIP
characters)
WPA/WPA2/WPA1-2 Enterprise CCMP or TKIP Dot1x
e n
/
Configure security profile security-profile name voice1, encryption mode TKIP, password of
PSK is voicevoice.
[AC1-wlan-view]security-profile name voice1
o m
[AC1-wlan-sec-prof-voice1]security wpa psk pass-phrase voicevoice tkip
Warning: The current password is too simple. For the sake of security,
e i.c
you are advised to set a password containing at least two of the
aw
u
following: lowercase letters a to z, uppercase letters A to Z, digits,
.h
and special characters. Continue? [Y/N]:y
g
[AC1-wlan-sec-prof-voice1]quit
i n
Configure VAP Profile voiceX bind to security profile voiceX.
n
[AC1-wlan-view]vap-profile name voice1
r
lea
[AC1-wlan-vap-prof-voice1]security-profile voice1
//
:
t t p
:h
Then the Configuration of WPA-PSK has been finished, we can test the connection.
e s
r c
s ou
Re
i n g
n
e ar
e L
or
M
C:\Users\zWX>ping 101.101.101.101

--- 101.101.101.101 ping statistics ---

0.00% packet loss
e n
/
Checking the security profile configuration for WPA PSK.
o m
i.c
[AC1-wlan-view]display security-profile name voice1
------------------------------------------------------------
Security policy : WPA PSK
w e
Encryption : TKIP
------------------------------------------------------------
u a
WEP's configuration
g .h
Key 0
Key 1
: *****
: *****
ni n
r
lea
Key 2 : *****
Key 3 : *****
Default key ID : 0
: //
t p
------------------------------------------------------------
t
PTK update
s :h: disable
e
r c
------------------------------------------------------------
ou
es
CA certificate filename
ASU certificate filename
: -
: -
R
n g
AC private key filename
i
: -
n
ar
L e WAI timeout(s)
BK update interval(s)
: 60
: 43200
e
or
M USK update interval(s)

MSK update method
: 86400
: Time-based
MSK update interval(s) : 86400
------------------------------------------------------------
Run the display access-user ssid voice1 commands on the AC. The command output
shows that the STAs are connected to the SSID.
[AC1-wlan-view]display access-user ssid voice1

------------------------------------------------------------------------
------------------------------------------------------------------------
55 10417f6701b1 10.1.12.254 1041-7f67-01b1 Open
------------------------------------------------------------------------
e n
/
authentication type, and vlan.
[AC1-wlan-view]display station sta-mac 1041-7f67-01b1
-------------------------------------------------------------------------
o m
Station MAC-address
Station IP-address
: 1041-7f67-01b1
: 10.1.12.254
e i.c
Station gateway : 10.1.12.1
aw
Associated SSID : voice1
u
Station online time(ddd:hh:mm:ss)
The upstream SNR(dB)
: 000:00:09:21
: 32.0
g .h
ni n
Station connect rate(Mbps)
r: 54
lea
Station connect channel : 165
://
Station inactivity time(ddd:hh:mm:ss) : 000:00:00:00
tp
Authorized for data transfer
t : YES
:h
QoS enabled : YES
es
ERP enabled : No
HT rates enabled
r c : No
ou
Power save mode enabled : YES
es
UAPSD enabled : No
R
ing
n
ar
L e WDS link
PMF negotiation
: No
: No
e
or
Station's HT capability : Q
Station ERP element : 0
M Station capabilities
Station PMF capabilities
: EP
: PMFC=0,PMFR=0
Station VHT capabilities
MU-MIMO capabilities : No
Station's RSSI(dBm) : -63
Station's Radio ID : 1
Station's Authentication Method : WPA-PSK
Station's Cipher Type : TKIP
Station's Vlan ID : 12
Station's asso BSSID : 4cfa-cabf-d0d1
e n
Station's MCS value : 0 /
Station's Short GI : nonsupport
o m
i.c
Station's roam state : Yes
Station supported band
Station support 802.11k
: 2.4G/5G
: Yes
w e
u a
.h
Available to trigger roam
Is sticky client now
: Yes
: No
i n g
Trigger aimless roam while sticky
r n
: Yes
lea
Neighbor list:
//
------------------------------------------
AP name RfID SNR
:
RCPI
p
t t
------------------------------------------
:h
------------------------------------------
s
Total: 0
U-APSD list:
r c e
-------------------------------------------------------
ou
es
-------------------------------------------------------
R
i n g
-------------------------------------------------------
Step3 Configuring WPA EAP Authentication

n
e ar The authentication architecture of EAP consists of three parts: clients, authenticator and
L
authentication server.
e
or
M
The authentication server of this experiment had set an IP address 10.254.1.100,
password: huawei, the authentication server was ready and test account: huawei,
password: Huawei@123.
Configure radius service gateway in the S5700.
[S5700] vlan batch 200
[S5700] interface GigabitEthernet0/0/24

[S5700-GigabitEthernet0/0/24]port link-type access
[S5700-GigabitEthernet0/0/24]port default vlan 200
[S5700] interface Vlanif200
[S5700-Vlanif200] ip address 10.254.1.1 24
Configure radius service and accounting scheme in the AC.

[AC1]radius-server template huawei
e n
[AC1-radius-huawei]radius-server authentication 10.254.1.100 1812 source
/
ip-address 10.1.10.100
o m
i.c
[AC1-radius-huawei]radius-server accounting 10.254.1.100 1813 source ip-
address 10.1.10.100
[AC1-radius-huawei]radius-server shared-key cipher huawei
w e
a
[AC1-radius-huawei]undo radius-server user-name domain-included
[AC1-radius-huawei]quit
u
Configure and test AAA.
g .h
[AC1-aaa]authentication-scheme radius
ni n
r
[AC1-aaa-authen-radius]authentication-mode radius
lea
[AC1-aaa-authen-radius]quit
//
[AC-aaa] accounting-scheme radius
:
[AC-aaa-accounting-radius] accounting-mode radius
p
t
[AC-aaa-accounting- radius] accounting realtime 15
t
:h
[AC-aaa-accounting- radius] quit
s
[AC1-aaa]domain default
r c e
[AC1-aaa-domain-default]authentication-scheme radius
[AC1-aaa-domain-default]radius-server huawei
ou
[AC1]test-aaa huawei Huawei@123 radius-template huawei
s
[AC1]
Re
Info: Account test succeed.
n g
If the account test failed please ignore it first, and keep on configuring it.
i
nConfigure access profile dot1x-access-profile name employeeX。
e ar [AC1]dot1x-access-profile name employee1
e L [AC1-dot1x-access-profile-employee1]quit
or
Configure Authentication profile authentication-profile name employeeX。
Bind the access profile, authentication scheme, accounting scheme and radius server to
M authentication profile.
[AC1]authentication-profile name employee1
[AC1-authentication-profile-auth_dot1x]dot1x-access-profile employee1
[AC1-authentication-profile-auth_dot1x]authentication-scheme radius
[AC1-authentication-profile-auth_dot1x]accounting-scheme radius
[AC1-authentication-profile-auth_dot1x]radius-server huawei
[AC1-authentication-profile-auth_dot1x]quit
Configure security profile security-profile name employee, encryption mode CCMP,

authentication mode Dot1x EAP.
[AC1]wlan
[AC1-wlan-view]security-profile name employee1
[AC1-wlan-sec-prof-employee1]security wpa2 dot1x aes
[AC1-wlan-sec-prof-employee1]quit
Configure VAP profile employee to bind the security profile and authentication profile.
[AC1]wlan
[AC1-wlan-vap-prof-employee1]security-profile employee1
e n
[AC1-wlan-vap-prof-employee1]authentication-profile employee1
/
o m
i.c
w e
3.3 Verification u a
g .h
3.3.1 Connect an STA to the WLAN
ni n
r
lea
Connect iphone to the WLANs with SSIDs employeeX.
: //
t t p
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
3.3.2 Checking the Users Status h
s :
r c e
Check the security profile configuration.
u
<AC1>display security-profile name employee1
o
s
------------------------------------------------------------
Re
Security policy : WPA2 802.1x
g
Encryption : AES
i
PMF
n : disable
rn
------------------------------------------------------------
e a WEP's configuration
L
Key 0 : *****
e
Key 1 : *****
o r Key 2
Key 3
: *****
: *****
M Default key ID : 0
------------------------------------------------------------
PTK update : disable
------------------------------------------------------------
CA certificate filename : -
ASU certificate filename : -
AC private key filename : -
WAI timeout(s) : 60
BK update interval(s) : 43200
USK update interval(s) : 86400
MSK update method : Time-based
e n
MSK update interval(s) : 86400 /
o m
i.c
------------------------------------------------------------
w e
u a
Run the display access-user ssid XX commands on the AC. The command output shows
that the STAs are connected to the SSID.
g .h
n
<AC1>display access-user ssid employee1
ni
------------------------------------------------------------------------
r
lea
------------------------------------------------------------------------
://
31 huawei1 10.1.11.254 1041-7f67-01b1 Success
tp
------------------------------------------------------------------------
t
:h
s
r c e
authentication type, and vlan.
ou
<AC1>display station sta-mac 1041-7f67-01b1
s
-------------------------------------------------------------------------
e
R
Station MAC-address : 1041-7f67-01b1
g
Station IP-address : 10.1.12.254
n i n
Station gateway
Associated SSID
: 10.1.12.1
: voice1
ar Station online time(ddd:hh:mm:ss) : 000:00:00:01
Le
The upstream SNR(dB) : 27.0
e
o r Station connect rate(Mbps)

Station connect channel
: 54
: 149
M Station inactivity time(ddd:hh:mm:ss)

: 000:00:00:00
Authorized for data transfer : YES

QoS enabled : YES
ERP enabled : No
HT rates enabled : No
Power save mode enabled : No
UAPSD enabled : No
WDS link : No
PMF negotiation : No
Station's HT capability : Q
Station ERP element : 0
Station capabilities : EP
Station PMF capabilities : PMFC=0,PMFR=0
e n
Station VHT capabilities /
o m
i.c
MU-MIMO capabilities
Station's RSSI(dBm)
: No
: -68
w e
u a
.h
Station's Radio ID
Station's Authentication Method
: 1
i n g
: WPA-PSK
Station's Cipher Type
r n
: TKIP
lea
://
Station's Vlan ID : 12
Station's asso BSSID
t tp : 4cfa-cabe-eb71
:h
es
c
r
Station's MCS value : 0
ou
Station's Short GI : nonsupport
es
Station's roam state : No
R
Station supported band : 2.4G/5G
ing
Station support 802.11k : Yes
n
ar
Available to trigger roam : Yes
L e Is sticky client now : No
e Trigger aimless roam while sticky : Yes
or Neighbor list:
M
------------------------------------------
AP name RfID SNR RCPI
------------------------------------------
------------------------------------------
Total: 0
U-APSD list:
-------------------------------------------------------
-------------------------------------------------------

#
sysname S5700
#
#
e n
lldp enable
/
#
o m
i.c
#
w e
#
u a
.h
aaa
g
ni n
domain default
r
lea
//
p :
#
t t
:h
interface Vlanif1
#
interface Vlanif10
e s
c
ip address 10.1.10.1 255.255.255.0
r
ou
#
interface Vlanif11
s
ip address 10.1.11.1 255.255.255.0
e
R
#
interface Vlanif12
n g
ip address 10.1.12.1 255.255.255.0
i
n
#
ar
interface Vlanif13
e
ip address 10.1.13.1 255.255.255.0
e L #
interface Vlanif200
or
ip address 10.254.1.1 255.255.255.0
#
M interface MEth0/0/1
ip address 172.21.11.1 255.255.0.0
#
#
#
#
#
#
#
#
#
e n
/
#
o m
i.c
w e
#
u a
g .h
ni n
#
r
lea
//
#
p :
t
#
t
:h
#
s
e
c
#
r
ou
#
#
es
R
#
i n g
n
ar
#
L e #
e
or
#
M #
#
#
interface NULL0
#
interface LoopBack1
ip address 101.101.101.101 255.255.24255.255
#
e n
/
#
return
o m
3.4.2 AC Configuration ei.c
aw
u
#
.h
sysname AC1
g
#
n
http server enable
ni
#
r
lea
//
#
p :
#
t t
:h
#
s
e
c
r
ou
s
e
R
authentication-profile name employee1
dot1x-access-profile employee1
n g
i
accounting-scheme radius
n
ar
radius-server huawei
e
#
e L lldp enable
#
or
dhcp enable
#
M diffserv domain default

#
radius-server template huawei
radius-server authentication 10.254.1.100 1812 source ip-address
10.1.10.100 weight 80
radius-server accounting 10.254.1.100 1813 source ip-address
10.1.10.100 weight 80
undo radius-server user-name domain-included
#
pki realm default

#
pki-realm default
#
dh group2
e n
/
o m
i.c
prf hmac-sha2-256
#
w e
#
u a
#
ip pool ap
g .h
ni n
network 10.1.10.0 mask 255.255.255.0
r
lea
//
#
ip pool employee
p :
t
t
network 10.1.11.0 mask 255.255.255.0
:h
#
ip pool voice
e s
c
r
network 10.1.12.0 mask 255.255.255.0
ou
#
es
ip pool guest
R
network 10.1.13.0 mask 255.255.255.0
#
i
aaa
n g
n
ar
L e authentication-mode radius
e
or
M accounting-mode radius
accounting realtime 15
domain default
%^%#

local-user huawei service-type telnet ssh
#
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
#
interface Vlanif10
ip address 10.1.10.100 255.255.255.0
e n
dhcp select global
/
m
#
interface Vlanif11
o
i.c
ip address 10.1.11.100 255.255.255.0
e
dhcp select global
w
#
interface Vlanif12
ip address 10.1.12.100 255.255.255.0
u a
#
dhcp select global
g .h
interface Vlanif13
ni n
r
ip address 10.1.13.100 255.255.255.0
lea
dhcp select global
#
: //
#
ip address 172.21.11.3 255.255.0.0
t t p
:h
s
#
#
r c e
ou
s
#
#
Re
#
i n g
n
ar
#
e
or
stp disable
M
#
#
interface NULL0
#
snmp-agent local-engineid 800007DB03845B12566919
snmp-agent community
read %^%#zx5kPs")cO.ÎG;R6J^5nd^JU_|q",$FD,E.s%@9CaEk5yD*QDiGKR&$73e;T^
(&JH\gl'IkR|DmZ=0C%^%#
write %^%#bSWeA`C;H5A98pQDivZ4mR\LSzVDEHibs|Gln%zJW[vB~(`4KElv:@:;H:BMM
=5^F$Ab1,k4LJ;xbEb=%^%#
snmp-agent sys-info version v2c
snmp-agent
#
ssh client first-time enable
e n
/
o m
i.c
e
#
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
#
aw
u
.h
#
i n g
r n
lea
%^%#
//
p :
t t
:h
e
s
#
r c
ou
wlan
s
security-profile name test
e
R
security-profile name guest1
security wep share-key
i n g
wep key 0 wep-40 pass-phrase %^%#)~{E64X##X|h6647iii5.y8.)yr"2@":|):-
T.B/%^%#
n
ar
security-profile name voice1
security wpa psk pass-
L e phrase %^%#'B_NS~.4,Fh#8YX{gfeV}Ekj=<[Gi){`xT>QmnG>%^%# tkip

e
or
security wpa2 dot1x aes
M security-profile name default-wds

qK%aTJ_0%^%# aes
ssid guest1
ssid voice1

ssid employee1
forward-mode tunnel
ssid-profile guest1
security-profile guest1
ssid-profile voice1
security-profile voice1
e n
/
o m
i.c
authentication-profile employee1
w e
u a
g .h
ni n
r
lea
//
p :
t
t
:h
s
e
c
r
ou
es
radio 0
R
i n g
n
ar
radio 1
L e vap-profile employee1 wlan 1

e
or
radio 2
M vap-profile employee1 wlan 1

ap-name ap1
ap-group ap-group1
ap-name ap2
ap-group ap-group1
provision-ap
#

dot1x-access-profile name employee1
#
#
#
return
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
4 Experiment 4: eSight WLAN Management

/
o m
4.1.1 Objectives
ei.c
 Configure SNMP in AC
aw
 Understand the method of eSight discover AC
u
 Configure WLAN with eSight wizard
g .h
4.1.2 Topology
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
4.1.3 Plan
Trunk.
Group
n
No.
/ e
1 AC1—G0/0/1
 AP1-G0/0/10
o m
i.c
 AP2-G0/0/11
 AP3-G0/0/12
w e
a
2 AC2—G0/0/2
AP4-G0/0/13
u

 AP5-G0/0/14
g .h
3 AC3—G0/0/3
 AP6-G0/0/15
ni n
r
lea
 AP7-G0/0/15
4 AC4—G0/0/4
AP8-G0/0/16
//

p :

t t
AP9-G0/0/17
:h
5 AC5—G0/0/5
 AP10-G0/0/18
e s
6 AC6—G0/0/6
r c  AP11-G0/0/19
ou
 AP12-G0/0/20
es
R
n g
eSight Server IP
i
172.21.11.20
n
e ar
eSight Server password Name: admin Password: Huawei@123
e L
or
SNMP read only community publicRO
M SNMP read and write

community
privateRW
4.2 Experiment Task

Continue the configuration from experiment 1, the configuration of the switch has
been ready.
e n
Step2 Configuring SNMP Parameters
/
Configure AC SNMP Community and static route.
o m
i.c
[AC1]snmp-agent community read publicRO
e
[AC1]snmp-agent community write privateRW
w
[AC1]snmp-agent sys-info version v2c
[AC1]ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
u a
.h
Step3 Configuring eSight Discover AC
i n g
After the PC connect to the WLAN, enter URL http://172.21.11.20:8080 to access eSight
Server, user name: admin, password: Huawei@123 (The initialized user name and
r n
password are: admin/Changeme123, you need change the initial password when you first
lea
login eSight). Should use google chrome or firefox browser.
: //
t t p
s :h
r c e
s ou
Re
i n g
n
e ar
e L After login in to eSight, select the pull-down menu“Resource”，and click “Add
or
Device”, reference below parameters.
M IP Address
Name
172.21.11.X+2
ACX
SNMP Version V2C
Read Only Community publicRO
Write Community privateRW
Telnet Authentication mode Password
Password Admin@123
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L Click”OK” when you finished, if displayed “Success”then means the configuring is
or
successed.

，and click “Network Device”.
Select the pull-down menu“Resource”
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
Click “WLAN Feature > AP”, enter the Create Manually interface and add aps.
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
Configure interface Group huaweiX.

Select the pull-down menu“Resource> Resources Group> Group Management”
e n
Click “Interface group > User Defined > ”, and the name for this experiment is/
“huawei1”.
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
Configure VLANIF and DHCP Server
ni n
r
Select the pull-down menu“Business> WLAN Management> Configuration and
lea
Deployment”
: //
t t p
s :h
r c e
s ou
Re
i n g
Add devices on base configuration.
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
Configure Channel. Click “Base configuration > Channel Configuration ”, set the allow
pass VLANs and PVID for interface group”.
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
Step1 Configuring AP Online
aw
Configure AP Authentication mode and AC Source Address.
u
Click “Global AC Configuration > AC >
g
”, select Resouce AC1”.
.h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
Step2 Configure WLAN Service Parameters

Create Profiles employeeX, Click “AP Configuration > Profile Management > VAP Profile >
SSID Profile ”, select Create”. Configure the security policy for employeeX to WPA2, with
the password employee.
e n
/
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
e i.c
aw
u
g .h
n
Create VAP profiles employeeX. Set the data forwarding mode for employeeX to tunnel
i
forwarding. Configure the service VLAN and bind the profile to the security profile and
n
SSID profile.
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L Configure AP groups ap-groupX to use the VAP profile.
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
After finish above, ap still not online. Configure the function of ssh for AC, and test the
SFTP for eSight. Username: admin, password: Changeme123.
[AC6005]ssh client first-time enable
[AC6005]sftp 172.21.0.11 31922
Please input the username:admin
Trying 172.21.0.11 ...
Press CTRL+K to abort
The server is not authenticated. Continue to access it? (y/n)[n]:y
Save the server's public key? (y/n)[n]:y
e n
/
The server's public key will be saved with the name 172.21.0.11. Please
wait...
o m
i.c
Enter password:
sftp-client>
w e
Click “System > Network Management Settings > Polling Settings”. Configure Polling
interval, make the AP online.
u a
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
c e
Check the AP Status and two Aps are online.
r
s ou
Re
i n g
n
e ar
e L
or
M
e n
/
o m
ei.c
aw
u
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
orVerification
4.3
M
4.3.1 Connect an STA to the WLAN
Connect STAs to the WLANs with SSIDs employeeX.
e n
/
o m
ei.c
aw
u
g .h
ni n
r
C:\Users\zWX>ping 101.101.101.101
// lea
p :
t t
:h
s
e
c
r
ou
es
--- 101.101.101.101 ping statistics ---
R
i n g
0.00% packet loss
n
ar
L e
e
4.4rReference Configuration
o
M4.4.1 S5700 Configuration
#
sysname S5700
#
#
lldp enable
#

#
#
aaa
domain default
e n
/
#
o m
i.c
interface Vlanif1
#
interface Vlanif10
w e
#
ip address 10.1.10.1 255.255.255.0
u a
interface Vlanif11
ip address 10.1.11.1 255.255.255.0
g .h
#
ni n
interface Vlanif12
r
lea
ip address 10.1.12.1 255.255.255.0
//
#
interface Vlanif13
p :
t
ip address 10.1.13.1 255.255.255.0
#
t
:h
interface Vlanif200
s
ip address 10.254.1.1 255.255.255.0
e
c
#
r
interface MEth0/0/1
ou
ip address 172.21.11.1 255.255.0.0
#
es
R
#
i n g
n
ar
#
#
e
or
#
#
#
#
#
#

#
#
#
e n
/
#
o m
i.c
#
#
w e
#
u a
#
g .h
ni n
#
r
lea
//
#
p :
t
#
t
:h
#
s
e
c
#
r
ou
#
es
R
#
i n g
interface NULL0
n
ar
#
interface LoopBack1
L e #
ip address 101.101.101.101 255.255.255.255
e
or
M set authentication password

#
return
#
sysname AC1
#
http server enable
#
portal local-server ip 10.1.10.100
e n
portal local-server https ssl-policy default_policy port 2000
/
#
o m
i.c
#
w e
#
u a
#
g .h
ni n
r
lea
portal-access-profile guest1
: //
t p
authentication-profile name guest1
t
portal-access-profile guest1
s :h
e
r c
ou
#
es
R
lldp enable
#
i n g
n
dhcp enable
ar
#
Le
#
r e radius-server template default
o radius-server template huawei
M radius-server authentication 10.254.1.100 1812 source ip-address

10.1.10.100 weight 80
#
pki realm default
#
pki-realm default
#
dh group2
e n
prf hmac-sha2-256 /
#
o m
i.c
#
w e
portal local-server enable
u a
.h
#
portal-access-profile name guest1
portal local-server enable
i n g
#
r n
lea
ip pool ap
//
network 10.1.10.0 mask 255.255.255.0
p :
t t
:h
#
s
ip pool employee1
c
r e
network 10.1.11.0 mask 255.255.255.0
ou
dns-list 114.114.114.114
#
es
R
ip pool voice1
i n g
network 10.1.12.0 mask 255.255.255.0
n
ar
#
ip pool guest1
L e gateway-list 10.1.13.1
e network 10.1.13.0 mask 255.255.255.0
or #
M
aaa
domain default
local-user admin password irreversible-cipher $1a$VNcE$6oR"2$aASkVyCl-

~~qx^~!e+:.S|>BJto>%VV[WvDxK./G$
$1a$6@(!=HT_IP$A=lvP*~iu+0<..Y&4`Y6+j4$Xkcf=#aMU=5[4wEP$
local-user huawei service-type telnet ssh http
local-user guest01 password cipher %^%#h)q(D@"^~3lbX|<lHk1L#bj]RY3-
pAYq#XEVAp>~%^%#
e n
local-user guest01 privilege level 0
/
local-user guest01 service-type web
o m
i.c
#
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
w e
#
interface Vlanif10
u a
ip address 10.1.10.100 255.255.255.0
g .h
dhcp select global
#
ni n
r
lea
interface Vlanif11
ip address 10.1.11.100 255.255.255.0
dhcp select global
: //
#
interface Vlanif12
t t p
:h
ip address 10.1.12.100 255.255.255.0
s
e
dhcp select global
#
r c
ou
interface Vlanif13
es
ip address 10.1.13.100 255.255.255.0
dhcp select global
# R
n g
i
n
ip address 172.21.11.3 255.255.0.0
ar
#
Le
#
r e interface GigabitEthernet0/0/2
o #
#
#
#
#

stp disable
#
#
interface NULL0
#
e n
info-center timestamp log format-date /
#
o m
i.c
read %^%#En_g+AWfX>adWz&5.!G~E^)4&/r]vCScEB~w~u%Zje-
w e
$@`GH0BN7e"$A8PF(_n~lC9qvT)O*{4!I+:yR%^%#
u a
.h
snmp-agent community write %^%#atYiX7&TjG<o\Y/.2Y-
V/8bVI&sGJOTB4$0Y@{"2$306$`dp;=7cULM)*$.3Q!lXY<}!y7jZ,7BS"NNY%^%#
i n g
snmp-agent
r n
lea
#
: //
ssh server secure-algorithms cipher aes256_ctr aes128_ctr aes256_cbc
aes128 3des
t t p
ssh server secure-algorithms hmac sha2_256 sha2_256_96 sha1 sha1_96 md5
:h
md5_96
s
e
c
ssh client secure-algorithms cipher aes256_ctr aes128_ctr aes256_cbc
r
ou
aes128 3des
ssh client secure-algorithms hmac sha2_256 sha2_256_96 sha1 sha1_96 md5
md5_96
es
R
#
i n g
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
n
ar
#
L e #
e user-interface con 0
or authentication-mode password
M
cipher %^%#1<n6!"VC7VQQj=/vGNXG}:Eu&6zT3'C<qU9G'>N8A~"fK_+WA~0De+C]/yW"%^
%#
protocol inbound telnet
#
wlan
phrase %^%#0)RfPJm>L58cY+4*K);#E~]V)7`\406bJM4syy*%%^%# tkip
e n
/
qK%aTJ_0%^%# aes
o m
i.c
e
aw
ssid guest1
u
g .h
ssid voice1
ni n
r
lea
ssid employee1
: //
forward-mode tunnel
t t p
ssid-profile guest1
s :h
e
r c
authentication-profile portal_authen_profile
ou
es
ssid-profile voice1
R
n g
i
n
ar
L e ssid-profile employee1
e
or
M mesh-profile name default


radio 0
e n
vap-profile voice1 wlan 2 /
o m
i.c
radio 1
w e
u a
.h
radio 2
i n g
r n
lea
//
ap-group ap-group1
:
p
ap-group ap-group1
t t
:h
provision-ap
s
#
c e
r
ou
#
es
#
R
#
i n g
n
ar
return
L e
e
or
M
5 Experiment 5: Layer 3 Networking Experiment

/
o m
5.1.1 Objectives
ei.c
 Understand the L3 networking structure
aw
 Configure L3 networking device
u
 Configure tunnel forwarding
g .h
n
 Verify the configuration
ni
5.1.2 Topology r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
5.1.3 Plan
Trunk.
Group
n
No.
/ e
1 AC1—G0/0/1
 AP1-G0/0/10
o m
i.c
 AP2-G0/0/11
 AP3-G0/0/12
w e
a
2 AC2—G0/0/2
AP4-G0/0/13
u

 AP5-G0/0/14
g .h
3 AC3—G0/0/3
 AP6-G0/0/15
ni n
r
lea
 AP7-G0/0/15
4 AC4—G0/0/4
AP8-G0/0/16
//

p :

t t
AP9-G0/0/17
:h
5 AC5—G0/0/5
 AP10-G0/0/18
e s
6 AC6—G0/0/6
r c  AP11-G0/0/19
ou
 AP12-G0/0/20
es
R
n g
Trainee Group X
i
AC Configuration
n
ar
Console Port Login
Admin@123
L e Password
e Device ACX
or AP Management
VLAN：X0 IP：10.1.X0.100
M VLAN
Service VLAN
VLAN：X1 IP：10.1.X1.100
(Employee)
Service VLAN (Voice) VLAN：X2 IP：10.1.X2.100
Service VLAN (Guest) VLAN：X3 IP：10.1.X3.100
AC Source interface
VLANif 80X IP：10.1.20X.100
（L3 Networking）
5.2 Experiment Task
e n
/
Configure the VLAN and Trunk on switch S5700, set the VLANIF80X ip address.
o m
i.c
[S5700]vlan batch 801
[S5700]int GigabitEthernet 0/0/1
[S5700-GigabitEthernet0/0/1]port trunk allow-pass vlan 801
w e
a
u
.h
[S5700]int Vlanif 801
i n g
r n
lea
Update the VLAN and Trunk Configuration, and set the VLANIF80X ip address.
[AC1]vlan 801
: //
p
[AC1]interface GigabitEthernet 0/0/8
t t
[AC1-GigabitEthernet0/0/8]port trunk allow-pass vlan 801
:h
[AC1-GigabitEthernet0/0/8]quit
[AC1]int Vlanif 801
e s
c
r
[AC1-Vlanif801]quit
s ou
Modify the DHCP Option43 address to 10.1.201.100.
Re
[AC1]ip pool ap
[AC1-ip-pool-ap]display this
#
i n g
nip pool ap
ar gateway-list 10.1.10.1
Le
network 10.1.10.0 mask 255.255.255.0
e
o r #
[AC1-ip-pool-ap]undo option 43
M [AC1-ip-pool-ap]option 43 sub-option 3 ascii 10.1.20X.100
Modify the AC Source interface.

[AC1]undo capwap source interface Vlanif 10
Warning: This operation will disconnect the device on the source
interface. Continue? [Y/N]:y
[AC1]capwap source interface Vlanif 801
Modify VAP Profile employeeX and voiceX forwarding mode to tunnel forwarding.
[AC1]wlan

[AC1-wlan-vap-prof-employee1]forward-mode tunnel
[AC1-wlan-vap-prof-voice1]forward-mode tunnel
e n
5.3 Verification /
o m
5.3.1 Verifiy the L3 Network Status
e i.c
aw
Then the Configuration of L3 Network has been finished, all Aps are online.
u
.h
[AC1]display ap all
g
Info: This operation may take a few seconds. Please wait for a
n
moment.done.
Total AP information:
ni
r
lea
nor : normal [2]
-------------------------------------------------------------------------
://
ID MAC Name Group IP Type State STA Uptime
tp
-------------------------------------------------------------------------
0
t
4cfa-cabe-eb60 ap1 ap-group1 10.1.10.253 AP4030DN nor 0 6S
:h
1 4cfa-cabf-d0c0 ap2 ap-group1 10.1.10.254 AP4030DN nor 1 26S
e s
-------------------------------------------------------------------------
Total: 2
r c
ou
Check the station information.
es
[AC1]display station all
R
Rf/WLAN: Radio ID/WLAN ID
i n g
Rx/Tx: link receive rate/link transmit rate(Mbps)
-------------------------------------------------------------------------
n
ar
STA MAC AP ID Ap name Rf/WLAN Band Type Rx/Tx RSSI VLAN IP
address SSID
Le -------------------------------------------------------------------------
re
1041-7f67-01b1 0 ap1 0/2 2.4G 11g 35/46 -64 12
o
10.1.12.254 voice1
-------------------------------------------------------------------------
M Total: 1 2.4G: 1 5G: 0

#
sysname S5700
#
vlan batch 10 to 13 200 801
#
e n
lldp enable
/
#
o m
i.c
#
w e
#
u a
.h
aaa
g
ni n
domain default
r
lea
//
p :
#
t t
:h
interface Vlanif1
#
interface Vlanif10
e s
c
ip address 10.1.10.1 255.255.255.0
r
ou
#
interface Vlanif11
s
ip address 10.1.11.1 255.255.255.0
e
R
#
interface Vlanif12
n g
ip address 10.1.12.1 255.255.255.0
i
n
#
ar
interface Vlanif13
e
ip address 10.1.13.1 255.255.255.0
e L #
interface Vlanif200
or
ip address 10.254.1.1 255.255.255.0
#
ip address 10.1.201.1 255.255.255.0
#
interface MEth0/0/1
ip address 172.21.11.1 255.255.0.0
#
port trunk allow-pass vlan 10 to 13 801
#
#
#
#
#
#
e n
#
/
#
o m
i.c
#
w e
u a
#
g .h
ni n
r
lea
//
#
p :
t
#
t
:h
#
e s
c
#
r
ou
#
es
#
R
#
i n g
n
ar
#
#
e
or
#
#
#
#
#
interface NULL0
#
interface LoopBack1
ip address 101.101.101.101 255.255.255.255
#
e n
cipher %@%@`KL`QN[h79h[6AS2ggdT<+Hjaz5lH\hpS4]~^/-CFvtO+Hm<%@%@ /
o m
i.c
e
#
return
aw
5.4.2 AC Configuration u
g .h
n
#
sysname AC1
ni
#
r
lea
//
http server enable
#
p :
t t
:h
#
#
e s
c
vlan batch 10 to 13 801 4090
r
ou
#
s
e
R
n g
i
n
ar
e
e L accounting-scheme radius
or
#
lldp enable
M #
dhcp enable
#
#
radius-server template huawei
radius-server authentication 10.254.1.100 1812 source ip-address
10.1.10.100 weight 80
radius-server accounting 10.254.1.100 1813 source ip-address
10.1.10.100 weight 80

#
pki realm default
#
pki-realm default
#
e n
/
dh group2
o m
i.c
w e
#
prf hmac-sha2-256
u a
#
g .h
ni n
#
r
lea
ip pool ap
//
network 10.1.10.0 mask 255.255.255.0
p :
t
#
t
:h
ip pool employee
s
e
c
network 10.1.11.0 mask 255.255.255.0
#
r
ou
ip pool voice
es
network 10.1.12.0 mask 255.255.255.0
#
R
i n g
ip pool guest
n
ar
network 10.1.13.0 mask 255.255.255.0
#
L e aaa
e
or
M authorization-scheme default
accounting-mode radius
accounting realtime 15
domain default

%^%#
local-user huawei service-type telnet ssh
#
n
interface Vlanif1
#
ip address 169.254.1.1 255.255.0.0
/ e
interface Vlanif10
o m
i.c
ip address 10.1.10.100 255.255.255.0
dhcp select global
#
w e
a
interface Vlanif11
u
ip address 10.1.11.100 255.255.255.0
.h
dhcp select global
g
#
interface Vlanif12
ip address 10.1.12.100 255.255.255.0
ni n
r
lea
dhcp select global
#
//
interface Vlanif13
ip address 10.1.13.100 255.255.255.0
p :
dhcp select global
t t
:h
#
interface Vlanif801
e s
ip address 10.1.201.100 255.255.255.0
#
r c
ou
ip address 172.21.11.3 255.255.0.0
#
es
R
g
#
n i n
#
ar
L e #
e
or
#
#
#
stp disable
#
#
interface NULL0
#
read %^%#zx5kPs")cO.ÎG;R6J^5nd^JU_|q",$FD,E.s%@9CaEk5yD*QDiGKR&$73e;T^
(&JH\gl'IkR|DmZ=0C%^%#
write %^%#bSWeA`C;H5A98pQDivZ4mR\LSzVDEHibs|Gln%zJW[vB~(`4KElv:@:;H:BMM
=5^F$Ab1,k4LJ;xbEb=%^%#
n
#
snmp-agent
/ e
ssh client first-time enable
o m
i.c
w e
u a
.h
g
#
ni n
ip route-static 0.0.0.0 0.0.0.0 10.1.10.1
r
lea
#
//
#
p :
t t
:h
s
e
c
%^%#
r
ou
es
R
#
i n g
n
ar
wlan
L e security-profile name test

e
or
security wep share-key
wep key 0 wep-40 pass-phrase %^%#)~{E64X##X|h6647iii5.y8.)yr"2@":|):-
M
T.B/%^%#
phrase %^%#'B_NS~.4,Fh#8YX{gfeV}Ekj=<[Gi){`xT>QmnG>%^%# tkip
qK%aTJ_0%^%# aes

ssid guest1
ssid voice1
ssid employee1
forward-mode tunnel
e n
/
m
ssid-profile guest1
o
i.c
e
forward-mode tunnel
w
ssid-profile voice1
u a
g .h
ni n
r
lea
: //
t t p
:h
s
r c e
ou
s
Re
i n g
n
ar
L e ap-group name default

e
or
radio 0
M
radio 1
radio 2

ap-name ap1
ap-group ap-group1
ap-name ap2
ap-group ap-group1
provision-ap
#
#
e n
/
#
o m
i.c
#
Return
w e
u a
g .h
ni n
r
// lea
p :
t t
s :h
r c e
s ou
Re
i n g
n
e ar
e L
or
M
6 Experiment 6: Backup the Configuration and

Reset the Device
e n
/
o m
6.1 About This Course
e i.c
6.1.1 Objectives aw
u
 Save the configuration of AC
g .h
 Configure FTP service in AC
ni n
 Backup the configuration of AC
r
lea
 Reset the configuration of AC
6.1.2 Plan : //
t t p
:h
s
e
c
Trunk.
r
ou
Group
es
No.
R
i n g
n
 AP1-G0/0/10
ar
1 AC1—G0/0/1
 AP2-G0/0/11
L e AP3-G0/0/12
e

or
2 AC2—G0/0/2
 AP4-G0/0/13
M 3 AC3—G0/0/3


AP5-G0/0/14
AP6-G0/0/15
 AP7-G0/0/15
4 AC4—G0/0/4
 AP8-G0/0/16
 AP9-G0/0/17
5 AC5—G0/0/5
 AP10-G0/0/18
 AP11-G0/0/19
6 AC6—G0/0/6
 AP12-G0/0/20
Item Parameter
Management IP 172.21.11.X+2
Backup Configuration
e n
File name
acvrpcfg.zip
/
FTP account Name: ftp Password: Huawei@123
o m
FTP Directory Flash:/
e i.c
aw
u
g .h
6.2 Experiment Task
ni n
r
//lea
p :
Step1 Save the Configuration
t t
:h
We can use save command to save the current configuration to the storage device.
s
<AC1>save acvrpcfg.zip
r c e
Are you sure to save the configuration to acvrpcfg.zip? (y/n)[n]:y
ou
It will take several minutes to save configuration file, please
wait........
es
Configuration file has been saved successfully
R
Note: The configuration file will take effect after being activated
i n g
Using the dir command, you can view information about the files and directories on the
storage device.
n
ar
<AC1>dir
e
Directory of sdcard:/
e L Idx Attr Size(Byte) Date Time(LMT) FileName
or
0 -rw- 1,883 May 13 2016 16:19:42 002f_sftpsync_53.xml
1 -rw- 3,266 Nov 11 2016 15:16:11 AC6005-1.cfg
M 2 -rw- 61,456 Jun 20 2015 07:33:20

AC6005V200R005C10SPH301.pat
3 -rw- 53,286,116 Oct 26 2015 19:55:55
AC6005V200R006C10SPC100.cc
4 -rw- 67,503,156 Nov 11 2016 14:11:48
AC6005V200R007C10SPC100.cc
5 -rw- 2,610 Nov 17 2016 10:14:27 acvrpcfg.zip
6 -rw- 1,318 Nov 11 2016 14:37:26 ca.cer
7 -rw- 149 Nov 11 2016 14:39:00 ca_config.ini
8 -rw- 7,211 Nov 16 2016 20:28:47 config.cfg
9 drw- - Jun 20 2015 07:29:43 corefile
10 -rw- 1,055 Nov 12 2016 18:11:10 daemon.log

11 -rw- 2,100 Oct 31 2016 15:34:40 daemon.log.bak
12 drw- - Nov 12 2016 18:12:33 default-sdb
13 -rw- 793 Jun 20 2015 08:05:59 default_local.cer
14 -rw- 1,775 Nov 11 2016 14:39:00
default_local_privkey.pem
15 drw- - Jul 30 2016 12:43:59 dhcp
16 -rw- 12,606,028 Nov 11 2016 14:17:12
FitAP4X30XN_V200R007C10SPC100.bin
17 -rw- 11,707,428 Oct 26 2015 19:58:48
n
FitAP6X10XN_V200R006C10SPC100.bin
18 -rw- 1,575 Jun 20 2015 08:06:29
LICQPZQ6F614HF_210235681310F6000040.dat
/ e
19 -rw- 1,253 Nov 11 2016 14:37:26 local.cer
o m
i.c
20 drw- - Nov 11 2016 19:36:33 localuser
21 drw- - Oct 11 2016 18:22:34 logfile
22 drw-
23 -rw-
- Jan 01 2013 09:49:36
59,025 Nov 12 2016 18:13:15
lost+found
w
mon_file.txte
24 drw- - Nov 12 2016 18:13:14 pmdata
u a
.h
25 -rw- 855 Aug 23 2016 15:24:27 private-data.txt
g
26 -rw- 1,260 Nov 11 2016 19:38:25 rsa_host_key.efs
27 -rw-
28 -rw-
540 Nov 11 2016 19:38:25
1,807,526 Oct 21 2015 22:54:16
ni n rsa_server_key.efs
sacrule.dat
29 drw- - Jun 20 2015 07:32:17
r security
lea
30 drw- - Nov 11 2016 14:36:45 update
//
31 -rw- 1,395 Nov 11 2016 15:08:22 vrpcfg.zip
p :
t
1,882,652 KB total (1,531,204 KB free)
t
:h
Step2 Configuring FTP Service on AC
e
[AC1]ftp server enable
s
[AC1]aaa
r c
ou
[AC1-aaa]local-user ftp password irreversible-cipher Huawei@123 ftp-
directory sdcard:/
es
[AC1-aaa]local-user ftp service-type ftp
R
[AC1-aaa]local-user ftp privilege level 15
g
n
n i
Step3 Backup the Configuration to PC
ar
Le
D:\>ftp 192.168.100.200
connect 192.168.100.200。
r e 220 FTP service ready.
o User(192.168.100.200:(none)): ftp
M 331 Password required for ftp.

password:ftp001
230 User logged in.
ftp> get acvrpcfg.zip
200 Port command okay.
150 Opening ASCII mode data connection for acvrpcfg.zip.
226 Transfer complete.
ftp: 1373 bytes received in 0.00Seconds 1373000.00Kbytes/sec.
ftp>
Then the configuration file is backuped in the PC, find the file in D:/ and then can opent it
by notepad or wordpad.
e n
/
o m
e i.c
aw
u
g .h
ni n
r
// lea
p :
t t
:h
Step4 Reset the Configuration
e s
After your practice finished, We need to reset the configuration of the devices before the
c
practice, so as to avoid the impacting to the practice, please following below procedures
r
ou
to reset the configuration and reboot the device.
s
<AC1>reset saved-configuration
Re
This will delete the configuration in the flash memory.
The device configurations will be erased to reconfigure.
n g
Are you sure? (y/n)[n]:y
i
n
ar
#
e
<AC1>reboot
e L Info: The system is comparing the configuration, please wait......
or
Warning: All the configuration will be saved to the next startup
configuration. Continue ? [y/n]:n
M
System will reboot! Continue ? [y/n]:y
6.3 Verification
6.3.1 Checking the Device Configuration

It required set a new password When you login the device after reboot.
Please configure the login password:

Info: A plain text password is a string of 8 to 16 case-sensitive
characters and must be a combination of at least two of the following:
uppercase letters A to Z, lowercase letters a to z, digits, and special
characters. A cipher text password contains 68 characters.
Enter password:
Confirm password:
Only the default configuration exist.

<AC6005>display current-configuration
#
e n
http server enable
/
#
o m
i.c
#
w e
u a
.h
g
#
ni n
#
r
lea
//
#
pki realm default
p :
t t
:h
#
s
e
pki-realm default
r c
ou
version tls1.0 tls1.1 tls1.2
#
es
R
n g
dh group2
i
n
ar
e
e L #
prf hmac-sha2-256
or
#
M portal-access-profile name portal_access_profile

#
aaa
domain default
cipher %^%#M`4JPQpOV5o%dg<#chz:0uQcV}F#{FY6"T-
UeF>YO[l0C!OPI-!:hyJLvcXC%^%#
#
interface Vlanif1
ip address 169.254.1.1 255.255.0.0
#
e n
/
#
o m
i.c
#
e
#
aw
#
u
.h
#
i n g
#
r n
lea
#
: //
p
#
interface NULL0
t t
:h
#
s
undo snmp-agent
#
r c e
ou
undo telnet server enable
s
Re
i n g
nssh client secure-algorithms hmac sha2_256
ar
L e #
e
or
cipher %^%#h'O5Y|4b&.=,loK4{<@Qo0h6R~Q>oT[2{<X+y^:,Sg*tSthkTO("UiYv~tN<
M %^%#
protocol inbound ssh
#
wlan

security wpa2 psk pass-
phrase %^%#qNfI(V#y8:b/W|/(mY81#Z\D8~!8Y*#IO1RwV);+%^%# aes
security wpa2 psk pass-phrase %^%#o[7"I"t]\4xd-
e7_BV:3&kdR~nCGO!El4DSuB>~E%^%# aes
e n
/
o m
i.c
e
aw
u
.h
i n g
r n
lea
provision-ap
#
: //
p
#
t t
:h
#
s
#
return
r c e
s ou
Re
i n g
rn
6.4.1 Key Configuration
a
L e [AC1]ftp server enable
r e [AC1]aaa
[AC1-aaa]local-user ftp password irreversible-cipher Huawei@123 ftp-
o directory sdcard:/
M [AC1-aaa]local-user ftp service-type ftp

[AC1-aaa]local-user ftp privilege level 15
7 Appendix
7.1 Configuration of Core Switch e n

/
#
o m
i.c
sysname S5700
#
vlan batch 10 to 13 20 to 23 30 to 33 40 to 43 50 to 53 60 to 63 200
w e
801 to 806
#
u a
g .h
#
ni n
aaa
r
lea
//
domain default
p :
t t
:h
#
e s
r
interface Vlanif1
c
ou
#
es
interface Vlanif10
ip address 10.1.10.1 255.255.255.0
#
R
i n g
interface Vlanif11
ip address 10.1.11.1 255.255.255.0
n
ar
#
interface Vlanif12
L e #
ip address 10.1.12.1 255.255.255.0
e
or
interface Vlanif13
ip address 10.1.13.1 255.255.255.0
M #
interface Vlanif20
ip address 10.1.20.1 255.255.255.0
#
interface Vlanif21
ip address 10.1.21.1 255.255.255.0
#
interface Vlanif22
ip address 10.1.22.1 255.255.255.0
#
interface Vlanif23
ip address 10.1.23.1 255.255.255.0

#
interface Vlanif30
ip address 10.1.30.1 255.255.255.0
#
interface Vlanif31
ip address 10.1.31.1 255.255.255.0
#
interface Vlanif32
ip address 10.1.32.1 255.255.255.0
#
e n
interface Vlanif33
/
#
ip address 10.1.33.1 255.255.255.0
o m
i.c
interface Vlanif40
#
ip address 10.1.40.1 255.255.255.0
w e
interface Vlanif41
ip address 10.1.41.1 255.255.255.0
u a
#
interface Vlanif42
g .h
ip address 10.1.42.1 255.255.255.0
ni n
#
r
lea
interface Vlanif43
//
ip address 10.1.43.1 255.255.255.0
#
p :
t
interface Vlanif50
t
ip address 10.1.50.1 255.255.255.0
:h
#
interface Vlanif51
e s
c
ip address 10.1.51.1 255.255.255.0
#
r
ou
interface Vlanif52
#
es
ip address 10.1.52.1 255.255.255.0
R
interface Vlanif53
#
i n g
ip address 10.1.53.1 255.255.255.0
n
ar
interface Vlanif60
ip address 10.1.60.1 255.255.255.0
L e #
interface Vlanif61
e
or
ip address 10.1.61.1 255.255.255.0
#
#
ip address 10.1.62.1 255.255.255.0
interface Vlanif63
ip address 10.1.63.1 255.255.255.0
#
interface Vlanif200
ip address 10.254.1.1 255.255.255.0
#
interface Vlanif801
ip address 10.1.201.1 255.255.255.0
#
interface Vlanif802
ip address 10.1.202.1 255.255.255.0
#
interface Vlanif803
ip address 10.1.203.1 255.255.255.0
#
interface Vlanif804
ip address 10.1.204.1 255.255.255.0
#
interface Vlanif805
e n
ip address 10.1.205.1 255.255.255.0
/
#
interface Vlanif806
o m
i.c
ip address 10.1.206.1 255.255.255.0
#
interface MEth0/0/1
w e
#
u a
g .h
#
ni n
r
lea
//
#
p :
t
t
:h
#
e s
c
r
ou
#
es
R
ing
#
rn
e a port link-type trunk
L
#
r e interface GigabitEthernet0/0/7
o #
#
#
#

#
#
e n
/
#
o m
i.c
w e
#
u a
g .h
ni n
#
r
lea
//
p :
t
#
t
:h
e s
c
r
ou
#
es
R
ing
#
rn
e a port link-type trunk
eL
or
#
M port link-type trunk

#
#
#
#
#
interface NULL0
#
interface LoopBack1
e n
ip address 101.101.101.101 255.255.255.255
/
#
interface LoopBack2
o m
i.c
ip address 102.102.102.102 255.255.255.255
#
interface LoopBack3
w e
#
ip address 103.103.103.103 255.255.255.255
u a
interface LoopBack4
ip address 104.104.104.104 255.255.255.255
g .h
#
ni n
interface LoopBack5
r
lea
ip address 105.105.105.105 255.255.255.255
//
#
interface LoopBack6
p :
t
ip address 106.106.106.106 255.255.255.255
#
t
:h
s
e
c
r
cipher %@%@;($MM!"!U<_DW.Z.H!4L,$49.>!z*#!\EX>M5e+/7j&#$4<,%@%@
ou
s
#
return
Re
i n g
n
e ar
e L
or
M
The privilege of HCNA/HCNP/HCIE:
With any Huawei Career Certification, you have the privilege on http://learning.huawei.com/en to enjoy:
n
 1、e-Learning Courses： Logon http://learning.huawei.com/en and enter Huawei Training/e-Learning
/e

o m
If you have the HCNA/HCNP certificate：You can access Huawei Career Certification and Basic Technology e-Learning
courses.
e i .c
If you have the HCIE certificate: You can access all the e-Learning courses which marked for HCIE Certification Users.
aw

Methods to get the HCIE e-Learning privilege : Please associate HCIE certificate information with your Huawei account, and
hu

email the account to Learning@huawei.com to apply for HCIE e-Learning privilege.

g .
 2、 Training Material Download
i n

arn
Content: Huawei product training material and Huawei career certification training material.

//le
Method：Logon http://learning.huawei.com/en and enter Huawei Training/Classroom Training ,then you can download
training material in the specific training introduction page.
p :
 3、 Priority to participate in Huawei Online Open Class (LVC)
t t

s :h
The Huawei career certification training and product training covering all ICT technical domains like R&S, UC&C, Security,
4、Learning Tools: rc e
Storage and so on, which are conducted by Huawei professional instructors.
u

s o
eNSP ：Simulate single Router&Switch device and large network.

R e
WLAN Planner ：Network planning tools for WLAN AP products.

n g
In addition, Huawei has built up Huawei Technical Forum which allows candidates to discuss technical issues with Huawei experts ,
ni
share exam experiences with others or be acquainted with Huawei Products.
a r
 Statement:
L e
r e
This material is for personal use only, and can not be used by any individual or organization for any commercial purposes.
o
M
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential 1

HCNA-WLAN Experiment Guide (CLI-based) V2.0 PDF

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

HCNA-WLAN Experiment Guide (CLI-based) V2.0 PDF

Încărcat de

Drepturi de autor:

Formate disponibile

The privilege of HCNA/HCNP/HCIE:

email the account to Learning@huawei.com to apply for HCIE e-Learning privilege.

Copyright © Huawei Technologies Co., Ltd. 2017. All rights reserved.

Trademarks and Permissions

or representations of any kind, either express or implied.

Huawei Certificate System

About This Document

Background Knowledge Required

Experiment Environment Overview

Device name Model

Experiment Environment Preparation

Device Quantity Remarks

o  Four twisted pairs

o port 20 of the switch. AP12 is connected to port 21 of the switch.

About This Document ..................................................................................................................... 3

M2.3.2 Terminal Connection Test ............................................................................................................................31

3 Experiment 3: WLAN Security Configuration....................................................................... 39

3.1.3 Plan ...........................................................................................................................................................40

M6 Experiment 6: Backup the Configuration and Reset the Device...................................... 103

6.1 About This Course .......................................................................................................................................103

6.3.1 Checking the Device Configuration ...........................................................................................................106

7 Appendix .................................................................................................................................... 110

1 Experiment 1:AC configuration initialization

1.1 About This Course e n

Service VLAN (Voice) VLAN：X2 IP：10.1.X2.100

Service VLAN (Guest) VLAN：X3 IP：10.1.X3.100

AC Port Connecting GE0/0/8 VLANs X0 through X3 can pass the

Topology: layer2 and layer 3 bypass topology

1.2 Experiment Task

1.2.1 Configuration Procedure

Step2 Configuring a Switch

L e [S5700-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 to 13

or Create a LoopbackX interface, and set its IP address to 10X.10X.10X.10X to simulate a

Step3 Configuring Basic AC Parameters

Check whether the interface status is up.

The number of interface that is UP in Physical is 7

Interface IP Address/Mask Physical Protocol

--- 101.101.101.101 ping statistics ---

L e Reply from 101.101.101.101: bytes=56 Sequence=5 ttl=254 time=1 ms

r e --- 101.101.101.101 ping statistics ---

Step4 Configuring and Testing the Telnet/SSH Service (AAA Authentication)

[AC1-aaa] local-user huawei service-type telnet

Step5 Save the Configuration

L e User last login information:

M Time : 2016-11-11 19:50:02+08:00

1.4 Reference Configuration

1.4.1 S5700 Configuration

e L ssl policy default_policy type server

port default vlan 4090

n security wpa2 psk pass-phrase %^%#CB&>,Q$BB>x\Fn"|^%qToSj.2]:%J"+-

L e security-profile name default-mesh

M mesh-handover-profile name default

ap-system-profile name default

2 Experiment 2: AP Authentication and

Name: guestX SSID Profile: guestX

2.2 Experiment Task

2.2.1 Configuration Procedure

s ou 5. Bind the profile

Step5 Configuring AP Online Parameters

e ar Configure the AC source interface.

e L [AC1]capwap source interface vlanif 10

M APs based on MAC addresses.

L e Warning: This action may cause service interruption. Continue?[Y/N]y