RADIUS服务器进行MAC验证

RADIUS服务器进行MAC验证,配置nat，使无线接入端连接外网

一、实验目的：通过Radius服务器的mac验证和路由器上的

nat配置，使得在局域网内的无线设备可以上网。

二、实验拓扑图：

三、使用的设备列表：

S3610交换机3台

AR28路由器1台

AP无线路由器1台

AC无线控制器1台

Radius服务器1台

四、具体的配置：

步骤一：在AC上设置用户和做mac地址绑定，以及设计无线网

sys

[h3c]sysname AC( 注意，AC为WA2620-AGN，本AC改名字的时候不能只打sys+名字，需要的是完整才能打出来sysname+名字) [AC]int vlan 1

[AC-vlan-interfacel]undo ip add

[AC-vlan-interfacel]vlan 2

[AC-vlan2]vlan 4

[AC-vlan4]int vlan 4

[AC-vlan-interface4]ip add 192.168.4.1 24

[AC-vlan-interface4]quit

[AC]radius scheme yu

[AC-radius-yu]server-type extended

[AC-radius-yu]primary authentication 192.168.5.1

[AC-radius-yu]primary accounting 192.168.5.1

[AC-radius-yu]key authentication h3c(radius上默认的密钥为h3c，可以重设，所以在配置上需要一致，所以这里配置h3c)

[AC-radius-yu]key accounting h3c

[AC-radius-yu]user-name-format without-domain(注意：这条指令的意思是，不用域名，让你在radius添加账户时可以不带域名)

[AC]radius scheme yu

[AC-isp-yu]authentication lan-access radius-scheme yu

[AC-isp-yu]authorization lan-access radius-scheme lu

[AC-isp-yu]accounting lan-access radius-scheme lu

[AC]int g1/0/1

[AC-GigabitEthernet1/0/1]port link-type trunk

[AC-GigabitEthernet1/0/1]port trunk permit vlan 1 to 2 4 [AC]interface WLAN-ESS7

[AC-WLAN-ESS7] port access vlan 2

[AC-WLAN-ESS7]port-security port-mode mac-authentication [AC]wlan service-template 7 clear

[AC-wlan-st-7]ssid yu

[AC-wlan-st-7]bind WLAN-ESS 7

[AC-wlan-st-7] service-template enable

[AC]wlan ap yu model wa2620-agn

[AC-wlan-ap-yu]serial-id 219801A0A89112G03396

[AC-wlan-ap-yu]radio 2

[AC-wlan-ap-yu-radio-2]service-template 7

[AC-wlan-ap-yu-radio-2]radio enable

[AC]ip route-static 0.0.0.0 0.0.0.0 192.168.4.254

[AC]local –user 90c1151c77db

[AC-luser-90c1151c77db]password simple 90c1151c77db

(这里是接入的无线客户端的mac地址)

步骤二：在AC交换模块上配置连接

oap connet slot 0

sys

[acsw]int vlan 1

[acsw-vlan-interfacel]undo ip add

[acsw-vlan-interfacel]vlan 2

[acsw-vlan2]vlan 4

[acsw-vlan4]quit

[acsw]interface GigabitEthernet1/0/8

[acsw- GigabitEthernet1/0/8]port link-type trunk

[acsw- GigabitEthernet1/0/8]port trunk permit vlan 1 to 2 4 [acsw]int g1/0/9

[acsw- GigabitEthernet1/0/9] port link-type trunk

[acsw- GigabitEthernet1/0/9] port trunk permit vlan 1 to 2 4 步骤三：配置Dhcp中继交换机上的ip地址池

[dhcp]vlan 3

[dhcp]dhcp enable

[dhcp]dhcp server ip-pool 1

[dhcp-pool-pool1]network 192.168.1.0 24