- Table of Contents
-
- H3C Access Points Comware 7 Configuration Examples-6W100
- 00-Preface
- 01-H3C Access Points Comware 7 WPA2-PSK Encryption Configuration Examples
- 02-H3C Access Points Comware 7 Client Rate Limiting Configuration Examples
- 03-H3C Access Points Comware 7 NAT Configuration Examples
- 04-H3C Access Points Comware 7 PPPoE Configuration Examples
- 05-H3C Access Points Comware 7 Mesh WDS Configuration Examples
- 06-H3C Access Points Comware 7 Local MAC Authentication (IPv6) Configuration Examples
- 07-H3C Access Points Comware 7 IPv6 Configuration Examples
- 08-H3C Access Points Comware 7 Remote 802.1X Authentication (IPv6) Configuration Examples
- 09-H3C Access Points Comware 7 Layer 2 IPv6 Multicast Configuration Examples
- 10-H3C Access Points Comware 7 Layer 3 IPv6 Multicast Configuration Examples
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 01-H3C Access Points Comware 7 WPA2-PSK Encryption Configuration Examples | 66.02 KB |
|
H3C Access Points |
|
Comware 7 WPA2-PSK Encryption |
|
Configuration Examples |
Document version: 6W100-20201125
Copyright © 2020 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.
The information in this document is subject to change without notice.
Introduction
The following information provides an example for configuring WPA2-PSK encryption.
Prerequisites
This document applies to Comware 7-based access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access points.
The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
This document assumes that you have basic knowledge of WLAN access and WLAN security.
Example: Configuring WPA2-PSK encryption
Network configuration
As shown in Figure 1, the clients access the WLAN provided by the fat AP. The fat AP obtains IP addresses from a DHCP server in the IP network.
· Configure the fat AP to act as a DHCP server to assign IP addresses to the clients.
· Configure WPA2-PSK encryption on the fat AP.
· Configure open-system authentication and bypass authentication.
· Set the AKM mode to PSK to protect client data transmission.
· Set the CCMP cipher suite for frame encryption, and enable the RSN IE in beacon and probe responses.
Procedures
1. Configure AP interfaces:
# Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The AP will use this IP address to communicate with clients.
[WA5530] vlan 100
[WA5530-vlan100] quit
[WA5530] interface vlan-interface 100
[WA5530-Vlan-interface100] ip address 192.1.1.1 24
[WA5530-Vlan-interface100] quit
# Configure uplink interface VLAN-interface 1 to obtain IP addresses through DHCP.
[WA5530] interface vlan-interface 1
[WA5530-Vlan-interface1] undo ip address
[WA5530-Vlan-interface1] ip address dhcp-alloc
[WA5530-Vlan-interface1] quit
2. Configure wireless services:
# Create service template service and enter its view.
[WA5530] wlan service-template service
# Configure the SSID as service.
[WA5530-wlan-st-service] ssid service
# Specify VLAN 100 for clients to access the WLAN defined by the service template.
[WA5530-wlan-st-service] vlan 100
# Set the AKM mode to PSK and configure simple character string 12345678 as the PSK.
[WA5530-wlan-st-service] akm mode psk
[WA5530-wlan-st-service] preshared-key pass-phrase simple 12345678
# Set the CCMP cipher suite for frame encryption, and enable the RSN IE in beacon and probe responses.
[WA5530-wlan-st-service] cipher-suite ccmp
[WA5530-wlan-st-service] security-ie rsn
# Enable the service template.
[WA5530-wlan-st-service] service-template enable
[WA5530-wlan-st-service] quit
3. Bind the service template to interface WLAN-Radio 1/0/1.
[WA5530] interface wlan-radio 1/0/1
[WA5530-WLAN-Radio1/0/1] service-template service
[WA5530-WLAN-Radio1/0/1] quit
4. Configure the DHCP service:
# Enable DHCP.
[WA5530] dhcp enable
# Create a DHCP address pool named vlan100, specify subnet 192.1.1.0/24, and specify gateway address 192.1.1.1.
[WA5530] dhcp server ip-pool vlan100
[WA5530-dhcp-pool-vlan100] network 192.1.1.0 mask 255.255.255.0
[WA5530-dhcp-pool-vlan100] gateway-list 192.1.1.1
[WA5530-dhcp-pool-vlan100] quit
Verifying the configuration
# Verify that the clients can access the WLAN through PSK authentication.
[WA5530] display wlan client verbose
Total number of clients: 1
MAC address : 3829-5a40-9589
IPv4 address : 192.1.1.2
IPv6 address : N/A
Username : N/A
AID : 1024
Radio ID : 1
SSID : service
BSSID : d461-fe59-4d20
VLAN ID : 1
Sleep count : 3
Wireless mode : 802.11an
Channel bandwidth : 40MHz
20/40 BSS Coexistence Management : Supported
SM power save : Enabled
SM power save mode : Static
Short GI for 20MHz : Supported
Short GI for 40MHz : Supported
STBC RX capability : Supported
STBC TX capability : Not supported
LDPC RX capability : Not supported
Block Ack : TID 0 In
Supported HT MCS set : 0, 1, 2, 3, 4, 5, 6, 7
Supported rates : 6, 9, 12, 18, 24, 36,
48, 54 Mbps
QoS mode : WMM
Listen interval : 2
RSSI : 48
Rx/Tx rate : 135/6
Authentication method : Open system
Security mode : RSN
AKM mode : PSK
Cipher suite : CCMP
User authentication mode : Bypass
Authorization ACL ID : N/A
Authorization user profile : N/A
Roam status : N/A
Key derivation : SHA1
PMF status : N/A
Forwarding policy name : N/A
Online time : 0days 0hours 0minutes 8seconds
FT status : Inactive
Configuration files
#
version 7.1.064, ESS 2326
#
sysname WA5530
#
telnet server enable
#
port-security enable
#
dhcp enable
#
password-recovery enable
#
vlan 1
#
vlan 100
#
dhcp server ip-pool vlan100
gateway-list 192.1.1.1
network 192.1.1.0 mask 255.255.255.0
#
wlan service-template service
ssid service
vlan 100
akm mode psk
preshared-key pass-phrase cipher $c$3$7hZ2DNiI+h/ajPE7DhZbD6Y7py9vqf4721sp
cipher-suite ccmp
security-ie rsn
service-template enable
#
interface NULL0
#
interface Vlan-interface1
ip address dhcp-alloc
#
interface Vlan-interface100
ip address 192.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/1
#
interface GigabitEthernet1/0/2
#
interface WLAN-Radio1/0/1
service-template service
#
interface WLAN-Radio1/0/2
service-template 1
#
interface WLAN-Radio1/0/3
service-template 1
#
return
Related documentation
· WLAN Access Command Reference in H3C Access Points Command References
· WLAN Access Configuration Guide in H3C Access Points Configuration Guides
· WLAN Security Command Reference in H3C Access Points Command References
· WLAN Security Configuration Guide in H3C Access Points Configuration Guides
