思科小型统一无线网络案实施和特配置介绍与功能演示.ppt

* * It is recommend (where possible) to place the WLAN Controller in the Distribution layer. Accordingly to the Cisco Hierarchical Layer Model of Access/Distribution and Core, filtering, tunnel termination and other services are performed to the traffic aggregated from the access layer and so in the Distribution layer. For its performances and versatility, that’s probably where the customer already have a Catalyst 6500 anyway. Always following the hierarchical model, it’s also suggested not to place the controller in the Core that should be completely dedicated to switching packets as fast as possible. Finally positioning the blade in the Access Layer would cause some problems in case the customer decides to implement redundancy: as explained before, for HSRP to work you would need a L2 connection between two Access Layer switches and this is not a Cisco recommended design because it implies spanning a VLAN between Access switches. * * * * * 配置WEB认证 配置WEB认证—定制用户认证页面 配置WEB认证—定义内部认证用户数据库 配置WEB认证—定义内部认证用户数据库 配置完成WEB Authentication认证后，需要重新启动Controller一次，才能起作用 验证WEB认证 如前面连接WLAN20那样，建立WLAN30的OPEN连接，在CSSC的Manage Network中，选择并激活WLAN30 验证WEB认证 Presentation Title Size 30PTOption 2: Live 构建一个支持EAP-FAST认证的员工无线接入网络 构建一个支持EAP-FAST认证的员工网络 在路由器上增加一个新的地址池 在路由器上增加一个新的路由接口（做用户的网关） 在Controller上增加一个新的接口 在Controller上建立一个新的WLAN SSID 配置EAP-FAST认证 配置AAA服务器（Radius服务器） 设置CSSC客户端软件 测试EAP-FAST认证 新建一个内部员工使用的地址池 WLC-router# conf t Enter configuration commands, one per line. End with CNTL/Z. WLC-router(config)#ip dhcp pool webauth WLC-router(dhcp-config)#network 192.168.40.0 WLC-router(dhcp-config)#default-router 192.168.40.254 WLC-router(dhcp-config)#lease infinite WLC-router(config)#ip dhcp excluded-address 192.168.40.1 WLC-router(config)#ip dhcp excluded-address 192.168.40.254 为什么要排除这两个IP地址？？ 添加EAP-FAST认证用户将要使用的地址网关 如何添加？ 在那里添加？ interface wlan-controller1/0.40 encapsulation dot1Q 40 ip address 192.168.40.254 255.255.255.0 no shut 控制器添加一个VLAN40接口 新建一个WLAN 新建一个WLAN 设置认证服务器 添加认证服务器 添加A