校園無線網(wǎng)絡設計仿真和測試分析案例目錄TOC\o"1-3"\h\u20062校園無線網(wǎng)絡設計仿真和測試分析案例 1174一、無線網(wǎng)絡設計仿真實現(xiàn) 1270421.1、仿真拓撲 1228561.2、網(wǎng)絡仿真配置 119523二、網(wǎng)絡仿真測試 8105602.1、測試內部用戶訪問外網(wǎng) 8157272.2、測試內部用戶訪問服務器的連通性 10226922.3、測試無線終端連接AP訪問外網(wǎng) 12133562.4、查看核心交換機VRRP狀態(tài) 13155602.5、查看AP上線狀 13無線網(wǎng)絡設計仿真實現(xiàn)1.1、仿真拓撲校園無線網(wǎng)絡規(guī)劃設計使用模擬器仿真設計實現(xiàn)，模擬器使用huaweiensp模擬器，根據(jù)無線網(wǎng)絡規(guī)劃設計方案，搭建模擬拓撲，通過完成相關配置，并測試網(wǎng)絡連通性。圖七校園無線網(wǎng)絡仿真拓撲1.2、網(wǎng)絡仿真配置1.2.1、接入交換機配置為了隔離廣播領域并避免訪問層中發(fā)生廣播風暴,把不同區(qū)域或部門分割成不同的vlan。首先要在接入層的交換機上進行創(chuàng)建vlan,再按照端口的劃分方式將用戶從vlan中添加。因此我們可以把接入層交換機和上行鏈路交換機的互連端口配置為中繼端口，從而讓所有VLAN通過。教學區(qū)所有接入設備命令如下表：教學樓接入交換機配置命令創(chuàng)建業(yè)務VLAN、主要有有線業(yè)務vlan、無線AP管理VLAN和無線業(yè)務VLANvlan10vlan100vlan200接入層交換機與上聯(lián)交換機互聯(lián)端口配置為中繼端口，允許所有的VLAN通過interfaceEthernet0/0/1portlink-typetrunkporttrunkallow-passvlanall終端端口劃分對應的VLAN，連接PC終端的劃分vlan10，AP端口VLAN劃分vlan100interfaceEthernet0/0/2portlink-typeaccessportdefaultvlan10InterfaceEthernet0/0/2portlink-typeaccessportdefaultvlan1001.2.2、匯聚層交換機配置教學樓匯聚交換機配置為例：教學樓接入交換機配置命令創(chuàng)建所有業(yè)務VLANvlanbatch102030405060100200匯聚交換機與交換機互聯(lián)端口全部配置為中繼端口，允許VLAN通過，Gi0/0/1口配置為例interfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlanall生成樹配置，MSTP多生成樹模式stpregion-configurationregion-nameHuaWeiinstance1vlan1020304050100200activeregion-configuration1.2.3、核心交換機配置在核心交換機上配置相應的VLAN，我們可以把交換機上的互連端口配置為中繼端口，我們還可以在核心交換機上配置用戶的個人網(wǎng)關，并配置VRRP網(wǎng)關備份。我們可以配置防火墻對接接口的IP地址為192.168.10.254，并配置與防火墻的OSPF動態(tài)路由，實現(xiàn)相互連接。核心1配置命令創(chuàng)建所有業(yè)務VLAN和業(yè)務vlanbatch102030405060100200核心交換機與下聯(lián)交換機互聯(lián)端口配置為中繼端口，允許相應VLAN通過，G0/0/3為例interfaceGigabitEthernet0/0/3portlink-typetrunkporttrunkallow-passvlan1090100MSTP生成樹配置stpregion-configurationregion-nameHuaWeiinstance1vlan1020304050100200activeregion-configurationstpinstance1rootprimaryVRRP配置，vlan接口10配置為例：配置接口IP地址，配置虛地址，指定優(yōu)先級，配置DHCPinterfaceVlanif10ipaddress192.168.10.252251.251.251.0vrrpvrid10virtual-ip192.168.10.254vrrpvrid10priority120dhcpselectglobal聚合端口配置interfaceEth-Trunk1portlink-typetrunkporttrunkallow-passvlan2to4094interfaceGigabitEthernet0/0/1eth-trunk1interfaceGigabitEthernet0/0/2eth-trunk1動態(tài)路由ospf配置ospf1area0.0.0.0network192.168.10.00.0.0.255network192.168.20.00.0.0.255network192.168.30.00.0.0.255network192.168.40.00.0.0.255network192.168.50.00.0.0.255network192.168.100.00.0.0.255network192.168.200.00.0.0.255network10.0.0.00.0.0.2551.2.4、出口防火墻配置出口主防火墻配置為例：出口主防火墻配置命令防火墻HA配置，主防火墻配置為例interfaceGigabitEthernet0/0/0ipaddress10.0.0.252251.251.251.0vrrpvrid1virtual-ip10.0.0.254masterinterfaceGigabitEthernet0/0/1ipaddress200.200.200.2251.251.251.248vrrpvrid2virtual-ip200.200.200.1masterinterfaceGigabitEthernet0/0/2ipaddress200.200.201.2251.251.251.248vrrpvrid3virtual-ip200.200.201.1masterinterfaceGigabitEthernet0/0/3ipaddress192.168.60.252251.251.251.0vrrpvrid4virtual-ip192.168.60.254masterhrpenablehrppreemptdelay5hrpinterfaceGigabitEthernet0/0/3接口區(qū)域劃分，主要4個區(qū)域，trust區(qū)域連接內網(wǎng)，untrust連接運營商，dmz連接服務器firewallzonetrustsetpriority85addinterfaceGigabitEthernet0/0/0firewallzoneuntrustsetpriority5addinterfaceGigabitEthernet0/0/1addinterfaceGigabitEthernet0/0/2firewallzonedmzsetpriority50addinterfaceGigabitEthernet0/0/3addinterfaceGigabitEthernet0/0/8動態(tài)路由OSPF配置ospf100default-route-advertiseimport-routestaticarea0.0.0.0network10.0.0.00.0.0.255network192.168.60.00.0.0.255配置靜態(tài)路由iproute-static0.0.0.00.0.0.0200.200.200.4地址映射，內部web服務器發(fā)布公網(wǎng)natserver0global200.200.200.6inside192.168.60.1防火墻策略配置，允許部門1和部門網(wǎng)段訪問外網(wǎng)policyinterzonetrustuntrustinboundpolicy1actionpermitpolicydestination192.168.60.00.0.0.255policyinterzonetrustuntrustoutboundpolicy1actionpermitpolicysource192.168.0.00.0.251.255NAT策略,實現(xiàn)私有地址轉換為公網(wǎng)接口地址nat-policyinterzonetrustuntrustoutboundpolicy0actionsource-natpolicysource192.168.0.00.0.251.255easy-ipGigabitEthernet0/0/1policy2actionsource-natpolicysource192.168.0.00.0.251.255easy-ipGigabitEthernet0/0/21.2.5、無線控制器配置AC配置命令創(chuàng)建vlan開啟DHCP服務器配置IP地址配置默認路由配置AC的源接口vlanbatch100200dhcpenableinterfaceVlanif100ipaddress192.168.100.124dhcpselectinterfaceinterfaceGigabitEthernet0/0/1portlink-typetrunkporttrunkallow-passvlanallinterfaceGigabitEthernet0/0/2portlink-typetrunkporttrunkallow-passvlanalliproute-static0.0.0.00.0.0.0192.168.100.254capwapsourceinterfacevlanif100基礎配置interfaceGigabitEthernet0/0/3portlink-typetrunkporttrunkallow-passvlan1090100無線配置、主要配置配置安全模板、配置SSID、創(chuàng)建VAP模板vap，配置隧道轉發(fā)模式、綁定業(yè)務vlan、綁定SSID，關聯(lián)AP等wlansecurity-profilenamesecsecuritywpa-wpa2pskpass-phrasehuawei@123aesssid-profilenamessidssidhuaweivap-profilenamevapforward-modetunnelservice-vlanvlan-id200ssid-profilessidsecurity-profilesecregulatory-domain-profilenamedefaultregulatory-domain-profilenamedomain1ap-groupnameapregulatory-domain-profiledomain1radio0vap-profilevapwlan1ap-groupnamedefaultap-id0type-id69ap-mac00e0-fc9c-4640ap-namearea_1ap-groupapap-id1type-id69ap-mac00e0-fccc-5550ap-namearea_2ap-groupapap-id2type-id69ap-mac00e0-fcac-45d0ap-namearea_3ap-groupapap-id3type-id69ap-mac00e0-fcb9-5530ap-namearea_4ap-groupapap-id6type-id69ap-mac00e0-fc49-1840ap-namearea_5ap-groupapap-id7type-id69ap-mac00e0-fc76-53c0ap-namearea_6ap-groupapap-id8type-id69ap-mac00e0-fc73-3b40ap-namearea_7ap-groupap網(wǎng)絡仿真測試2.1、測試內部用戶訪問外網(wǎng)以教學區(qū)中的PC機為例，測試與外部網(wǎng)絡的連接。外部網(wǎng)絡