Aruba-本地dot1x与portal认证.docxVIP

Dot1x与portal认证一、基础配置：新建ssid profile文件名字为：test-dot1x-portal-profile命令格式：(OAW-6000) (config) #wlanssid-profile test-dot1x-portal-ssid新建一个SSID名称，essid test-dot1xandportal命令格式：(OAW-6000) (SSID Profile test-dot1x-portal-ssid) #essid test-dot1xandportal(OAW-6000) (SSID Profile test-dot1x-portal-ssid) #exit新建一个虚拟AP命令格式：(OAW-6000) (config) #wlan virtual-ap test-dot1xandportal-vp将vlan1与虚拟AP进行关联(OAW-6000) (Virtual AP profile test-dot1xandportal-vp) #vlan 1将VAP与ssid-profile文件进行关联命令格式：(OAW-6000) (Virtual AP profile test-dot1xandportal-vp) #ssid-profile test-dot1x-portal-ssid进入系统默认AP组(OAW-6000) (config) #ap-group default将VAP与系统默认AP组进行关联，此时基础配置已经做完(OAW-6000) (AP group default) #virtual-ap test-dot1xandportal-vp二、认证配置1、新建一个dot1x认证：(OAW-6000) (config) #aaa authentication dot1x test-dot1x-portal2、在终端开启dot1x认证：(OAW-6000) (802.1X Authentication Profile test-dot1x-portal) #termination enable3、开启认证协议，同时选择EAP的认证类型：(OAW-6000) (802.1X Authentication Profile test-dot1x-portal) #termination eap-type eap-tls(OAW-6000) (802.1X Authentication Profile test-dot1x-portal) #termination eap-type eap-peap前三步的截图如下：4、退出到config模式下，然后新建一个dot1x认证组(OAW-6000) (config) #aaa server-group test-sg-dot1x-portal5、在认证组里调用本地的“internal”数据库，然后退出到config模式下。(OAW-6000) (Server Group test-sg-dot1x-portal) #auth-server internal6、在AAA Profile下面新建一个AAA文件，命名为“test-dot1x-portal-profile”(OAW-6000) (config) #aaa profile test-dot1x-portal-profile进入aaa-profile的“test-dot1x-portal-profile”下面，将第四步中新建的server-group与之关联在一起(OAW-6000) (AAA Profile test-dot1x-portal-profile) #dot1x-server-group test-sg-dot1x-portal将之前在L2Authentication下面建立的“test-dot1x-portal”与aaa profile下的“test-dot1x-portal-profile”文件进行关联(OAW-6000) (AAA Profile test-dot1x-portal-profile) #authentication-dot1x test-dot1x-portal注：这里的“test-dot1x-portal”是在【认证配置】部分第一步里新建立的文件。退回到config配置模式下来，并进入到基础配置阶段建立的虚拟AP模式下面(OAW-6000) (config) #wlan virtual-ap test-dot1xandportal-vp在VAP下调用之前建立的aaa profile文件(OAW-6000) (Virtual AP profile test-dot1xandportal-vp) #aaa-profile test-dot1x-portal