ac典型組網(wǎng)及配置

1、AC典型組網(wǎng)及配置,基本內(nèi)容,WEB+DHCP認(rèn)證流程典型組網(wǎng)2/3層隧道的典型場(chǎng)景及配置N+1的組網(wǎng)及配置雙portal和雙radius的組網(wǎng)及配置,WEB+DHCP認(rèn)證流程,WEB認(rèn)證 基于WEB認(rèn)證方式，是以AC/SC作為WLAN用戶接入認(rèn)證點(diǎn)。,WEB+DHCP認(rèn)證流程,WEB+DHCP認(rèn)證流程,WLAN用戶終端 WLAN用戶終端要求安裝802.11b無(wú)線網(wǎng)卡和WEB瀏覽器軟件。 WL

2、AN接入點(diǎn)（AP） AP用于WLAN用戶的無(wú)線接入。 WLAN業(yè)務(wù)用戶接入認(rèn)證點(diǎn)和業(yè)務(wù)控制點(diǎn)（AC/SC） AC檢查連接用戶是否已經(jīng)通過(guò)用戶認(rèn)證，并和后臺(tái)WLAN WEB認(rèn)證服務(wù)器協(xié)同工作完成對(duì)WLAN用戶的認(rèn)證。SC用于用戶在WLAN接入過(guò)程中的業(yè)務(wù)控制，包括強(qiáng)制portal等。,WEB+DHCP認(rèn)證流程,portal服務(wù)器 完成向WLAN用戶推送認(rèn)證頁(yè)面和門戶網(wǎng)站。radius用戶認(rèn)證服務(wù)器

3、 radius用戶認(rèn)證服務(wù)器完成基于WEB方式的用戶認(rèn)證。,WEB+DHCP認(rèn)證流程,WEB+DHCP認(rèn)證流程,1、用戶通過(guò)標(biāo)準(zhǔn)的DHCP協(xié)議，通過(guò)AC獲取到規(guī)劃的IP地址。2、用戶打開IE，訪問(wèn)某個(gè)網(wǎng)站，發(fā)起HTTP請(qǐng)求。3、AC截獲用戶的HTTP請(qǐng)求，由于用戶沒有認(rèn)證過(guò)，就強(qiáng)制到Portal服務(wù)器。并在強(qiáng)制Portal URL中加入相關(guān)參數(shù)。4、Portal服務(wù)器向WLAN用戶終端推送WEB認(rèn)證頁(yè)面。5、用戶在認(rèn)證

4、頁(yè)面上填入用戶名、密碼等信息，提交到Portal服務(wù)器。,WEB+DHCP認(rèn)證流程,6、Portal服務(wù)器接收到用戶信息，向Radius發(fā)出用戶信息查詢請(qǐng)求。7、Radius驗(yàn)證用戶密碼、查詢用戶信息，并向Portal返回查詢結(jié)果及系統(tǒng)配置的單次連接最大時(shí)長(zhǎng)(SessionTimeout)、手機(jī)用戶及卡用戶的套餐剩余時(shí)長(zhǎng)信息(AvailableTime)。8、如查詢成功，Portal服務(wù)器按照CHAP流程向AC請(qǐng)求Challen

5、ge。如果查詢失敗，Portal直接返回提示信息給用戶，流程至此結(jié)束。9、AC返回Challenge，包括Challenge ID和Challenge。,WEB+DHCP認(rèn)證流程,10、Portal將密碼和Challenge ID及Challenge做MD5算法后的Challenge-Password，和帳號(hào)一起提交到AC，發(fā)起認(rèn)證。11、AC將Challenge ID、Challenge、Challenge-Password、

6、Called-Station-ID和帳號(hào)一起送到中央RADIUS用戶認(rèn)證服務(wù)器，由中央RADIUS用戶認(rèn)證服務(wù)器進(jìn)行認(rèn)證。12、中央RADIUS服務(wù)器根據(jù)用戶信息判斷用戶是否合法（對(duì)于省內(nèi)預(yù)付費(fèi)卡用戶，還需要判斷用戶接入地和歸屬地是否一致）。RADIUS對(duì)用戶密碼分別進(jìn)行靜態(tài)密碼和動(dòng)態(tài)密碼兩次密碼認(rèn)證。如果其中一次成功，RADIUS向AC返回認(rèn)證成功報(bào)文，并攜帶協(xié)議參數(shù)，以及用戶的相關(guān)業(yè)務(wù)屬性給用戶授權(quán)。如果兩次都失敗，RADIUS

7、向AC返回認(rèn)證失敗報(bào)文。,WEB+DHCP認(rèn)證流程,13、AC返回認(rèn)證結(jié)果給Portal服務(wù)器。（以及相關(guān)業(yè)務(wù)屬性。）14、Portal服務(wù)器根據(jù)認(rèn)證結(jié)果，推送認(rèn)證結(jié)果頁(yè)面。如果成功，根據(jù)編碼規(guī)則判斷帳戶的歸屬地，推送歸屬地定制的個(gè)性化頁(yè)面，并將認(rèn)證結(jié)果、系統(tǒng)配置的單次連接最大時(shí)長(zhǎng)、套餐剩余時(shí)長(zhǎng)、自服務(wù)選項(xiàng)填入頁(yè)面，和門戶網(wǎng)站一起推送給客戶,同時(shí)啟動(dòng)正計(jì)時(shí)提醒。如果失敗，頁(yè)面提示用戶失敗原因。,WEB+DHCP認(rèn)證流程,15、Por

8、tal服務(wù)器回應(yīng)AC收到認(rèn)證結(jié)果報(bào)文。如果認(rèn)證失敗，則流程到此結(jié)束。16、認(rèn)證如果成功，AC發(fā)起計(jì)費(fèi)開始請(qǐng)求給中央RADIUS用戶認(rèn)證服務(wù)器。17、中央RADIUS回應(yīng)計(jì)費(fèi)開始響應(yīng)報(bào)文，并將響應(yīng)信息返回給AC。用戶上線完畢，開始上網(wǎng)。18、在用戶上網(wǎng)過(guò)程中，為了保護(hù)用戶計(jì)費(fèi)信息，每隔一段時(shí)間AC就向中央RADIUS用戶認(rèn)證服務(wù)器報(bào)一個(gè)實(shí)時(shí)計(jì)費(fèi)信息，包括當(dāng)前用戶上網(wǎng)總時(shí)長(zhǎng)，以及用戶總流量信息。,WEB+DHCP認(rèn)證流程,19、

9、中央RADIUS計(jì)費(fèi)服務(wù)器回應(yīng)實(shí)時(shí)計(jì)費(fèi)確認(rèn)報(bào)文給AC。20、當(dāng)AC收到下線請(qǐng)求時(shí)，向RADIUS用戶認(rèn)證服務(wù)器發(fā)計(jì)費(fèi)結(jié)束報(bào)文。21、中央RADIUS計(jì)費(fèi)服務(wù)器回應(yīng)AC的計(jì)費(fèi)結(jié)束報(bào)文。,WEB+DHCP認(rèn)證流程,WEB用戶下線流程 WEB用戶下線流程包括用戶主動(dòng)下線和異常下線兩類情況。異常下線指AC偵測(cè)到用戶下線。,WEB+DHCP認(rèn)證流程,WEB+DHCP認(rèn)證流程,當(dāng)用戶需要下線時(shí)，可以點(diǎn)擊認(rèn)證結(jié)果頁(yè)面上的下線機(jī)制，向

10、Portal服務(wù)器發(fā)起一個(gè)下線請(qǐng)求。1、Portal服務(wù)器向AC發(fā)起下線請(qǐng)求。2、AC返回下線結(jié)果給Portal服務(wù)器。3、Portal服務(wù)器根據(jù)下線結(jié)果，推送含有對(duì)應(yīng)的信息的頁(yè)面給用戶。4、當(dāng)AC收到下線請(qǐng)求時(shí)，向向RADIUS用戶認(rèn)證服務(wù)器發(fā)計(jì)費(fèi)結(jié)束報(bào)文。5、RADIUS用戶認(rèn)證服務(wù)器回應(yīng)AC的計(jì)費(fèi)結(jié)束報(bào)文。,WEB+DHCP認(rèn)證流程,WEB+DHCP認(rèn)證流程,1、AC偵測(cè)到用戶下線，向Portal服務(wù)器發(fā)出下線請(qǐng)求。

11、2、Portal服務(wù)器回應(yīng)下線成功。3、當(dāng)AC收到下線請(qǐng)求時(shí)，向計(jì)費(fèi)服務(wù)器發(fā)計(jì)費(fèi)結(jié)束報(bào)文。4、計(jì)費(fèi)服務(wù)器回應(yīng)AC的計(jì)費(fèi)結(jié)束報(bào)文。,2/3層隧道的具體應(yīng)用場(chǎng)景及配置,1、本地轉(zhuǎn)發(fā) AC做無(wú)線控制器+BRAS使用（一般為串接） AC只做無(wú)線控制器（一般為旁掛）2、集中轉(zhuǎn)發(fā) 三層隧道（串接、旁掛） 二層隧道（一般為旁掛）,本地轉(zhuǎn)發(fā)（AC+BRAS）,本地轉(zhuǎn)發(fā)（AC）,集中轉(zhuǎn)發(fā)（三層隧道-串接）,集中轉(zhuǎn)發(fā)

12、（三層隧道-旁掛）,本地轉(zhuǎn)發(fā),本地轉(zhuǎn)發(fā),Login:bnasPassword:bnasBnas>enaPassword:superBans#config terBans（config）#interface Fastethernt 1/21.0Bans（config）#ip address 10.1.1.1 255.255.255.0Bnas（config）#exit,本地轉(zhuǎn)發(fā),Bans（config）#ip dhcp

13、 server 10.1.1.1Bnas（config）#ip-pool apBans（ip-pool）#ipaddress 80.1.1.1 255.255.255.0Bans（ip-pool）#alloc-mode localdhcpBans（ip-pool）#default-route 80.1.1.1Bans（ip-pool）#option-60 ac-manage-ip 10.1.1.3Bans（ip-pool）#

14、option-60 enterprise-code 8458Bans（ip-pool）#option-43 ip-list 10.1.1.3Bans（ip-pool）#available-interface port 3Bans（ip-pool）#exit,本地轉(zhuǎn)發(fā),Bnas（config）#ip-pool staBans（ip-pool）#ipaddress 90.1.1.1 255.255.255.0Bans（ip-poo

15、l）#alloc-mode localdhcpBans（ip-pool）#default-route 90.1.1.1Bans（ip-pool）#available-interface port 3Bans（ip-pool）#end all,三層隧道,三層隧道,Bnas（config）#system mode fit-apBnas（config）# ip dhcp server 10.1.1.1Bnas（config）# ip

16、 dhcp activeBnas（config）# hostname ACBnas（config）# system data-tunnel layer3Bnas（config）# wireless data-sync enableBnas（config）# wireless local-tunnel-ip 10.1.1.1Bnas（config）# wireless ap-tunnel-port 5248Bnas（confi

17、g）# portalserver 10.1.1.1Bnas（config）# rule dns permit udp 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 53,三層隧道,Bnas（config）# rule portalserver permit ip 0.0.0.0 0.0.0.0 10.1.1.1 255.255.255.255Bnas（config）# rule radiusserver permi

18、t ip 0.0.0.0 0.0.0.0 172.16.0.3 255.255.255.255Bnas（config）# wlan enableBnas（config）# interface FastEthernet 1/21.0Bnas（config-if）# ip address 10.1.1.1 255.255.255.0Bnas（config）# interface FastEthernet 1/4.0Bnas（con

19、fig-if）# ip address 172.16.0.2 255.255.255.0Bnas（config）# interface FastEthernet 1/3.0,三層隧道,Bnas（config）# radius-clientipaddress 172.16.0.2cache-interval 0auth-port 1812account-port 1813radius-server 172.16.0.3 aut

20、henticationkey 88----89udp-port 1812radius-server 172.16.0.3 accountingkey 88----89udp-port 1813,三層隧道,Bnas（config）#domain defaultaaa authentication radiusaaa accounting radiusradius server 172.16.0.3 authenticati

21、onradius server 172.16.0.3 accountingBnas（config）#filter-policy webfilter-rule portalserverfilter-rule radiusserverfilter-rule dnsBnas（config）#service-policy webfilter-policy web,三層隧道,Bnas（config）#ip-pool STAipad

22、dress 50.1.1.1 255.255.255.0alloc-mode localdhcpdefault-router 50.1.1.1max-lease 300available-interface port 0-7dns-server 202.106.196.115 202.106.0.20 service-policy web,三層隧道,Bnas（config）#ip-pool WTPipaddress 60.

23、1.1.1 255.255.255.0alloc-mode localdhcpdefault-router 60.1.1.1option-43 ip-list 10.1.1.3option-60 enterprise-code 8458option-60 ac-manage-ip 10.1.1.3available-interface port 0-7max-lease 60Bnas（config）#ip route 0

24、.0.0.0 0.0.0.0 172.16.0.3,二層隧道,二層隧道,Bnas（config）#ip dhcp server 10.1.1.1Bnas（config）# ip dhcp activeBnas（config）# hostname ACBnas（config）# system mode fit-apBnas（config）# system data-tunnel layer2Bnas（config）# igmp-

25、proxy turn onBnas（config）# wireless data-sync enableBnas（config）# wireless local-tunnel-ip 10.1.1.1Bnas（config）# wireless ap-tunnel-port 5248,二層隧道,Bnas（config）# interface FastEthernet 1/21.0ip address 10.1.1.1 255.25

26、5.255.0 Bnas（config）# interface FastEthernet 1/5.0ip address 192.168.11.1 255.255.255.248port-trunkBnas（config）# interface FastEthernet 1/4.0port-access,二層隧道,Bnas（config）#ip-pool WTPipaddress 60.1.1.1 255.255

27、.255.0alloc-mode localdhcpdefault-router 60.1.1.1option-43 ip-list 10.1.1.3option-60 enterprise-code 8458option-60 ac-manage-ip 10.1.1.3available-interface port 0-7max-lease 60,N+1場(chǎng)景及配置,N+1場(chǎng)景及配置,AC1配置config termi

28、nalhostname master10ip dhcp server 1.0.0.1rule rule-dns permit udp 0.0.0.0 0.0.0.0 0 0.0.0.0 0.0.0.0 53rule rule-portal permit ip 0.0.0.0 0.0.0.0 192.168.2.21 255.255.255.255ip nat routerportalserver 192.168.2.21h

29、otstandby preempt-mode enablehotstandby priority 100,N+1場(chǎng)景及配置,ip nat pool out22 192.168.2.4 255.255.255.255ip nat pool in1 101.0.0.1 255.255.255.0ip nat inside in1 out22 overloadhotstandby access-port 8hotstandby tr

30、ack-port 8hotstandby track-port 19hotstandby track-port 0,N+1場(chǎng)景及配置,interface FastEthernet 1/19.0ip address 20.0.0.20 255.255.255.0standby peerip 20.0.0.21 group-id 10interface FastEthernet 1/0.0ip address 192.168.2

31、.40 255.255.255.0standby vrip 192.168.2.4 group-id 10ip nat outsideinterface FastEthernet 1/2.0ip address 1.0.0.1 255.255.255.0interface FastEthernet 1/21.0ip address 10.1.1.4 255.255.255.0,N+1場(chǎng)景及配置,radius-clientc

32、ache-interval 0ipaddress 192.168.2.4radius-server 192.168.3.249 authenticationkey bgateudp-port 1645 radius-server 192.168.3.249 accountingkey bgateudp-port 1646,N+1場(chǎng)景及配置,filter-policy port-dnsfilter-rule rule-dn

33、sfilter-rule rule-portal domain group10aaa authentication radiusaaa accounting radiusradius server 192.168.3.249 authenticationradius server 192.168.3.249 accounting,N+1場(chǎng)景及配置,ip-pool ap_group10ipaddress 100.0.0.1

34、255.255.255.0alloc-mode localdhcpmax-lease 300default-router 100.0.0.1option-60 enterprise-code 1234available-interface port 3,N+1場(chǎng)景及配置,ip-pool dhcp_group10ipaddress 101.0.0.1 255.255.255.0alloc-mode localdhcpdns

35、-server 221.4.8.1default-router 101.0.0.1max-lease 180filter-policy port-dnsavailable-interface port 8available-interface port 1available-interface port 3available-interface port 4ip route 0.0.0.0 0.0.0.0 192.168

36、.2.1,N+1場(chǎng)景及配置,AC2配置config terminalhostname master11ip dhcp server 1.0.0.1rule rule-dns permit udp 0.0.0.0 0.0.0.0 0 0.0.0.0 0.0.0.0 53ip nat routerip nat pool out 192.168.2.6 255.255.255.255ip nat pool in 103.0.0.

37、1 255.255.255.0rule rule-portal permit ip 0.0.0.0 0.0.0.0 192.168.2.21 255.255.255.255portalserver 192.168.2.21,N+1場(chǎng)景及配置,hotstandby preempt-mode enablehotstandby access-port 9ip nat inside in out overloadhotstandby

38、priority 100hotstandby track-port 9hotstandby track-port 0hotstandby track-port 21,N+1場(chǎng)景及配置,interface FastEthernet 1/21.0ip address 21.0.0.21 255.255.255.0standby peerip 21.0.0.22 group-id 11 interface FastEthernet

39、 1/0.0ip address 192.168.2.60 255.255.255.0standby vrip 192.168.2.6 group-id 11ip nat outsideinterface FastEthernet 1/2.0ip address 1.0.0.1 255.255.255.0,N+1場(chǎng)景及配置,radius-clientcache-interval 0ipaddress 192.168.2.6

40、 radius-server 192.168.3.249 authenticationkey bgateudp-port 1645radius-server 192.168.3.249 accountingkey bgateudp-port 1646,N+1場(chǎng)景及配置,filter-policy port-dnsfilter-rule rule-dnsfilter-rule rule-portal

41、domain default domain group11radius server 192.168.3.249 authenticationradius server 192.168.3.249 accountingaaa authentication radiusaaa accounting radius,N+1場(chǎng)景及配置,ip-pool ap_group11ipaddress 102.0.0.1 255.255.25

42、5.0alloc-mode localdhcpmax-lease 300default-router 102.0.0.1available-interface port 9option-60 enterprise-code 1234,N+1場(chǎng)景及配置,ip-pool dhcp_group11ipaddress 103.0.0.1 255.255.255.0alloc-mode localdhcpdns-server 22

43、1.4.8.1default-router 103.0.0.1max-lease 180filter-policy port-dnsavailable-interface port 9ip route 0.0.0.0 0.0.0.0 192.168.2.1,N+1場(chǎng)景及配置,AC3配置hostname standbyip dhcp server 1.0.0.1portalserver 192.168.2.21rule

44、 rule-dns permit udp 0.0.0.0 0.0.0.0 0 0.0.0.0 0.0.0.0 53rule rule-portal permit ip 0.0.0.0 0.0.0.0 192.168.2.21 255.255.255.255ip nat routerip nat pool out 192.168.2.6 255.255.255.255ip nat pool in 103.0.0.1 255.255

45、.255.0ip nat pool out22 192.168.2.4 255.255.255.255,N+1場(chǎng)景及配置,hotstandby access-port 8-10ip nat pool in1 101.0.0.1 255.255.255.0ip nat inside in out overloadip nat inside in1 out22 overloadhotstandby preempt-mode ena

46、blehotstandby track-port 8hotstandby track-port 9hotstandby track-port 0hotstandby track-port 20hotstandby track-port 21,N+1場(chǎng)景及配置,interface FastEthernet 1/2.0ip address 1.0.0.1 255.255.255.0interface FastEthernet

47、1/21.0ip address 21.0.0.22 255.255.255.0standby peerip 21.0.0.21 group-id 11 interface FastEthernet 1/20.0 ip address 20.0.0.21 255.255.255.0standby peerip 20.0.0.20 group-id 10 interface FastEthernet 1/0.0ip addr

48、ess 192.168.2.80 255.255.255.0standby vrip 192.168.2.6 group-id 11standby vrip 192.168.2.4 group-id 10ip nat outside,N+1場(chǎng)景及配置,radius-clientcache-interval 0ipaddress 192.168.2.6 radius-server 192.168.3.249 authentic

49、ationkey bgateudp-port 1645 radius-server 192.168.3.249 accountingkey bgateudp-port 1646,N+1場(chǎng)景及配置,filter-policy port-dnsfilter-rule rule-dnsfilter-rule rule-portal domain group11aaa authentication radiusaaa acc

50、ounting radiusradius server 192.168.3.249 authenticationradius server 192.168.3.249 accounting,N+1場(chǎng)景及配置,domain group10aaa authentication radiusaaa accounting radiusradius server 192.168.3.249 authenticationradius s

51、erver 192.168.3.249 accounting,N+1場(chǎng)景及配置,ip-pool ap_group11ipaddress 102.0.0.1 255.255.255.0alloc-mode localdhcpmax-lease 300default-router 102.0.0.1available-interface port 9option-60 enterprise-code 1234vrrp-grou

52、p-id 11,N+1場(chǎng)景及配置,ip-pool dhcp_group11ipaddress 103.0.0.1 255.255.255.0alloc-mode localdhcpdns-server 221.4.8.1default-router 103.0.0.1max-lease 180filter-policy port-dnsavailable-interface port 9vrrp-group-id 11,

53、N+1場(chǎng)景及配置,ip-pool ap_group10ipaddress 100.0.0.1 255.255.255.0alloc-mode localdhcpmax-lease 300default-router 100.0.0.1available-interface port 8option-60 enterprise-code 1234vrrp-group-id 10,N+1場(chǎng)景及配置,ip-pool dhcp_g

54、roup10ipaddress 101.0.0.1 255.255.255.0alloc-mode localdhcpdefault-router 101.0.0.1dns-server 221.4.8.1max-lease 180available-interface port 8filter-policy port-dnsvrrp-group-id 10available-interface port 1avai

55、lable-interface port 3available-interface port 4 ip route 0.0.0.0 0.0.0.0 192.168.2.1,雙portal和雙radius組網(wǎng)和配置,config terminalhostname ZZ-SYDAC7000-XDL-Activeip dhcp activeip dhcp server 211.142.237.137ip nat router

56、ip nat static inside 192.168.100.2 211.142.237.141 255.255.255.255hotstandby priority 150hotstandby access-port 1hotstandby track-port 1hotstandby track-port 0,雙portal和雙radius組網(wǎng)和配置,wlan disableFront-Port-Serdes port

57、 3ex-portal ac-name 4001.0731.731.00portalserver 211.142.211.10 external url-head http://211.142.211.10wapi enableweb redirect-delay 0portal-secure-offnas-identifier 4014.0731.731.00.460,雙portal和雙radius組網(wǎng)和配置,rule p

58、ortal permit ip 0.0.0.0 0.0.0.0 211.142.211.10 255.255.255.255rule dns1 permit ip 0.0.0.0 0.0.0.0 211.136.17.108 255.255.255.255rule dns2 permit ip 0.0.0.0 0.0.0.0 211.142.236.87 255.255.255.255portal-bind-type domai

59、n-----------------使用domain中的portalual，綁定域, 域名需要配置為SSIDwireless ssid-match-domain enable----不同的ssid使用不同的radius,雙portal和雙radius組網(wǎng)和配置,interface GigabitEthernet 1/1.0duplex fulldescription link-xiaxing interface GigabitE

60、thernet 1/2.0 duplex full ip address 192.168.100.1 255.255.255.0 interface GigabitEthernet 1/3.0 ip address 192.168.150.1 255.255.255.0 standby peerip 192.168.150.2 group-id 10 duplex full,雙portal和雙radius組網(wǎng)和配置,inte

61、rface FastEthernet 0/0ip address 192.168.3.1 255.255.255.0 interface GigabitEthernet 1/0.0ip address 211.142.237.137 255.255.255.248standby vrip 211.142.237.139 group-id 10ip nat outsideduplex fulldescription Lin

62、k-shangxing,雙portal和雙radius組網(wǎng)和配置,radius-clientipaddress 211.142.237.139cache-interval 0 radius-server 211.142.211.7 authenticationkey hnydtest radius-server 211.142.211.7 accountingkey hnydtest radius-server 211.1

63、42.211.8 authenticationkey hnydtest radius-server 211.142.211.8 accounting,雙portal和雙radius組網(wǎng)和配置,domain 123----已有的ssid portal-url http://211.142.211.253/wlan/index.phpradius server 211.142.211.7 authenticationradius