security wpa2 psk pass-phrase 12345678 aes示例参考配置1：https://support.huawei.com/enterprise/zh/doc/EDOC1100008291/851c6a11
示例参考配置2：https://forum.huawei.com/enterprise/zh/forum.php?mod=viewthread&tid=411237
网络拓扑：
配置思路
1、配置AP、AC和周边网络设备之间实现三层互通
2、配置VLAN pool，用于作为业务VLAN
3、配置AP上线。
a 创建AP组，用于将需要进行相同配置的AP都加入到AP组，实现统一配置
b 配置AC的系统参数，包括国家码、AC与AP之间通信的源接口
c 配置AP上线的认证方式并离线导入AP，实现AP正常上线
4、配置WLAN业务参数，实现STA访问WLAN网络功能
前期规划表
1、AP管理VLAN ：VLAN10、VLAN100
vlan10 AP管理网管
vlan 100 AC与三层交换机互通网段
2、STA业务VLAN-VLAN pool，即用户无线网使用的网段，本次示例的dhcp pool是创建在三层交换机上
3、DHCP服务器
a、AC作为AP的DHCP服务器
b、核心交换机作为用户DHCP服务器,用户wlan网段有vlan 101-104共4个
4、AP地址池-vlan 10
5、AC源接口-VLANIF100：10.23.100.1/24
6、AP组：默认Default和新建的AP-group组
7、域管理模板：名称：defaul和国家码：中国
8、ssid模板：wlan-net和WLAQ
9、安全模板：wlan-net和Icerain
10、VAP模板：该模板会引用“安全模板”+“SSID模板”+“调用VLANID或VLAN_group”+转发模式_隧道模式
接入交换机（AP）配置
vlan batch 10
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
port-isolate enable group 1
#
interface GigabitEthernet0/0/2 //上联口配置
port link-type trunk
port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
port-isolate enable group 2
#
核心交换机配置
vlan batch 10 100 to 104
dhcp enable
//vlan 101 和 vlan 102配置接口DHCP
//vlan 103和 vlan 104启用全局DHCP
ip pool vlan103
gateway-list 10.23.103.1
network 10.23.103.0 mask 255.255.255.0
Lease day 15 hour 0 minute 0
dns-list 8.8.8.8 1.1.1.1
#
ip pool vlan104
gateway-list 10.23.104.1
network 10.23.104.0 mask 255.255.255.0
lease day 20 hour 0 minute 0
dns-list 8.8.8.8 1.1.1.1
#
interface Vlanif10
ip address 10.23.10.1 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.23.100.1
#
interface Vlanif100
ip address 10.23.100.2 255.255.255.0
#
interface Vlanif101
ip address 10.23.101.1 255.255.255.0
dhcp select interface
dhcp server lease day 30 hour 0 minute 0
dhcp server dns-list 8.8.8.8 1.1.1.1
#
interface Vlanif102
ip address 10.23.102.1 255.255.255.0
dhcp select interface
dhcp server lease day 30 hour 0 minute 0
dhcp server dns-list 8.8.8.8 1.1.1.1
#
interface Vlanif103
ip address 10.23.103.1 255.255.255.0
dhcp select global
#
interface Vlanif104
ip address 10.23.104.1 255.255.255.0
dhcp select global
interface GigabitEthernet0/0/1 //接入层交换机配置
port link-type trunk
port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/2 //与AC互联口配置
port link-type trunk
port trunk allow-pass vlan 100 to 105
#
interface GigabitEthernet0/0/3 //上联防火墙配置，这个可以忽视
port link-type trunk
port trunk allow-pass vlan 101 to 102
#
AC配置
dhcp enable
vlan batch 100 to 104
vlan pool sta-pool
vlan 101 to 102
ap auth-mode no-auth //AP自动注册，无验证
ip pool huawei //Vlan10-AP上线的DHCP配置
gateway-list 10.23.10.1
network 10.23.10.0 mask 255.255.255.0
option 43 sub-option 3 ascii 10.23.100.1
interface Vlanif100
ip address 10.23.100.1 255.255.255.0
dhcp select global
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 100 to 105
静态路由
ip route-static 10.23.10.0 255.255.255.0 10.23.100.2
重点wlan配置
1、创建两个security-profile模板
security-profile name Icerain
security wpa2 psk pass-phrase 12345678 aes
security-profile name wlan-net
security wpa2 psk pass-phrase 12345678 aes
2、创建两条ssid profile模板
ssid-profile name WLAQ
ssid WLAQ
ssid-profile name wlan-net
ssid wlan-net
3、创建两条vap-profile模板
vap-profile name TFB
forward-mode tunnel
service-vlan vlan-id 104
ssid-profile WLAQ
security-profile Icerain
vap-profile name wlan-net
forward-mode tunne
service-vlan vlan-pool sta-pool
ssid-profile wlan-net
security-profile wlan-net
4、默认AP组和新的AP组两种方式
新建的AP组
ap-group name ap-group1
radio 0
vap-profile wlan-net wlan 1 //这里调用vap-profile模板-wlan-net
radio 1
vap-profile wlan-net wlan 1 //这里调用vap-profile模板 -wlan-net
默认AP组
ap-group name default
radio 0
vap-profile TFB wlan 1 //这里调用vap-profile模板 -TFB
radio 1
vap-profile TFB wlan 1 //这里调用vap-profile模板 -TFB
5、AP默认上线的组是在Deault组里，所以要改变AP所在组，需要进入到AP里面，修改所属组即可
ap-id 0 type-id 45 ap-mac 00e0-fc4d-0e10 ap-sn 2102354483106517FD21 //第一台AP
ap-name area_1 //AP命名修改
ap-group ap-group1 //这里是修改AP组
radio 0
channel 20mhz 6
radio 1
channel 20mhz 149
ap-id 1 type-id 45 ap-mac 00e0-fc7d-6840 ap-sn 2102354483109A14716C //第二台AP
ap-name AP-2
ap-group Deault //默认组隐藏，不显示
