ARUBA無線網(wǎng)絡(luò)基礎(chǔ)培訓(xùn)

李海彬

hli@

ARUBA無線網(wǎng)絡(luò)基礎(chǔ)培訓(xùn)

Peoplemove.Networksmustfollow.?ARUBA無線網(wǎng)絡(luò)的組網(wǎng)架構(gòu)EmailServer10/100MbpsL2/3DHCPServer1.3.4.通訊過程：AP連接到現(xiàn)有網(wǎng)絡(luò)的交換機(jī)端口，加電起動后，獲得IP地址AP通過以下各種方式獲得ARUBA控制器的IP地址（靜態(tài)獲得、DHCP返回、組播、廣播、DNS解析）AP與控制器之間建立PAPI隧道（UDP8211），通過FTP或TFTP到ARUBA控制器上比對并下載AP的image軟件和配置文件，并根據(jù)配置信息建立AP與控制器之間的GRE隧道，同時向無線用戶提供無線接入服務(wù)無線用戶通過SSID連接無線網(wǎng)絡(luò)，所有的用戶流量都通過AP與ARUBA控制器之間的GRE隧道直接傳遞到ARUBA控制器上，進(jìn)行相應(yīng)的加解密、身份驗證、授權(quán)、策略和轉(zhuǎn)發(fā)2.配置ARUBA無線控制器管理員登陸(admin/saic_admin)CliWeb管理帳號網(wǎng)絡(luò)配置VlanIPaddressIProuteIPdhcp安全配置PolicyRoleAAA無線配置SSIDVirtualAP配置ARUBA無線控制器管理員登陸登陸ARUBA無線控制器CommandlineUser:adminPassword:*****(Aruba800)>enPassword:******(Aruba800)#configuretEnterConfigurationcommands,oneperline.EndwithCNTL/ZWebUI

https://<Controller’sIPaddress>Admin帳號管理#mgmt-user<username><role>

(Aruba800)(config)#mgmt-useradminrootPassword:*****Re-Typepassword:*****(Aruba800)(config)#配置ARUBA無線控制器ARUBA無線控制器的初始設(shè)置初始化之前的準(zhǔn)備工作查看并保存控制器軟件許可(Aruba200)#showlicenseverboseLicenseTableKeyInstalledExpiresFlagsServiceType

Xw2K4EGT-qWpz5YLM-Ouw7wpRt-kQPUrJMM-x8fB27hP-1Zg2010-07-08NeverEPolicyEnforcementFirewall

12:53:50Wnm8I0AK-bhAPAsim-pd8gS573-oJ4YHCWG-5ghonB8G-x8w2010-07-08NeverEWirelessIntrusionProtection

12:53:504gCv4bFb-JDfaSPiN-YNV/TLoP-1od3XEI3-wxj+0can-NFE2010-07-08NeverERemoteAccessPoints:1

12:53:52LicenseEntries:3Flags:A-auto-generated;E-enabled;R-rebootrequiredtoactivate恢復(fù)控制器出廠配置恢復(fù)控制器出廠配置(Aruba200)#writeeraseallSwitchwillbefactorydefaulted.Alltheconfigurationanddatabaseswillbedeleted.Press'y'toproceed:Cannotdeletetheconfiguration,Alreadydeleted重啟控制器(Aruba200)#reloadDoyoureallywanttoresetthesystem(y/n):ySystemwillnowrestart!ShutdownprocessingstartedSyncingdatadone.ThesystemisgoingdownNOW!!SendingSIGTERMtoallprocesses.SendingSIGKILLtoallprocesses.Pleasestandbywhilerebootingthesystem.Restartingsystem.恢復(fù)控制器出廠配置EnterSystemname[Aruba200]:EnterVLAN1interfaceIPaddress[54]:54EnterVLAN1interfacesubnetmask[]:EnterIPDefaultgateway[none]:EnterSwitchRole,(master|local)[master]:EnterCountrycode(ISO-3166),<ctrl-I>forsupportedlist:cnYouhavechosenCountrycodeCNforChina(yes|no)?:yEnterTimeZone[PST-8:0]:cht+8:0EnterTimeinUTC[06:58:59]:07:01:30EnterDate(MM/DD/YYYY)[7/12/2010]:EnterPasswordforadminlogin(upto32chars):**********Re-typePasswordforadminlogin:**********EnterPasswordforenablemode(upto15chars):******Re-typePasswordforenablemode:******Doyouwishtoshutdownalltheports(yes|no)?[no]:……Ifyouacceptthechangestheswitchwillrestart!Type<ctrl-P>togobackandchangeanswerforanyquestionDoyouwishtoacceptthechanges(yes|no)yCreatingconfiguration...Done.Systemwillnowrestart!添加控制器軟件許可(Aruba200)User:adminPassword:**********(Aruba200)>enPassword:******(Aruba200)#licenseaddXw2K4EGT-qWpz5YLM-Ouw7wpRt-kQPUrJMM-x8fB27hP-1ZgPleasereloadtheswitchforthenewservicekeytotakeeffect.(Aruba200)#licenseaddWnm8I0AK-bhAPAsim-pd8gS573-oJ4YHCWG-5ghonB8G-x8wPleasereloadtheswitchforthenewservicekeytotakeeffect.(Aruba200)#reloadDoyoureallywanttoresetthesystem(y/n):ySystemwillnowrestart!Lab1：完成控制器初始配置任務(wù)：清空控制器原有配置對控制器進(jìn)行初始設(shè)置為控制器添加軟件許可相關(guān)配置參數(shù)：組號第1組第2組第X組IP地址01020X子網(wǎng)掩碼網(wǎng)關(guān)地址545454配置ARUBA無線控制器ARUBA無線控制器的網(wǎng)絡(luò)配置ARUBA無線控制器的網(wǎng)絡(luò)配置配置Vlan(Aruba800)(config)#vlan200(Aruba800)(config)#interfacefastethernet1/0接入模式：(Aruba800)(config-if)#switchportaccessvlan200 (Aruba800)(config-if)#switchportmodeaccess中繼模式：(Aruba800)(config-if)#switchporttrunkallowedvlanall (Aruba800)(config-if)#switchportmodetrunk(Aruba800)(config-if)#showvlanVLANCONFIGURATIONVLANNamePorts

1DefaultFE1/1-7100VLAN0100GE1/8200VLAN0200FE1/0配置IPaddress(Aruba800)(config)#interfacevlan200(Aruba800)(config-subif)#ipaddress54(vlaninterface)(Aruba800)(config-subif)#iphelper-address(DHCPrelay)ARUBA無線控制器的網(wǎng)絡(luò)配置配置IProute配置缺省路由:(Aruba800)(config)#ipdefault-gateway

配置靜態(tài)路由：(Aruba800)(config)#iproute(Aruba800)(config)#showiprouteCodes:C-connected,O-OSPF,R-RIP,S-staticM-mgmt,U-routeusable,*-candidatedefaultGatewayoflastresortistonetworkS*/0[1/0]via*S/24[1/0]via*Cisdirectlyconnected,VLAN1Cisdirectlyconnected,VLAN100Cisdirectlyconnected,VLAN200配置dhcpserver(Aruba800)(config)#ipdhcppooluser_pool(Aruba800)(config-dhcp)#default-router54(Aruba800)(config-dhcp)#dns-server(Aruba800)(config-dhcp)#network(Aruba800)(config-dhcp)#exit(Aruba800)(config)#servicedhcpLab2：完成控制器網(wǎng)絡(luò)配置任務(wù)：為控制器配置1個APVLAN和2個用戶VLAN為上述VLAN配置端口和IP地址在控制器中配置3個DHCP

Pool相關(guān)配置參數(shù)：組號第1組第2組第X組AP

VLANVLANID=1154/24VLANID=1254/24VLANID=1X172.16.1X.254/24用戶VLAN101VLANID=10154/24VLANID=10254/24VLANID=10X172.16.10X.254/24用戶VLAN2VLANID=20154/24VLANID=20254/24VLANID=20X172.16.20X.254/24DHCP池~40~40~40~40~40~40172.16.1X.1~172.16.1X.240172.16.10X.1~172.16.10X.240172.16.20X.1~172.16.20X.240配置ARUBA無線控制器ARUBA無線控制器的安全配置ARUBA控制器的安全配置Rule1Rule2Rule3RulenRule1Rule2Rule1Rule1Rule2Rule3Rule4Rule1Rule2Rule3Rule4Policy1Policy2Policy3Policy4Policy5Role1Policy1Policy2Role2Policy1Policy3Policy4Role3Policy4Policy5Role4Policy4User1User2User3User4User5User6…………UserNRoleDerivation:1)LocallyDerived2)ServerAssigned3)DefaultRoleAssignsuserstoaroleMethods:PoliciesRolesDerivation<source><destination><service><action><extendedaction>ARUBA控制器的安全配置AddressesHTTPFTPDNSetcDenyPermitNatLogQueue802.1passignmentTOSTimeRange策略示例：ipaccess-listsessionInternet_Only useranyudp68deny useranysvc-dhcppermit userhostsvc-dnspermit userhostsvc-dnspermit useraliasInternal-Networkdenylog useranyanypermit防火墻策略：一組按照特定次序排列的規(guī)則的集合別名的定義：1)網(wǎng)絡(luò)別名netdestinationInternal-Networknetwork networknetdestinationExternal-networknetwork networkinvert2)服務(wù)別名 netservicesvc-httptcp80<source><destination><service><action><extendedaction>ARUBA控制器的安全配置AddressesHTTPFTPDNSetcDenyPermitNatLogQueue802.1passignmentTOSTimeRange防火墻策略：一組按照特定次序排列的規(guī)則的集合ARUBA無線控制器的安全配置用戶角色（Role）決定了每個用戶的訪問權(quán)限每一個role都必須與一個或多個policy綁定防火墻策略按次序執(zhí)行最后一個隱含的缺省策略是“denyall”可以設(shè)定role的帶寬限制和會話數(shù)限制用戶角色（Role）的分配可以通過多種方式實現(xiàn)基于接入認(rèn)證方式的缺省角色(i.e.802.1x,VPN,WEP,etc.)由認(rèn)證服務(wù)器導(dǎo)出的用戶角色(i.e.RADIUS/LDAP屬性)本地導(dǎo)出規(guī)則ESSIDMACEncryptiontypeEtc.ARUBA控制器中的每一個用戶都會被分配一個Role!ARUBA無線控制器的安全配置(Aruba800)#showrightsRoleTableNameACLBandwidthACLListType

ap-role4Up:NoLimit,Dn:NoLimitcontrol,ap-aclSystemauthenticated39Up:NoLimit,Dn:NoLimitallowall,v6-allowallUserdefault-vpn-role37Up:NoLimit,Dn:NoLimitallowall,v6-allowallUserguest3Up:NoLimit,Dn:NoLimithttp-acl,https-acl,dhcp-acl,icmp-acl,dns-acl,v6-http-acl,v6-https-acl,v6-dhcp-acl,v6-icmp-acl,v6-dns-aclUserguest-logon6Up:NoLimit,Dn:NoLimitlogon-control,captiveportalUserlogon1Up:NoLimit,Dn:NoLimitlogon-control,captiveportal,vpnlogon,v6-logon-controlUserstateful-dot1x5Up:NoLimit,Dn:NoLimitSystemvoice38Up:NoLimit,Dn:NoLimitsip-acl,noe-acl,svp-acl,vocera-acl,skinny-acl,h323-acl,dhcp-acl,tftp-acl,dns-acl,icmp-aclUserARUBA無線控制器的安全配置(Aruba800)#showrightsauthenticatedDerivedRole='authenticated'UpBW:NoLimitDownBW:NoLimitL2TPPool=default-l2tp-poolPPTPPool=default-pptp-poolPeriodicreauthentication:DisabledACLNumber=39/0MaxSessions=65535access-listListPositionNameLocation

1allowall2v6-allowallallowallPrioritySourceDestinationServiceActionTimeRangeLogExpiredQueueTOS8021PBlacklistMirrorDisScan

1anyanyanypermitLowv6-allowallPrioritySourceDestinationServiceActionTimeRangeLogExpiredQueueTOS8021PBlacklistMirrorDisScan

1anyanyanypermitLowExpiredPolicies(duetotimeconstraints)=0ARUBA無線控制器的安全配置定義用戶角色（role）(Aruba800)(config)#user-rolevisitors(Aruba800)(config-role)#access-listsessioninternet-only(Aruba800)(config-role)#max-sessions100(Aruba800)(config-role)#exit(Aruba800)(config)#ARUBA無線控制器的安全配置基于接入認(rèn)證方式的缺省角色（role）分配(Aruba800)(config)#showaaaprofiledefaultAAAProfile"default"ParameterValue

InitialrolelogonMACAuthenticationProfileN/AMACAuthenticationDefaultRoleguestMACAuthenticationServerGroupdefault802.1XAuthenticationProfileN/A802.1XAuthenticationDefaultRoleguest802.1XAuthenticationServerGroupN/ARADIUSAccountingServerGroupN/AXMLAPIserverN/ARFC3576serverN/AUserderivationrulesN/AWiredtoWirelessRoamingEnabledSIPauthenticationroleN/A(Aruba800)(config)#showaaaauthenticationcaptive-portaldefaultCaptivePortalAuthenticationProfile"default"ParameterValue

DefaultRoleguestServerGroupdefaultRedirectPause10secUserLoginEnabledGuestLoginDisabledLogoutpopupwindowEnabledUseHTTPforauthenticationDisabledLogonwaitminimumwait5secLogonwaitmaximumwait10seclogonwaitCPUutilizationthreshold60%MaxAuthenticationfailures0ShowFQDNDisabledUseCHAP(non-standard)DisabledSygate-on-demand-agentDisabledLoginpage/auth/index.htmlWelcomepage/auth/welcome.htmlShowWelcomePageYesAddingswitchipaddressinredirectionURLDisabledARUBA無線控制器的安全配置基于接入認(rèn)證方式的缺省角色（role）分配ARUBA無線控制器的安全配置基于服務(wù)期返回規(guī)則的角色（role）分配(Aruba800)(config)#aaaserver-grouptest(Aruba800)(ServerGroup"test")#setroleconditionmemberOfcontainsstudentset-valuestudent說明：從LDAP服務(wù)器獲取用戶屬性，并以此為依據(jù)分配用戶角色時，只能通過CLI進(jìn)行配置ARUBA無線控制器的安全配置基于用戶定義規(guī)則的角色（role）分配(Aruba800)(config)#aaaderivation-rulesuser"test_rule"(Aruba800)(user-rule)#setroleconditionencryption-typeequals"dynamic-aes"set-value"authenticated"position1(Aruba800)(user-rule)#setroleconditionencryption-typeequals"dynamic-tkip"set-value"guest"position2Lab3：定義用戶角色和相關(guān)策略任務(wù)：定義角色1：沒有訪問權(quán)限，只能彈出Portal認(rèn)證頁面定義角色2：認(rèn)證通過后的角色，訪問權(quán)限不受任何限制定義角色3：認(rèn)證通過后的角色，禁止ICMP，其余不限相關(guān)配置參數(shù)：組號第1組第2組第X組角色1T1-logon1）只允許dhcp和dns服務(wù)2）Http服務(wù)重定向到captiveportal3）MaxSession=504）captiveportaldefaultT2-logon1）只允許dhcp和dns服務(wù)2）Http服務(wù)重定向到captiveportal3）MaxSession=504）captiveportaldefaultTX-logon1）只允許dhcp和dns服務(wù)2）Http服務(wù)重定向到captiveportal3）MaxSession=504）captiveportaldefault角色2T1-authenticated1）允許所有服務(wù)2）MaxSession=200T2-authenticated1）允許所有服務(wù)2）MaxSession=200TX-authenticated1）允許所有服務(wù)2）MaxSession=200角色3T1-notping1）不允許ICMP服務(wù)2）允許其它所有服務(wù)3）MaxSession=200T2-notping1）不允許ICMP服務(wù)2）允許其它所有服務(wù)3）MaxSession=200TX-notping1）不允許ICMP服務(wù)2）允許其它所有服務(wù)3）MaxSession=200配置ARUBA無線控制器ARUBA無線控制器的無線配置ARUBA無線控制器的無線配置APGroupWirelessLANRFManagementAPQoSIDSVirtualAPPropertiesSSIDAAAa/gRadioSettingsRFOptimizationsSystemProfileEthernetRegulatoryVoIPa/gManagementVirtualAPPropertiesSSIDAAAVLANVLANARUBA無線控制器的無線配置加密方法確保數(shù)據(jù)在空中傳輸時的私密性可以選擇不加密(open)、二層加密(WEP,TKIP,AES)或者三層加密(VPN)認(rèn)證方式確保接入無線網(wǎng)絡(luò)的用戶都是合法用戶認(rèn)證方式可以選擇不認(rèn)證，或者M(jìn)AC、EAP、captiveportal、VPN等認(rèn)證方式訪問控制對接入無線網(wǎng)絡(luò)的合法用戶流量進(jìn)行有效控制，包括可以訪問的網(wǎng)絡(luò)資源、帶寬、時間等WLAN服務(wù)的配置要點SSIDProfileAAAProfileRoleARUBA無線控制器的無線配置(Aruba800)#showwlanvirtual-apdefaultVirtualAPprofile"default"Parameter

Value

VirtualAPenable

EnabledAllowedband

allSSIDProfile

defaultVLAN

100Forwardmode

tunnelDenytimerange

N/AMobileIP

EnabledHADiscoveryon-association

DisabledDoSPrevention

DisabledStationBlacklisting

EnabledBlacklistTime

3600secAuthenticationFailureBlacklistTime

3600secFastRoaming

DisabledStrictCompliance

DisabledVLANMobility

DisabledAAAProfile

defaultRemote-APOperation

standardARUBA無線控制器的無線配置SSIDProfile的定義(Aruba800)(config)#wlanssid-profiletest(Aruba800)(SSIDProfile“test”)#essidtest（WLAN顯示的SSID名稱）(Aruba800)(SSIDProfile“test”)#opmode?（WLAN可以選用的加密方式）dynamic-wep WEPwithdynamickeysopensystem Noencryptionstatic-wep WEPwithstatickeyswpa-aes WPAwithAESencryptionanddynamickeysusing802.1Xwpa-psk-aes WPAwithAESencryptionusingapre-sharedkeywpa-psk-tkip WPAwithTKIPencryptionusingapre-sharedkeywpa-tkip WPAwithTKIPencryptionanddynamickeysusing802.1Xwpa2-aes WPA2withAESencryptionanddynamickeysusing802.1Xwpa2-psk-aes WPA2withAESencryptionusingapre-sharedkeywpa2-psk-tkip WPA2withTKIPencryptionusingapre-sharedkeywpa2-tkip WPA2withTKIPencryptionanddynamickeysusing802.1XxSec xSecencryption<cr>(Aruba800)(SSIDProfile“test”)#opmodeopensystemARUBA無線控制器的無線配置SSIDProfile的定義ARUBA無線控制器的無線配置AAAProfile的定義配置基于Open的AAAProfile(Aruba800)(config)#aaaprofiletest(Aruba800)(AAAProfile"test")#clonedefault配置基于Portal認(rèn)證的CaptivePortalProfile(Aruba800)(config)#aaaauthenticationcaptive-portaltest(Aruba800)(CaptivePortalAuthenticationProfile"test")#clonedefault(Aruba800)(CaptivePortalAuthenticationProfile"test")#default-roleguest(Aruba800)(CaptivePortalAuthenticationProfile"test")#noenable-welcome(Aruba800)(CaptivePortalAuthenticationProfile"test")#server-grouptestARUBA無線控制器的無線配置配置LDAP服務(wù)器(Aruba800)(config)#aaaauthentication-serverldaptest(Aruba800)(LDAPServer"test")#host0(Aruba800)(LDAPServer"test")#admin-dnadmin(Aruba800)(LDAPServer"test")#admin-passwdadmin(Aruba800)(LDAPServer"test")#base-dncn=users,dc=qa,dc=domain,dc=com(Aruba800)(LDAPServer"test")#allow-cleartext(Aruba800)(LDAPServer"test")#exit對LDAP服務(wù)器進(jìn)行測試(Aruba800)#aaaquery-user

<LDAP-Server-Name><Username>ARUBA無線控制器的無線配置配置Radius服務(wù)器(Aruba800)(config)#aaaauthentication-serverradiustest(Aruba800)(RADIUSServer"test")#host0(Aruba800)(RADIUSServer"test")#key123456(Aruba800)(RADIUSServer"test")#exit對Radius服務(wù)器進(jìn)行測試(Aruba800)#aaatest-servermschapv2<Radius-Server-Name><Username><Password>ARUBA無線控制器的無線配置配置Server-Group(Aruba800)(config)#aaaserver-grouptest(Aruba800)(ServerGroup"test")#auth-servertest(Aruba800)(ServerGroup"test")#setroleconditionmemberOfcontainsguestset-valueguest(Aruba800)(config)#showaaaserver-grouptestFailThrough:NoAuthServersNameServer-Typetrim-FQDNMatch-TypeMatch-OpMatch-Str

testLdapNoRole/VLANderivationrulesPriorityAttributeOperationOperandTypeActionValueValid

1memberOfcontainsguestStringsetroleguestNoLab4：配置兩個Server-Group步驟：定義一個RadiusServer并測試通過定義一個RadiusServerGroup定義一個LDAPServer并測試通過定義一個LDAPServerGroup相關(guān)配置參數(shù)：組號第1組第2組第X組Radius-ServerT1-radius-server1）host002）key123456T2-radius-server1）host002）key123456TX-radius-server1）host002）key123456Radius-Server-GroupT1-radius-servergroup1）auth-serverT1-radius-server2）setroleconditionrolevalue-ofT2-radius-servergroup1）auth-serverT1-radius-server2）setroleconditionrolevalue-ofTX-radius-servergroup1）auth-serverT1-radius-server2）setroleconditionrolevalue-ofLdap-ServerT1-ldap-server1）host002）admin-dnadmin3）admin-pass1qaz@wsx4）base-dndc=mylab,dc=netT2-ldap-server1）host002）admin-dnadmin3）admin-pass1qaz@wsx4）base-dndc=mylab,dc=netTX-ldap-server1）host002）admin-dnadmin3）admin-pass1qaz@wsx4）base-dndc=mylab,dc=netLdap-Server-GroupT1-ldap-servergroup1）auth-serverT1-ldap-serverT2-ldap-servergroup1）auth-serverT2-ldap-serverTX-radius-servergroup1）auth-serverTX-ldap-serverARUBA無線控制器的無線配置在用戶初始角色（initialrole）中調(diào)用CaptivePortalProfile(Aruba800)(config)#user-rolelogon(Aruba800)(config-role)#captive-portaltest(Aruba800)(config-role)#exitARUBA無線控制器的無線配置VirtualAPAAAVLANSSIDESSIDOpenSystemCaptivePortalDefaultRoleServerGroupInitialRoleLDAPServerRadiusServerDerivedRolePolicyPolicyLab5：配置一個Open的SSID步驟：定義SSIDProfile定義AAAProfile定義VAPProfile(引用SSID-Profile,AAA-Profile,并指定用戶VLAN)將VAP

Profile加入AP-Group（default）用Laptop連接無線網(wǎng)絡(luò)，觀察獲得的IP地址以及用戶的角色和權(quán)限改變AAAProfile中的initialrole，重新連接，觀察并體會用戶權(quán)限的變化相關(guān)配置參數(shù)：組號第1組第2組第X組SSID-ProfileT1-ssid-profile1）ESSID=T1-aruba2）opmode=opensystemT2-ssid-profile1）ESSID=T2-aruba2）opmode=opensystemTX-ssid-profile1）ESSID=TX-aruba2）opmode=opensystemAAA-ProfileT1-aaa-profile1）initial-role=T1-authenticatedT2-aaa-profile1）initial-role=T2-authenticatedTX-aaa-profile1）initial-role=TX-authenticatedVAP-ProfileT1-vap-profile1）T1-ssid-profile2）T1-aaa-profile3）VLAN101T2-vap-profile1）T2-ssid-profile2）T2-aaa-profile3）VLAN102TX-vap-profile1）TX-ssid-profile2）TX-aaa-profile3）VLAN10XLab6