H3C Anchor Access Points in AC Mode Configuration Examples-6W100

HomeSupportConfigure & DeployConfiguration ExamplesH3C Anchor Access Points in AC Mode Configuration Examples-6W100
06-H3C Anchor AC Mode Remote 802.1X Auth in Local Forwarding Configuration Examples

 

H3C Anchor Access Points in AC Mode

Remote 802.1X Authentication (Local Forwarding Deployment) Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Copyright © 2022 New H3C Technologies Co., Ltd. All rights reserved.

No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.

Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.

The information in this document is subject to change without notice.



Introduction

The following information provides an example for configuring remote 802.1X authentication when an anchor AP acts as an AC in a local forwarding mode deployment. In this deployment mode, fit APs act as data traffic forwarders for clients.

Prerequisites

The following information applies to Comware 7-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the devices.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of AAA, 802.1X, and WLAN access.

Example: Configuring remote 802.1X authentication

The AC in this example is an anchor AP that acts as an AC.

Network configuration

As shown in Figure 1:

·     The switch acts as a DHCP server to assign IP addresses to the AP and the client.

·     Establish the CAPWAP tunnels between the AC and the AP in VLAN 100.

·     Connect the client to the WLAN network in VLAN 200.

·     Use IMC as the RADIUS server to do authentication, authorization, and accounting for the client.

Configure the network to meet the following requirements:

·     The AP forwards the data traffic from the client directly.

·     Use 802.1X AKM to authenticate clients and protect data transmission between the clients and the AP.

·     The IMC server dynamically changes the authorization for the client or forces the client offline.

Figure 1 Network diagram

 

Analysis

·     To have the AP forward client data traffic in VLAN 200 on GigabitEthernet 1/0/1, edit a .txt configuration file to add the port to VLAN 200 and upload the file to the AC.

·     For the RADIUS server to dynamically change client authorization or force clients offline, you must enable the RADIUS session-control feature on the AC.

·     To do dynamic authorization for clients, configure the AC as a RADIUS DAE server (DAS).

Restrictions and guidelines

·     Make sure the fit APs deployed on the network are compatible with the anchor AP (the AC in this document).

·     Use the serial ID labeled on the AP's rear panel to specify an AP.

Procedures

Configuring the switch

Configuring interfaces on the switch

# Create VLAN 100 to transport the traffic in the CAPWAP tunnels between the AC and the AP.

<Switch> system-view

[Switch] vlan 100

[Switch-vlan100] quit

# Create VLAN 200 to transport radio packets for the client. 

[Switch] vlan 200

[Switch-vlan200] quit

# Create VLAN 2 for establishing connectivity to the IMC server.

[Switch] vlan 2

[Switch-vlan2] quit

# Create VLAN-interface 100 and assign an IP address to it.

[Switch] interface vlan-interface 100

[Switch-Vlan-interface100] ip address 2.2.1.100 255.255.255.0

[Switch-Vlan-interface100] quit

# Create VLAN-interface 200 and assign an IP address to it.

[Switch] interface vlan-interface 200

[Switch-Vlan-interface200] ip address 2.2.2.100 255.255.255.0

[Switch-Vlan-interface200] quit

# Create VLAN-interface 2 and assign an IP address to it.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.0.100 255.255.255.0

[Switch-Vlan-interface2] quit

# Assign the interface connected to the RADIUS server to VLAN 2. (Details not shown.)

# Configure GigabitEthernet 1/0/1 (the port connected to the AC) as a trunk port and assign it to VLANs 100 and 200.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] port link-type trunk

[Switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 (the port connected to the AP) as a trunk port, assign it to VLANs 100 and 200, and set its PVID to VLAN 100.

[Switch] interface gigabitethernet 1/0/2

[Switch-GigabitEthernet1/0/2] port link-type trunk

[Switch-GigabitEthernet1/0/2] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/2] port trunk pvid vlan 100

# Enable PoE.

[Switch-GigabitEthernet1/0/2] poe enable

[Switch-GigabitEthernet1/0/2] quit

Configuring the DHCP server

# Enable DHCP.

[Switch] dhcp enable

# Configure DHCP address pool 100 to assign IP addresses to APs. Specify 2.2.1.100 as a gateway address in the address pool.

[Switch] dhcp server ip-pool 100

[Switch-dhcp-pool-100] network 2.2.1.0 mask 255.255.255.0

[Switch-dhcp-pool-100] gateway-list 2.2.1.100

[Switch-dhcp-pool-100] forbidden-ip 2.2.1.1

[Switch-dhcp-pool-100] quit

# Configure DHCP address pool 200 to assign IP addresses to clients. In this example, the DNS server address is the same as the gateway address in the address pool. You must replace it with the actual address of the DNS server on your network.

[Switch] dhcp server ip-pool 200

[Switch-dhcp-pool-200] network 2.2.2.0 mask 255.255.255.0

[Switch-dhcp-pool-200] gateway-list 2.2.2.100

[Switch-dhcp-pool-200] dns-list 2.2.2.100

[Switch-dhcp-pool-200] forbidden-ip 2.2.2.1

[Switch-dhcp-pool-200] quit

# Configure the interface connected to the external network and the default route. (Details not shown.)

Editing the AP configuration file

# Use a text editor to edit the APs' configuration file, and then upload the file to the central AC. In this example, the configuration file name is map.txt. The following is the AP configuration for this example:

system-view

vlan 200

interface gigabitethernet1/0/1

port link-type trunk

port trunk permit vlan 200

Configuring the anchor AP in AC mode

Configuring interfaces on the AC

# Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The AC will use this IP address to establish CAPWAP tunnels with the AP.

<AC> system-view

[AC] vlan 100

[AC-vlan100] quit

[AC] interface vlan-interface 100

[AC-Vlan-interface100] ip address 2.2.1.1 24

[AC-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200, and assign an IP address to the VLAN interface. The client will be assigned to this VLAN.

[AC] vlan 200

[AC-vlan200] quit

[AC] interface vlan-interface 200

[AC-Vlan-interface200] ip address 2.2.2.1 24

[AC-Vlan-interface200] quit

# Configure GigabitEthernet 1/0/1 (the port connected to the switch) as a trunk port and assign it to VLANs 100 and 200.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[AC-GigabitEthernet1/0/1] quit

Configuring static routing

# Configure a static route to IMC (the RADIUS servers).

[AC] ip route-static 192.168.0.0 255.255.255.0 2.2.2.100

Configuring a RADIUS scheme

# Create a RADIUS scheme named radius1 and enter its view.

[AC] radius scheme radius1

# Specify the IP addresses of the primary authentication and accounting RADIUS servers.

[AC-radius-radius1] primary authentication 192.168.0.111

[AC-radius-radius1] primary accounting 192.168.0.111

# Set the shared key to radius in plain text for secure communication with the servers.

[AC-radius-radius1] key authentication simple radius

[AC-radius-radius1] key accounting simple radius

# Specify IP address 2.2.2.1 as the source IP address of outgoing RADIUS packets.

[AC-radius-radius1] nas-ip 2.2.2.1

[AC-radius-radius1] quit

# Enable the RADIUS session-control feature.

[AC] radius session-control enable

# Enable the RADIUS DAS feature and enter RADIUS DAS view.

[AC] radius dynamic-author server

# Specify the RADIUS server at 192.168.0.111 as a DAC and set the shared key to radius in plain text for validating DAE packets from the RADIUS server.

[AC-radius-da-server] client ip 192.168.0.111 key simple radius

[AC-radius-da-server] quit

Configuring the authentication domain

# Create an ISP domain named dm1 and enter its view.

[AC] domain dm1

# Apply RADIUS scheme radius1 to the ISP domain for LAN user authentication, authorization, and accounting.

[AC-isp-dm1] authentication lan-access radius-scheme radius1

[AC-isp-dm1] authorization lan-access radius-scheme radius1

[AC-isp-dm1] accounting lan-access radius-scheme radius1

# Configure the idle-cut feature to disconnect idle users in the domain. Users are considered idle if they fail to generate a minimum amount of traffic over a period set by the idle-cut timer. In this example, set the idle-cut timer to 15 minutes and the minimum traffic to 1024 bytes.

[AC-isp-dm1] authorization-attribute idle-cut 15 1024

[AC-isp-dm1] quit

Configuring 802.1X authentication

# Configure EAP relay as the method for the AC to exchange packets with the RADIUS server.

[AC] dot1x authentication-method eap

Configuring a service template

# Create service template st1 and enter its view.

[AC] wlan service-template st1

# Set the SSID of the service template to service.

[AC-wlan-st-st1] ssid service

# Assign VLAN 200 to the matching clients.

[AC-wlan-st-st1] vlan 200

# Set the AKM mode to 802.1X, specify the CCMP cipher suite, and enable the RSN IE in beacon and probe responses.

[AC-wlan-st-st1] akm mode dot1x

[AC-wlan-st-st1] cipher-suite ccmp

[AC-wlan-st-st1] security-ie rsn

# Set the access authentication mode to 802.1X and the ISP domain to dm1 for the matching clients.

[AC-wlan-st-st1] client-security authentication-mode dot1x

[AC-wlan-st-st1] dot1x domain dm1

# Specify APs as client data traffic forwarders.

[AC–wlan-st-st1] client forwarding-location ap

# Enable the service template.

[AC-wlan-st-st1] service-template enable

[AC-wlan-st-st1] quit

# Create an AP named office and specify its AP model and serial ID. In this example, the AP model is WA6638 and its serial ID is 219801A24F8198E00042.

[AC] wlan ap office model WA6638

[AC-wlan-ap-office] serial-id 219801A24F8198E00042

# Deploy the map.txt configuration file to the AP.

[AC-wlan-ap-office] map-configuration map.txt

# Enter the view of radio 1.

[AC-wlan-ap-office] radio 1

# Bind service template st1 to radio 1, and then enable the radio.

[AC-wlan-ap-office-radio-1] service-template st1

[AC-wlan-ap-office-radio-1] radio enable

[AC-wlan-ap-office-radio-1] quit

[AC-wlan-ap-office] quit

Configuring the RADIUS server

This example uses IMC as the RADIUS server, which runs PLAT 7.1(E0303p13), IMC EIA 7.1(F0302p08), and EIP 7.1(F0302p08).

Adding the AC to IMC as an access device

1.     Log in to IMC and click the User tab.

2.     From the navigation pane, select User Access Policy > Access Device Management > Access Device.

3.     Click Add.

4.     On the Add Access Device page that opens, add the AC as an access device to IMC:

a.     In the Access Configuration area, enter radius in the Shared Key and Confirm Shared Key fields. Use the default values for other parameters.

The shared key must be the same as the authentication and accounting shared keys configured on the central AC.

b.     In the Device List area, click Select or Add Manually to add the AC at 2.2.2.1 as an access device.

The IP address must be the NAS IP specified in the RADIUS scheme on the AC.

c.     Click OK.

Figure 2 Adding the AC to IMC as an access device

 

Adding an access policy

1.     Click the User tab.

2.     From the navigation pane, select User Access Policy > Access Policy.

3.     Click Add.

4.     On the page that opens, add the access policy:

a.     Enter the access policy name.

b.     Select EAP-PEAP from the Preferred EAP Type list, and select EAP-MSCHAPv2 from the Subtype list.

The certificate subtype on the IMC server must be the same as the identity authentication method configured on the clients.

Use the default values for other parameters.

Figure 3 Adding an access policy

 

Adding an access service

1.     Click the User tab.

2.     From the navigation pane, select User Access Policy > Access Service.

3.     Click Add.

4.     On the Add Access Service page, add the access service:

a.     Enter dot1x in the Service Name field.

b.     Select dot1x (the access policy you have created) from the Default Access Policy list.

Use the default values for other parameters.

Figure 4 Adding an access service

 

Adding an access user

1.     Click the User tab.

2.     From the navigation pane, select Access User > All Access Users.

3.     Click Add.

4.     On the page that opens, add the client as an access user:

a.     If the user has been added to the platform, click Select to select that user. If the user has not been added to the platform, click Add User to add the user to the platform.

b.     Enter the access user account name for the user in the Account Name field and set a password for the account. In this example, the account name for the user is client and the password is dot1x11.

c.     Bind the access user account to the access service you have created.

Use the default values for other parameters.

Figure 5 Adding an access user

 

Configuring the client

Access the WLAN from a mobile phone

Search for WLAN networks and connect to the WLAN named service:

·     Select 801.1X EAP for security, set the EAP method to PEAP, set phase 2 authentication to MSCHAPv2, and select None for the CA certificate.

·     Enter the username and password to authenticate to the network. In this example, the username is client and the password is dot1x11.

·     Use the default values for other parameters.

Accessing the WLAN from a PC

The following information uses Windows 7 for example to describe the wireless adapter configuration procedure.

1.     Access the window for wireless network management:

a.     Click the Start menu icon, and then select the Control Panel option.

b.     Under Network and Internet, click View network status and tasks.

c.     In the Network and Sharing Center window, select Manage wireless networks.

2.     In the window that opens, click Add, and then select Manually create a network profile.

3.     In the wizard that opens, add the WLAN settings:

¡     Set the network name to 1X.

¡     Set the security type to WPA2-Enterprise.

¡     Set the encryption type to AES.

¡     Use the default values for other parameters.

¡     Click Next.

4.     After the network is created, select Change connection settings to configure security attributes for the network.

5.     In the dialog box that opens, configure the security attributes for the network:

a.     Click the Security tab.

b.     Select Microsoft: Protected EAP (PEAP) from the Choose a network authentication method list.

c.     Clear the Remember my credentials for this connection each time I’m logged on option.

6.     Click Settings to configure PEAP properties, as follows:

¡     Clear the Validate server certificate option.

¡     Clear the Enable Fast Reconnect option.

¡     Click the Configure button next to the option for the Select Authentication Method field.

¡     In the EAP MSCHAPv2 Properties dialog box that opens, clear the Automatically use my Windows logon name and password option, and then click OK.

7.     In the Protected EAP Properties dialog box, click OK.

8.     Configure advanced 802.1X and 802.11 settings:

a.     In the Wireless Network Properties dialog box, click Advanced Settings.

b.     On the 802.1X settings tab, select the Specify authentication mode option, and then select User authentication from the authentication mode list.

c.     Click the 802.11 settings tab, clear the Enable Pairwise Master Key (PMK) caching option, and then click OK.

9.     Connect to the WLAN network named service.

10.     On the authentication page that opens, enter the username and password to authenticate to the network. In this example, the username is client and the password is dot1x11.

Verifying the configuration

Verify that the client can pass 802.1X authentication and associate with the AP to access the network.

# Execute the display wlan client verbose command on the AC to verify the online state of the client.

[AC] display wlan client verbose

Total number of clients: 1

 

 MAC address                             : cc3a-61a8-fb8c

 IPv4 address                            : 2.2.2.3

 IPv6 address                            : N/A

 Username                                : client

 AID                                     : 1

 AP ID                                   : 3

 AP name                                 : office

 Radio ID                                : 1

 SSID                                    : service

 BSSID                                   : 741f-4ad4-1fe0

 VLAN ID                                : 200

 Sleep count                            : 0

 Wireless mode                          : 802.11ax

 Channel bandwidth                      : 80MHz

 SM power save                          : Disabled

 Short GI for 20MHz                     : Supported

 Short GI for 40MHz                     : Supported

 Short GI for 80MHz                     : Supported

 Short GI for 160/80+80MHz              : Not supported

 STBC RX capability                     : Supported

 STBC TX capability                     : Supported

 LDPC RX capability                     : Supported

 Beamformee STS capability              : N/A

 Number of Sounding Dimensions          : N/A

 SU beamformee capability               : Not supported

 MU beamformee capability               : Not supported

 Beamformee STS capability              : N/A

 Block Ack                              : N/A

 Supported VHT-MCS set                  : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

                                          NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

 Supported HT MCS set                   : 0, 1, 2, 3, 4, 5, 6, 7

                                          8, 9, 10, 11, 12, 13, 14,

                                          15

 Supported rates                        : 6, 9, 12, 18, 24, 36, 48, 54 Mbps

 5G 40And80MHz Channel bandwidth        : Supported

 5G 160MHz Channel bandwidth            : Not Supported

 5G 8080MHz Channel bandwidth           : Not Supported

 OFDMA random access RUs                : Not supported

 Supported HE-MCS set                   : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

                                          NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

 TWT scheduled                          : no

 QoS mode                               : WMM

 Listen interval                        : 10

 RSSI                                   : 0

 Rx/Tx rate                             : 0/0

 Authentication method                  : Open system

 Security mode                          : RSN

 AKM mode                               : 802.1X

 Cipher suite                           : CCMP

 User authentication mode               : 802.1X

 Authorization ACL ID                   : N/A

 Authorization user profile             : N/A

 Roam status                            : N/A

 Key derivation                         : SHA1

 PMF status                             : N/A

 Forwarding policy name                 : N/A

 Online time                            : 0days 0hours 0minutes 15seconds

 FT status                              : Inactive

 BTM status                             : Disabled

# Execute the display dot1x command on the AC to verify the online state of the 802.1X user (the client).

[AC] display dot1x connection

Total connections: 1

 

User MAC address           : cc3a-61a8-fb8c

AP name                    : office

Radio ID                   : 1

SSID                       : service

BSSID                      : 741f-4ad4-1fe0

Username                   : client

Authentication domain      : dm1

IPv4 address               : 2.2.2.3

Authentication method      : EAP

Initial VLAN               : 200

Authorization VLAN         : 200

Authorization ACL number   : N/A

Authorization user profile : N/A

Termination action         : Default

Session timeout period     : 36000001 s

Online from                : 2022/05/21 11:27:11

Online duration            : 0h 1m 1s

Configuration files

·     AC (anchor AP):

#

dot1x authentication-method eap

#

vlan 100

#

vlan 200

#

wlan service-template st1

 ssid service

 vlan 200

 akm mode dot1x

 cipher-suite ccmp

 security-ie rsn

 client-security authentication-mode dot1x

 dot1x domain dm1

 service-template enable

#

interface Vlan-interface100

 ip address 2.2.1.1 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

 ip route-static 192.168.0.0 24 2.2.2.100

#

 radius session-control enable

#

radius scheme radius1

 primary authentication 192.168.0.111

 primary accounting 192.168.0.111

 key authentication cipher $c$3$Sqgqz7lDs4XPnethmAgyAKVlke7qwEkYbQ==

 key accounting cipher $c$3$4J/JBRGwqB4F213furJMkB6JWYXBFjWE6g==

 nas-ip 2.2.2.1

#

radius dynamic-author server

 client ip 192.168.0.111 key cipher $c$3$AkTEB7OgMYnCqsfDeplhoAgXUek/rVrLZw==

#

domain dm1

 authorization-attribute idle-cut 15 1024

 authentication lan-access radius-scheme radius1

 authorization lan-access radius-scheme radius1

 accounting lan-access radius-scheme radius1

#

wlan ap office model WA6638

 serial-id 219801A24F8198E00042

 map-configuration flash:/map.txt

 radio 1

  radio enable

  service-template st1

 radio 2

#

·     Switch:

#

 dhcp enable

#

vlan 2

#

vlan 100

#

vlan 200

#

dhcp server ip-pool 100

 gateway-list 2.2.1.100

 network 2.2.1.0 mask 255.255.255.0

 forbidden-ip 2.2.1.1

#

dhcp server ip-pool 200

 gateway-list 2.2.2.100

 network 2.2.2.0 mask 255.255.255.0

 dns-list 2.2.2.100

 forbidden-ip 2.2.2.1

#

interface Vlan-interface2

 ip address 192.168.0.100 255.255.255.0

#

interface Vlan-interface100

 ip address 2.2.1.100 255.255.255.0

#

interface Vlan-interface200

 ip address 2.2.2.100 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/2

 port link-type trunk

 port trunk permit vlan 1 100 200

 port trunk pvid vlan 100

 poe enable

#

Related documentation

·     User Access and Authentication Configuration Guide in H3C Access Points Anchor AC Mode Configuration Guides

·     User Access and Authentication Command Reference in H3C Access Points Anchor AC Mode Command Reference

·     WLAN Access Configuration Guide in H3C Access Points Anchor AC Mode Configuration Guides

·     WLAN Access Command Reference in H3C Access Points Anchor AC Mode Command Reference

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网