组网需求

如图1所示，FAT AP通过有线方式接入Internet，通过无线方式连接终端。现某企业分支机构为了保证工作人员可以随时随地的访问公司网络，需要通过部署WLAN基本业务实现移动办公。

数据准备

配置思路

配置注意事项

纯组播报文由于协议要求在无线空口没有ACK机制保障，且无线空口链路不稳定，为了纯组播报文能够稳定发送，通常会以低速报文形式发送。如果网络侧有大量异常组播流量涌入，则会造成无线空口拥堵。为了减小大量低速组播报文对无线网络造成的冲击，建议在直连AP的交换机接口上配置组播报文抑制功能。配置前请确认是否有组播业务，如果有，请谨慎配置限速值。配置方法请参见如何配置组播报文抑制，减小大量低速组播报文对无线网络造成的冲击？。

操作步骤

1. 配置Router作为DHCP服务器，为STA分配IP地址

   # 配置基于接口地址池的DHCP服务器，GE1/0/0为STA提供IP地址。

   说明：

   DNS服务器地址请根据实际需要配置。常用配置方法如下：

   • 接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
   • 全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。

[Huawei]dis current-configuration
#http secure-server ssl-policy default_policyhttp server enable
#undo clock timezone
#
vlan batch 100 to 101
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name macportal_authen_profile
#
dns resolve
dns proxy enable
#
radius-server template default
#
pki realm defaultrsa local-key-pair defaultenrollment self-signed
#
ssl policy default_policy type serverpki-realm default                        version tls1.0 tls1.1 tls1.2             ciphersuite rsa_aes_128_cbc_sha rsa_aes_128_sha256 rsa_aes_256_sha256
#
acl name nat 2000                         rule 5 permit
#
free-rule-template name default_free_rule
#
portal-access-profile name portal_access_profile
#
aaa                                       authentication-scheme default            authentication-scheme radius             authentication-mode radius              authorization-scheme default             accounting-scheme default                domain default                           authentication-scheme default           domain default_admin                     authentication-scheme default           local-user admin password irreversible-cipher $1a$=VGg7L*Co$$R7i^U\v%u%6e^N*Nj{*9RvhKGmsC{$t:&,A-$4b3$local-user admin privilege level 15      local-user admin service-type ssh http
#
interface Vlanif1                         ip address 169.254.1.1 255.255.0.0       nat outbound 2000                        ip address dhcp-alloc unicast
#
interface Vlanif100                       ip address 192.168.100.200 255.255.255.0
#
interface Vlanif101                       ip address 192.168.1.200 255.255.255.0
#
interface GigabitEthernet0/0/0            port link-type access                    port default vlan 101                    mac-learning priority 3
#
interface NULL0
#                                         undo snmp-agent
#                                         stelnet server enable                    undo telnet server enable
ssh server secure-algorithms cipher aes256_ctr aes128_ctr
ssh server secure-algorithms hmac sha2_256
ssh server key-exchange dh_group14_sha1
ssh client secure-algorithms cipher aes256_ctr aes128_ctr
ssh client secure-algorithms hmac sha2_256
ssh client key-exchange dh_group14_sha1
#
user-interface con 0                      authentication-mode password             set authentication password cipher %^%#Jln(HwG8$'RnxlJ/{#pWXVd@.#_>D0JoC2~ze/=P;!,922n.nChp;N3}Q8$/%^%#
user-interface vty 0 4                    authentication-mode aaa                  protocol inbound ssh
user-interface vty 16 20                  protocol inbound all
#
wlan                                      traffic-profile name default             traffic-profile name default-ssid        security-profile name default            security-profile name zhiyi-new          security wpa-wpa2 psk pass-phrase %^%#Jc>Q&D61r.%HY5Fvod.JZUiW-=GoX0<"08<T@J]%%^%# aessecurity-profile name default-ssid       ssid-profile name default                ssid-profile name zhiyi-new              ssid zhiyi-new                          ssid-profile name default-ssid           ssid HUAWEI-27A0                        vap-profile name default                 vap-profile name zhiyi-new               service-vlan vlan-id 101                ssid-profile zhiyi-new                  security-profile zhiyi-new              vap-profile name default-ssid            service-vlan vlan-id 100                ssid-profile default-ssid               security-profile default-ssid           traffic-profile default-ssid            air-scan-profile name default            rrm-profile name default                 radio-2g-profile name default            radio-5g-profile name default            wids
#
interface Wlan-Radio0/0/0                 vap-profile default-ssid wlan 1          vap-profile zhiyi-new wlan 2             calibrate auto-txpower-select disable
#
interface Wlan-Radio0/0/1                 vap-profile default-ssid wlan 1          vap-profile zhiyi-new wlan 2             calibrate auto-txpower-select disable
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
#                                         undo ntp-service enable
#
return
[Huawei]