IPv6无线校园网工程方案

IPv6无线校园网工程终验文档（管理维护手册）赛尔网络有限公司2011年10月目录1、全校覆盖示意图 (3)2、技术方案概述 (3)3、网络拓扑图 (6)4.光纤拓扑图 (7)5、IP地址和VLAN规划 (7)6、核心汇聚交换机C3750配置清单 (8)7、Aruba AC6000配置清单 (16)9、设备配置表 (28)10、交换机端口对应表 (33)11、竣工图纸 (38)11、1 外经贸楼 (38)11、2 第九教学楼 (40)11、3 曹光彪主楼 (42)11、4 曹光彪左裙楼 (44)11、4 曹光彪右裙楼 (45)11、5 第七教学楼 (45)11、6信电系 (46)11、7 工控楼 (47)11、8 热力学楼 (49)11、9室外 (50)12、试运行期间的维护报告 (51)13、典型故障与解决办法 (51)14、客户端PC部分常见问题 (53)14、1 使用指南 (53)14、2无线网故障解决方法 (53)15、ARUBA AP 配置方法和命令 (54)16、日常维护记录表 (54)17、Aruba AC 6000用户手册 (55)1、全校覆盖示意图2、技术方案概述本方案采用182个AP61和4个AP60，1台AC6000无线控制器，AP与控制器以三层隧道方式组网，AP全部设置为静态IP方式。

AP的物理链路分为两种：1.除了室外广场和热力学楼的4个AP外，其它AP都是由POE交换机和独立光纤直接连回Cisco核心交换机，再连到AC6000；60002.室外广场和热力学楼的4个AP直接连接到学校网络的交换机上，穿过有线校园网经过Cisco出口路由器连回Cisco核心交换机，再连到AC6000。

6000每个AP都配置了AC的IP地址，自己的IP地址和默认网关，加电启动如网络畅通，则与AC建立起三层隧道，并从控制器下载软件AP软件和相应配置，无线射频开始工作。

用户的无线网卡关联到一个AP后，由AC指定到一个用户VLAN，DHCP服务器响应客户端的DHCP 请求，根据用户VLAN的网关，分配IP地址和DNS配置。

用户的VLAN终结于核心交换机，IP4的默认路由指向出口路由器，再分别指向CERNET和学校有线网。

IP6的默认路由指向CERNET2出口。

AC上启用了WEB Portal认证，用户第一次联网时路由终结在AC，需要打开浏览器，弹出认证页面，输入用户名和密码后，AC将加密的认证信息发送到radius,radius再转发给学校的LDAP进行验证，如果验证通过，则返回验证通过信息给radius,再转发给AC，对用户放行。

否则返回验证不通过信息，保持现有状态。

用户访问外网IPv6资源不需认证。

物理连接上，教7，工控，信电3个楼的POE交换机是通过SFP光口，2对单模光纤直接连接到机房的核心交换机SFP光口，速率是千兆；其他楼都是通过4对百兆光纤收发器和4对多模光纤以百兆相连。

下图分别是全校无线网络拓扑图和光纤拓扑图。

3、网络拓扑图10.15.31.254/2410.15.44.252/24右裙楼信电楼4.光纤拓扑图5、IP地址和VLAN规划浙江大学玉泉校区无线网共分配32个c类IPv4地址，其中58.206.194.0－58.206.210.0 的17个C类地址分配给用户，一个C划分为一个子网。

浙江大学的IPv6地址范围是2001:DA8:E007::0/48,其中2001:DA8:E007:20－2001:DA8:E007:81分配给用户。

6、核心汇聚交换机C3750配置清单! Last configuration change at 09:24:10 china Thu Mar 20 2008 by cernet ! NVRAM config last updated at 09:24:36 china Thu Mar 20 2008 by cernet !version 12.2no service padservice timestamps debug datetime localtime show-timezoneservice timestamps log datetime localtime show-timezoneno service password-encryption!hostname ZJU-TSG-SW-C3750!username cernet password 0 123456no aaa new-modelclock timezone china 8switch 1 provision ws-c3750g-12sswitch 2 provision ws-c3750g-24ts-1uip subnet-zeroip routingip cef load-sharing algorithm universal CDBCDC28ip name-server 10.0.0.21ip name-server 10.10.0.21ip dhcp relay information trust-all!ipv6 unicast-routing!no file verify autospanning-tree mode pvstspanning-tree extend system-id!vlan internal allocation policy ascending!!interface Loopback0no ip address!interface Loopback1ip address 58.206.223.24 255.255.255.255 ip rip advertise 5!!interface GigabitEthernet2/0/1 description mm waijingmaoswitchport access vlan 6switchport mode access!interface GigabitEthernet2/0/2 description mm jiao9switchport access vlan 6switchport mode access!interface GigabitEthernet2/0/3 description mm caoguangbiao335 switchport access vlan 6switchport mode access!interface GigabitEthernet2/0/4 description mm caoguangbiao407 switchport access vlan 6switchport mode access!interface GigabitEthernet2/0/5 switchport access vlan 220!interface GigabitEthernet2/0/6 switchport access vlan 220!interface GigabitEthernet2/0/7 switchport access vlan 220!interface GigabitEthernet2/0/8 switchport access vlan 220!interface GigabitEthernet2/0/13 switchport access vlan 6switchport mode access!interface GigabitEthernet2/0/14 switchport access vlan 7switchport mode access!interface GigabitEthernet2/0/15switchport access vlan 6switchport mode accessinterface GigabitEthernet2/0/16 switchport access vlan 6!interface GigabitEthernet2/0/17 switchport access vlan 6!interface GigabitEthernet2/0/23 description hotline to routerno switchportip address 58.206.223.2 255.255.255.252 ip rip advertise 5!interface GigabitEthernet2/0/24 description backup to routerno switchportip address 58.206.223.6 255.255.255.252 ip rip advertise 5!interface GigabitEthernet2/0/25 description to Aruba AC 6000 switchport trunk encapsulation dot1q switchport trunk native vlan 7 switchport mode trunk!interface GigabitEthernet2/0/26 description sm jiao7switchport access vlan 6switchport mode accessinterface GigabitEthernet2/0/27 description sm gongkongxindian switchport access vlan 6switchport mode access!interface GigabitEthernet2/0/28 description to cernet2no switchportno ip addressipv6 address 2001:DA8:E007::2/64ipv6 enable!interface Vlan1no ip address!interface Vlan6description to apip address 58.206.193.1 255.255.255.0ip helper-address 58.206.223.129ip rip advertise 5!interface Vlan7ip address 58.206.223.131 255.255.255.248 ip rip advertise 5!interface Vlan20description caoguangbiaoip address 58.206.194.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:20::1/64ipv6 enableinterface Vlan21description caoguangbiaoip address 58.206.195.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:21::1/64ipv6 enable!interface Vlan22description caoguangbiaoip address 58.206.196.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:22::1/64ipv6 enable!interface Vlan23description caoguangbiaoleftip address 58.206.197.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:23::1/64ipv6 enable!interface Vlan24description caoguangbiaorightip address 58.206.198.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:24::1/64 ipv6 enable!interface Vlan31description xindianip address 58.206.199.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:31::1/64ipv6 enable!interface Vlan32description xindianip address 58.206.200.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:32::1/64 ipv6 enable!interface Vlan41description jiao7ip address 58.206.201.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:41::1/64 ipv6 enable!interface Vlan42description jiao7ip address 58.206.202.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:42::1/64 ipv6 enable!interface Vlan51description jiao9ip address 58.206.203.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:51::1/64 ipv6 enabledescription jiao9ip address 58.206.204.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:52::1/64 ipv6 enable!interface Vlan53description jiao9ip address 58.206.205.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:53::1/64 ipv6 enable!interface Vlan61description renengip address 58.206.206.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:61::1/64 ipv6 enableipv6 nd ra-interval 30!interface Vlan62description shiwaiip address 58.206.207.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:62::1/64 ipv6 enable!interface Vlan63no ip addressip helper-address 58.206.223.19!interface Vlan71description waijingmaoip address 58.206.208.1 255.255.255.0 ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:71::1/64 ipv6 enabledescription waijingmaoip address 58.206.209.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:72::1/64!interface Vlan81description gongkongip address 58.206.210.1 255.255.255.0ip helper-address 58.206.223.19ip rip advertise 5ipv6 address 2001:DA8:E007:81::1/64 ipv6 enable!interface Vlan82no ip addressipv6 enable!interface Vlan220description to serversip address 58.206.223.22 255.255.255.248 ip rip advertise 5!router ospf 200log-adjacency-changesredistribute connected subnets redistribute staticnetwork 58.206.223.4 0.0.0.3 area 0!router ripversion 2timers basic 5 15 15 30redistribute staticnetwork 58.0.0.0distance 105no auto-summary!ip classlessip http serverip http secure-server!!ipv6 route ::/0 2001:DA8:E007::1snmp-server community zju_v6wlan ROsnmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps ttysnmp-server enable traps clustersnmp-server enable traps fru-ctrlsnmp-server enable traps entitysnmp-server enable traps cpu thresholdsnmp-server enable traps vtpsnmp-server enable traps vlancreatesnmp-server enable traps vlandeletesnmp-server enable traps flash insertion removalsnmp-server enable traps port-securitysnmp-server enable traps envmonsnmp-server enable traps mac-notificationsnmp-server enable traps stackwisesnmp-server enable traps bgpsnmp-server enable traps copy-configsnmp-server enable traps configsnmp-server enable traps hsrpsnmp-server enable traps ipmulticastsnmp-server enable traps msdpsnmp-server enable traps ospf state-changesnmp-server enable traps ospf errorssnmp-server enable traps ospf retransmitsnmp-server enable traps ospf lsasnmp-server enable traps ospf cisco-specific state-changesnmp-server enable traps ospf cisco-specific errorssnmp-server enable traps ospf cisco-specific retransmitsnmp-server enable traps ospf cisco-specific lsasnmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message snmp-server enable traps rtrsnmp-server enable traps bridge newroot topologychangesnmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency snmp-server enable traps syslogsnmp-server enable traps vlan-membership!control-plane!!line con 0line vty 0 4exec-timeout 20 0login localline vty 5 15no loginntp clock-period 36028703ntp server 202.112.1.34ntp server 202.112.7.150ntp server 202.112.10.60end7、Aruba AC6000配置清单version 3.3enable secret "******"telnet clihostname "ZJU-TSG-WLC-ARUBA-A6000-1" clock timezone pst 8location "Building1.floor1"mms config 0controller config 260netservice svc-snmp-trap udp 162netservice svc-https tcp 443netservice svc-dhcp udp 67 68 alg dhcp netservice svc-smb-tcp tcp 445netservice svc-ike udp 500netservice svc-l2tp udp 1701netservice svc-syslog udp 514netservice svc-pptp tcp 1723netservice svc-telnet tcp 23netservice svc-sccp tcp 2000 alg sccp netservice svc-tftp udp 69 alg tftpnetservice svc-sip-tcp tcp 5060netservice svc-kerberos udp 88netservice svc-pop3 tcp 110netservice svc-adp udp 8200netservice svc-cfgm-tcp tcp 8211netservice svc-noe udp 32512 alg noe netservice svc-http-proxy3 tcp 8888 netservice svc-dns udp 53 alg dnsnetservice svc-msrpc-tcp tcp 135 139 netservice svc-rtsp tcp 554 alg rtspnetservice svc-http tcp 80netservice svc-vocera udp 5002 alg vocera netservice svc-h323-tcp tcp 1720netservice svc-h323-udp udp 1718 1719 netservice svc-nterm tcp 1026 1028 netservice svc-sip-udp udp 5060netservice svc-http-proxy2 tcp 8080 netservice svc-papi udp 8211netservice svc-noe-oxo udp 5000 alg noe netservice svc-ftp tcp 21 alg ftpnetservice svc-natt udp 4500netservice svc-svp 119 alg svpnetservice svc-gre 47netservice svc-smtp tcp 25netservice svc-smb-udp udp 445netservice svc-sips tcp 5061 alg sips netservice svc-esp 50netservice svc-bootp udp 67 69netservice svc-snmp udp 161netservice svc-v6-dhcp udp 546 547 netservice svc-icmp 1netservice svc-ntp udp 123netservice svc-msrpc-udp udp 135 139 netservice svc-ssh tcp 22netservice svc-http-proxy1 tcp 3128 netservice svc-v6-icmp 58ip access-list session controluser any udp 68 denyany any svc-icmp permitany any svc-dns permitany any svc-papi permitany any svc-cfgm-tcp permitany any svc-adp permitany any svc-tftp permitany any svc-dhcp permitany any svc-natt permit!ip access-list session validuserany any any permit!ip access-list session vocera-aclany any svc-vocera permit queue high!ip access-list session icmp-aclany any svc-icmp permit!ip access-list session captiveportaluser alias mswitch svc-https dst-nat 8081 user any svc-http dst-nat 8080user any svc-https dst-nat 8081user any svc-http-proxy1 dst-nat 8088user any svc-http-proxy2 dst-nat 8088user any svc-http-proxy3 dst-nat 8088!ip access-list session allowallany any any permit!ip access-list session sip-aclany any svc-sip-udp permit queue highany any svc-sip-tcp permit queue high!ip access-list session https-aclany any svc-https permit!ip access-list session dns-aclany any svc-dns permit!ip access-list session logon-controluser any udp 68 denyany any svc-icmp permitany any svc-dns permitany any svc-dhcp permitany any svc-natt permit!ip access-list session vpnlogonuser any svc-ike permituser any svc-esp permitany any svc-l2tp permitany any svc-pptp permitany any svc-gre permit!ip access-list session srcnatuser any any src-nat!ip access-list session skinny-aclany any svc-sccp permit queue highip access-list session tftp-aclany any svc-tftp permit!ip access-list session cplogoutuser alias mswitch svc-https dst-nat 8081 !ip access-list session guest!ip access-list session dhcp-aclany any svc-dhcp permit!ip access-list session http-aclip access-list session ap-aclany any svc-gre permitany any svc-syslog permitany user svc-snmp permituser any svc-snmp-trap permituser any svc-ntp permit!ip access-list session svp-aclany any svc-svp permit queue high user host 224.0.1.116 any permit!ip access-list session noe-aclany any svc-noe permit queue high!ip access-list session h323-aclany any svc-h323-tcp permit queue high any any svc-h323-udp permit queue high !ipv6 access-list session v6-icmp-aclany any svc-v6-icmp permit!ipv6 access-list session v6-https-aclany any svc-https permit!ipv6 access-list session v6-controluser any udp 68 denyany any svc-v6-icmp permitany any svc-v6-dhcp permitany any svc-dns permitany any svc-tftp permit!ipv6 access-list session v6-dhcp-aclany any svc-v6-dhcp permit!ipv6 access-list session v6-dns-aclany any svc-dns permit!ipv6 access-list session v6-allowallany any any permit!ipv6 access-list session v6-http-aclany any svc-http permit!ipv6 access-list session v6-tftp-aclipv6 access-list session v6-logon-control user any udp 68 denyany any svc-v6-icmp permitany any svc-v6-dhcp permitany any svc-dns permit!vpn-dialer default-dialerike authentication PRE-SHARE ****** !user-role ap-rolesession-acl controlsession-acl ap-acl!user-role trusted-apsession-acl allowall!user-role default-vpn-rolesession-acl allowallipv6 session-acl v6-allowall!user-role voicesession-acl sip-aclsession-acl noe-aclsession-acl svp-aclsession-acl vocera-aclsession-acl skinny-aclsession-acl h323-aclsession-acl dhcp-aclsession-acl tftp-aclsession-acl dns-aclsession-acl icmp-acl!user-role guestsession-acl http-aclsession-acl https-aclsession-acl dhcp-aclsession-acl icmp-aclsession-acl dns-aclipv6 session-acl v6-http-aclipv6 session-acl v6-https-aclipv6 session-acl v6-dhcp-aclipv6 session-acl v6-icmp-aclipv6 session-acl v6-dns-acl!user-role stateful-dot1x!user-role authenticatedsession-acl allowallipv6 session-acl v6-allowall!user-role statefulsession-acl control!user-role logoncaptive-portal CERNET-portalprofile session-acl logon-controlsession-acl captiveportalsession-acl vpnlogonipv6 session-acl v6-logon-control!aaa pubcookie-authentication!interface mgmtdhcp!interface loopbackip address 58.206.223.129!vlan 7vlan 20vlan 21vlan 22vlan 23vlan 24vlan 31vlan 32vlan 41vlan 42vlan 51vlan 52vlan 53vlan 61vlan 62vlan 71vlan 72vlan 81vlan 700interface gigabitethernet 2/0description "GE2/0"trustedswitchport mode trunkwitchport trunk native vlan 7!interface gigabitethernet 2/1description "GE2/1"trusted!interface vlan 1!interface vlan 7ip address 58.206.223.130 255.255.255.248 !interface vlan 21ip address 58.206.195.2 255.255.255.0!interface vlan 20ip address 58.206.194.2 255.255.255.0!interface vlan 22ip address 58.206.196.2 255.255.255.0!interface vlan 23ip address 58.206.197.2 255.255.255.0!interface vlan 24ip address 58.206.198.2 255.255.255.0!interface vlan 31ip address 58.206.199.2 255.255.255.0!interface vlan 32ip address 58.206.200.2 255.255.255.0!interface vlan 41ip address 58.206.201.2 255.255.255.0!interface vlan 42ip address 58.206.202.2 255.255.255.0!interface vlan 51ip address 58.206.203.2 255.255.255.0!interface vlan 52ip address 58.206.204.2 255.255.255.0!interface vlan 53ip address 58.206.205.2 255.255.255.0!interface vlan 61ip address 58.206.206.2 255.255.255.0!interface vlan 62ip address 58.206.207.2 255.255.255.0!interface vlan 71ip address 58.206.208.2 255.255.255.0!interface vlan 72ip address 58.206.209.2 255.255.255.0!interface vlan 81ip address 58.206.210.2 255.255.255.0!ip default-gateway 58.206.223.131wmsgeneral poll-interval 60000general poll-retries 3general ap-ageout-interval 30general sta-ageout-interval 30general learn-ap disablegeneral persistent-known-interfering enablegeneral propagate-wired-macs enablegeneral stat-update enablegeneral collect-stats disable!no crypto-local isakmp permit-invalid-certlocalip 0.0.0.0 ipsec e1f54e0b83b8e7fd4bc0d20aef9550bdda96a0876719dd49crypto isakmp groupname changemecrypto-local isakmp dpd idle-timeout 22 retry-timeout 2 retry-attempts 3crypto-local isakmp xauthvpdn group l2tpppp authentication PAP!ip dhcp pool testdefault-router 58.206.223.131dns-server importlease 0 1 0network 58.206.223.248 255.255.255.248authoritative!service dhcpsyslocation "zju_library"syscontact "dongjx@cernet"snmp-server community zju_v6wlanvpdn group pptpppp authentication MSCHAPv2!mux-address 0.0.0.0adp discovery enableadp igmp-join enableadp igmp-vlan 0ssh mgmt-auth username/passwordmgmt-user admin root 3a9fcf9101bb4e6c1cc19066d74cfebc8a0194542467acdfa6 mgmt-user cernet read-only 9aaefc2401610469361da7d3a47ed083d956a017841cfab2cano database synchronizedatabase synchronize rf-plan-dataip mobile domain default!ip igmp!packet-capture-defaults tcp disable udp disable sysmsg disable other disableip domain lookup!country CNaaa authentication mac "default"!aaa authentication dot1x "default"!aaa authentication-server radius "CERNET-radius"host 58.206.223.17key 1a645a481a4b0652261c954eb77e63eca9658ad33f4b4a7a nas-ip 58.206.223.129aaa authentication-server radius "CERNET-Radius2"host 58.206.223.17key c6294d3aa837a31ffc594f8d725f975899e86d4fbdda8d3c nas-ip 58.206.223.129use-md5!aaa server-group "default"allow-fail-throughauth-server CERNET-radiusauth-server CERNET-Radius2!aaa profile "CERNET-AAAprofile"radius-accounting "default"!aaa profile "default"!aaa profile "open"initial-role "authenticated"!aaa authentication captive-portal "CERNET-portalprofile"default-role "authenticated"redirect-pause 0protocol-httplogon-wait maximum-delay 5welcome-page "https:///"!aaa authentication captive-portal "default"default-role "authenticated"redirect-pause 1!aaa authentication vpn!aaa authentication mgmtaaa authentication stateful-dot1x!aaa authentication wired!web-server!ap system-profile "default"!ap regulatory-domain-profile "default"country-code CN!ap wired-ap-profile "default"!ap enet-link-profile "default"!ap snmp-profile "default"!ids general-profile "default"!ids unauthorized-device-profile "default"!ids profile "default"!rf arm-profile "default"min-tx-power 18!rf optimization-profile "default"!rf event-thresholds-profile "default"!rf dot11a-radio-profile "default"!rf dot11g-radio-profile "default"!wlan ht-ssid-profile "default"!wlan ssid-profile "CERNET-ssidprofile"essid "CERNET"!wlan ssid-profile "default"!wlan virtual-ap "default"ssid-profile "CERNET-ssidprofile"vlan 20-24,31-32,41-42,51-53,61-62,71-72,81 aaa-profile "CERNET-AAAprofile"!ap-group "default"virtual-ap "default" !end9、设备配置表10、交换机端口对应表11、竣工图纸11、1 外经贸楼11、2 第九教学楼11、3 曹光彪主楼11、4 曹光彪左裙楼11、4 曹光彪右裙楼11、5 第七教学楼11、6信电系11、7 工控楼11、8 热力学楼11、9室外。