- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 新华三人才研学中心
- 关于我们
79-WIPS功能典型配置举例(V5)
本章节下载： 79-WIPS功能典型配置举例(V5) (226.44 KB)
WIPS功能典型配置举例(V5)
资料版本：6W114-20210416
Copyright © 2008-2021 新华三技术有限公司 版权所有，保留一切权利。
非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部，并不得以任何形式传播。
除新华三技术有限公司的商标外，本手册中出现的其它公司的商标、产品标识及商品名称，由各自权利人拥有。
本文档中的信息可能变动，恕不另行通知。
目 录
本文档介绍用户通过配置WIPS（Wireless Intrusion Prevention System，无线入侵防护）功能实现非法设备检测的配置举例。
本文档不严格与具体软、硬件版本对应，如果使用过程中与产品实际情况有差异，请参考相关产品手册，或以设备实际情况为准。
本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。
本文档假设您已了解WIPS的相关功能。
如图1所示，WIPS AC通过Switch A与Sensor相连，WIPS AC作为DHCP server为Sensor分配IP地址，Client关联的Rogue AP作为Sensor检测的对象。现要求： 配置WIPS功能，使Sensor能够检测网络中是否存在Rogue AP。
图1 WIPS检测非法设备组网图
为了使AP能够成为WIPS功能中的Sensor，需要在AP的radio射频配置中将WIPS检测模式配置为带外模式。
· WIPS特性需要安装License才可使用。
· 配置AP的序列号时请确保该序列号与AP唯一对应，AP的序列号可以通过AP设备背面的标签获取。
(1) 配置WIPS AC的接口
# 创建VLAN 100及其对应的VLAN接口，并为该接口配置IP地址。WIPS AC将使用该接口的IP地址与AP建立LWAPP隧道。
<WIPS AC> system-view
[WIPS AC] vlan 100
[WIPS AC-vlan100] quit
[WIPS AC] interface Vlan-interface 100
[WIPS AC-Vlan-interface100] ip address 150.100.1.1 16
[WIPS AC-Vlan-interface100] quit
# 将与Switch相连的接口GigabitEthernet1/0/1的链路类型配置为Trunk，当前Trunk口的PVID为100，禁止VLAN1通过，允许VLAN 100通过。
[WIPS AC] interface gigabitethernet 1/0/1
[WIPS AC-GigabitEthernet1/0/1] port link-type trunk
[WIPS AC-GigabitEthernet1/0/1] port trunk pvid vlan 100
[WIPS AC-GigabitEthernet1/0/1] undo port trunk permit vlan 1
[WIPS AC-GigabitEthernet1/0/1] port trunk permit vlan 100
[WIPS AC-GigabitEthernet1/0/1] quit
(2) 配置DHCP
# 在WIPS AC上开启DHCP服务。
[WIPS AC] dhcp enable
# 配置DHCP地址池vlan100为AP动态分配的网段为150.100.0.0/16，网关地址为150.100.1.1。
[WIPS AC] dhcp server ip-pool vlan100
[WIPS AC-dhcp-pool-vlan100] network 150.100.1.1 16
[WIPS AC-dhcp-pool-vlan100] gateway-list 150.100.1.1
[WIPS AC-dhcp-pool-vlan100] quit
(3) 配置AP作为带外Sensor
# 创建型号为WA2620E-AGN的AP模板名为officeap，指定其序列号。
[WIPS AC] wlan ap officeap model WA2620E-AGN
[WIPS AC-wlan-ap-officeap] serial-id 21023529G007C000020
# 在AP的Radio1上开启WIPS功能并采用带外Sensor模式，使能AP的radio 1射频。
[WIPS AC-wlan-ap-officeap] radio 1
[WIPS AC-wlan-ap-officeap-radio-1] wips detect mode detect-only
[WIPS AC-wlan-ap-officeap-radio-1] radio enable
[WIPS AC-wlan-ap-officeap-radio-1] return
(4) 配置WIPS
# 进入WIPS视图。
[WIPS AC] wlan ips
# 配置自定义AP分类规则test：当检测到AP使用的无线服务的SSID为service时，该AP会被归类为Rogue AP。
[WIPS AC-wlan-ips] ap-classification-rule test
[WIPS AC-wlan-ips-class-test] sub-rule ssid case-sensitive equal service
[WIPS AC-wlan-ips-class-test] classify-type rogue-ap
[WIPS AC-wlan-ips-class-test] quit
# 配置WIPS虚拟安全域testvsd。
[WIPS AC-wlan-ips] virtual-security-domain testvsd
# 将officeap添加到虚拟安全域testvsd，并绑定自定义AP分类规则test。
[WIPS AC-wlan-ips-vsd-testvsd] sensor officeap
[WIPS AC-wlan-ips-vsd-testvsd] ap-classification-rule test
[WIPS AC-wlan-ips-vsd-testvsd] quit
# 使能WIPS功能。
[WIPS AC-wlan-ips] wips enable
(1) 配置AC的接口
# 创建VLAN 100及其对应的VLAN接口，并为该接口配置IP地址。AC将使用该接口的IP地址与AP建立LWAPP隧道。同时VLAN100为无线用户接入的VLAN。
<AC> system-view
[AC] vlan 100
[AC-vlan100] quit
[AC] interface vlan-interface 100
[AC-Vlan-interface100] ip address 192.168.1.1 24
[AC-Vlan-interface100] quit
# 将与Switch相连的接口GigabitEthernet1/0/1的链路类型配置为Trunk，配置PVID为100，禁止VLAN1通过，允许VLAN 100通过。
[AC] interface gigabitethernet 1/0/1
[AC-GigabitEthernet1/0/1] port link-type trunk
[AC-GigabitEthernet1/0/1] port trunk pvid vlan 100
[AC-GigabitEthernet1/0/1] undo port trunk permit vlan 1
[AC-GigabitEthernet1/0/1] port trunk permit vlan 100
[AC-GigabitEthernet1/0/1] quit
(2) 配置DHCP
# 在AC上开启DHCP服务。
[AC] dhcp enable
# 配置DHCP地址池vlan100为AP动态分配的网段为192.168.1.0/24，网关地址为192.168.1.1。
[AC] dhcp server ip-pool vlan100
[AC-dhcp-pool-vlan100] network 192.168.1.0 24
[AC-dhcp-pool-vlan100] gateway-list 192.168.1.1
[AC-dhcp-pool-vlan100] quit
(3) 配置WLAN-ESS接口
# 创建WLAN-ESS1接口，并设置端口的链路类型为Hybrid类型。
[AC] interface wlan-ess 1
[AC-WLAN-ESS1] port link-type hybrid
# 配置当前Hybrid端口的PVID为VLAN 100，禁止VLAN 1通过，允许VLAN 100不带tag通过。
[AC-WLAN-ESS1] undo port hybrid vlan 1
[AC-WLAN-ESS1] port hybrid vlan 100 untagged
[AC-WLAN-ESS1] port hybrid pvid vlan 100
# 使能MAC VLAN功能。
[AC-WLAN-ESS1] mac-vlan enable
[AC-WLAN-ESS1] quit
(4) 配置无线服务
# 创建clear类型的服务模板1。
[AC] wlan service-template 1 clear
# 设置当前服务模板的SSID为service。
[AC-wlan-st-1] ssid service
# 将WLAN-ESS1接口绑定到服务模板1。
[AC-wlan-st-1] bind wlan-ess 1
# 启用无线服务。
[AC-wlan-st-1] service-template enable
[AC-wlan-st-1] quit
# 创建型号为WA2620E-AGN的AP模板名为rouge，指定其序列号。
[AC] wlan ap rouge model WA2620E-AGN
[AC-wlan-ap- rouge] serial-id 21023529G007C000021
# 在AP的Radio1上绑定服务模板，使能AP的radio 1射频。
[AC-wlan-ap-rouge] radio 1
[AC-wlan-ap-rouge-radio-1] service-template 1
[AC-wlan-ap-rouge-radio-1] radio enable
[AC-wlan-ap-rouge-radio-1] return
# 创建VLAN 100，用于转发AC和AP间LWAPP隧道内的流量。
<Switch A> system-view
[Switch A] vlan 100
[Switch A-vlan100] quit
# 配置Switch A与AC相连的GigabitEthernet1/0/1接口的属性为Trunk，配置PVID为100，禁止VLAN 1通过，允许VLAN 100通过。
[Switch A] interface gigabitethernet1/0/1
[Switch A-GigabitEthernet1/0/1] port link-type trunk
[Switch A-GigabitEthernet1/0/1] undo port trunk permit vlan 1
[Switch A-GigabitEthernet1/0/1] port trunk permit vlan 100
[Switch A-GigabitEthernet1/0/1] port trunk pvid vlan 100
[Switch A-GigabitEthernet1/0/1] quit
# 配置Switch A与AP相连的GigabitEthernet1/0/2接口属性为Access，并允许VLAN100通过。
[Switch A] interface gigabitethernet1/0/2
[Switch A-GigabitEthernet1/0/2] port link-type access
[Switch A-GigabitEthernet1/0/2] port access vlan 100
# 配置Switch A与AP相连的GigabitEthernet1/0/2接口使能PoE功能。
[Switch A-GigabitEthernet1/0/2] poe enable
[Switch A-GigabitEthernet1/0/2] quit
# 创建VLAN 100，用于转发AC和AP间LWAPP隧道内的流量和无线用户的接入。
<Switch B> system-view
[Switch B] vlan 100
[Switch B-vlan100] quit
# 配置Switch B与AC相连的GigabitEthernet1/0/1接口的属性为Trunk，配置PVID为100，禁止VLAN 1通过，允许VLAN 100通过。
[Switch B] interface gigabitethernet1/0/1
[Switch B-GigabitEthernet1/0/1] port link-type trunk
[Switch A-GigabitEthernet1/0/1] undo port trunk permit vlan 1
[Switch B-GigabitEthernet1/0/1] port trunk permit vlan 100
[Switch B-GigabitEthernet1/0/1] port trunk pvid vlan 100
[Switch B-GigabitEthernet1/0/1] quit
# 配置Switch B与AP相连的GigabitEthernet1/0/2接口属性为Access，并允许VLAN 100通过。
[Switch B] interface gigabitethernet1/0/2
[Switch B-GigabitEthernet1/0/2] port link-type access
[Switch B-GigabitEthernet1/0/2] port access vlan 100
# 配置Switch B与AP相连的GigabitEthernet1/0/2接口使能PoE功能。
[Switch B-GigabitEthernet1/0/2] poe enable
[Switch B-GigabitEthernet1/0/2] quit
(1) 在WIPS AC上通过命令行display wlan ips device ap和命令display wlan ips device client查看检测到Rogue AP设备和Unauthorized Client（在Rogue AP上线的Client按照WIPS的规则会被分类到Unauthorized Client）设备。
[WIPS AC] display wlan ips devices ap
SL = severity level, #S = number of reporting sensors, S = status
VSD = virtual security domain, I = inactive, A = active
Cli = client, Chl = channel
Detected Wireless Devices
--------------------------------------------------------------------------------
MAC-Address Type Classification SL Last-Time #S Chl S
--------------------------------------------------------------------------------
VSD default: 0
VSD testvsd: 1
5866-ba20-6e61 AP Rogue 0 2014-01-23/19:11:56 1 60 A
--------------------------------------------------------------------------------
[WIPS AC] display wlan ips devices client
SL = severity level, #S = number of reporting sensors, S = status
VSD = virtual security domain, I = inactive, A = active
Cli = client, Chl = channel
Detected Wireless Devices
--------------------------------------------------------------------------------
MAC-Address Type Classification SL Last-Time #S Chl S
--------------------------------------------------------------------------------
VSD default: 0
VSD testvsd: 1
0015-0062-6580 Cli Unauthorized - 2014-01-23/19:14:14 1 60 A
--------------------------------------------------------------------------------
(2) 在WIPS AC上通过命令行display wlan ips device ap rogue verbose可以查看Rogue AP的详细信息，该AP的SSID为service。
[WIPS AC] display wlan ips devices ap rogue verbose
Detected Wireless Devices
--------------------------------------------------------------------------------
VSD: default
Total Number of APs: 0
--------------------------------------------------------------------------------
VSD: testvsd
Total Number of APs: 1
--------------------------------------------------------------------------------
BSSID : 5866-ba20-6e61
Vendor: Hangzhou H3C Technologies Co., Limited
SSID : service
Status : Active
Classification : Rogue
Severity Level : 0
Security : Clear
Encrypt Method : -NA-
Authentication Method : None
Radio Type : 802.11an
Channel : 60
In Countermeasure List : No
Up Time : 2014-01-23/17:44:25
First Reported Time : 2014-01-23/17:44:26
Last Reported Time : 2014-01-23/19:15:07
Reporting Sensor : 1
Sensor 1 : officeap
RadioId : 1
RSSI : 22
Last Reported Time : 2014-01-23/19:15:07
Attached Clients : 1
Client 1 : 0015-0062-6580
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
(3) 在WIPS AC上通过命令行display wlan ips device client unauthorized verbose查看该未授权Client的详细信息。
[WIPS AC] display wlan ips devices client unauthorized verbose
Detected Wireless Devices
--------------------------------------------------------------------------------
VSD: default
Total Number of Clients: 0
--------------------------------------------------------------------------------
VSD: testvsd
Total Number of Clients: 1
--------------------------------------------------------------------------------
MAC Address: 0015-0062-6580
Vendor: Intel Corporate
BSSID : 5866-ba20-6e61
Status : Active
State : Association
Classification : Unauthorized
RadioType : 802.11an
Channel : 60
In Countermeasure List : No
First Reported Time : 2014-01-23/17:57:11
Last Reported Time : 2014-01-23/19:18:50
Reporting Sensor : 1
Sensor 1 : officeap
RadioId : 1
RSSI : 21
Last Reported Time : 2014-01-23/19:18:50
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
· WIPS AC
#
vlan 100
#
dhcp server ip-pool vlan100
network 150.100.0.0 mask 255.255.0.0
gateway-list 150.100.1.1
#
interface Vlan-interface100
ip address 150.100.1.1 255.255.0.0
#
interface GigabitEthernet1/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk permit vlan 100
#
wlan ap officeap model WA2620E-AGN id 1
serial-id 21023529G007C000020
radio 1
wips detect mode detect-only
radio enable
radio 2
#
wlan ips
wips enable
malformed-detect-policy default
signature deauth_flood signature-id 1
signature broadcast_deauth_flood signature-id 2
signature disassoc_flood signature-id 3
signature broadcast_disassoc_flood signature-id 4
signature eapol_logoff_flood signature-id 5
signature eap_success_flood signature-id 6
signature eap_failure_flood signature-id 7
signature pspoll_flood signature-id 8
signature cts_flood signature-id 9
signature rts_flood signature-id 10
signature-policy default
countermeasure-policy default
attack-detect-policy default
ap-classification-rule test
classify-type rogue-ap
sub-rule ssid case-sensitive equal service
virtual-security-domain default
attack-detect-policy default
malformed-detect-policy default
signature-policy default
countermeasure-policy default
virtual-security-domain testvsd
attack-detect-policy default
malformed-detect-policy default
signature-policy default
countermeasure-policy default
ap-classification-rule test precedence 0
sensor officeap
#
dhcp enable
#
· AC
#
vlan 200
#
dhcp server ip-pool vlan100
network 192.168.1.0 mask 255.255.255.0
gateway-list 192.168.1.1
#
wlan service-template 1 clear
ssid service
bind WLAN-ESS 1
service-template enable
#
interface WLAN-ESS1
port link-type hybrid
undo port hybrid vlan 1
port hybrid vlan 200 untagged
port hybrid pvid vlan 200
mac-vlan enable
#
wlan ap rouge model WA2620E-AGN id 1
serial-id 21023529G007C000021
radio 1
service-template 1
radio enable
radio 2
#
dhcp enable
#
· Switch A
#
vlan 100
#
interface GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100
port trunk pvid vlan 100
#
interface GigabitEthernet1/0/2
port link-mode bridge
port access vlan 100
poe enable
#
· Switch B
#
vlan 100
#
interface GigabitEthernet1/0/1
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100
port trunk pvid vlan 100
#
interface GigabitEthernet1/0/2
port link-type access
port access vlan 100
poe enable
#
· 《H3C无线控制器产品 配置指导》中的“WLAN配置指导”。
· 《H3C无线控制器产品 命令参考》中的“WLAN命令参考”。
不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!
支持
售前咨询
售后咨询
人工在线咨询
