Aruba控制器操作配置模版中文

1.Mgmt用户设置设置mgmt用户ssh登录的方式：是证书还是用户名与密码ssh mgmt-auth [public-key ｜username/password]mgmt-user ssh-pubkey client-cert <certificate> <username> <role>mgmt用户验证使用外部认证服务器:aaa authentication-server radius rad1host <ipaddr>key――――aaa server-group corp_radauth-server rad1-------------------------aaa authentication mgmtdefault-role rootenableserver-group corp_rad禁用本地认证数据库mgmt-user localauth-disable设置用户超时退出loginsession timeout <value> //CLI下web-server sessiontimeout <session-timeout> //webUI下1.1配置mgmt的tacacs认证The pre-defined roles for the controllers are:1.root - super user role2.guest-provisioning - guest provisioning rolework-operations - Network operator role4.read-only - Read only role5.location-api-mgmt - Location API Management Roleaaa authentication-server tacacs TACACS-SERVERhost TACACS_SERVER_IPkey PRESHARE_KEYsession-authorization!aaa server-group TACACS-SERVER-GRPauth-server TACACS-SERVER!aaa tacacs-accounting server-group TACACS-SERVER-GRP mode enable command[all|action|configuration|show]aaa authentication mgmtserver-group TACACS-SERVER-GRPenable!2.系统默认的角色与策略：默认的策略：ip access-list session control，validuser，allowall，icmp-acl, logon-control, captiveportal,tftp-acl, https-acl, http-acl, dhcp-acl, ap-acl,默认的角色：user-role ap-role， voice, guest-logon(portal认证), guest, authenticated，logon――――――――――――――――――――――――――――――――――――3.本地数据库操作local-userdb export <filename>local-userdb import <filename>local-userdb add {generate-username|username <name>} {generate-password|password <password>}――――――――――――――――――――――――――――――――――――――――4.配置DHCP服务：ip dhcp pool user-pooldefault-router 192.168.100.1dns-server 192.168.100.1network 192.168.100.0 255.255.255.0!service dhcpip dhcp excluded-address 192.168.100.1 192.168.100.10 ――――――――――――――――――――――――――――――――――――5.配置带宽：aaa bandwidth-contract BC512_up kbps 512user-role web-guestbw-contract BC512_up per-user upstream ―――――――――――――――――――――――――――――――――――――6.策略：限制访问内网netdestination “Internal Network”network 10.0.0.0 255.0.0.0network 172.16.0.0 255.255.0.0network 192.168.0.0 255.255.0.0ip access-list session block-internal-accessuser alias “Internal Network” any deny ―――――――――――――――――――――――――――――――――――――7.配置portal认证：外置portal时：netdestination portal-serverhost 10.50.22.221ip access-list session abc-portal-acluser alias portral-server svc-http permitaaa authentication captive-portal c-portaldefault-role employeeserver-group cp-srvlogin-page http://192.168.100.10/test.phpuser-role logoncaptive-portal c-portalsession-acl abc-portal-aclaaa profile aaa_c-portalinitial-role logonwlan ssid-profile ssid_c-portalessid c-portal-apwlan virtual-ap vp_c-portalaaa-profile aaa_c-portalssid-profile ssid_c-portalvlan 20portal下增加白名单：(host)(config)# netdestination "Mywhite-list"(host)(config)#name (host)(config)#name (host) (config) #aaa authentication captive-portal default(host)(Captive Portal Authentication Profile "default")#white-list Mywhite-list注意：如果在一台控制器配置多个captiveportal的Virtaul AP时，每个captiveportal必须分别配置不同的initial role和user role、cp profile、AAA profile与ssid profile;8.配置Air time fair(Aruba651) (Traffic management profile "test") #shaping-policy fair-access (Aruba651) (Traffic management profile "test") #exit(Aruba651) (config)ap-group demo-group(Aruba651) (AP group " demo-group") #dot11g-traffic-mgmt-profile test(Aruba651) (AP group "demo-group") #9.配置LACP:LACP默认不生效每台设备最多创建8个组（0-7），每个组最多允许8个端口加入,所有端口的属性要相同；1、Enable LACP and configure the per-port specific LACP. The group number range is 0 to 7.lacp group <group_number> mode {active | passive}? Active mode—the interface is in active negotiating state. LACP runs on any link that is configured to be in the active state. The port in an active mode also automatically initiates negotiations with otherports by initiating LACP packets.? Passive mode—the interface is not in an active negotiating state. LACP runs onany link that is configured in a passive state. The port in a passive mode responds to negotiations requests from other ports that are in an active state. Ports in passive state respond to LACP packets.注意：passive模式的端口不能与另一个passive 模式的端口建立起来；2. Set the timeout for the LACP session. The timeout value is the amount of time thata port-channelinterface waits for a LACPDU from the remote system before terminating the LACP session. The defaulttime out value is long (90 seconds); short is 3 seconds,默认为longlacp timeout {long | short}3. Set the port priority.lacp port-priority <priority_value>The higher the priority value the lower the priority. Range is 1 to 65535 and default is 255.4.加入端口中interface fastethernet 1/1lacp timeout shortlacp group 0 mode active―――――――――――――――――――――――――――――――――――――――――10.配置RAP（remote ap）在控制器上配置VPN、AP通过认证后的地址池，及isakmp的共享密码；注意地址池为RAP的管理地址，如其他网管要直接ping通RAP，需要将此地址段配置静态路由；vpdn group l2tpppp authentication PAPip local pool <pool> <start-ipaddr> <end-ipaddr>crypto isakmp key <key> address 0.0.0.0 netmask 0.0.0.0在控制器上配置服务器组，RAP通过username/password方式接入，并在服务器上增加用户名与密码，此用户名/密码用于L2TP/PAP认证 (如果采用证书方式，此步可以省略)aaa server-group <group>auth-server <server>aaa authentication vpn default-rapdefault-role <role>server-group <group>local-userdb add username rapuser1 password <password>配置remote ap的VAP：wlan ssid-profile <profile>essid <name>opmode <method>wpa-passphrase <string> (if necessary)配置用户角色，用于dot1x-default-role(cli) #netdestination corp(cli) (config-dest) # network 10.3.10.0 255.255.255.0(cli) (config-dest) # !ip access-list session Remote_Enterprise_aclany any svc-dhcp permituser alias corp any permitalias corp user any permituser network 224.0.0.0 255.0.0.0 any permitalias coopr alias corp any permituser any any route src-nat(cli) # user-role corpsplit(cli) (config-role) # session-acl Remote_Enterprise_acl(cli) (config-role) # !配置aaa profile可用于split-tunnel时用户角色策略指定aaa profile <profile>authentication-dot1x <profile>dot1x-default-role <role>dot1x-server-group <group>(cli) # wlan virtual-ap split(cli) # vlan X <-- Clients get IP addr. from VLAN X(cli) # forward-mode split-tunnelaaa-profile <profile>rap-operation {always|backup|persistent}配置RAP的有线端口：ap wired-ap-profile Wired_Branch_ap_profilewired-ap-enableforward-mode split-tunnelswitchport access vlan 128!ap wired-port-profile Wired_Branch_port_profileaaa-profile Remote_Ent_aaa_profilewired-ap-profile Wired_Branch_ap_profile配置RAP做DHCP serverap system-profile APGroup1_sys_profilelms-ip 63.82.214.194rap-dhcp-server-vlan 177rap-dhcp-server-id 192.168.177.1rap-dhcp-default-router 192.168.177.1rap-dhcp-pool-start 192.168.177.100rap-dhcp-pool-end 192.168.177.254!ap-group <name>virtual-ap <name>在webUI界面对AP进行provision，从AC上获取IP，修改为remote模式，AP会重启11.配置MAC认证完整例子RADIUS Server Definition:服务器认证aaa authentication-server radius "amigopod"host "172.16.0.20"key f0e40f33109cd5f863a77327072720aaa4785eff2ca57800nas-identifier "Aruba651"nas-ip 172.16.0.254!aaa server-group "amigopod-srv"auth-server amigopod!aaa rfc-3576-server "172.16.0.20"key 10795ff19c00465dd0b0824e562103bee537be631e5bc876MAC Authentication Profile：MAC认证aaa authentication mac "amigopod-mac"case upperdelimiter dashAAA Profile：aaa profile "amigopod-aaa"authentication-mac "amigopod-mac"mac-default-role "authenticated"mac-server-group "amigopod-srv"radius-accounting "amigopod-srv"rfc-3576-server "172.16.0.20"Captive Portal Profile：aaa authentication captive-portal "amigopod-cp"server-group "amigopod-srv"redirect-pause 3no logout-popup-windowprotocol-httplogin-page "http://172.16.0.20/aruba_login.php"Netdestination Alias for Amigopod：netdestination amigopodhost 172.16.0.20Access Policy to allow redirect to Amigopod：允许的aclip access-list session allow-amigopoduser alias amigopod svc-http permituser alias amigopod svc-https permitInitial Role with Captive Portal enabled:配置initial角色user-role logoncaptive-portal "amigopod-cp"access-list session logon-controlaccess-list session allow-amigopodaccess-list session captiveportalPost Authentication Role for MAC Authentication：配置MAC认证角色user-role MAC-Guestaccess-list session allowallSSID Profile:wlan ssid-profile "MAC-Auth-CP"essid "amigo-MAC-CP"Virtual AP:wlan virtual-ap "MAC-Auth-CP"aaa-profile "amigopod-aaa"ssid-profile "MAC-Auth-CP"12.配置LDAP认证服务器Portal认证aaa authentication-server ldap "aruba-ldap"host 10.1.1.50admin-dn "cn=ldapquery2, cn=Users, dc=arubanetworks, dc=com" admin-passwd "Zaq1xsw2"base-dn "ou=Corp, dc=arubanetworks, dc=com"!aaa server-group "aruba-ldap"auth-server aruba-ldapset role condition memberOf contains "dl-seonly" set-value root !如果将ldap认证应用于无线用户802.1x，必须使用eap-gtc方式aaa authentication dot1x "dot1x_prof-yxy03"termination enabletermination eap-type eap-peaptermination inner-eap-type eap-gtc！aaa authentication mgmt //应用在管理用户default-role "no-access"server-group "aruba-ldap"enable!注意：使用802.1x认证时不能用LDAP认证服务器；但portal认证时可以；13.有线端口NAT!ip NAT pool Dell-AirWave 63.80.98.56 63.80.98.56 172.16.0.246ip NAT pool SE-WebServer 63.80.98.59 63.80.98.59 172.16.0.16ip NAT pool PDL-eTips 63.80.98.61 63.80.98.61 172.16.0.15ip NAT pool PDL-Clearpass 63.80.98.60 63.80.98.60 172.16.0.13ip NAT pool PDL-AirWave 63.80.98.49 63.80.98.49 172.16.0.252!netdestination PDL-Airwave-Livehost 63.80.98.49!netdestination IPCommshost 64.154.41.150!netdestination SE-WebServerhost 63.80.98.59!netdestination Live-IPhost 63.80.98.41!netdestination PDL-eTipshost 63.80.98.61!netdestination Dell-Airwave-Livehost 63.80.98.56!netdestination PDL-ClearPasshost 63.80.98.60!ip access-list session OUTSIDE-POLICYalias IPComms alias Live-IP udp 4569 dst-nat ip 172.16.0.11 4569 classify-media queue highalias IPComms alias Live-IP udp 5060 dst-nat ip 172.16.0.11 5060 classify-media queue highalias IPComms alias Live-IP udp 5061 dst-nat ip 172.16.0.11 5061 classify-media queue highalias IPComms alias Live-IP udp 5062 dst-nat ip 172.16.0.11 5062 classify-media queue highany alias Live-IP tcp 4343 permitany alias Live-IP udp 4500 permitany alias Live-IP svc-ssh permitany alias Live-IP svc-http permitany alias Live-IP svc-https permitany alias Live-IP udp 500 permitany alias Live-IP svc-icmp permitany alias Live-IP tcp 4345 dst-nat ip 172.16.0.242 443any alias Live-IP tcp 4346 dst-nat ip 172.16.0.242 22any alias Dell-Airwave-Live svc-https dst-nat ip 172.16.0.246 443any alias Dell-Airwave-Live svc-http dst-nat ip 172.16.0.246 80any alias PDL-Airwave-Live svc-https dst-nat ip 172.16.0.252 443any alias PDL-Airwave-Live svc-http dst-nat ip 172.16.0.252 80any alias SE-WebServer svc-http dst-nat ip 172.16.0.16 80any alias SE-WebServer svc-https dst-nat ip 172.16.0.16 443any alias SE-WebServer svc-ssh dst-nat ip 172.16.0.16 22any alias SE-WebServer udp 5900 dst-nat ip 172.16.0.16 5900any alias PDL-eTips svc-http dst-nat ip 172.16.0.15 80any alias PDL-eTips svc-https dst-nat ip 172.16.0.15 443any alias PDL-ClearPass svc-https dst-nat ip 172.16.0.13 443any alias PDL-ClearPass svc-http dst-nat ip 172.16.0.13 80!interface fastethernet 2/0description "OUTSIDE-INTERNET"trustedip access-group OUTSIDE-POLICY sessionswitchport access vlan 10!14.用户通过有线端口portal认证，不同的IP用户可以分别认证，所有有线口共用一个认证方式aaa profile "cppm"initial-role "cp-guest"radius-accounting "amigopod-sg"radius-interim-accountingrfc-3576-server "222.190.16.186" //amigopod地址aaa authentication wired //有线端口启用认证profile "cppm"interface gigabitethernet 1/6 //有张端口untrusted vlan 1000description "connect_to_H3C"trusted vlan 1-999,1001-4094switchport access vlan 1000针对某一vlan启用portal认证vlan 20 wired aaa-profile cppm15.配置AP以太口对于有两个以太口的AP，如125与135系列，除了一个以太口用于AC互连外，另外一个以太口可以连接终端或串联AP；（1）连接终端时：创建wired-ap profileap wired-ap-profile "cppm"wired-ap-enableswitchport access vlan 11trusted创建wired-port profileap wired-port-profile "cppm"wired-ap-profile "cppm"将profile加入到group中ap-group "test"enet1-port-profile "cppm"注意：如果端口为untrusted，需要在wired-port profile中加入aaa profile16.配置VIA(host) (config)# license add <key>(1)Create VIA roles(host) (config) #user-role example-via-role(host) (config-role) #access-list session "allowall" position 1(host) (config-role) #ipv6 session-acl "v6-allowall" position 2(2)Create VIA authentication profiles(host) (config) #aaa server-group "via-server-group"(host) (Server Group "via-server-group") #auth-server "Internal" position 1 (host) (config) #aaa authentication via auth-profile default(host) (VIA Authentication Profile "default") #default-role example-via-role(host) (VIA Authentication Profile "default") #desc "Default VIAAuthenticationProfile"(host) (VIA Authentication Profile "default") #server-group "via-server-group"(3)Create VIA connection profiles(host) (config) #aaa authentication via connection-profile "via"(host) (VIA Connection Profile "via") #server addr 202.100.10.100 internal-ip10.11.12.13 desc "VIA Primary Controller" position 0(host) (VIA Connection Profile "via") #auth-profile "default" position 0(host) (VIA Connection Profile "via") #tunnel address 10.0.0.0 netmask255.255.255.0(host) (VIA Connection Profile "via") #split-tunneling(host) (VIA Connection Profile "via") #windows-credentials //使用windows 的帐号登录(host) (VIA Connection Profile "via") #client-netmask 255.255.255.255 (host) (VIA Connection Profile "via") #no ikev2-proto //local数据库不支持ikeV2(host) (VIA Connection Profile "via") #dns-suffix-list (host) (VIA Connection Profile "via") #support-email via-support@(host) (VIA Connection Profile "via") #client-wlan-profile"via_corporate_wpa2"position 0(4)Configure VIA web authentication(host) (config) #aaa authentication via web-auth default(host) (VIA Web Authentication "default") #auth-profile default position 0(5)Associate VIA connection profile to user role(host) (config) #user-role "example-via-role"(host) (config-role) #via "via"You can have only one profile (default) for VIA web authentication.(6)Configure VIA client WLAN profiles(host) (config) #wlan ssid-profile "via_corporate_wpa2"(host) (SSID Profile "via_corporate_wpa2") #essid corporate_wpa2(host) (SSID Profile "via_corporate_wpa2") #opmode wpa2-aes(host) (SSID Profile "via_corporate_wpa2") #wlan client-wlan-profile"via_corporate_wpa2"(host) (VIA Client WLAN Profile "via_corporate_wpa2") #ssid-profile"via_corporate_ssid"(7)crypto isakmp key 123456 address 0.0.0.0 netmask 0.0.0.0(8)。