CISCO控制器无线AP配置方法-课件

2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID1CISCO控制器无线控制器无线AP配置配置方法方法2014年年6月月3日日2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID2CISCO控制器无线控制器无线AP配置方法配置方法准备工作1.控制器启动配置和升级控制器软件版本控制器启动配置和升级控制器软件版本2.熟悉控制器配置界面熟悉控制器配置界面3.连接连接AP到控制器上到控制器上配置任务1.思科思科CSSC无线客户端的安装和简单配置无线客户端的安装和简单配置2.构建一个构建一个OPEN和一个和一个WEP的无线网络的无线网络3.构建一个简单构建一个简单WEB认证的无线网络认证的无线网络4.构建一个支持本地构建一个支持本地EAP认证的无线网络认证的无线网络5.构建一个用构建一个用ACS做做AAA认证的无线网络认证的无线网络2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID3CISCO控制器无线AP配置方法准备工作2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID4CISCO控制器无线控制器无线AP配置方法配置方法控制器4400或者2100系列AP：1130或者1240系列交换机：最好是3560POE交换机2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID5CISCO控制器无线控制器无线AP配置方法配置方法支持支持802.11a/b/g/n支持支持PCI认证认证WLC2100 硬件硬件8个FE口，2个上联口，6个下联口其中2个FE口有以太网供电未使用端口未使用端口2个USB端口和一个扩展槽留作将来扩展用*2106和2006不能作为guestaccess的anchorcontroller*不支持LinkAggregation*不能通过软件升级AP容量AIR-WLC2125-K92100 Series WLAN Controller for up to 25 Lightweight APs$18,890AIR-WLC2112-K92100 Series WLAN Controller for up to 12 Lightweight APs$10,070AIR-WLC2106-K92100 Series WLAN Controller for up to 6 Lightweight APs$4,8752006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID6CISCO控制器无线控制器无线AP配置方法配置方法1RU高度2口或者4口千兆上联支持12,25,50or100AP支持5000MAC地址转发表10/100Base-TX以太网ServicePort9pin串口Console口2扩展槽和1个utilityport目前未使用2热插拔电源模块插槽44xx WLAN Controller型号4402支持12,25,和50AP型号4404支持100APs*不能通过软件升级AP容量*4400系列使用SFP光纤模块*4400系列每port支持50个AP2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID7CISCO控制器无线控制器无线AP配置方法配置方法网线和Console线。如果是4400，需要两头是DB9接口的线，如果是2106或者ISR，需要DB9+RJ45的线如果是4400，需要GLC光纤模块和光纤确认控制器版本是否需要升级(用命令showsysinfo查看系统版本)是否需要将胖AP升级到瘦AP1200/1100/1300需要upgradetool做升级，1250不需要工具，直接在图形化界面上升级2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID8CISCO控制器无线控制器无线AP配置方法配置方法TRUNKVLAN1/20/30/40fa0/1port1WLC说明：说明：1、VLAN1用于连接控制器、AP和ACS；2、VLAN20用于WPA/WPA2认证，认证服务器用ACS。3、VLAN30用作OPEN/WEP/GUEST客户接入3、VLAN40用作WPA/WPA2认证，认证用本地EAPSSID:VLAN20SSID:VLAN30PC/AAA服务器服务器VLAN1所有3层网关设置在3层交换机上，地址2542006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID9CISCO控制器无线控制器无线AP配置方法配置方法The controller boot sequence will always have these option available since this is set in PROM to ensure controller recovery options按5清空配置2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID10CISCO控制器无线控制器无线AP配置方法配置方法Wouldyouliketoterminateautoinstall?yes:SystemNameCisco_51:2b:60(31charactersmax):2106-demoAUTO-INSTALL:processterminated-noconfigurationloadedEnterAdministrativeUserName(24charactersmax):ciscoEnterAdministrativePassword(24charactersmax):ciscoRe-enterAdministrativePassword:ciscoManagementInterfaceIPAddress:192.168.10.1ManagementInterfaceNetmask:255.255.255.0ManagementInterfaceDefaultRouter:192.168.10.254ManagementInterfaceVLANIdentifier(0=untagged):ManagementInterfacePortNum1to8:1ManagementInterfaceDHCPServerIPAddress:192.168.10.254APManagerInterfaceIPAddress:192.168.10.2AP-ManagerisonManagementsubnet,usingsamevaluesAPManagerInterfaceDHCPServer(192.168.10.254):VirtualGatewayIPAddress:1.1.1.1Mobility/RFGroupName:demo2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID11CISCO控制器无线控制器无线AP配置方法配置方法EnableSymmetricMobilityTunnelingyesNO:yesNetworkName(SSID):openAllowStaticIPAddressesYESno:ConfigureaRADIUSServernow?YESno:noWarning!ThedefaultWLANsecuritypolicyrequiresaRADIUSserver.Pleaseseedocumentationformoredetails.EnterCountryCodelist(enterhelpforalistofcountries)US:CNEnable802.11bNetworkYESno:Enable802.11aNetworkYESno:Enable802.11gNetworkYESno:EnableAuto-RFYESno:ConfigureaNTPservernow?YESno:noConfigurethesystemtimenow?YESno:EnterthedateinMM/DD/YYformat:09/28/08EnterthetimeinHH:MM:SSformat:17:11:00Configurationcorrect?Ifyes,systemwillsaveitandreset.yesNO:yesConfigurationsaved!Resettingsystemwithnewconfiguration.非常重要，非常重要，Controller的的wireless的的domain要和要和AP一致。一致。2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID12CISCO控制器无线控制器无线AP配置方法配置方法pdhcpexcluded-address192.168.10.1ipdhcpexcluded-address192.168.10.254ipdhcpexcluded-address192.168.10.2!ipdhcppoolAPnetwork192.168.10.0255.255.255.0default-router192.168.10.254!interfaceFastEthernet0/1switchporttrunkencapsulationdot1qswitchportmodetrunkinterfaceVlan1ipaddress192.168.10.254255.255.255.0!interfaceVlan20ipaddress192.168.20.254255.255.255.0!interfaceVlan30ipaddress192.168.30.254255.255.255.0!interfaceVlan40ipaddress192.168.40.254255.255.255.0linevty04privilegelevel15passwordciscologin2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID13CISCO控制器无线控制器无线AP配置方法配置方法1、使用直通网线，连接交换机的trunk接口到控制器端口12、配置PC机的IP地址192.168.10.100/24或者DHCP，网关192.168.10.2543、测试PC能否Ping通Controller的地址：192.168.10.13、用访问控制器，如果要开启http访问，需要在系统里打开。2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID14CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID15CISCO控制器无线控制器无线AP配置方法配置方法tftp服务器推荐支持64M以上文件传输2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID16CISCO控制器无线控制器无线AP配置方法配置方法支持室内室外mesh版本支持802.11n和其他新功能的普通版本2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID17CISCO控制器无线控制器无线AP配置方法配置方法Current Software Release Upgrade Path to 5.0.148.0 Software 3.2.78.0orlater3.2releaseUpgradetoa4.1releasebeforeupgradingto5.0.148.0.4.0.155.5orlater4.0releaseUpgradetoa4.1or4.2releasebeforeupgradingto5.0.148.04.1.171.0orlater4.1releaseYoucanupgradedirectlyto5.0.148.0.4.2.61.0orlater4.2releaseYoucanupgradedirectlyto5.0.148.0.注意：由于配置存储格式不同，从3.x-4.x升级到5.x后，原来的部分配置可能丢失2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID18CISCO控制器无线控制器无线AP配置方法配置方法Current Software Release Upgrade Path to 4.1.171.0 Software 3.2.78.0Upgradeto4.0.206.0oralater4.0releasebeforeupgradingto4.1.171.0.3.2.116.213.2.150.103.2.171.63.2.193.5IfyourcontrollerisconfiguredwiththenewJ3countrycode,upgradeto3.2.195.10oralater3.2release.IfyourcontrollerisnotconfiguredforthenewJ3countrycode,youcanupgradeto3.2.195.10oralater3.2releaseorto4.0.206.0oralater4.0release.3.2.195.10orlater3.2releaseYoucanupgradedirectlyto4.1.171.0.4.0.155.5Upgradeto4.0.206.0oralater4.0releasebeforeupgradingto4.1.171.0.4.0.179.114.0.206.0orlater4.0releaseYoucanupgradedirectlyto4.1.171.0.2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID19CISCO控制器无线控制器无线AP配置方法配置方法Step1.pingserver-ip-address 测试控制器与T的连通性Step2.transferdownloadmodetftp设置传输使用的协议：tftpStep3.transferdownloaddatatypecode设置传输的数据类型Step4.transferdownloadserveripserver-ip-address指定tftp server的IP地址Step5.transferdownload 制定Image的文件名Step6.transferdownloadstart开始传输文件，确认时如果回答No,则显示TFTP的参数设置Step7.resetsystemWLC的系统重新启动注：TFTP服务器软件推荐t，可以在网上免费下载，支持64M以上大文件传输2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID20CISCO控制器无线控制器无线AP配置方法配置方法电脑上设置好Tftp软件；填入Tftp地址和文件名后，选择右侧的download按钮开始。完成后按提示reboot。2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID21CISCO控制器无线AP配置方法熟悉无线控制器Controller配置界面2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID22CISCO控制器无线控制器无线AP配置方法配置方法cisco2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID23CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID24CISCO控制器无线控制器无线AP配置方法配置方法andmore2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID25CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID26CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID27CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID28CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID29CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID30CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID31CISCO控制器无线控制器无线AP配置方法配置方法配置接口配置接口配置控制器配置控制器做做DHCP服务服务器器定义无线组定义无线组参看和配置参看和配置端口端口2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID32CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID33CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID34CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID35CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID36CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID37CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID38CISCO控制器无线控制器无线AP配置方法配置方法Radius服务器配置服务器配置本地用户数据库本地用户数据库MAC地址过滤地址过滤WEB认证相关认证相关配置配置本地本地EAP2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID39CISCO控制器无线控制器无线AP配置方法配置方法定义能够进行定义能够进行Controller管管理的管理用户理的管理用户2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID40CISCO控制器无线控制器无线AP配置方法配置方法系统和配置文系统和配置文件的上传、下件的上传、下载配置载配置控制器软重启控制器软重启2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID41CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID42CISCO控制器无线控制器无线AP配置方法配置方法TxPowerNumOfSupportedPowerLevels.6TxPowerLevel1.14dBmTxPowerLevel2.11dBmTxPowerLevel3.8dBmTxPowerLevel4.5dBmTxPowerLevel5.2dBmTxPowerLevel6.-1dBmAP1242的level1是17dBm2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID43CISCO控制器无线控制器无线AP配置方法配置方法Failover等级全局HA配置2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID44CISCO控制器无线AP配置方法连接AP到控制器2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID45CISCO控制器无线控制器无线AP配置方法配置方法Controller必需配置的接口带内管理接口“Management Interface”LWAPPTunnel终结接口“AP Manager Interface”桥接的无线客户端接口“Dynamic Interfaces”.二三层漫游而设的虚拟接口“Virtual Interface”可选接口:服务接口带外管理接口带外管理接口*2100系列和WLCM没有serviceport2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID46CISCO控制器无线控制器无线AP配置方法配置方法目前版本支持同时支持多国家2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID47CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID48CISCO控制器无线控制器无线AP配置方法配置方法在在AP和控制器不在同一网段的情况下，建立和控制器不在同一网段的情况下，建立AP能够获取能够获取IP Address 的地址池，加上的地址池，加上Option 43WLC-router(config)#ipdhcppoolLWLC-router(dhcp-config)#network192.168.10.0255.255.255.0WLC-router(dhcp-config)#default-router192.168.0.254WLC-router(dhcp-config)#option43ascii192.168.10.1“/很重要！通过很重要！通过Option 43 可以让可以让AP在获取和控制器不同网段在获取和控制器不同网段IP Address的时候，能够知道的时候，能够知道Controller的所在。的所在。如果如果AP和控制器在一个网段和广播域，则可以不配置和控制器在一个网段和广播域，则可以不配置option 43WLC-router(dhcp-config)#exitWLC-router(config)#ipdhcpexcluded-address192.168.0.2542006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID49CISCO控制器无线控制器无线AP配置方法配置方法对于1000/1500系列，直接写option43ascii“192.168.10.5,129.168.10.20“对于1100和1200，需要写option60和option43假设要连接1240，控制器地址为192.168.10.5和192.168.10.20ipdhcppoolAPnetwork192.168.10.0/24default-router192.168.10.254dns-server192.168.10.100option60ascii“CiscoAPc1240“option43hexf108c0a80a05c0a80a14option43的配置详见VCIString1130的是CiscoAPc1130类型=f1长度=2x4=08192.168.10.5192.168.10.202006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID50CISCO控制器无线控制器无线AP配置方法配置方法(CiscoController)debuglwappeventsenable(CiscoController)*Oct0419:20:19.154:00:1a:e3:d0:19:50ReceivedLWAPPDISCOVERYREQUESTfromAP00:1a:e3:d0:19:50to00:1e:13:51:2b:60onport8*Oct0419:20:19.154:Receivedapacketwhichisa(type=DISCOVERY_REQUEST)withsessionid0*Oct0419:20:19.154:JoinPriorityProcessingstatus=0,IncomingApsPriority1,MaxLrads=6,joinedAps=0*Oct0419:20:19.155:00:1a:e3:d0:19:50SuccessfultransmissionofLWAPPDiscoveryResponsetoAP00:1a:e3:d0:19:50onport8*Oct0419:20:19.156:00:1a:e3:d0:19:50ReceivedLWAPPDISCOVERYREQUESTfromAP00:1a:e3:d0:19:50toff:ff:ff:ff:ff:ffonport8*Oct0419:20:19.156:Receivedapacketwhichisa(type=DISCOVERY_REQUEST)withsessionid0*Oct0419:20:19.156:JoinPriorityProcessingstatus=0,IncomingApsPriority1,MaxLrads=6,joinedAps=0*Oct0419:20:19.156:00:1a:e3:d0:19:50SuccessfultransmissionofLWAPPDiscoveryResponsetoAP00:1a:e3:d0:19:50onport8*Oct0419:20:31.162:00:1a:e3:d0:19:50ReceivedLWAPPJOINREQUESTfromAP00:1a:e3:d0:19:50to00:1e:13:51:2b:67onport8*Oct0419:20:31.162:Receivedapacketwhichisa(type=JOIN_REQUEST)withsessionid0*Oct0419:20:31.177:00:1a:e3:d0:19:50APAP001b.5302.28f8:txNonce00:1E:13:51:2B:60rxNonce00:1A:E3:D0:19:50*Oct0419:20:31.177:00:1a:e3:d0:19:50LWAPPJoinRequestMTUpathfromAP00:1a:e3:d0:19:50is1500,remotedebugmodeis0*Oct0419:20:31.177:DTLAddingAP1-192.168.10.10*Oct0419:20:31.177:00:1a:e3:d0:19:50SuccessfullyaddedNPUEntryforAP00:1a:e3:d0:19:50(index1)SwitchIP:192.168.10.2,SwitchPort:12223,intIfNum8,vlanId0APIP:192.168.10.10,APPort:8847,nex*Oct0419:20:31.911:00:1a:e3:d0:19:50SuccessfultransmissionofLWAPPJoinReplytoAP00:1a:e3:d0:19:50*Oct0419:20:31.912:00:1a:e3:d0:19:50spam_lrad.c:1589-OperationState0=4*Oct0419:20:31.913:00:1a:e3:d0:19:50RegisterLWAPPeventforAP00:1a:e3:d0:19:50slot0*Oct0419:20:31.914:00:1a:e3:d0:19:50RegisterLWAPPeventforAP00:1a:e3:d0:19:50slot1*Oct0419:20:33.192:00:1a:e3:d0:19:50ReceivedLWAPPCONFIGUREREQUESTfromAP00:1a:e3:d0:19:50to00:1e:13:51:2b:67*Oct0419:20:33.194:00:1a:e3:d0:19:50UpdatingIPinfoforAP00:1a:e3:d0:19:50-static0,192.168.10.10/255.255.255.0,gtw192.168.10.254*Oct0419:20:33.194:00:1a:e3:d0:19:50UpdatingIP192.168.10.10=192.168.10.10forAP00:1a:e3:d0:19:50*Oct0419:20:33.194:00:1b:53:02:28:f8BuildingConfigResponseMsgfor00:1b:53:02:28:f82006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID51CISCO控制器无线控制器无线AP配置方法配置方法图形界面命令行2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID52CISCO控制器无线AP配置方法CSSC无线客户端2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID53CISCO控制器无线控制器无线AP配置方法配置方法WLAN特性CSSCMicrosoftCiscoACU/ADU多WLANProfile（不同的SSID，不同的安去策略）支持YesYesYesActiveProbe(hiddenSSIDsupport)YesNoYes部署工具YesNoYesWPA/WPA2YesYesPartialWPA2PMKcachingYesYesPartialEAP-FASTYesNoPartialWPA-PSKYesYesPartialStaticWEP(40/128bit)YesYesYesNAC/CTA（网络准入支持）YesNoNo2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID54CISCO控制器无线控制器无线AP配置方法配置方法由于企业内笔记本电脑牌子比较多，建议客户端使用由于企业内笔记本电脑牌子比较多，建议客户端使用Cisco CSSC软件，使用软件，使用CSSC软件的好软件的好处如下：处如下：1.整个公司笔记本电脑统一的平台，方便管理和下发策略。CSSC带有部署工具，制订好策略后容易部署（如果是Windows平台的话，还要配置相关的参数）3.CSSC软件支持CiscoNAC网络准入控制技术.4.建议新购买的笔记本电脑采用统一的品牌（方便管理），旧的笔记本电脑如果没有无线网卡的话，建议统一使用Cisco的CB21AG（支持AES强加密）,Cisco还提供专门为台式机使用的无线网卡：AIR-PI21AG。5.Cisco倡导了CCX（各厂家笔记本电脑和CiscoAP兼容性测试）计划，可以从下面的链接知道哪些笔记本电脑的型号是CCX计划里面的成员。2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID55CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID56CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID57CISCO控制器无线AP配置方法构建一个构建一个OPEN和一个和一个WEP的无线网络的无线网络2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID58CISCO控制器无线控制器无线AP配置方法配置方法配置无线客户端的DHCP服务器配置一个无线网络接口dynamicinterface配置一个无线业务WLAN2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID60CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID61CISCO控制器无线控制器无线AP配置方法配置方法点击点击APPLY2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID62CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID63CISCO控制器无线控制器无线AP配置方法配置方法点击可以进行VLAN20接口的参数修改如果想建立更多的接口，可以继续点击NEW设置新接口点击可以删除2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID64CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID65CISCO控制器无线控制器无线AP配置方法配置方法很重要！很容易被忘记2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID66CISCO控制器无线控制器无线AP配置方法配置方法选择None，不对无线网络有任何加密和限制2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID67CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID68CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID69CISCO控制器无线控制器无线AP配置方法配置方法40位WEP要求5位ASCII字符密码104位WEP要求13位ASCII字符密码CiscoAironet1100/1200/1300不支持128位WEP2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID70CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID71CISCO控制器无线AP配置方法构建一个简单WEB认证的无线接入网络2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID72CISCO控制器无线控制器无线AP配置方法配置方法1.增加一个新的地址池增加一个新的地址池2.增加一个新的接口增加一个新的接口3.配置配置web页面认证的本地页面页面认证的本地页面4.增加增加web认证的认证的WLAN5.建立本地用户认证数据库建立本地用户认证数据库2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID73CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID74CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID75CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID76CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID77CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID78CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID79CISCO控制器无线控制器无线AP配置方法配置方法跟前面一样，在跟前面一样，在CSSC的的Manage Network中，选择并激活中，选择并激活web-auth2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID80CISCO控制器无线控制器无线AP配置方法配置方法在浏览器里输入类似地址（因为没有DNS，所以不能输入网址）2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID81CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID82CISCO控制器无线AP配置方法构建一个支持本地EAP认证的无线接入网络2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID83CISCO控制器无线控制器无线AP配置方法配置方法1.增加一个新的地址池增加一个新的地址池2.增加一个新的动态接口增加一个新的动态接口3.添加本地添加本地EAP支持或者支持或者AAA服务器（服务器（Radius服务器）服务器）4.建立一个新的建立一个新的WLAN SSID5.配置配置WPA/WPA2认证认证6.设置设置CSSC客户端软件客户端软件2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID84CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID85CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID86CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID87CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID88CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID89CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID90CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID91CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID92CISCO控制器无线控制器无线AP配置方法配置方法2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID93CISCO控制器无线AP配置方法构建一个用ACS做AAA认证的无线接入网络2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID94CISCO控制器无线控制器无线AP配置方配置方法法PostureACSAccessControlServerNAPNetworkAccessProfileNAFNetworkAccessFilterNADNetworkAccessDeviceNDGNetworkDeviceGroupPAPostureAgentPVPostureValidationRACRadiusAuthorizationComponentDACLDynamicAccessControlListADFAttributeDefinitionFile2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID95CISCO控制器无线控制器无线AP配置方法配置方法NAPAuthenticationAuthorizationPostureValidationAuthenticationDBGlobalAuthSetupInternalDBExternalDBRule1RuleNPolicy1InternalPostureValidationExternalPostureValidationExternalPostureValidationAuditRACDACLNAFNAD+AAANDGSwitchesRoutersVPNGWFWPolicyNororor通过认证后检查状态检查状态后指示设备配置关联组成下载至设备组成引用引用2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID96CISCO控制器无线控制器无线AP配置方法配置方法Securityaaaradiusauthentication2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID97CISCO控制器无线控制器无线AP配置方法配置方法Cisco的自适应WPA或者WPA22006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID98CISCO控制器无线控制器无线AP配置方法配置方法配置radius2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID99CISCO控制器无线控制器无线AP配置方法配置方法