H3C Access Points
Comware 7 WPA2-PSK Encryption
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring WPA2-PSK encryption· 1

Network configuration· 1

Procedures· 1

Verifying the configuration· 2

Configuration files· 4

Related documentation· 4

 

Introduction

The following information provides an example for configuring WPA2-PSK encryption.

Prerequisites

This document applies to Comware 7-based access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access points.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of WLAN access and WLAN security.

Example: Configuring WPA2-PSK encryption

Network configuration

As shown in Figure 1, the clients access the WLAN provided by the AP. The AP obtains IP addresses from a DHCP server in the IP network.

·     Configure the AP to act as a DHCP server to assign IP addresses to the clients.

·     Configure WPA2-PSK encryption on the AP.

·     Configure open-system authentication and bypass authentication.

·     Set the AKM mode to PSK to protect client data transmission.

·     Set the CCMP cipher suite for frame encryption, and enable the RSN IE in beacon and probe responses.

Figure 1 Network diagram

 

Procedures

1.     Configure AP interfaces:

# Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The AP will use this IP address to communicate with clients.

<AP> system-view

[AP] vlan 100

[AP -vlan100] quit

[AP] interface vlan-interface 100

[AP-Vlan-interface100] ip address 192.1.1.1 24

[AP-Vlan-interface100] quit

# Configure uplink interface VLAN-interface 1 to obtain IP addresses through DHCP.

[AP] interface vlan-interface 1

[AP-Vlan-interface1] undo ip address

[AP-Vlan-interface1] ip address dhcp-alloc

[AP-Vlan-interface1] quit

2.     Configure wireless services:

# Create service template service and enter its view.

[AP] wlan service-template service

# Configure the SSID as service.

[AP-wlan-st-service] ssid service

# Specify VLAN 100 for clients to access the WLAN defined by the service template.

[AP-wlan-st-service] vlan 100

# Set the AKM mode to PSK and configure simple character string 12345678 as the PSK.

[AP-wlan-st-service] akm mode psk

[AP-wlan-st-service] preshared-key pass-phrase simple 12345678

# Set the CCMP cipher suite for frame encryption, and enable the RSN IE in beacon and probe responses.

[AP-wlan-st-service] cipher-suite ccmp

[AP-wlan-st-service] security-ie rsn

# Enable the service template.

[AP-wlan-st-service] service-template enable

[AP-wlan-st-service] quit

3.     Bind the service template to interface WLAN-Radio 1/0/1.

[AP] interface wlan-radio 1/0/1

[AP-WLAN-Radio1/0/1] service-template service

[AP-WLAN-Radio1/0/1] quit

4.     Configure the DHCP service:

# Enable DHCP.

[AP] dhcp enable

# Create a DHCP address pool named vlan100, specify subnet 192.1.1.0/24, and specify gateway address 192.1.1.1.

[AP] dhcp server ip-pool vlan100

[AP-dhcp-pool-vlan100] network 192.1.1.0 mask 255.255.255.0

[AP-dhcp-pool-vlan100] gateway-list 192.1.1.1

[AP-dhcp-pool-vlan100] quit

Verifying the configuration

# Verify that the clients can access the WLAN through PSK authentication.

[AP] display wlan client verbose

Total number of clients: 1

 

 MAC address                       : 502b-73dc-603a

 IPv4 address                      : 192.1.1.2

 IPv6 address                      : N/A

 Username                          : N/A

 AID                               : 1

 Radio ID                          : 1

 Channel                           : 36

 SSID                              : service

 BSSID                             : 743a-2013-6ba4

 VLAN ID                           : 100

 Service VLAN ID                   : N/A

 Sleep count                       : 3

 Wireless mode                     : 802.11ac

 Channel bandwidth                 : 80MHz

 SM power save                     : Disabled

 Short GI for 20MHz                : Supported

 Short GI for 40MHz                : Supported

 Short GI for 80MHz                : Supported

 Short GI for 160/80+80MHz         : Not supported

 STBC RX capability                : Not supported

 STBC TX capability                : Not supported

 LDPC RX capability                : Not supported

 Beamformee STS capability         : N/A

 Number of Sounding Dimensions     : N/A

 SU beamformee capability          : Not supported

 MU beamformee capability          : Not supported

 Block Ack                         : TID 0  Both

                                     TID 6  Out

 Supported VHT-MCS set             : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

 Supported HT MCS set              : 0, 1, 2, 3, 4, 5, 6, 7

 Supported rates                   : 6, 9, 12, 18, 24, 36,

                                     48, 54 Mbps

 QoS mode                          : WMM

 Listen interval                   : 1

 RSSI                              : 8

 Rx/Tx rate                        : 6.5/21.7 Mbps

 Speed                             : 0.544/0.216Kbps

 Authentication method             : Open system

 Security mode                     : RSN

 AKM mode                          : PSK

 Cipher suite                      : CCMP

 User authentication mode          : Bypass

 WPA3 status                       : Disabled

 Authorization CAR                 : N/A

 Authorization user group name     : N/A

 Authorization ACL ID              : N/A

 Authorization user profile        : N/A

 Roam status                       : N/A

 Key derivation                    : SHA1

 PMF status                        : N/A

 Forwarding policy name            : Not configured

 Online time                       : 0days 0hours 4minutes 26seconds

 FT status                         : Inactive

 BTM mode                          : Inactive

Configuration files

#

 dhcp enable

#

vlan 1

#

vlan 100

#

dhcp server ip-pool vlan100

 gateway-list 192.1.1.1

 network 192.1.1.0 mask 255.255.255.0

#

wlan service-template service

 ssid service

 vlan 100

 akm mode psk

 preshared-key pass-phrase cipher $c$3$7hZ2DNiI+h/ajPE7DhZbD6Y7py9vqf4721sp

 cipher-suite ccmp

 security-ie rsn

 service-template enable

#

interface NULL0

#

interface Vlan-interface1

ip address dhcp-alloc

#

interface Vlan-interface100

 ip address 192.1.1.1 255.255.255.0

#

interface WLAN-Radio1/0/1

 service-template service

#

return

Related documentation

·     WLAN Access Command Reference in H3C Access Points Command References

·     WLAN Access Configuration Guide in H3C Access Points Configuration Guides

·     WLAN Security Command Reference in H3C Access Points Command References

·     WLAN Security Configuration Guide in H3C Access Points Configuration Guides