H3C Access Controllers
WLAN Access (IPv6)
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring IPv6 WLAN access· 1

Network configuration· 1

Restrictions and guidelines· 1

Procedures· 2

Configuring the AC· 2

Configuring the switch· 4

Verifying the configuration· 6

Configuration files· 6

Related documentation· 8

 

Introduction

The following information provides an IPv6 access configuration example.

Prerequisites

The following information applies to Comware-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access controllers and access points.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of IPv6 basics and WLAN access.

Example: Configuring IPv6 WLAN access

Network configuration

As shown in Figure 1, the Layer 3 switch acts as a DHCP server to assign IPv6 addresses to the AP and Client 1 and assign an IPv6 prefix to Client 2. Configure wireless services to ensure that the WLAN uses IPv6 addresses and Client 1 and Client 2 can access the WLAN. Assume that centralized forwarding is used in this example.

Figure 1 Network diagram

 

Restrictions and guidelines

When you configure IPv6 access, follow these restrictions and guidelines:

·     Use the serial ID labeled on the AP's rear panel to specify an AP.

·     To prevent too many packets from entering VLAN 1, configure the switch's interface that connects the switch to the AP to deny packets from VLAN 1.

Procedures

Configuring the AC

1.     Configure the interfaces of the AC:

# Create VLAN 100 and VLAN-interface 100, and assign the interface an IPv6 address. The AC will use this IPv6 address to establish a CAPWAP tunnel with the AP.

<AC> system-view

[AC] vlan 100

[AC-vlan100] quit

[AC] interface vlan-interface 100

[AC-Vlan-interface100] ipv6 address 2001::1 64

[AC-Vlan-interface100] quit

# Create VLAN 200 and VLAN 400. The AC uses the VLANs to forward client traffic.

[AC] vlan 200

[AC-vlan200] quit

[AC] vlan 400

[AC-vlan400] quit

# Configure GigabitEthernet 1/0/1 that connects the AC to the switch as a trunk port, remove the port from VLAN 1, and assign the port to VLANs 100, 200, and 400.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] undo port trunk permit vlan 1

[AC-GigabitEthernet1/0/1] port trunk permit vlan 100 200 400

[AC-GigabitEthernet1/0/1] quit

2.     Configure IPv6 static routes.

[AC] ipv6 route-static 3001::0 64 2001::2

[AC] ipv6 route-static 4001::0 64 2001::2

3.     Configure wireless services:

# Create service template 1 and enter its view.

[AC] wlan service-template 1

# Set the SSID to service1.

[AC-wlan-st-1] ssid service1

# Specify PSK as the AKM mode and specify 12345678 as the plaintext key.

[AC-wlan-st-1] akm mode psk

[AC-wlan-st-1] preshared-key pass-phrase simple 12345678

# Specify CCMP as the cipher suite and specify RSN as the security IE.

[AC-wlan-st-1] cipher-suite ccmp

[AC-wlan-st-1] security-ie rsn

# Configure the AC to forward client data traffic. If the default client data traffic forwarder is AC, skip this step.

[AC-wlan-st-1] client forwarding-location ac

# Enable service template 1.

[AC-wlan-st-1] service-template enable

# Enable snooping DHCPv6 and ND packets.

[AC-wlan-st-2] client ipv6-snooping dhcpv6-learning enable

[AC-wlan-st-2] client ipv6-snooping nd-learning enable

[AC-wlan-st-2] quit

# Create service template 2 and enter its view.

[AC] wlan service-template 2

# Set the SSID to service2.

[AC-wlan-st-2] ssid service2

# Specify PSK as the AKM mode and specify 12345678 as the plaintext key.

[AC-wlan-st-2] akm mode psk

[AC-wlan-st-2] preshared-key pass-phrase simple 12345678

# Specify CCMP as the cipher suite and specify RSN as the security IE.

[AC-wlan-st-2] cipher-suite ccmp

[AC-wlan-st-2] security-ie rsn

# Configure the AC to forward client data traffic. If the default client data traffic forwarder is AC, skip this step.

[AC-wlan-st-2] client forwarding-location ac

# Enable service template 2.

[AC-wlan-st-2] service-template enable

# Enable snooping DHCPv6 and ND packets.

[AC-wlan-st-2] client ipv6-snooping dhcpv6-learning enable

[AC-wlan-st-2] client ipv6-snooping nd-learning enable

[AC-wlan-st-2] quit

4.     Configure AP settings:

 

NOTE: To simply AP configuration on a large-scale network, configure AP settings on a per AP group basis as a best practice.

 

# Create manual AP officeap, and specify the AP model and serial ID.

[AC] wlan ap officeap model WA6320

[AC-wlan-ap-officeap] serial-id 219801A28N819CE0002T

# Create AP group group1 and configure officeap as the AP grouping rule.

[AC] wlan ap-group group1

[AC-wlan-ap-group-group1] ap officeap

# Bind service template 1 and VLAN 200 to radio 1 for AP group group1.

[AC-wlan-ap-group-group1] ap-model WA6320

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 1

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] service-template 1 vlan 200

# Enable radio 1.

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] quit

# Bind service template 2 and VLAN 400 to radio 2 for AP group group1.

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template 2 vlan 400

# Enable radio 2.

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] return

Configuring the switch

1.     Configure switch interfaces:

# Create VLAN 100, VLAN 300, VLAN-interface 100, and VLAN-interface 300, and assign IPv6 addresses to the VLAN interfaces. The switch will use VLAN 100 and VLAN 300 to forward packets between AC and AP.

<L3 switch> system-view

[L3 switch] vlan 100

[L3 switch-vlan100] quit

[L3 switch] interface vlan-interface 100

[L3 switch-Vlan-interface100] ipv6 address 2001::2/64

[L3 switch-Vlan-interface100] quit

[L3 switch] vlan 300

[L3 switch-vlan300] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] ipv6 address 3001::1/64

[L3 switch-Vlan-interface300] quit

# Create VLAN 200 and VLAN-interface 200 and assign an IPv6 address to the VLAN interface. Client 1 will use this VLAN to access the WLAN.

[L3 switch] vlan 200

[L3 switch-vlan200] quit

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] ipv6 address 3000::1/64

[L3 switch-Vlan-interface200] quit

# Create VLAN 400 and VLAN-interface 400 and assign an IPv6 address to the VLAN interface. Client 2 will use this VLAN to access the WLAN.

[L3 switch] vlan 400

[L3 switch-vlan400] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] ipv6 address 4000::1/64

[L3 switch-Vlan-interface400] quit

# Configure GigabitEthernet 1/0/1 that connects the switch to the AC as a trunk port, remove the port from VLAN 1, and assign the port to VLANs 100, 200, and 400.

[L3 Switch] interface gigabitethernet 1/0/1

[L3 Switch-GigabitEthernet1/0/1] port link-type trunk

[L3 switch-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[L3 Switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200 400

[L3 Switch-GigabitEthernet1/0/1] quit

# Configure GigabitEthernet 1/0/2 that connects the switch to the AP as a trunk port, remove the port from VLAN 1, configure the PVID as VLAN 300, and assign the port to VLANs 300.

[L3 switch] interface gigabitEthernet 1/0/2

[L3 switch-GigabitEthernet1/0/2] port link-type trunk

[L3 switch-GigabitEthernet1/0/2] undo port trunk permit vlan 1

[L3 switch-GigabitEthernet1/0/2] port trunk permit vlan 300

[L3 switch-GigabitEthernet1/0/2] port trunk pvid vlan 300

[L3 switch-GigabitEthernet1/0/2] quit

2.     Configure DHCPv6:

# Enable the DHCPv6 server on VLAN-interface 200, VLAN-interface 300, and VLAN-interface 400, respectively.

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] ipv6 dhcp select server

[L3 switch-Vlan-interface200] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] ipv6 dhcp select server

[L3 switch-Vlan-interface300] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] ipv6 dhcp select server

[L3 switch-Vlan-interface400] quit

# Disable RA message suppression, set both the managed address configuration flag (M) and the other stateful configuration flag (O) to 1 in RA advertisements to be sent for the created VLAN interfaces.

[L3 switch] interface vlan-interface 200

[L3 switch-Vlan-interface200] undo ipv6 nd ra halt

[L3 switch-Vlan-interface200] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface200] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface200] quit

[L3 switch] interface vlan-interface 300

[L3 switch-Vlan-interface300] undo ipv6 nd ra halt

[L3 switch-Vlan-interface300] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface300] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface300] quit

[L3 switch] interface vlan-interface 400

[L3 switch-Vlan-interface400] undo ipv6 nd ra halt

[L3 switch-Vlan-interface400] ipv6 nd autoconfig managed-address-flag

[L3 switch-Vlan-interface400] ipv6 nd autoconfig other-flag

[L3 switch-Vlan-interface400] quit

# Create DHCPv6 address pool 1 to assign an IPv6 address to Client 1, and specify subnet 3000::0/64 in the DHCP address pool.

[L3 switch] ipv6 dhcp pool 1

[L3 switch-dhcp6-pool-1] network 3000::0/64

[L3 switch-dhcp6-pool-1] gateway-list 3000::1

[L3 switch-dhcp6-pool-1] quit

# Create DHCPv6 address pool 2 to assign an IPv6 address to the AP, specify subnet 3001::0/64 in the DHCP address pool, and configure Option 52 that specifies AC IPv6 address 2001:1 in the address pool.

[L3 switch] ipv6 dhcp pool 2

[L3 switch-dhcp6-pool-2] network 3001::0/64

[L3 switch-dhcp6-pool-2] gateway-list 3001::1

[L3 switch-dhcp6-pool-2] option 52 hex 20010000000000000001000000000001

[L3 switch-dhcp6-pool-2] quit

# Create a prefix pool and specify the prefix and the assigned prefix length for the pool.

[L3 switch] ipv6 dhcp prefix-pool 1 prefix 4001::/64 assign-len 64

# Create DHCPv6 address pool 3 to assign an IPv6 address to Client 2, and specify subnet 4001::0/64 in the DHCP address pool.

[L3 switch] ipv6 dhcp pool 3

[L3 switch-dhcp6-pool-3] network 4001::0/64

[L3 switch-dhcp6-pool-3] gateway-list 4001::1

# Apply prefix pool 1 to DHCPv6 address pool 3, so the DHCPv6 server can dynamically select a prefix from the prefix pool for a client.

[L3 switch-dhcp6-pool-3] prefix-pool 1

[L3 switch-dhcp6-pool-3] quit

Verifying the configuration

# Verify that Client 1 and Client 2 have connected to the network successfully.

[AC] display wlan client ipv6

MAC address     AP name              IPv6 address                            VLAN

0000-000f-1211  officeap             3000::2                                 200

0000-000f-1212  officeap             4001::3                                 400

Configuration files

·     AC:

#

vlan 100

#

vlan 200

#

vlan 400

#

interface Vlan-interface100

 ipv6 address  2001::1/64

#

wlan service-template 1

 ssid service

 client forwarding-location ac

 client ipv6-snooping dhcpv6-learning enable

 client ipv6-snooping nd-learning enable

 akm mode psk

 preshared-key pass-phrase cipher $c$3$N//5BVbsOqdBTxi+7MJZKT6Zqh5MAmYs2ZzM

 cipher-suite ccmp

 security-ie rsn

 service-template enable

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 100 200 400

#

ipv6 route-static 3001::0 64 2001::2

ipv6 route-static 4001::0 64 2001::2

#                                                                              

wlan ap-group group1                                                           

 ap officeap                                                                        

 ap-model WA6320                                                               

  radio 1                                                                      

   radio enable                                                                

   service-template 1 vlan 200

  radio 2                                                                      

   radio enable                                                                

   service-template 2 vlan 400

#

wlan ap officeap model WA6320

 serial-id 219801A28N819CE0002T

#

·     Layer 3 switch:

#

 ipv6 dhcp prefix-pool 1 prefix 4001::/64 assign-len 64

# #

vlan 100

#

vlan 200

#

vlan 300

#

vlan 400

#

ipv6 dhcp pool 1

 network 3000::0/64

 gateway-list 3000::1

#

ipv6 dhcp pool 2

 network 3001::0/64

 gateway-list 3001::1

 option 52 hex 00010000000000000001000000000001

#

#

ipv6 dhcp pool 3

 network 4001::0/64

 prefix-pool 1

 gateway-list 4001::1

#

interface Vlan-interface100

 ipv6 address 2001::2/64

#

interface Vlan-interface200

 ipv6 dhcp select server

 ipv6 address 3000::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface Vlan-interface300

 ipv6 dhcp select server

 ipv6 address 3001::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface Vlan-interface400

 ipv6 dhcp select server

 ipv6 address 4001::1/64

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

 undo ipv6 nd ra halt

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 100 200 400

#

interface GigabitEthernet1/0/2

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 300

 port trunk pvid vlan 300

#

Related documentation

·     AP and WT Management Command Reference in H3C Access Controllers Command References

·     AP and WT Management Configuration Guide in H3C Access Controllers Configuration Guides

·     Network Connectivity Command Reference in H3C Access Controllers Command References

·     Network Connectivity Configuration Guide in H3C Access Controllers Configuration Guides